Watchdog-Driven Error Recovery

In this lesson, you will learn how to design a resilient recovery strategy that uses a hardware watchdog to reset the system into a known-good state after an unrecoverable fault.

The Problem: The "Silent Hang"

In embedded systems, intermittent faults—such as memory corruption or race conditions that evade standard static analysis—can leave your runtime in an undefined state. If your Hardware Watchdog Integration is active, it will simply trigger a hard reset. Without a strategy, your system will either boot-loop or resume with corrupted variables, potentially causing cascading failures or physical damage.

Designing the Recovery Path

Robust recovery requires two things: non-volatile state logs (using State Persistence in Wasm) and a graceful re-initialization routine.

When the system restarts after a watchdog trip, you must not treat it as a cold boot. Instead, perform a "Self-Check" sequence:

1. Fault Tagging: Before the watchdog kicks in, if a software error is detected, write a specific "Panic Pattern" to a dedicated non-volatile memory (NVM) address.
2. Post-Reset Inspection: On boot, immediately inspect this NVM flag.
3. Recovery Branching: If the flag is set, enter a "Safe Mode" where you re-initialize hardware peripherals and attempt to restore critical state from your logs, rather than resuming the complex application logic.

fn main() -> ! {
    // 1. Inspect non-volatile memory for crash tags
    if nvm::read_reset_reason() == ResetReason::Watchdog {
        log_error("Recovering from watchdog trip...");
        perform_safe_reinit();
    }

    // 2. Initialize watchdog with a timeout
    let mut watchdog = Watchdog::new(WDT_TIMEOUT);

    loop {
        // 3. Process application state
        do_work();
        
        // 4. Feed the dog only if tasks are healthy
        if system_is_sane() {
            watchdog.feed();
        }
    }
}

Why this works

By gating your watchdog.feed() call with system_is_sane(), you intentionally allow the watchdog to reset the system if a task hangs. By coupling this with the NVM flag, you differentiate between a clean power-on and a recovery cycle, allowing the system to skip heavy initialization or report the error to telemetry after the reboot.

Key Takeaway: Watchdog-driven recovery transforms a fatal hardware reset into a controlled software restart, allowing your system to audit its own failure and resume operation from a persisted safe state.