Add Watchdog timer and add support for NRF watchdog

[xobs]

This patchset adds a new wdt module based on the WDT class provided by Micropython: http://docs.micropython.org/en/latest/library/machine.WDT.html

Note that on nrf, once the WDT is enabled it can not be disabled or have its duration modified without resetting the device.

[xobs]

Initially I had it enabled for all NRF platforms, however that caused several platforms to overrun their flash. So I have since disabled all platforms except Simmel.

[dhalbert]

Initially I had it enabled for all NRF platforms, however that caused several platforms to overrun their flash. So I have since disabled all platforms except Simmel.

I'm surprised by this, since there is still a lot of unused flash on nRF52480, even with an internal filesystem. What's an example of a platform that overflowed? Maybe you were compiling with optimization off?

[xobs]

Let me re-enable them for all platforms and re-build.

[dhalbert]

@xobs ok, despite some missing builds (which are not boards), we can see that it didn't quite fit in the pca10100 build (by 80 bytes), so that's the (only) one to fix.

[tannewt]

Thanks for adding this! I have some API feedback.

[tannewt]

It'd be awesome to have the result of the watchdog be configurable. For testing, raising an exception rather than restarting would be very helpful. I imagine it's possible that libraries take a while to return to the main code.

[xobs]

I put together a messy patch that implements what you requested. Documentation is unclear, but I wanted to make sure you were okay with the API before documenting everything again.

Example usage:

Simple usage:

wdt = microcontroller.watchdog.WatchDogTimer(5.0)
print("Sleeping for 3 seconds (shouldn't exit)")
time.sleep(3)
wdt.feed()
print("Sleeping for 3 seconds (also shouldn't exit)")
time.sleep(3)
print("Sleeping for 3 seconds without feeding WDT (should exit)")
time.sleep(3)
print("Shouldn't get here")

Using a with block:

import microcontroller

with microcontroller.watchdog.WatchDogTimer(5.0) as wdt:
    print("Sleeping for 3 seconds (shouldn't exit)")
    time.sleep(3)
    wdt.feed()
    print("Sleeping for 3 seconds (also shouldn't exit)")
    time.sleep(3)
    print("Sleeping for 3 seconds without feeding WDT (should exit)")
    time.sleep(3)
    print("Shouldn't get here")

You can also add hardware=True to get the true Hardware watchdog timer.

---

For some reason, I'm unable to actually get this to work. It seems as though there's no way to set an exception in an interrupt routine, and while I'm setting mp_pending_exception this value is not immediately consulted. As a result, "Shouldn't get here" is printed, although time.sleep(3) returns immediately.

It looks like the Python VM only checks for exceptions on loop constructs. Additionally, when it sees an exception it calls nlr_pop(), but because we raised the exception in an interrupt handler there is no context to pop so it crashes.

[tannewt]

I put together a messy patch that implements what you requested. Documentation is unclear, but I wanted to make sure you were okay with the API before documenting everything again.

Totally ok. Feel free to ping me on Discord when you get to your computer in the morning and we can video chat to sync up.

Example usage:

Simple usage:

I'd do:

# By default the watchdog has infinite timeout and raises an exception on timeout.
wdt = microcontroller.watchdog 
# Now we set the timeout is 5 seconds and it will raise an exception. This may need to
# be implemented without the hardware WDT because it may only do real resets.
wdt.timeout = 5 
# This is where we start the real WDT to trigger a reset. Setting action to 
# anything else after will raise an exception (and likely lead to a WDT reset since it isn't fed 
# outside the VM.)
wdt.action = RESET 
print("Sleeping for 3 seconds (shouldn't exit)")
time.sleep(3)
wdt.feed()
print("Sleeping for 3 seconds (also shouldn't exit)")
time.sleep(3)
print("Sleeping for 3 seconds without feeding WDT (should exit)")
time.sleep(3)
print("Shouldn't get here")

With this API, the WatchdogTimer instance already exists. This is helpful because it's state will live across VMs.

Another thing to think about is the watchdog's relationship to safe mode. When off USB we probably want to boot up in normal mode after a watchdog. However, when on USB we may want to boot into safe mode or silently ignore action set to RESET if we started up on USB after a watchdog reset. If we do neither, we risk the user getting into a situation where they can't easily edit code.py due to a reset loop. There is a magic reset press to enter safe mode but most folks probably don't know about it.

Using a with block:

Why support a with block? It seems unhelpful because the nRF WDT can't be disabled.

For some reason, I'm unable to actually get this to work. It seems as though there's no way to set an exception in an interrupt routine, and while I'm setting mp_pending_exception this value is not immediately consulted. As a result, "Shouldn't get here" is printed, although time.sleep(3) returns immediately.

