The watcher's job is to kill the driver if it is non-responcive. There are other similar tricks and we could use two or more of them if we were very concerned about keeping the system up. Another problem even more likely is a coding error in the real-time driver that causes it to fail under some condition. It this case any restart, hardware or software, will not work if the condition recures. I've seen quite a few fault tolerent systems.
Examples come mostly from the military.
I also know what it costs to design these things. We can't do it.