Watchdog Timer Subsystem
Hardware_Watchdog_Timer_Array
Independent hardware watchdog timers for each TMR processor module that force automatic hardware reset if the processor fails to periodically signal healthy operation, preventing permanent lockup states.
Purpose
Guarantee recovery from any software hang, infinite loop, or radiation-induced processor lockup within a bounded time window (500ms). Each processor module has its own independent watchdog timer implemented in radiation-hardened discrete logic, ensuring that no common-mode failure can prevent reset capability.
Context
In a 100-year uncrewed mission, software faults and radiation-induced processor lockups are statistically certain. Without hardware watchdog timers, a single lockup event could permanently disable a processor module. The watchdog system operates on independent clock and power domains from the processors it monitors, ensuring it can force a reset even when the processor's own clock or power regulation has failed.
Principles
- ▸Watchdog timer is independent of the processor it monitors (separate clock, separate power)
- ▸Windowed watchdog rejects both too-early and too-late kicks to detect erratic behavior
- ▸Cascaded watchdog hierarchy: per-module WDT, system-level WDT, and last-resort power-cycle
- ▸Watchdog reset triggers boot sequence through L3-CDH-PROC-BOOT for clean restart
- ▸All watchdog events are logged to non-volatile memory for post-mortem analysis
Typical implementations
- ▸Vorago Technologies VA108xx rad-hard microcontroller as dedicated WDT controller
- ▸Discrete radiation-hardened logic (e.g., Renesas ISL70001 comparators and timers)
- ▸Microsemi RTAX FPGA implementing windowed WDT with configurable timeouts
- ▸Independent crystal oscillator for WDT clock domain
Lunar considerations
- ▸WDT must operate reliably through lunar night thermal extremes when processors are in sleep mode
- ▸Independent power domain prevents processor power fault from disabling watchdog
- ▸SEL-immune implementation required since WDT is last line of defense against processor lockup
- ▸Watchdog timeout values must account for longest legitimate processing bursts (AI inference)
Specifications
Functional
| primary function | Monitor processor liveness and force hardware reset upon timeout to recover from lockup conditions |
| inputs | Periodic kick signals from each L3-CDH-PROC-CPU module software, Configuration registers for timeout window parameters, System mode signals (normal, sleep, maintenance) for timeout adjustment, Independent clock source (crystal oscillator) |
| outputs | Hardware reset signal to individual processor modules, Watchdog timeout event notification to L3-CDH-PROC-BOOT, Timeout count telemetry to L2-CDH-STOR for logging, System-level watchdog escalation to L2-CDH-PROC |
| timeout window ms | 500 |
| minimum kick interval ms | 100 |
| reset pulse duration us | 50 |
| clock accuracy ppm | 100 |
| cascade escalation time s | 5 |
Physical
| mass kg | 0.5 |
| dimensions | 0.08m x 0.06m x 0.02m per WDT module (3 units plus system-level WDT) |
| materials | Radiation-hardened discrete logic ICs in ceramic packages, Independent crystal oscillator (32.768 kHz or 1 MHz), Dedicated power regulator with separate input from critical bus, Conformal-coated PCB assembly |
| operating temp c | -55 to +125 |
| survival temp c | -65 to +150 |
| radiation tolerance krad | 300 |
| sel immune | True |
| vacuum compatible | True |
Operational
| power consumption w | 0.5 |
| thermal range c | -55, 125 |
| lifetime years | 100 |
| mtbf hours | 1000000 |
Interfaces
Provides
- Forced hardware reset signal to individual processor modules upon watchdog timeout.
- Indication that reset was triggered by watchdog timeout, enabling boot firmware to select recovery boot path.
- Non-volatile log entries for every watchdog timeout event with timestamp and processor ID.
Requires
- Regular heartbeat signals from processor software indicating healthy operation within timing window.
- Dedicated power feed from critical bus, separate from processor power domain, for WDT independence.
Cite this entry
Lunar Ark Codex. "Watchdog Timer Subsystem" (L3-CDH-PROC-WDT). Retrieved 10 September 2026, from https://lunarark.com/entry/L3-CDH-PROC-WDT
Licensed CC-BY-SA 4.0. You may reuse and adapt this entry with attribution, under the same licence.