hardConceptScenarioDesignMidSeniorStaff
How do you use a watchdog timer to recover a wedged device without hiding the bug that wedged it?
Watchdog recovery in firmware only works if the code that kicks the watchdog can detect task progress. Kick from one supervisor after checking heartbeats, record reset cause and diagnostics in retained memory, and treat watchdog resets as defects to investigate.
5 min readUpdated 2026-08-15
Answer
Short answer
Have one supervisor kick the watchdog only after every critical task proves progress, preserve reset diagnostics, and use the reboot to recover while still fixing the underlying hang.
Mention reliability where it changes the risk, the owner, or the next check. A useful reliability point should make the answer more testable, not merely longer. Tie reliability back to the scenario so the interviewer can see why it matters here.
Was this answer helpful?
Likely follow-ups
- Two tasks run at 1Hz and 100Hz. How do you build a single check-in scheme that catches either one stalling without the fast task masking the slow one?
- How would you distinguish a genuine firmware hang from a brownout that also resets the part?
- What is a windowed watchdog protecting against that a conventional one does not catch?
- Your device reboots every ninety seconds in the field but never on the bench. What do you instrument first?
Related questions
- How do you size the stack and the heap on a device with a fixed RAM budget?mediumAlso on firmware5 min
- How do you isolate a degraded dependency and halt a cascading failure before thread pool exhaustion takes down the entire microservice ecosystem?hardAlso on reliability2 min
- How do you conduct a post-mortem after a catastrophic Sev1 outage triggered by a junior engineer's mistake, without succumbing to the blame game?hardAlso on reliability2 min
- You want to prove the system survives losing a database, in production, on a Tuesday afternoon. How do you run that without being fired?hardAlso on reliability7 min