How do you choose the watchdog timeout, and what goes wrong at the extremes?

You size the timeout to your worst-case healthy loop time plus a safety margin, the longest legitimate interval between kicks under normal operation, including any slow-but-valid operations like a flash erase/write, a burst of computation, or a blocking peripheral transaction. Too short, and those legitimate long operations don't get a kick in time, so the watchdog fires spuriously and the device keeps resetting itself mid-work, a self-inflicted denial of service. Too long, and a genuinely hung device stays wedged for that whole period before recovering, hurting availability and possibly safety. So it's a balance between false positives (resets during valid slow paths) and slow recovery. The practical approach: measure or bound the worst-case time around your kick point, set the timeout comfortably above it, and if a legitimately long operation exceeds the timeout, restructure so the watchdog is still kicked during it (or temporarily use a longer-timeout strategy) rather than just inflating the timeout for everyone. And always log watchdog resets so spurious ones surface.