Enable watchdog for bootloader?

[harbaum]

I have a device that may be connected to all kinds of odd power sources. In one case the power up isn't stable and every now and then my esp32 falls into the bootloader at startup even though the boot button is not pressed. IMHO the watchdog might allow to greacefully handle this without hardware changes (e.g. making the esp32's power supply more stable or the like).

According to the documentation the RTC WDT should be enabled by default for the bootloader with a timeout of 9000ms. It's my understanding that this should cause a reset when being in bootloader for > 9 seconds. But that doesn't happen. It sits in the bootloader forever.

What am I missing? How do I make the device restart if it sits for a few seconds in bootloader without e.g. a PC trying to communicate with it?

[boarchuz]

That would be really inconvenient if the ESP32 restarted after 9 seconds in download mode! That wouldn't be enough time to even flash most binaries. Fortunately (or unfortunately for you) the ROM bootloader disables the watchdog for download mode.

See if strong external pullups can ensure correct levels on strapping pins at startup (even 0 ohm if necessary).

A voltage supervisor on CHIP_PU is worth considering too given your description (see datasheet 2.3.2). This might also help to ensure strapping pin levels aren't sampled prematurely.

[harbaum]

The bootloader could disable the watchdog once it received a valid download request. Or after it has received some other kind of useful communication. That way you could easily trigger a download and would only run into a problem if you have e.g. electromagnetic noise that resembles a valid communications request which is pretty unlikely.

The idea behind a watchdog is to cope with unexpected situations in a way that keeps the device somewhat operational. This typically includes software and hardware problems.

If the solution really is to make the hardware more reliable, then I don't understand why the esp32 e.g. has functions to cope with brown-out situations. Brown-outs are exactly the kind of hardware problems I describe. They aren't necessarily hardware bugs but also arise from electromagnetic noise or the like if e.g. a breaker trips nearby.

And yes, I can add hardware to increase the stability. But it IMHO significantly reduces the benefit of a watchdog if there are still situations where the device can get stuck.

[harbaum]

The bootloader might actually properly feed the watchdog. That could even help to solve problems during download. Otherwise the device could get stuck during a failed or interrupted download attempt.

I don't see any negative aspects that would arise with this. Downloads would still work as usual. The only difference would be that there's a limited time between entering bootloader and starting a download. But this is usually handled via dtr/RTS and wouldn't even be noticable.