What Is a Watchdog Timer?

A watchdog timer is an independent counter that counts down from a set value. While the software is healthy, it restarts the count at regular intervals, which engineers call kicking, petting or feeding the watchdog. If a crash, an endless loop or a driver fault stops the software doing that, the counter reaches zero and the watchdog acts, usually by resetting the processor.

The point is that the watchdog does not rely on the software it is watching. It runs from its own clock in separate hardware, so it still works when the operating system has frozen solid. A system that hangs at 3 a.m. at an unmanned pumping station is running again within minutes, without a site visit.

Watchdogs are as old as embedded computing. Spacecraft, car engine controllers and pacemakers all rely on them, and almost every microcontroller and industrial PC has at least one built in.

A hardware watchdog is a physical timer outside the main software: a peripheral in a microcontroller, a separate supervisor chip, the Super I/O controller or chipset on a PC board, or the baseboard management controller on a server. It can reset the system even if the processor itself has locked up.

A software watchdog is a program or operating system feature that watches other programs. On Linux, systemd can restart a service that stops checking in, and the kernel can detect a stalled CPU. Software watchdogs are good at catching a single failed application, but they cannot help if the kernel or hardware hangs.

In practice the two are layered. Systemd watches the applications and feeds the hardware watchdog through the Linux watchdog driver. If the whole system hangs, the feeding stops and the hardware resets the machine.

Watchdogs vary in how strictly they judge the software, from a simple timeout to checks that the code is running in the right order.

A windowed watchdog matters because a runaway program can sometimes kick a simple watchdog by accident. Requiring the kick to land inside a time window, or to carry the right answer to a challenge, makes that much less likely.

On x86 industrial boards, the watchdog usually sits in the Super I/O chip or the chipset and is programmable from about 1 to 255 seconds, or in minutes on some boards. It is enabled in the BIOS or UEFI setup, then fed by a driver or the manufacturer’s utility under Windows or Linux. Many of our industrial motherboards and fanless PCs list a hardware watchdog in their specifications. Servers and edge servers add a second watchdog in the baseboard management controller, which runs independently of the host.

A watchdog earns its place wherever nobody is on hand to press a reset button:

The timeout has to be longer than the slowest normal gap between kicks, including boot time and heavy-load moments, or the watchdog will reset a healthy system. It should still be short enough that a real hang is cleared quickly. Disable or extend it during firmware and operating system updates, and log every watchdog reset so a recurring fault is investigated rather than hidden.

Feed the watchdog from a point that proves the whole application is healthy, not from a separate thread that keeps running when the main work has stalled. On a vision or control system, that usually means kicking it only after each processing cycle completes. Test the setting by deliberately hanging the system before it goes into service.

We enable and set the hardware watchdog to suit your software as standard when we configure industrial and embedded computers, alongside the operating system image and drivers.