Okay, may I say some words about Watchdog implementation as well?
Looking on Atmel chips I see that internal watchdogs are like a kids` toys. Really, their watchdogs are disabled during power-down mode; by other words if software fails and does switch on power-down mode somehow then watchdog is stopped and all the program execution hang ups. It is because power-down mode stops osc generator which is used as clock source for watchdog as well.
There is one chip: AT89S8252 in which the watchdog is clocked from independent oscillator (IMHO, by internal RC :) Unfortunately, its watchdog also is stopped in power-down mode. Why? I think it is for saving some power. As for me, it should be optional because for high-stable system it is more important to have always worked watchdog instead save some power.
As result: if you wish to build high-stable system on Atmel 51`s then you need to use external WDT; thanks for Maxim and other who offer PowerSV+WDT in one chip.
Good days!