Watchdog not working when in HardFault?

[TW]

We are configuring the watchdog like this:

// Watchdog
NRF_WDT->CONFIG = (WDT_CONFIG_HALT_Run << WDT_CONFIG_HALT_Pos) | ( WDT_CONFIG_SLEEP_Run << WDT_CONFIG_SLEEP_Pos);
NRF_WDT->CRV = 3*32768;   //ca 3 sek. timout
NRF_WDT->RREN |= WDT_RREN_RR0_Msk;  //Enable reload register 0
NRF_WDT->TASKS_START = 1;

This comes from one of the examples. If I do not reset the watchdog in my code, the processor resets, as intended. However, when a hardfault exception occurs, the watchdog seems to stop working and does not reset the processor, so it is stuck inside the hardfault handler forever.

For now, I have solved this by doing a system reset in the Hardfault handler, but it is a bit scary that the watchdog apparantly does not work while the processor is in an exception status. Is there any reason for this to happen?

[RK]

Yes that's how ARM Cortex works. Hardfault has a negative exception priority which means it cannot be interrupted except by the two even higher (more negative) exceptions, which are NMI and Reset.

The WDT is just a normal peripheral with a maximum exception priority of 0, there's no way that it would be able to interrupt the hardfault handler. That's not scary, that's how ARM works.

[TW]

Coming from an AVR where the watchdog is the almighty ruler, it was odd seeing this. Your answer makes perfect sense, thanks!