Watchdog timer

A watchdog timer (or computer operating properly timer) is a computer hardware timing device that triggers a system reset if the main program, due to some fault condition, such as a hang, neglects to regularly service the watchdog (writing a “service pulse” to it, also referred to as “petting the dog” or "feed the watchdog"^[1] or "waking the watchdog"). The intention is to bring the system back from the hung state into normal operation.

Watchdog timers may be more complex, attempting to save debug information onto a persistent medium; i.e. information useful for debugging the problem that caused the fault. In this case a second, simpler, watchdog timer ensures that if the first watchdog timer does not report completion of its information saving task within a certain amount of time, the system will reset with or without the information saved. The most common use of watchdog timers is in embedded systems, where this specialized timer is often a built-in unit of a microcontroller.

Even more complex watchdog timers may be used to run untrusted code in a sandbox.^[2]

Watchdog timers may also trigger fail-safe control systems to move into a safety state, such as turning off motors, high-voltage electrical outputs, and other potentially dangerous subsystems until the fault is cleared.

For example, a watchdog timer can be implemented with a x-bit counter in a system working with a clock signal of y MHz, therefore, the system will shut down if the timer is not reset in a period of seconds.

For those embedded systems that can't be constantly watched by a human, watchdog timers may be the solution. For example, most embedded systems need to be self-reliant, and it's not usually possible to wait for someone to reboot them if the software hangs. Some embedded designs, such as space probes, are simply not accessible to human operators. If their software ever hangs, such systems are permanently disabled. In cases similar to these, a watchdog timer can help in solving the problem.

The watchdog timer is a chip external to the processor. However, it could also be included within the same chip as the CPU; this is done in many microcontrollers. In either case, the watchdog timer is tied directly to the processor's reset signal. Expansion card based watchdog timers exist and can be fitted to computers without an onboard watchdog.

See also

• Immunity Aware Programming
• Power distribution unit
• System time
• Dead man's switch

References

1. ^ United States Patent 5694444
2. ^ "the Grenade Timer: Fortifying the Watchdog Timer Against Malicious Mobile Code" by Frank Stajano and Ross Anderson (2000) -- gives most of the benefits of "protected mode" hardware to "very low-cost microcontrollers" that don't have protected mode hardware, using "very frugal hardware resources".

External links

• Advanced Watchdog Timers: Monitoring Multiple Tasks
• One design for a hardware watchdogPDF (6.62 KiB)
• Building a great watchdog - Article by Jack Ganssle