Click the blue text to follow us
“ Imagine this: a car speeding down the highway suddenly has its ESP system malfunction due to electromagnetic interference. Without an effective protection mechanism, the braking system could completely fail, leading to catastrophic consequences. However, in reality, such situations are rare, precisely because there is a silent “guardian” constantly monitoring the system’s operational status — the watchdog.
In automotive electronic systems, watchdogs and reset circuits act like the “life support system” of the system. They not only need to “rescue” the system (reset) promptly when it “falls ill” (program anomaly), but also distinguish between a “minor cold” (transient fault) and a “serious illness” (permanent fault). This capability directly relates to the functional safety level of the entire vehicle.For automotive embedded software engineers, understanding the working principles of watchdogs and reset circuits is not just about mastering a technology; it is about cultivating a system-level fault handling mindset. Today, let us delve into this critical topic concerning the life and death of systems.”
01 Why Do Automotive Electronics Need Watchdogs?
Accident Case: Occasional Failure of ESP System in a Certain Model
In 2018, a certain model was recalled due to the occasional failure of its ESP system under specific conditions. Investigations revealed that the root cause was that the main program occasionally malfunctioned in a strong electromagnetic interference environment, and the improperly configured watchdog failed to reset the system in time, leading to a temporary loss of braking functionality.
This case reveals three core roles of the watchdog in automotive electronics:
1. Fault Detection and Recovery When the program malfunctions, enters a deadlock, or experiences abnormal task scheduling, the watchdog can detect this abnormal state and reset the system to a known initial state. This is akin to installing an “automatic restart” button for the system.
2. Functional Safety Requirements According to the ISO 26262 standard, any safety-related electronic system must have a monitoring mechanism. The watchdog is a fundamental technical means to achieve these monitoring requirements. Different ASIL levels have explicit requirements for the detection capability and response time of the watchdog.
3. Improvement of System Reliability Over the 15 years or 250,000 kilometers of use, the ECU needs to operate continuously and stably. The watchdog can handle those sporadic faults that are difficult to cover completely through testing, thereby enhancing the overall reliability of the system.
Failure Consequences Analysis
The absence of a watchdog or improper watchdog design may lead to:
-
System freeze, complete loss of functionality
-
Actuators remaining in a dangerous state
-
Accumulation of faults leading to systemic failure
-
Violation of functional safety requirements
02 Types and Working Principles of Watchdogs
Independent Watchdog — The Most Reliable “Guardian”
An independent watchdog is typically a completely separate hardware module with the following characteristics:
-
Clock Independence: Uses an independent RC oscillator, not relying on the system’s main clock
-
Power Independence: Can operate even when the main power supply is abnormal
-
Simple Operation: Usually requires writing a specific sequence within a certain time
-
High Reliability: Less affected by system failures
The working process of an independent watchdog can be summarized as follows: once the watchdog is activated, it starts counting. If it does not receive a “kick” signal before the timeout, it will generate a reset signal. To prevent a reset, a specific reload value must be written before the timeout. Some watchdogs also provide early warning interrupts, giving the software a chance to fix the issue before a reset.
Window Watchdog — A Stricter “Supervisor”
The window watchdog is stricter than the independent watchdog; it requires the kick signal to be sent within a specific time window:
-
Early Kick: If the kick signal is sent before the window opens, it is considered abnormal
-
Late Kick: If the kick signal is not sent after the window closes, it is considered abnormal
-
Precise Timing: Requires precise system clock support
This design can effectively detect abnormal situations where the program runs too fast or too slow, suitable for tasks with strict timing requirements.
Software Watchdog — Self-Monitoring at the Application Layer
In complex systems, software watchdogs are often implemented:
-
Task Monitoring: Monitors whether each task is executed on time
-
Logic Monitoring: Checks whether the program logic state is reasonable
-
Data Monitoring: Validates the reasonableness of critical data
-
Multi-Level Monitoring: Forms a multi-layer monitoring system
03 Key Points in Watchdog Hardware Design
Clock Source Selection
The selection of the clock source for the watchdog directly affects its reliability:
-
Internal RC Oscillator: Low cost, average accuracy, affected by temperature
-
External Crystal Oscillator: High accuracy, high cost, good reliability
-
Independent Oscillator: Completely independent, highest reliability, highest cost
In automotive electronics, it is generally recommended to configure an independent clock source for the independent watchdog to ensure it can operate normally even when the main clock fails.
