Does Arduino have a Dead Man switch?

Watchdog circuits are the most common way to respond to serious system failure or software issues but there are a bunch of similar but subtly different concepts to clarify before a full answer...

• Fail-safe design is a design discipline that ensures that if a system fails, it fails in a safe manner
• Design for reliability is not the same - it tries to ensure the system doesn't fail.
• Fault tolerant design tries to ensure the system keeps running even if there are faults.
• Distributed systems try to ensure no single failure causes the whole system to fail.
• Limp home design tries to make sure mission critical parts of the system keep running at all costs.
• A deadman switch ensures the system stops in the event something dies - not necessarily a safe stop.
• A watchdog generally resets the system if a hearbeat stops - it may or may not stop bad behavior.
• Going into an infinite loop may stop further execution but may leave the system and I/O in a dangerous state.
• Error handlers are often preferred to watchdog crowbars and infinite loops, but they assume there is enough remaining functionality to handle the errors.
• Big brother supervisor MCUs can be used to monitor systems, but what happens it they fail?

External watchdog circuits can cycle power or simply turn power off.

On boot (potentially from a watchdog reset) many MCUs can test if there was a failure and decide what to do about it.

Many modern internal watchdog circuits don't always reset everything.

Likewise a hardware reset doesn't always reset everything.

Back in the days of microcode, some computers had the possibility of going into an infinite loop that could not be stopped by a full hardware reset. We called these sunset loops. You had to kill power to stop a sunset loop.

I guess there are a lot of options to deal with various failures. What type of failure does this deadman switch need to deal with and what would you like the deadman switch to do if triggered?

Watchdog circuits are the most common way to respond to serious system failure or software issues but there are a bunch of similar but subtly different concepts to clarify before a full answer...

• Fail-safe design is a design discipline that ensures that if a system fails, it fails in a safe manner
• Design for reliability is not the same - it tries to ensure the system doesn't fail.
• Fault tolerant design tries to ensure the system keeps running even if there are faults.
• Distributed systems try to ensure no single failure causes the whole system to fail.
• Limp home design tries to make sure mission critical parts of the system keep running at all costs.
• A deadman switch ensures the system stops in the event something dies - not necessarily a safe stop.
• A watchdog generally resets the system if a hearbeat stops - it may or may not stop bad behavior.
• Going into an infinite loop may stop further execution but may leave the system and I/O in a dangerous state.
• Error handlers are often preferred to watchdog crowbars and infinite loops, but they assume there is enough remaining functionality to handle the errors.
• Big brother supervisor MCUs can be used to monitor systems, but what happens it they fail?

External watchdog circuits can cycle power or simply turn power off.

On boot (potentially from a watchdog reset) many MCUs can test if there was a failure and decide what to do about it.

Many modern internal watchdog circuits don't always reset everything.

Likewise a hardware reset doesn't always reset everything.

Back in the days of microcode, some computers had the possibility of going into an infinite loop that could not be stopped by a full hardware reset. We called these sunset loops. You had to kill power to stop a sunset loop.

I guess there are a lot of options to deal with various failures. What type of failure does this deadman switch need to deal with and what would you like the deadman switch to do if triggered?