Hello Alexander,
the micro should receive an interrupt from an external independent watchdog (like a monoflop), if it can't restart the watchdog before the timeout is reached. Thus the micro must run a restart software routine triggered by an internal timer. Sometimes there is a second watchdog which resets the micro if the interrupt did not start the routine.
Enjoy the day