Libraries
Library watchdog
To use this library in your code:
import ec618.watchdogThe EC618 watchdog.
The watchdog resets the device if the application stops feeding it. Use it to recover automatically from a hang: arm it with watchdog-start, then call watchdog-feed regularly from the code path you want to keep alive. If the timeout passes without a feed, the device resets.
There is a single watchdog, so these are top-level functions rather than objects: arming it twice without stopping in between just updates the deadline.
How it works (and why it is a software watchdog)
Neither of the EC618's hardware watchdogs can guard the application: the WDT module's clock is gated whenever the chip idles (it counts only CPU-active time), and the always-on (AON) watchdog belongs to the platform — the modem core auto-feeds it. So the timeout is enforced by a small high-priority RTOS task, independent of the Toit scheduler: it survives a wedged VM and its timed waits wake the chip from light sleep, so the timeout is honored in wall-clock time — idle, sleeping, or busy.
The task also keeps the WDT module armed as a hardware backstop: a hang so hard that even the watchdog task is starved (an interrupt-off spin, an interrupt storm) accumulates CPU-active time on the unfed WDT and triggers a hardware reset within roughly 10-20 s.
A Toit
sleep does not stop the watchdog. If you sleep past the timeout without feeding, the device resets — feed around long waits, or stop the watchdog first. (Deep sleep is different: entering hibernate tears the VM down, and waking from it is a fresh boot.)Timing
The timeout is given in whole seconds, 1 to 60, and is honored in wall-clock time. Detection granularity is a few seconds at most, so feed at an interval comfortably shorter than the timeout.
The reset
A software-watchdog reset prints
[toit] FATAL: watchdog timeout (...) — resetting before resetting, so the cause is visible on the console. On the next boot the reset is reported as a power-on reset (RESET-POWER-ON, via the ec618 library's reset-reason); if you need a durable record that *your* watchdog fired, write your own breadcrumb (for example in flash) before relying on the reset reason.Example
import ec618.watchdog
main:
watchdog.watchdog-start --timeout=(Duration --s=10)
try:
while true:
do-work
watchdog.watchdog-feed
finally:
watchdog.watchdog-stop
Globals
Functions
Feeds the watchdog, restarting its timeout.
Has no effect if the watchdog is not armed.
Arms the watchdog with the given timeout.
The timeout must be between WATCHDOG-MIN-TIMEOUT and WATCHDOG-MAX-TIMEOUT and is rounded down to whole seconds. After this call the device resets unless watchdog-feed is called within the timeout (wall-clock time, including light sleep).
Calling this while armed re-arms with the new timeout.
Stops the watchdog.
After this call the watchdog no longer resets the device. Has no effect if the watchdog is not armed.