How reliable is the watchdog on the LPC81x series?

If I had a uC choice. This time I don't, LPC is on the prescription.

Microchip has that feature on some of their units (actually, IIRC, it's an option to enable software disabling of the WDT if that makes sense). It's protected from errant writing by the uC so much safer than a RAM or accessible flash register. If you worry about direct flash corruption, the micro can do anything at all if its memory is corrupt (that's why safety-critical applications will do a CRC on the program memory).

Personally, if there is any concern at all about it (and you would know the precise worst-case consequences of failure) I would seriously push for adding a belt-and-suspenders external unit integrated with the BOR. Including the BOR they're less than a dime each. A great add-on to a windowed WDT on the micro.

If it interferes with debugging, well T..F..B, let them put a 0R resistor in there to enable it and make sure they test them in production (should be easy).

A WDT that can be disabled by software is no WDT at all (tm).

--sp

Many way to handle this. I am more concerned about SW bugs. The WDT can be used to reset and when the MCU finds out it has been reset more often than x times a day it can enter a limp mode where the unit keeps operating in an acceptible temporary manner but a service call goes out (all automatic on this one).

I always have eternal POR/BOR. Maybe this time I go sans external WDT because it's a highly configurable system and lots of debug using production units for various markets. Opening it is a chore. This is what makes the 0R jumper not so feasible.

I mean enable, not disable. Debug finished -> blow fuse -> WDT irrevocably enabled from here on.