In this lesson, you will learn how to implement a tiered watchdog strategy that validates specific task progress before clearing the timer to prevent premature system resets.
The Problem with Naive "Kicking"
A common mistake in embedded design is the "heartbeat" approach, where a single low-priority task clears the watchdog timer (WDT). If that task remains functional but the critical application logic enters a deadlock or a corrupted state, the watchdog continues to be reset. The system appears healthy while the actual safety-critical functionality is dead.
Implementing Tiered Validation
To solve this, we move from a "simple heartbeat" to a "multistage validation" pattern. Instead of a single point of failure, we define a set of required progress checkpoints. We use a bitmask or a status structure to track the progress of every essential task. The final WDT reset logic only executes if all required bits have been set within the current monitoring window.
Consider this simplified implementation:
typedef struct {
uint8_t task_a_progress;
uint8_t task_b_progress;
uint8_t task_c_progress;
} watchdog_monitor_t;
void kick_watchdog_if_ready(watchdog_monitor_t *status) {
// Only clear the timer if every mandatory task has reported in
if (status->task_a_progress &&
status->task_b_progress &&
status->task_c_progress) {
hardware_wdt_clear();
// Reset flags for the next monitoring window
status->task_a_progress = 0;
status->task_b_progress = 0;
status->task_c_progress = 0;
}
}
Why This Increases Reliability
By requiring task-specific "proof of life," you prevent a runaway process or a high-level infinite loop from masking deeper system failures. If task_c hangs due to a memory violation or a deadlock, the watchdog_monitor_t structure will never satisfy the condition, and the hardware watchdog will trigger an honest reset. This forces the system into a recovery state instead of allowing it to limp along in a degraded or unsafe mode.
Key Takeaway: A robust watchdog strategy validates the successful completion of all critical system tasks through a checkpoint bitmask before clearing the timer, ensuring that task liveness is not mistaken for system health.