It looks like the Python VM only checks for exceptions on loop constructs. Additionally, when it sees an exception it calls nlr_pop(), but because we raised the exception in an interrupt handler there is no context to pop so it crashes.

You should be able to set the pending exception from an ISR. We won't want to raise from there though. Maybe delay_ms needs to mp_raise the pending_exception? Does it work as is if you use a for loop to delay?

[xobs]

I've implemented the new API. Additionally, it now boots into safe mode if it's connected to USB and is reset due to a watchdog timeout.

I will work to disentangle the watchdog exception stuff from the vm.

[xobs]

This patchset got big. But it was refactored twice. It contains the following features:

• The watchdog is a singleton under microcontroller
• Setting microcontroller.watchdog.mode = watchdog.WatchDogMode.RAISE works
• If watchdog.WatchDogMode.RESET causes a reset, and the board is plugged in to USB, then it enters safe mode
• When the watchdog timer hits, it calls reset_cpu()
• Calling microcontroller.reset() now goes through reset_cpu()
• The number of system ticks is saved in uninitialized memory, so the clock is mostly correct after a reset

Simmel exceeded flash by 500 bytes, so I shrank the filesystem by 4096 bytes.

pca10100 has now exceeded its flash. I could disable watchdog on this platform.

I'm not sure why xtensa failed to build. It looks like a configuration error on the server.

[dhalbert]

To get pca10100 to build (it's overflowing), change the options list in mpconfigboard.mk to this:

CIRCUITPY_AUDIOMP3 = 0
CIRCUITPY_BITBANGIO = 0
CIRCUITPY_BUSIO = 1
CIRCUITPY_COUNTIO = 0
CIRCUITPY_DISPLAYIO = 0
CIRCUITPY_FRAMEBUFFERIO = 0
CIRCUITPY_FREQUENCYIO = 0
CIRCUITPY_I2CSLAVE = 0
CIRCUITPY_NEOPIXEL_WRITE = 0
CIRCUITPY_NVM = 0
CIRCUITPY_PIXELBUF  = 0
CIRCUITPY_RGBMATRIX = 0
CIRCUITPY_ROTARYIO = 0
CIRCUITPY_RTC = 1
CIRCUITPY_TOUCHIO = 0
CIRCUITPY_ULAB = 0

SUPEROPT_GC = 0

This turns off several more modules and disables some extra optimization for GC. An alternative would be to shrink the internal filesystem size.

I would have a made a commit for this, but your fork isn't set to allow external changes via the PR mechanism.

[dhalbert]

By the way, it appears from the nRF52833 errata and datsheet that it does not suffer from the nRF52840 SPIM3 hardware bug. I'm not sure if you're avoiding SPIM3 for simmel or not, but we should not need to allocate the special 8KB SPIM3 RAM buffer on any nRF52833 board and also not include the special case handling of SPIM3.

[xobs]

@dhalbert Thanks for the heads-up! I am indeed disabling SPIM3 because the 8 kB penalty is pretty hefty on this 128 kB part. I'll need to do some special casing to only enable the workaround for NRF52840 parts. I'll do that in a separate patch.

I've made the adjustments you requested, and it's building now.

[xobs]

I discovered an issue where the Bluetooth system couldn't be re-initialzied after the hardware watchdog was set, due to the hardware watchdog timer using IRQ priority 1.

[dhalbert]

@tannewt The only build failures here are ESP32S2; is this fixed now?
@xobs Assuming ESP32S2 failures are a red herring, this just needs a merge from upstream and make translate to work, and then it should be fine.

[tannewt]

A couple minor API suggestions and a request to refactor shared-bindings/common-hal. Thank you so much for doing this! It's looking really good.

[tannewt]

@tannewt The only build failures here are ESP32S2; is this fixed now?

Ya, ESP32S2 should be happy again thanks to Jeff.

@xobs Assuming ESP32S2 failures are a red herring, this just needs a merge from upstream and make translate to work, and then it should be fine.

[xobs]

I've moved most everything into shared-bindings, rebased on current master, and exposed the exception under the watchdog module. Additionally, most checks now are performed inside shared-bindings with the exception of some platform-specific range checks.

[tannewt]

I had a few final tweaks I had hoped to push to the branch but it doesn't look like maintainer edits were allowed. Instead, I've made a PR to this PR's branch: simmel-project#1

[xobs]

Thanks, I merged the PR.

simmel-project is an organization and not a user, and apparently you can't allow maintainer edits if it's an organization: isaacs/github#1681

[tannewt]

Welp, we merged more translations and I can't merge for you. Mind adding me as a contributor to the Simmel repo?

[xobs]

Sure, I added you as a maintainer.

[tannewt]

Looks good! Thank you!