Can anyone explain a little more about watchdogs, specifically in the circuitry level?
If there is some kind of problem in the chip, how can I guarantee that it will be kept running? It is implemented in a different silicon and later attached to the main chip circuit to avoid temperature problems? Which kind of interface circuit it is commonly used to avoid counting/resetting errors? It is common to implement any kind of redundancy?
The watchdog is just a timer on the same die as the rest of the microcontroller. It's mainly meant to catch software errors, there are no precautions for a malfunction of the watchdog itself. Typically one would reset the watchdog timer in the program's main loop. If for some reason the main loop will no longer be executed the controller will reset.
If you don't trust the microcontroller hardware you can always add an external watchdog IC.
Watch Dog
Like others have mentioned, the watchdog timer is able to catch "odd" errors that cause the program to go into an odd state. The microcontroller is reset and everything acts as if it had just been turned on again. For many applications this is the best solution. A consumer would be annoyed if their TV remote reset itself as they were trying to use it, but a watch dog timer would catch an odd event and reset it. I can assure you the consumer would be much more happier with a random reset then having to remove the batteries and putting back in before it recovers.
There are also situations where you might have no ability to reset the device, such as it being in a sealed container or in some place that you just can't get to it. In these situations it would be much better to just reset instead of having to break into a container or what not.
Safety Critical
It sounds like you are looking for something that is more along the lines of safety critical in which you want a hardware failure to not cause something to go very wrong.
There are processors that are specifically designed for this. In general it is just able to alert you that an error has occurred, this alert can then be used to shut down your systems in a safe manner.
I saw a demo of a chip that did this, I think it was a TI ARM, maybe the TMS570. But anyway, one method of protection is to have 2 parallel processing cores that are offset by half a clock cycle. The results of every operation can then be compared between the two cores. The offset makes it so that it is less likely that an external event would cause both of the cores to make the same exact error.
If the comparison comes out true then you go on with life normally, if it were to be false then what you do would depend on your application. At least in this situation you will be made aware of an error and have full engineering control of how you want to recover from it.
