Independence avoids common-cause failures tied to the main PLL or shared oscillators. If the system clock stalls, the watchdog must still advance, detect lateness, and trigger a safe action. Standards expect clear independence plus an audit trail: timestamps, configuration version, and results linked to evidence.

Start from the task period T_task and characterize jitter ±J and worst-case latency L. Pick a guard Δ_guard, then compute T_min = T_task − J − L − Δ_guard and T_max = T_task + J + L + Δ_guard. Validate with boundary sweeps and freeze values in OTP or registers with change control.

Early or too-often feeds usually indicate logic disorder or feed spoofing, so prefer degrade or locked modes that restrict non-critical functions. Late or missing feeds often reflect task stalls or timebase faults, so prioritize a deterministic reset with guaranteed pulse width and audited action results.

Use low-duty rolling injections that avoid service windows, shifting test timing with workload. Escalate only on confirmed violations, falling back to degrade rather than immediate resets when continuity matters. Log detect latency, classification, and evidence hashes so audits can verify both coverage and impact boundaries.

Include timestamp, injection type, expected action, detect latency, action result, and an evidence hash or log pointer. Add tester ID and configuration version to anchor repeatability. Summaries should present per-class detection ratios and boundary cases, with raw logs retained for traceable re-analysis when required.

Mask the window counter during ramps, suppress feeds through DVFS transitions, and delay the first post-sleep feed. Add threshold hysteresis and a restore delay so transient frequency or voltage shifts do not contaminate timing. Every mask event must be logged to preserve a complete and auditable record.

Dual tokens are harder to spoof because each core must complete its critical slice before a feed is allowed. Out-of-phase feeding reduces common-mode misses. Single-token schemes require extra anti-spoof checks and arbitration rules to ensure a single compromised path cannot maintain a healthy watchdog illusion.

It can, if its clock and safety paths are demonstrably isolated from the main timebase and regulators they supervise. Review the safety manual for independence claims and coupling analysis. Where doubt remains, add an external window watchdog to provide a second, separately powered timing domain.

Detect stall quickly using a reference or window comparator and promote to the most conservative policy. Prefer hold-off when the timebase trust is lost, with optional degrade for limited diagnosis. Redundant sources and stall thresholds should be validated across temperature and voltage corners with logs retained.

Use a unified codebook and define edge-versus-level semantics. Time-align PG, DIAG, and reset causes with a common timestamp base, and filter glitches at the reset-tree fan-out. Provide short, machine-readable records that link to raw logs so root-cause analysis is fast, repeatable, and reviewable.

Reset polarity reversals, shorter t_pw(min), or different WDI sampling edges often break compatibility. Power-up order mismatches can also create false resets or empty feeds. Always run a reset-tree passthrough test at endpoints and update the BOM notes and validation plan before approving any substitution.

State window parameters with jitter and latency, reset pulse width and polarity, diagnostics export capability, temperature grade, safety level, and second-source policy. Keep wording identical between the visible note and any JSON exports so audits, sourcing portals, and PLM workflows remain perfectly synchronized.