Watchdog not working when in HardFault?

[TW]

We are configuring the watchdog like this:

// Watchdog
NRF_WDT->CONFIG = (WDT_CONFIG_HALT_Run << WDT_CONFIG_HALT_Pos) | ( WDT_CONFIG_SLEEP_Run << WDT_CONFIG_SLEEP_Pos);
NRF_WDT->CRV = 3*32768;   //ca 3 sek. timout
NRF_WDT->RREN |= WDT_RREN_RR0_Msk;  //Enable reload register 0
NRF_WDT->TASKS_START = 1;

This comes from one of the examples. If I do not reset the watchdog in my code, the processor resets, as intended. However, when a hardfault exception occurs, the watchdog seems to stop working and does not reset the processor, so it is stuck inside the hardfault handler forever.

For now, I have solved this by doing a system reset in the Hardfault handler, but it is a bit scary that the watchdog apparantly does not work while the processor is in an exception status. Is there any reason for this to happen?

[RK]

Yes that's how ARM Cortex works. Hardfault has a negative exception priority which means it cannot be interrupted except by the two even higher (more negative) exceptions, which are NMI and Reset.

The WDT is just a normal peripheral with a maximum exception priority of 0, there's no way that it would be able to interrupt the hardfault handler. That's not scary, that's how ARM works.

[TW]

Coming from an AVR where the watchdog is the almighty ruler, it was odd seeing this. Your answer makes perfect sense, thanks!

[Remco]

It makes sense for a watchdog interrupt/exception, but not for a reset! Chapter 19.1.3 of the RM: A TIMEOUT event will automatically lead to a watchdog reset equivalent to a system reset, see chapter 11 on page 36. If the watchdog is configured to generate an interrupt on the TIMEOUT event, the watchdog reset will be postponed with two 32.768 kHz clock cycles after the TIMEOUT event has been generated. Once the TIMEOUT event has been generated, the impending watchdog reset will always be effectuated.

[pabigot]

While this would explain why WDT_IRQHandler would not be invoked, it does not explain why the watchdog reset would not occur. In my own testing the WDT reliably reset the board even if it was stuck in HardFault_Handler.

[RK]

Depends what the hard fault handler looks like - if it's the normal one often-copied then it's just a busy loop which keeps the CPU running, that stops the watchdog counting down so it never fires.

[pabigot]

I'm at a loss to understand how the watchdog could fail the way you describe. Have you demonstrated this behavior?