Watchdog not working when in HardFault?

[TW]

We are configuring the watchdog like this:

// Watchdog
NRF_WDT->CONFIG = (WDT_CONFIG_HALT_Run << WDT_CONFIG_HALT_Pos) | ( WDT_CONFIG_SLEEP_Run << WDT_CONFIG_SLEEP_Pos);
NRF_WDT->CRV = 3*32768;   //ca 3 sek. timout
NRF_WDT->RREN |= WDT_RREN_RR0_Msk;  //Enable reload register 0
NRF_WDT->TASKS_START = 1;

This comes from one of the examples. If I do not reset the watchdog in my code, the processor resets, as intended. However, when a hardfault exception occurs, the watchdog seems to stop working and does not reset the processor, so it is stuck inside the hardfault handler forever.

For now, I have solved this by doing a system reset in the Hardfault handler, but it is a bit scary that the watchdog apparantly does not work while the processor is in an exception status. Is there any reason for this to happen?

[RK]

Yes that's how ARM Cortex works. Hardfault has a negative exception priority which means it cannot be interrupted except by the two even higher (more negative) exceptions, which are NMI and Reset.

The WDT is just a normal peripheral with a maximum exception priority of 0, there's no way that it would be able to interrupt the hardfault handler. That's not scary, that's how ARM works.

[Remco]

It makes sense for a watchdog interrupt/exception, but not for a reset! Chapter 19.1.3 of the RM: A TIMEOUT event will automatically lead to a watchdog reset equivalent to a system reset, see chapter 11 on page 36. If the watchdog is configured to generate an interrupt on the TIMEOUT event, the watchdog reset will be postponed with two 32.768 kHz clock cycles after the TIMEOUT event has been generated. Once the TIMEOUT event has been generated, the impending watchdog reset will always be effectuated.