What is the difference between the Independent Watchdog (IWDG) and Window Watchdog (WWDG) on STM32?

The IWDG (Independent Watchdog) is clocked by its own dedicated low-speed internal oscillator (LSI, approximately 32 kHz on STM32), making it truly independent of the main system clock and the entire digital clock tree. If the main HSE oscillator fails, if the PLL loses lock, or if the system clock configuration is corrupted, the IWDG continues counting and will reset the system. It is a simple countdown timer with a single constraint: refresh it before it reaches zero. You can refresh at any time — there is no "too early" penalty. The IWDG is best for catching catastrophic failures: complete CPU hangs, infinite loops, clock system failures, and corrupted program flow. Once started, the IWDG cannot be stopped (on most STM32 families), which is a deliberate safety feature — it prevents runaway software from disabling its own watchdog.

The WWDG (Window Watchdog) is clocked from the APB1 bus clock, which is derived from the main system clock. It adds a window constraint: the refresh must occur within a specific time window — after a configurable lower bound and before the counter expires. Refreshing too early (below the window value) triggers a reset, just like refreshing too late. This catches a broader class of bugs than the IWDG: if the software loop is running faster than expected (skipping critical sections, bypassing sensor reads, or stuck in a tight sub-loop that still reaches the feed point), the early-refresh detection catches the abnormal timing. The WWDG also provides an Early Wakeup Interrupt (EWI) that fires approximately one counter tick before the timeout, giving firmware a last chance to save diagnostic state or perform graceful shutdown before the reset.

For maximum protection, deploy both: the IWDG catches catastrophic failures and clock loss (since it runs on its own oscillator), while the WWDG verifies timing integrity (since it detects both too-fast and too-slow execution). This combination is recommended by several safety standards for SIL 2+ and ASIL B+ applications.