Its correct.

Its designed that way so that a runaway code condition wouldn't be likely to falsely create the watchdog timer reset conditions.

For example, if it merely required setting a bit high, than if a bug or stack overflow error got the microcontroller into a runaway condition where it was writing FFs through all memory, the watchdog timer would likely be reset and not restore the microcontroller.

That's why you write twice with two distinct byte patterns. Much much more improbable that a runaway would create that pattern.

Of course, you have to strategically place your watchdog timer resets so that they won't keep a locked-up microcontroller from resetting. Figure where to place and not place those code bits can be a real puzzle.

aka j