Safe Async Boilerplate with WDT reset

[MrTinkerman]

So, lately I've been diving into async.

My goal is to use async but also to have code that recovers from unexpected errors by resetting using the WDT.
With the help of chatgpt I conconted this code. But chatgpt is well... chatgpt.

Chatgpt says it's all fine and dandy but I'm curious about some real human/programmers/expert feedback.

So if you have any feedback, please post it.

Thanks

'''
==================================================
SAFE ASYNC BOILERPLATE

FUNCTION GUARD	: Soft reset of functions using a function_guard that starts and restarts coroutines
SET BEATS		: Error prone functions set a beat when running fine
SUPERVISOR		: Checks if any last_beat exceeds beat_timeout, if so: trigger watchdog

 ==================================================
'''

from machine import WDT
from time import ticks_ms as tms 
from time import ticks_diff as tdiff
from uasyncio import sleep_ms as asms
import uasyncio as asc


# WATCHDOG
wdt_timeout = 5000
wdt = WDT(timeout=wdt_timeout)

# GLOBAL OBJECTS
class GO:														# Global objects class
    def __init__(self):
        self.beats 	  	  = {}									# Last 'alive' timestamps for function
        self.beat_timeout = 2000								# Max value for last alive beats, if exceeded reset
        #self.lock        = asc.Lock()							# Future use (?)
go = GO()


# SET BEATS
def set_beat(name):												# functions should set a beat within beat_timeout (ms)								
    go.beats[name] = tms()										# Store funtion name and last beat


# FUNCTION GUARD
async def function_guard(coro):									# Runs a coroutine forever, restarts it if it crashes									
    while True:
        try: await coro()										# Waits until a possible exception occurs
        except: pass
        await asms(100)											# Wait n ms and restart coroutine


# SUPERVISOR
async def supervisor():											# Check if any beat exceeds go.beat_timeout
    while True:
        now = tms()												# Current timestamp
        system_ok = True										# Start by assuming system is ok
        for name, last_beat in go.beats.items():
            if tdiff(now, last_beat) > go.beat_timeout:  		# If  last beat exceeds beat_timeout
                system_ok = False
                break
        if system_ok: wdt.feed()								# Feed WDT only if all beats < go.beat_timeout
        else: await asms(int(wdt_timeout * 1.1)) 				# Let watchdog timeout 10% over timeout to reset board
        await asms(500)


# ========================================================
# CODE/FUNCTIONS TO RUN

# FUNCTION 1
async def func_1():
    
    while True:
        set_beat("f1")
        await asms(1000)
        
        
# FUNCTION 2
async def func_2():
    
    while True:
        set_beat("f2")
        await asms(1000)

# ========================================================


# MAIN LOOP
async def main():
    
    asc.create_task(supervisor())
    
    asc.create_task(function_guard(func_1))
    asc.create_task(function_guard(func_2))
    
    while True:
        set_beat("main")
        await asms(1000)
        

# INIT
try: asc.run(main())
finally: asc.new_event_loop()

[Josverl]

I don't think your friend chat has actually read "Peter async Hinch's" excellent documentation and tips .

I suggest you do:
https://github.com/peterhinch/micropython-async/blob/master/v3/docs/TUTORIAL.md#7-hints-and-tips

[peterhinch]

To add to the above :)
The point of a WDT is to force a reset in the event of a program crash. To use it, all you need is to run a task:

async def wdt_feed():
    while True:
        wdt.feed()
        await asyncio.sleep(1)

If the program crashes or stops running then the WDT will time out and hard-reset the host.

If you want to run checks on the running code you can do this in standard asyncio code. If you conclude that the code has effectively failed beyond repair, you can force a reset in several ways: issue an unhandled exception, call sys.exit, call machine.reset or cancel wdt_feed.

[MrTinkerman]

Ok, thanks, asyncio is quite something to get into.

The reason I would like an extra safeguard structure is that I have some background tasks that sometimes fail silently. If such a task fails, a single "async def wdt_feed()" would just keep running happily and feed the WDT. Until I have that figured out I would like to have a broad safeguarding system.

Yeah, you might say it's like tearing out the kitchen because the sink leaks but I don't have my async plumbing license yet.
So the code I posted might seem like overkill but would it work as an overall safeguard system?

Thanks

[peterhinch]

If I had a task that "sometimes fails silently" I'd want to know the reason. For example, it might fail to get a response from a particular hardware interface. In this case you'd devise a means of detecting this (e.g. using asyncio.wait_for to implement a timeout). Having detected the fault, if it can't be fixed, issue sys.exit and let the WDT do its job.

Simply accepting that something sometimes fails silently without determining the reason sounds like a very unsatisfactory approach.

asyncio is quite something to get into.

There is a learning curve but tackling it is very worthwhile. In my experience the majority of professional firmware uses cooperative scheduling.