Thanks Erik and Jez,

I wouldn't have thought of that. Okay, eventually I would have, but probably only after encountering the problem and spending who knows how long trying to figure out what was going on.

So then is it safe to say that deciding where to reset the WDT should be done only after a careful analysis of possible failures? Or would you say it should only be reset in the main function?

It seems to me that it is also possible that you could end up having program control dragged away from main for an unanticipated duration leading to an unintended triggering of the WDT. Suppose, for example, you get three or four interrupts at the same time. The µ-controller will prioritize them according to either programming or default design, but it could still be quite a bit longer than anticipated before getting back to the main function.

So shouldn't a good implementation of the WDT include reset commands in other locations as well? At least in locations that can't keep resetting the WDT perpetually and independently? Or maybe the solution would be to insure that the ISR operating on it's own does not provide sufficient time to keep the WDT operating (you know, make certain it takes too long).

Joe