Watchdog Timer and Brownout Circuit Design

An embedded controller can fail in ways that no amount of firmware testing will catch: a supply dip that leaves the core in an undefined state, a clock that starts late, or a code path that stops feeding the watchdog. A supervisor circuit exists to bring the system back to a known condition in each of those cases, and it is a small part of the board that prevents a large class of field failures.

Why Supervision Circuits Exist

Microcontrollers contain internal reset circuits, but their thresholds are loose and their timing is not guaranteed over temperature. An external supervisor provides a defined reset threshold, a defined reset delay and often a watchdog, so that the behaviour of the system at power up and at power failure is specified rather than assumed.

Supervision also covers the case where the supply falls slowly. A slow decay can leave the processor running at a voltage below its minimum while it still executes instructions, producing writes to memory that are neither valid nor detectable. A supervisor holds the processor in reset below a defined threshold, which removes that window.

The circuit is small, but it has to be designed rather than copied. The threshold, the reset delay and the watchdog period all depend on the processor, on the clock source and on the application, and the combination has to be verified over the temperature range.

Watchdog Timer Operation

A watchdog timer is a counter that must be refreshed periodically by the firmware. If the refresh does not arrive within the timeout period, the watchdog asserts a reset and the processor restarts. The purpose is to recover from a code lock up, a corrupted pointer or an interrupt storm that prevents the main loop from running.

The refresh must come from the part of the code that proves the system is healthy. Feeding the watchdog from a timer interrupt proves only that the interrupt still occurs, which is often true even when the main loop is stuck. Placing the refresh at the end of the main loop, and only when all of the tasks in that loop have completed, makes the watchdog meaningful.

The timeout period is a compromise. It must be longer than the longest legitimate time between refreshes, including the time spent in any long operation, and short enough that the system recovers quickly. Measuring the worst case loop time in the finished system, rather than estimating it, prevents spurious resets that are hard to distinguish from real faults.

Windowed Watchdogs

A windowed watchdog adds a lower limit as well as an upper one, so a refresh that arrives too early also triggers a reset. The purpose is to catch a processor that is running too fast, which can happen when the clock is disturbed, and to catch code that has been redirected to feed the watchdog in a tight loop.

The window has to be wide enough to accommodate the normal variation in loop time, which means the firmware needs a predictable timing structure. On a system with jittery task scheduling, a windowed watchdog is difficult to use and a conventional one is the better choice.

Some devices allow the window to be programmed after start up and then locked, so that a runaway program cannot disable the watchdog. That lock is worth using, because the first thing a corrupted program does is often to write to the configuration register. The lock makes the supervision independent of the code it is supervising.

<img src="https://www.gopcba.com/wp-content/uploads/2026/08/electronic-components.jpg" alt="Watchdog and reset supervisor circuit on a controller board” />

Brownout Reset and Threshold Selection

brownout reset holds the processor in reset when the supply falls below a threshold, and releases it when the supply recovers and remains above the threshold for a defined time. The threshold must be above the minimum operating voltage of the processor, with margin for the tolerance of the supervisor itself and for the drop across the board.

Threshold selection also has to account for the rise and fall times of the supply. A supply that rises slowly passes through the region where the processor would run incorrectly, and the supervisor must keep it in reset throughout. A supply that falls slowly has the same problem in reverse, and a supervisor with a wide operating range may keep the processor alive for longer than is safe.

The tolerance of the supervisor threshold is typically a few percent, and it has to be combined with the tolerance of the supply itself. A rail specified as three point three volts with five percent tolerance reaches three point one three five volts at its minimum, and the reset threshold has to sit below that with margin so that normal operation is not interrupted.

Supply Monitoring and Power Fail Warning

A power fail warning is an early indication that the supply is falling, generated at a level above the reset threshold. It gives the firmware time to save state, park actuators and shut down in an orderly way. The time available is set by the difference between the warning threshold and the reset threshold, divided by the rate at which the supply falls.

The warning threshold must be low enough that it does not trigger on normal supply variation and high enough to leave useful time. It is normally generated by a separate comparator input on the supervisor or by a second threshold in the same device, and the reservoir capacitance on the rail determines how long the processor can continue after the warning.

The firmware side matters as much as the hardware. The routine that saves state when the warning is asserted must be short enough to complete within the available time, and it should be tested by deliberately removing the supply rather than by simulating the event in software.

Reset Timing and Clock Start Up

The reset release delay has to cover the time the clock source needs to start and stabilise. A crystal oscillator can take several milliseconds to reach its nominal frequency, and a processor released from reset before that point may start with an incorrect clock configuration or not start at all. Supervisors with a programmable delay allow that time to be specified rather than assumed.

The delay also has to cover the rise time of the supply and the settling of any regulator that feeds the processor. Where a switching regulator has a soft start of several milliseconds, the reset delay has to be longer than the soft start plus the clock start up time, and the total should be checked on a prototype with the actual components.

Some processors have their own internal power on reset in addition to the external supervisor. The two should be compatible: an internal circuit that releases reset early does not matter if the external reset line is still asserted, but an internal circuit that asserts reset at a different threshold can produce a double reset or an ambiguous state. The datasheet of the processor settles the question.

Testing a Supervisor in Production

The reset threshold and the reset delay should be verified on a sample of units rather than on every board, because the test requires a variable supply and an oscilloscope. A slow ramp of the supply from zero to the nominal voltage, with the reset line monitored, shows both the threshold and the delay, and the same measurement catches a supervisor with the wrong part number fitted.

The watchdog should be tested by deliberately omitting the refresh. A simple test mode in the firmware that stops feeding the watchdog, or a test fixture that holds the processor in a state where the loop does not run, confirms that the reset occurs and that the system recovers. Testing the watchdog only in development leaves the possibility that it was disabled in the released firmware.

The backup and power fail paths deserve the same treatment. Removing the supply and observing whether the warning is issued, whether the state is saved and whether the system restarts cleanly verifies the whole chain rather than the individual components. The release checks that cover these items are listed in our guide to PCB design release checklist.

Common Failure Modes

The most common failure is a watchdog that is fed from a place where it cannot detect the real problem. The second is a reset threshold that is too close to the minimum operating voltage of the processor, so that a marginal supply causes resets in normal operation. The third is a reset line with excessive capacitance or leakage, which slows the edge and delays the release beyond the specified time.

Supply monitoring circuits are also affected by the tolerance of the divider that sets the threshold. A divider built from ordinary resistors drifts with temperature and with the tolerance of the parts, and a design that relies on the typical value will misbehave at the extremes. The discipline described in component tolerance and reliability applies directly here.

A supervisor that is intended to protect a system but has never been tested under the conditions it was designed for is not a protection at all. The assembly and inspection practices that catch a wrongly fitted or reversed supervisor, and the general quality checks in board quality characteristics, are the last line of defence before the product reaches a customer.

FAQ

Do I need an external watchdog if the microcontroller has one? The internal watchdog usually shares a clock with the core, so a disturbed clock disables both. An external device with its own oscillator is independent of the failure it is meant to catch.

How do I choose the brownout threshold? Set it above the minimum operating voltage of the processor with margin for the supervisor tolerance and the supply tolerance, then verify with a slow ramp on a prototype.

Why does my board reset randomly in the field? Check the watchdog period against the worst case loop time first, then measure the supply at the processor pins during the event. A reset that occurs on a load change usually indicates a threshold or decoupling problem.