Does Arduino have a Dead Man switch?

What about interrupt with infinite loop?

You could always drop into an infinite loop to stop an Arduino in its tracks.

More often, watchdog timers are used to reboot an Arduino in case the sketch stops running for a certain length of time.

But perhaps the safest and easiest depending on the application is to have a mechanical "dead-man's" that cuts power to the board entirely, e.g. a series power switch.

- Gough

As suggested, a dead man switch would mean powering the Arduino via a non-latching switch.

As for a code sequence, then perhaps put it into a sleep state with no wake option or alternatively connect the power through a relay which is energised by a GPIO pin.

Another option might be to not use the Arduino loop() function.

You can then break out of the infinite loop requiring a restart.

Optimizing Arduino Code: no setup(), no loop()
https://www.youtube.com/watch?v=-XPrSScamXc&t=189s

An ESTOP switch is a fail safe electro-mechanical device to provide fail-safe whether a machine is operating or not.

A deadman switch is used when a machine is in operation to ensure the operator is in control.  

In either case, a fail-safe solution is usually both hardware and software, often multiple layers of redundancy are used to reduce the chance that a fail-safe would fail to protect.  For example, an ESTOP/deadman  would implement an immediate stop in software (regen the motor in current limit), and remove power on a brake coil to cause the brake to set on a motor shaft. 

If safety is a true concern, kill the Arduino power, and have an external means to release stored energy in the mechanical device and ensure safety, based on the risk.  

I wonder if there’s a watchdog type power switch module? Ie, a module that shuts off after 1 second unless the timer is reset via a digital pin. Then in the Arduino code loop it has to pulse a digital pin or else the power gets cut.

Watchdog circuits are the most common way to respond to serious system failure or software issues but there are a bunch of similar but subtly different concepts to clarify before a full answer...

• Fail-safe design is a design discipline that ensures that if a system fails, it fails in a safe manner
• Design for reliability is not the same - it tries to ensure the system doesn't fail.
• Fault tolerant design tries to ensure the system keeps running even if there are faults.
• Distributed systems try to ensure no single failure causes the whole system to fail.
• Limp home design tries to make sure mission critical parts of the system keep running at all costs.
• A deadman switch ensures the system stops in the event something dies - not necessarily a safe stop.
• A watchdog generally resets the system if a hearbeat stops - it may or may not stop bad behavior.
• Going into an infinite loop may stop further execution but may leave the system and I/O in a dangerous state.
• Error handlers are often preferred to watchdog crowbars and infinite loops, but they assume there is enough remaining functionality to handle the errors.
• Big brother supervisor MCUs can be used to monitor systems, but what happens it they fail?

External watchdog circuits can cycle power or simply turn power off.

On boot (potentially from a watchdog reset) many MCUs can test if there was a failure and decide what to do about it.

Many modern internal watchdog circuits don't always reset everything.

Likewise a hardware reset doesn't always reset everything.

Back in the days of microcode, some computers had the possibility of going into an infinite loop that could not be stopped by a full hardware reset. We called these sunset loops. You had to kill power to stop a sunset loop.

I guess there are a lot of options to deal with various failures. What type of failure does this deadman switch need to deal with and what would you like the deadman switch to do if triggered?

I recently faced a similar issue with the Arduino Nano 33 IoT. The Arduino Nano 33 IoT uses the 32-bit SAMD21 Arm Cortex-M0 processor so the solution would not work for all Arduino models.

I had to activate the SAM D21 Watchdog Timer (WDT) to reset the board when 16 seconds passed without the main loop executing.

More in the following comment: Simple Remote Air Quality Monitor Project Tutorial - comment  

I suppose you could combine WDT with reset cause to achieve this.

Lets say your program begins by determining reset cause first - if it was WDT, then hang the program in a loop feeding the WDT. If the cause was anything else (e.g. cold boot, brownout), then continue execution.

- Gough

While researching the reset pin I stumbled across sleep_mode();

For idle (slight reduction in power): SLEEP_MODE_IDLE
For standby (more reduction in power): SLEEP_MODE_STANDBY
For power-down (most reduction in power): SLEEP_MODE_PWR_DOWN

In developing a model railroad Arduino animation project from theoretical to physical, I discovered a scenario, that in theory should not happen. Well add human interaction to the mix and anything can happen. In my case two relays start to chatter by oscillating back and forth. My deadman switch idea is to stop this scenario and force the operator to reset the layout.

There are some great suggestion provided. Responses sometime contain a solution but if it they don't the ideas provided create paths I never thought about. I long for the days when I worked with a crew of people each with different experience diversity and level. Coffee breaks where we just sat and chatted was a wonderful melting pot of ideas.

Are there any downsides to sleep_mode? I'm hoping to take it to the lab this afternoon and do some testing. I still am not confident I have the ideal solution.