Well, the way I did it was quite simple.

First, I wrote the program for what the PIC had to do. For the timekeeping part it kept a tally of SECONDS in a variable, and every hour it would increment a BYTE in EEPROM. Every 24 HOURS it would reset the EEPROM HOURS counter and increment an EEPROM DAYS counter (which actually was two bytes - a WORD). Now, back in 2003/4, the EEPROM endurance was 100,000 writes... so I calculated that was about eleven years worth of hours, way more than I needed.

Now my calibration was simple... my program loop was calculated to execute every 250mS. I simply set an I/O to toggle a LED at each HOURS write, and I simply compared it against my wrist-watch. First time, I was out by about 50 Seconds... so by adjusting my PAUSE value I eventually got it +/-5 seconds in an hour which was fine. I could have added a PAUSEUS and trimmed it even further, but I couldn't be bothered.

The reasoning was a couple of minutes a day was only 12 hours a year... my program started to blink a 'Service Due' LED, and if the Customer didn't respond, it would shut the equipment down two weeks after that (for Safety reasons of course!). The original device used a 16F84 and a 4MHz Resonator and was as crude as you could get - but it worked a treat!

To RESET (for the next time period), you had to hold one of the I/O's low for 20 seconds, then the LED would turn ON for 1 second only, at which point you had to release the I/O. If you didn't wait long enough, it wouldn't reset, and if you waited too long it wouldn't reset either... simple, but effective if you don't know what to do and prevents tampering.

Now in your case I would have a RESET Button that could be used only ONCE. If the machine shuts-down and they call you, tell them to press the RESET Button which would give them 14 days grace. During that time they have to straighten-out their account with you which will entitle them to a free replacement PCB.