Electronic – Microcontroller’s watchdog

This is the code I use for an LPC2148:

WDTC = 0x00000FFF; // very short timeout

WDMOD = 0x03; // watchdog resets CPU

WDFEED = 0xAA; // start watchdog

WDFEED = 0x55;

1. More expensive, as you already found out. But it should give you the highest level of reliability: because the watchdog is completely independent of the microcontroller it will still keep running, and reset the microcontroller when the latter is on fire, so to say. See 4)
2. Brian is against it, but there are cheap microcontrollers in a small package, like the PIC10F200 in SOT-23, which you can use as a retriggerable MMV (monostable multivibrator), which the watchdog actually is. If you would consider a 555, a 10F200 is better: no external parts, and more accurate timing (1% accuracy).
3. a 555? Seriously?
4. The internal watchdog will do if the dedicated IC is too expensive. If you're really paranoid you can think of a scenario where some hardware error will lock up the microcontroller and the watchdog with it. I've never known this happen, but I don't know how well you sleep.

Like pjc50 says 6 seconds is a long time. A typical microcontroller will execute tens of millions of instructions in that time, and then a lot can go wrong. Suppose you're controlling some load with PWM, and a low 10 % duty cycle keeps the dissipation low. Microcontroller goes bananas and the output gets stuck at a high level, 100 % duty cycle. The load doesn't like it, and dies. You don't want to wait 6 seconds for that to happen. There should be some part of your code where you pass much more frequenct. A main loop may be as short as 10 ms, then you could set the watchdog's timeout at 100 ms, for instance. If you kick the dog once every 10 ms, then a timeout means that you missed it 10 times! Once, OK, but ten times is disaster, and you have to take action. The load will be switched off after 100 ms instead of 6 seconds, which may be the difference between dead or alive.