Watchdog / Deadman Timer (WDT / DMT)

dsPIC30F dsPIC33F dsPIC33E dsPIC33C dsPIC33A

☀️ Light

The Watchdog / Deadman Timer block configures the chip’s Watchdog Timer (WDT) or Deadman Timer (DMT) at compile time and emits the periodic kick instruction at runtime. One block does both jobs: it writes the corresponding #pragma config fuses into the Microchip Master block (no manual fuse setup) and emits __builtin_clrwdt() (WDT) or the DMTPRECLR/DMTCLR 2-step clear (DMT) in its task step function.

When to use:

• Missed-deadline recovery — let the hardware reset (or trap) the MCU if the control loop stops kicking the timer
• Windowed protection — require the kick to land inside a time window (kicking too early or too late faults), catching runaway-fast loops as well as hangs
• Deadman protection — on chips with a DMT, count instruction fetches instead of wall-clock time for tighter coupling to actual execution
• Configure-only — set up and enable the timer here while another block (or your own C code) is responsible for the actual kick

When NOT to use:

• Explicit, commanded reset — use the Reset block for a deliberate software reset on a known fault, not the watchdog
• No safety requirement — a watchdog on a non-critical demo only adds the risk of spurious resets if the rate is mis-set
• Non-dsPIC / PIC32A target — the block is inert on SAM/ARM and PIC32MK/MX/MZ targets (it warns and generates no watchdog)

Block Dialog

1. Configuration2. Advanced

Screenshots taken with chip 33CK256MP508

Overview

The block is family-aware and chip-aware. It detects the target selected on the Microchip Master block and adapts:

• Clock source — on dsPIC30F it uses the 512 kHz LPRC, on dsPIC33F/E the 32 kHz LPRC; on dsPIC33C/CK/CH/CDV and dsPIC33A the clock source is selectable (LPRC / FRC / FCY).
• Mechanism popup — Deadman Timer (DMT) is offered only when the selected chip actually has DMT hardware. On chips without a DMT, the popup contains just Standard WDT and Windowed WDT.
• Timeout outcome — on dsPIC33A the WDT can be routed to a generic trap instead of a reset; the DMT is an IRQ on dsPIC33C and a non-maskable trap on dsPIC33A.

The requested timeout is mapped to the closest value the chip can actually produce (constrained by the postscaler set and clock frequency); the achieved value is reported live in the Effective timeout read-only field.

WDT and DMT in parallel

The WDT and the Deadman Timer are independent (orthogonal) peripherals — different fuses, different runtime-enable bits, different kick instructions. The block therefore supports:

• one Standard / Windowed WDT block only;
• one Deadman Timer (DMT) block only;
• one WDT block and one DMT block together (both run in parallel);
• several blocks of the same mechanism, only if their fuse settings are identical.

Two blocks that drive the same physical timer with different settings are a conflict: it is reported live in the Multi-block status field (Advanced tab, shown only when more than one block is present) and stops the build until resolved.

Ports

This is a configuration block — it has no signal ports. It configures fuses at compile time and emits the kick in its own task step function. Place it on a rate at least 2× faster than the configured timeout.

Parameters

Configuration tab

Advanced tab

Coherence check

When the block kicks (i.e. Configure only is off), it compares the block sample time Tb to the effective timeout Tw:

• Tb ≥ Tw → fail (the device will reset before the next kick)
• Tw/Tb < 2 → warning (less than 2× margin — intermittent resets likely)
• Tw/Tb ≥ 10 → safe

For Windowed WDT (and DMT windows) the check also verifies the kick lands after the window opens. The check is non-blocking at the dialog (it warns) and is re-verified during code generation.

Timeout outcome by family

For trap / IRQ outcomes, the block publishes the relevant entry through MCHP_USER_INTERRUPTS so an Interrupt block can aggregate the handler.

