Actually, a single-pin equivalent of the paranoid WD would be a circuit, where two pulses within a time window would cause WD reset, while a third pulse too early after those two, or just a single pulse without the second one, would cause immediate system reset.

And for the independent WD clock (if it needs any clock at all) - the task of WD should not be to cover up software errors; rather to resolve spurious hardware failures. It's a quite likely failure that the oscillator stops - the crystal is an electromechanical device with not so easily and precisely defined behaviour under various conditions as a bunch of transistors. Even if restart might be impossible, the primary task of WD is to kick in and bring the system into some reasonble defined state - most often the same state as power-on reset.

Anything else is a compromise with questionable benefit.

Jan Waclawek

PS. The personal experience: a multiplexed LED dot matrix display, reset/WD turns all of both high and low side drivers off. '52 based, multiplex is software driven. Leaving LEDs on without multiplex for a couple of seconds securely and permanently damages the LEDs- verified during development while the WD was not there. WD is fed in the most stupid way - ALE in the old board, a peripheral pin after redesign but driven from the timer interrupt responsible for mux - no sophisticated scheme. Several tens of failed control boards (the displays are operated in harsh environment out of our control, some of them being subject to heavy abuse - insufficient ventillation/cooling, wildly jumping mains voltage and similar), most of them had damaged crystals (probably due to heat). Fried LEDs did not occur, even with the ALE-fed dog...