Reset Circuit Design
The design of the reset circuit needs to consider various fault conditions:
-
Power-On Reset: Ensures system starts only after the power supply stabilizes
-
Under-Voltage Reset: Protects the system during abnormal power supply voltage
-
Watchdog Reset: Recovery means during program anomalies
-
Manual Reset: Required for maintenance and debugging
Power Management Integration
Modern automotive MCUs typically integrate the watchdog closely with the power management module:
-
Low Power Mode: Adjusts watchdog behavior in low power mode
-
Voltage Monitoring: Works in conjunction with the voltage monitoring module
-
Temperature Compensation: Adjusts watchdog parameters based on temperature
-
Fault Logging: Records reset reasons for problem analysis
04 Software Design and Configuration of Watchdogs
Initialization Configuration
The initialization of the watchdog requires careful configuration of multiple parameters:
-
Timeout Duration: Determined based on the worst-case task execution time
-
Window Time: For window watchdogs, set a reasonable time window
-
Clock Prescaler: Adjusts counting frequency to meet different timeout requirements
-
Interrupt Enable: Choose whether to enable early warning interrupts
Kick Strategy Design
A reasonable kick strategy is key to the success of the watchdog system:
Single Task Kick In the simplest systems, a main loop task is responsible for kicking the watchdog. This method is simple to implement but cannot detect anomalies in other tasks.
Multi-Task Cooperative Kick In complex multi-task systems, a multi-task cooperative kick strategy is usually adopted:
-
Each critical task sets a life flag
-
The monitoring task checks all life flags
-
Only when all flags are normal is the kick executed
-
This method can pinpoint the specific task with an anomaly
Kick Timing Planning The planning of kick timing needs to consider the worst execution time of tasks, reserving enough time margin for critical tasks, avoiding interference between different tasks, and ensuring uniformity of kick intervals.
Error Handling and Recovery
When the watchdog is about to timeout or a reset occurs, the system should have corresponding handling mechanisms:
-
Warning Handling: Attempt to fix during early warning of the window watchdog
-
State Preservation: Save critical diagnostic information before reset
-
Recovery Strategy: Choose different initialization paths based on the reset reason
-
Fault Reporting: Report watchdog-related faults to the diagnostic system
05 Functional Safety and Watchdog Design
ASIL Level Requirements
Different ASIL levels impose different requirements on the watchdog:
ASIL A/B
-
Basic watchdog functionality
-
Single monitoring strategy
-
Standard test coverage
ASIL C
-
Window watchdog or equivalent mechanism
-
Multi-dimensional monitoring
-
Enhanced diagnostic coverage
ASIL D
-
Independent watchdog + window watchdog
-
Complete monitoring system
-
Fault injection testing requirements
Monitoring System Architecture
In functional safety systems, the watchdog is usually part of a complete monitoring system:
Program Flow Monitoring
-
Checks whether the program execution sequence is correct
-
Verifies function call relationships
-
Monitors task scheduling order
Time Monitoring
-
Monitors task execution time
-
Monitors interrupt response time
-
Monitors bus communication time
Data Monitoring
-
Checks the reasonableness of critical data
-
Verifies the integrity of communication data
-
Checks the consistency of sensor data
Integration of Safety Mechanisms
The watchdog needs to work in conjunction with other safety mechanisms:
-
Integration with MPU/MMU: Triggers corresponding handling on memory access violations
-
Integration with ECC: Takes action when memory errors reach a threshold
-
Integration with Communication Monitoring: Adjusts watchdog behavior during communication anomalies
-
Integration with Power Monitoring: Enables emergency handling during power anomalies
06 Conclusion
The design of watchdogs and reset circuits is a seemingly simple yet complex key technology in automotive embedded systems. A good watchdog design not only enhances system reliability but is also a necessary condition to meet functional safety requirements.
As automotive electronics move towards higher safety levels and more complex functions, watchdog technology is also continuously evolving. From simple independent watchdogs to complex multi-level monitoring systems, from single timing checks to intelligent fault predictions, watchdogs are becoming increasingly “smart”.
As automotive embedded software engineers, we need to deeply understand the working principles of watchdogs, master their design methods, and continuously accumulate experience in practice. Only in this way can we design truly reliable automotive electronic systems, ensuring that every vehicle can safely and stably travel on the road.
Remember, the watchdog is not omnipotent, but it is absolutely essential. It is the last line of defense for system safety and our solemn commitment to user safety. Let us design every watchdog with care, safeguarding the safety of every traveler.
END
Like + Follow, scan to add friends, note (public account), and obtain AUTOSAR materials
