a watchdog timer
Imagine a night watchman who must phone the security office every ten minutes to confirm all is well. If a call is ever missed, the office assumes something has gone wrong and sends help. A watchdog timer is the hardware version of that arrangement inside a microcontroller: a countdown timer that, if it is ever allowed to reach zero, assumes the software has crashed or hung and forcibly resets the whole chip to recover it.
Mechanically it is simple and that simplicity is its strength. The watchdog is a hardware counter, separate from the main program flow, that counts down (or up to a limit) on its own clock. Your software must periodically 'kick' or 'feed' the watchdog — write a specific value to its register to reset the count before it expires. As long as the program is running normally and reaching its kick point in time, the counter never reaches zero and nothing happens. But if the software hangs in an infinite loop, deadlocks, gets lost after a glitch, or crashes such that it stops kicking, the counter expires and the watchdog triggers a hardware reset, restarting the system from the reset vector. Because the watchdog runs in independent hardware, it works even when the CPU is wedged. Good practice is to kick it from one well-chosen place (often the main loop), NOT scattered everywhere, so that a partial hang where only some tasks die is still caught. Many chips also have a windowed watchdog that faults if you kick too EARLY as well as too late, catching a runaway loop that kicks furiously.
It matters because embedded devices often run unattended for years with no one to press a reset button — the watchdog is the automatic last-resort recovery that turns a hung device back into a working one. The honest cautions: a watchdog is a safety net, NOT a fix — it papers over a crash by rebooting, so a device that silently resets every few minutes is broken, and you should find the real bug, not just rely on the reset. Kicking the watchdog from inside an interrupt or from too many places can mask a real hang (the kick keeps happening even though the main work has stalled), defeating the purpose. And after a watchdog reset you usually want to record that it happened (a reset-cause flag) so the failure is visible rather than hidden.
// Independent hardware counter; software must kick it in time. iwdg_init(/* timeout = */ 500 /* ms */); for (;;) { do_main_work(); // if this ever hangs > 500 ms ... iwdg_kick(); // ... this is not reached, so the } // watchdog resets the whole chip. // Kick from ONE place, not inside an ISR, so a real hang is caught.
If the main loop hangs and stops kicking, the independent watchdog counter expires and resets the chip — automatic recovery with no human present.
A watchdog hides a crash by rebooting; it is not a fix. Kicking it from an ISR or too many places can mask a real hang, so a device that quietly resets repeatedly is broken — log the reset cause and find the actual bug.