(... OK there actually IS, but that's a _really_rare_ case - see Kai's locked-up mcu which needed a power cycle).

What happens when a bug occurs, (and what from the point of the , is:
- program cycles in a cycle infinitely
- mcu executes what "he" thinks is code but what actually is data, code starting from a wrong address (e.g. in the middle of a multibyte instruction), noninitialized or simply nonexistent code memory
- any of the above plus a working interrupt
- none of the above (program working OK) but spuriously erratically disabled interrupt
- anything else :-) (actually, this is the tricky part of this whole issue: it is YOU who has to determine ALL possible modes of failure - and of course, this is a classically impossible task - this is why redundant systems exist, and in fact this is why WD exist at the first place - any "independent" checking mechanism reduces entropy (although a flawed redundant system might in fact increase entropy... :-( ))

And, for proper level of paranoia, you need to ensure, that the dog does NOT get kicked in either of the above cases so it can bite through reset...

You can never be paranoid enough...

JW