Code generation

• Fuses — written into the Master block (FWDTEN/WDTEN, RWDTPS/SWDTPS or WDTPRE/WDTPOST, WINDIS, WDTWIN, RCLKSEL, WDTRSTEN for WDT; DMTDIS, DMTCNTL/H, DMTIVTL/H for DMT). No manual fuse editing is required.
• Runtime enable — WDTCONLbits.ON (33C) / WDTCONbits.ON (33A) / RCON.SWDTEN (legacy) for WDT; DMTCONbits.ON for DMT, emitted at Start.
• Kick — __builtin_clrwdt() (WDT) or the DMTPRECLR = 0x...; DMTCLR = ... 2-step clear (DMT), emitted every step at the block’s rate. Suppressed when Configure only is on.
• PIL builds — the watchdog/DMT is disabled (no enable, no kick) for Processor-in-the-Loop builds, where it would be meaningless; a message is printed to the build log.

External Mode

A running watchdog is incompatible with External Mode “wait for host to start the application” (OnTargetWaitForStart = on). In that mode the target blocks — for an unbounded time — waiting for Simulink to send the start packet before the first model step, so the watchdog cannot be refreshed and would reset the target. The code generator stops the build with a clear error in this case. To use External Mode with a Watchdog/DMT in the model, either:

1. Remove the Watchdog/DMT block from the model, or
2. Build for External Mode without “wait for host to start” — use the 3-step flow from the Microchip toolstrip: 1) Build for monitoring, 2) Deploy, 3) Start.

(Normal External Mode without the wait-for-start option runs the model immediately, so the watchdog is serviced by the model steps and there is no conflict.)

Examples

Programmatic setup — Standard WDT, 1 s timeout

mdl = 'my_model';
add_block('MCHP_Blockset/System Configuration/Microchip Master', [mdl '/Master']);
add_block('MCHP_Blockset/System Functions/Watchdog_DMT', [mdl '/WDT']);

set_param([mdl '/WDT'], 'Mechanism',     'Standard WDT');
set_param([mdl '/WDT'], 'TimeoutChoice', '1 (s)');
set_param([mdl '/WDT'], 'SampleTime',    '0.1');   % kick 10x per timeout

Parallel WDT + DMT (dsPIC33C)

% Watchdog for wall-clock missed-deadline recovery ...
add_block('MCHP_Blockset/System Functions/Watchdog_DMT', [mdl '/WDT']);
set_param([mdl '/WDT'], 'Mechanism', 'Standard WDT', 'TimeoutChoice', '1 (s)');

% ... plus a Deadman Timer for instruction-fetch monitoring. Both run in
% parallel (orthogonal peripherals, disjoint fuses).
add_block('MCHP_Blockset/System Functions/Watchdog_DMT', [mdl '/DMT']);
set_param([mdl '/DMT'], 'Mechanism', 'Deadman Timer (DMT)', 'DMT_Count', '2000000');

Configure-only (another task does the kick)

% Enable the WDT here, but emit no CLRWDT in this block. A different block
% (or hand-written C) is responsible for refreshing it. 'Configure only'
% lives on the Advanced tab.
set_param([mdl '/WDT'], 'Mechanism', 'Standard WDT', 'TimeoutChoice', '500 (ms)');
set_param([mdl '/WDT'], 'NeverClear', 'on');

Device Support

Note — not every dsPIC33C/33A variant has a Deadman Timer. The block probes the chip database; when DMT is absent the mechanism popup omits the DMT choice.

Related Blocks

• Reset — explicit, commanded software reset (the watchdog is the automatic safety-net complement)
• Reset Status / Boot Cause — read the reset cause (RCON) on boot to distinguish a watchdog reset from POR/BOR/MCLR
• Interrupt — aggregates the WDT-trap / DMT-IRQ handler published by this block via MCHP_USER_INTERRUPTS
• MCHP Master — target selection and fuse aggregation; this block writes its watchdog fuses into the Master