An unattended machine cannot wait for someone to notice it has frozen. A pump that stays on because the code hung is a flood waiting to happen. This lesson covers the watchdog timer and the fail-safe habits that go with it.

What you will learn

• Explain what a watchdog does and what it does not fix.
• Arm a watchdog and feed it from loop().
• Design setup() so outputs start in a safe state after any restart.

What the watchdog does

The watchdog is a hardware timer that resets the board unless your code resets the timer itself, before it expires. If a bug causes an infinite loop or the code stops reaching the reset call, the watchdog fires and restarts the board instead of leaving it frozen.

A minimal watchdog pattern

#include <avr/wdt.h>

void setup() {
  // safe state first, always
  pinMode(Q0_0, OUTPUT);
  digitalWrite(Q0_0, LOW);
  wdt_enable(WDTO_2S);
}

void loop() {
  // your normal logic here

  wdt_reset();
}

wdt_enable(WDTO_2S) arms a two second watchdog. If wdt_reset() is not called within that window, the board restarts. Because the reset is at the end of loop(), a hang anywhere before it stops the resets and triggers the restart.

Test it on the bench first. When the watchdog fires, the CPU restarts, and so does your program: setup() runs again from the beginning. Run the exercise below on your own board and confirm the restart before you rely on a watchdog in a machine.

Try it: provoke a restart on purpose

void loop() {
  Serial.println("alive");
  delay(500);
  wdt_reset();
  if (millis() > 10000) {
    while (true) {}   // simulated hang: the watchdog should restart the board
  }
}

Expected result: the Serial Monitor prints alive for about 10 seconds, then the board restarts and the sequence starts again.

If it fails: if the Serial Monitor never prints alive again after the hang, check that the sketch includes avr/wdt.h and arms the watchdog with wdt_enable() in setup(). If the board still does not restart, contact Industrial Shields technical support.

A restart is a recovery, not a fix

A watchdog restart brings the board back, it does not explain why it hung. Log the event if you can, and treat repeated restarts as a symptom to investigate, not a feature working as intended. A common companion is the EEPROM counter from the previous lesson: increment a restart counter at startup.

Fail-safe outputs on restart

A restart reruns setup(), so outputs return to whatever setup() sets. Design it to leave outputs in a safe state: motors off, valves closed, alarms silent, not whatever they were before the restart. Do not assume loop() will run again in time to correct an unsafe default. For the pump station, that means the pump contactor is always off until the state machine explicitly asks for it.

Go deeper

• 8 signs your prototype isn't production ready
• PLC wiring mistakes: the 10 that destroy your panel

Next lesson: when you run out of terminals. Take the quiz below first.