In the context of the original question, regarding the power system ...

The watchdog doesn't do much to help if your power system isn't stabile. The on-chip (or off-chip) brownout detection should, however. Clamps, MOV's, and filters are all very useful for protecting the power subsystem from external events. Internal watchdogs aren't. For that reason I favor external ones.

For many years, chips have been equipped with "watchdog" timers for the purpose of restarting the chip if the code goes "off into the tall grass" as it often can do on receiving inputs that are not interpreted correctly, or encountering other unforeseen circumstances, or, for that matter, if the oscillator becomes irregular. Those will/may result in too much time between executions of the code that "kicks the dog" in order to keep him from going to sleep, and allowing the watchdog timeout reset to occur.

Most of the problems that were discussed back when watchdogs were an innovation, were simple failures in the imagination of the programmer, i.e. inadequate processing of possible input combinations, inadequate consideration of the effects of unanticipated sequences of events, etc. Can they do anything today that they couldn't do 20 years ago? I think not!

Expecting a watchdog to remedy problems with defective code, of which the above are certainly examples, is unrealistic. They might help point them out in early trials, but can't really help in full operation.

Expecting a watchdog to solve a problem with a stopped/irregular oscillator is a bit unrealistic, too, isn't it? What makes it work?

What remains, then, that can be dealt with by a watchdog is those ultra-rare events, mainly caused by EMI that cause high-impedance signals to venture into undefined regions, either momentarily, as with shot-noise, or persistently if a device clock is affected.

These effects can be avoided with proper power supply design, proper board layout, proper supply distribution and filtering, and proper shielding. The watchdog really only "comes into his own" when there's a significant cost tradeoff between "doing it right" and using the watchdog to "fix" the undesired result.

The only way in which a reset can resolve a stopped oscillator is to cycle the power, completely, so that it gets the necessary Vcc rise to kick-start it. If the oscillator is stopped, after all, the watchdog is presumably stopped, too. An external analog watchdog such as is provided by the MAX1232 supervisor could potentially deal with this. The DS1231, which is better equipped to process the unregulated input to the system might even be a better choice for control of Vcc. If Vin is "going away" then perhaps the best thing to do is to ensure that Vcc will "go away" too, and perhaps at a time when it can be managed in an orderly way.

Doesn't that approach offer a better path to a "solution" than using a watchdog, at least in this particular environment where power is unreliable? At a minimum, it can be used to prevent the runaway code, or whatever, from hurting anything, which the (infernal) internal watchdog really can not.

RE