What's changed: Initial version
1.4Clocks, timers, and the watchdog
Covers clock generation and frequency division via an oscillator and a PLL (phase-locked loop); the timer/counter and PWM output used for time measurement and event generation; and the judgment skill of reliability design using a watchdog timer (WDT), which detects software runaway and triggers an automatic reset.
The reliability of an embedded system depends not only on performance design under normal conditions but heavily on the design of "how to detect and recover from an abnormal condition." Building on the basics of clock generation and time measurement via timers, this section covers watchdog timer (WDT)-based software-runaway detection and automatic reset—an essential reliability design for embedded devices operating unattended. Both "how should the WDT timeout value be set" and "where should the WDT be reset (kicked)" are tested as design judgment, not rote definitions.
1.4.1Oscillators, PLLs, and frequency division
- An oscillator (a crystal oscillator/quartz crystal) is a component that uses the piezoelectric effect of quartz to generate a clock signal at a stable reference frequency. Operation inside the CPU proceeds as each circuit updates its state in sync with this reference clock.
- A PLL (phase-locked loop) is a circuit that multiplies (by an integer factor) an input reference clock's frequency to generate a higher clock frequency. Frequency division is the opposite: dividing the clock frequency by an integer to generate a lower frequency. By running the CPU core at a high clock for speed while running peripheral circuits at a divided-down lower clock, a design can secure the needed performance while holding down overall circuit power consumption and noise.
1.4.2Timers/counters, PWM, and the watchdog timer
- A timer/counter is hardware that counts clock cycles, used to detect the elapse of a fixed time or to generate periodic interrupts. PWM (pulse width modulation) is an output technique that uses a timer, varying the proportion of time a signal stays high within a fixed period (the duty cycle), to control motor speed or LED brightness in an analog-like way.
- A watchdog timer (WDT) is a mechanism where an independent counter counts down (or up) at fixed intervals, and unless software periodically performs a WDT clear (kick) to signal "it is still operating normally," the WDT times out and forcibly resets the CPU. This autonomously detects and recovers from runaway conditions such as software infinite loops or deadlocks, an essential reliability design for unattended equipment.
Most-tested: a PLL multiplies to generate a higher clock, while frequency division generates a lower clock; a WDT times out and forcibly resets the CPU if periodic clearing is interrupted; and the WDT clear should be placed where it reflects the main loop's normal health. The design judgment of where to place the WDT clear is tested.
Suppose you are designing firmware for an outdoor sensor device that operates unattended for a long period. The requirement is that "if the main loop stops for some reason (e.g., an infinite loop from a bug in a sensor driver), the system must be able to recover autonomously." You adopt a watchdog timer (WDT) for this, but where you place the WDT clear is the design fork in the road. If you design it so that "the timer interrupt handler, which fires at fixed intervals, unconditionally clears the WDT," then even if the main loop is stuck in an infinite loop due to a sensor driver bug, the timer interrupt itself keeps running normally, so the WDT keeps getting cleared periodically, the runaway is never detected, and the timeout never fires. This design fails to fulfill the WDT's original purpose (detecting the main loop's normal health). The appropriate design is to clear the WDT only at a point where a normal single pass of the main loop has completed (the point where the sequence of reading the sensor, processing, and producing output has come full circle). This way, the moment the main loop stalls in an infinite loop, WDT clearing stops, and after the configured timeout elapses, the CPU is reliably reset and the device recovers autonomously. The WDT timeout value likewise needs judgment: too short, and normal fluctuation in the main loop's processing time (such as a delay in sensor reading) triggers a false reset; too long, and recovery from a runaway takes longer than necessary—so it should be set to the main loop's worst-case execution time plus a sufficient margin.
| Element | Role | Design consideration |
|---|---|---|
| PLL | Multiplies the reference clock to generate a higher clock | Higher speed trades off against increased power consumption/noise |
| Frequency division | Divides the clock by an integer to generate a lower clock | Holds down power consumption of peripheral circuits |
| WDT | Forcibly resets the CPU if periodic clearing stops | Place the clear at the point where the main loop completes normally |
Trap: "It is fine to clear the WDT inside the timer interrupt handler" is wrong—a timer interrupt keeps firing periodically regardless of the main loop's state, so even if the main loop runs away, clearing never stops and the runaway is never detected. The WDT clear must be placed at the point where a normal single pass of the main loop has completed. Also wrong: "a PLL has the same role as frequency division"—a PLL multiplies to generate a higher clock, while frequency division does the opposite, generating a lower clock; their roles are reversed.
1.4.3Section summary
- A PLL multiplies to generate a higher clock; frequency division does the opposite, generating a lower clock. Choosing by use case holds down power consumption
- A WDT times out and forcibly resets the CPU if periodic clearing stops, enabling autonomous recovery from a software runaway
- The WDT clear should be placed at the point where a normal pass of the main loop completes. Unconditional clearing inside a timer interrupt causes missed detection
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. For an outdoor sensor device operating unattended, you want autonomous recovery even if the main loop enters an infinite loop due to a sensor driver bug. Where is the most appropriate place to put the watchdog timer (WDT) clear?
Q2. There is a requirement to run the CPU core at high speed while holding down peripheral-circuit power consumption and noise. Which combination is most appropriate for the clock design?
Q3. Which judgment is most appropriate regarding setting the watchdog timer (WDT) timeout value?