Post History

Is Feeding a Watchdog Timer from an ISR a Bad Practice?

In an embedded system, I require a watchdog to be able to pass ESD qualifications. Having no experience with watchdogs, I went through this Memfault article. I liked the events "registration" and "flags" since it easily allows us to do conditional ORing of events depending on the system's state. Plus it feels scalable.

For the feeding part, here's what I put in place:

```c
/** @brief Raise the event flag and feed the watchdog if all required event flags are set.
 *
 *  @param[in] event_flag  Bitmask corresponding to the triggering event.
 */
static void watchdog_feed_if_all_events_set(watchdog_event_t event_flag)
{
    /* Declare as volatile since this function could be called from concurrent ISRs. */
    static volatile watchdog_event_t watchdog_fed_events;

    enter_critical();

    watchdog_fed_events |= event_flag;

    if ((watchdog_fed_events & watchdog_required_events) == watchdog_required_events) {
        bsp_watchdog_feed();
        watchdog_fed_events = 0;
    }
    exit_critical();
}
```

This function can then be called from any part of the application, including from ISRs.

Now for the question:

I was told it was senseless to feed a watchdog from an ISR and that a redesign is required, but no rationale was provided. I see nothing wrong with my implementation and it works just fine. I feel like a watchdog design is closely related/dependent to the system on which it is implemented and that there are no one-size-fits-all designs.

Am I missing something? Why would someone want to avoid feeding a watchdog from an ISR?