millis() software timeout vs Watchdog Timer for graceful cancellation on AVR Arduino

Direct Answers

millis() cannot abort a blocking library call. It only measures elapsed time between cooperative checkpoints. The Watchdog Timer (WDT) resets the MCU and does not run cleanup code before setup(); RAM state is lost. No documented core pattern exists to cancel an in-progress Wire or Serial transaction mid-operation without vendor-specific functions.

Confirmed Facts

• millis() is non-blocking and rollover-safe when used as (unsigned long)(millis() - start) >= timeout. It detects elapsed time after a call returns or between explicit checks.
• Arduino core provides Serial.setTimeout() for blocking reads and Wire.endTransmission() status codes, but no unified cancellation token or standard mid-transaction abort.
• The standard AVR WDT (wdt_enable(), wdt_reset()) causes a device restart when not serviced. No user code runs between the reset vector and setup().

Likely Explanations (Not Portable Guarantees)

• WDT interrupt mode (WDIE) can set a flag in an ISR on some AVR parts, but this is register-level, device-specific, and not exposed by the Arduino core as a cancellation pattern.
• The portable approach is cooperative cancellation: split long operations into state-machine steps, check a volatile bool cancelFlag and the millis() deadline between library calls, use library-documented timeouts, and re-initialize peripherals only when the bus is idle.

Practical Pattern

volatile bool cancelRequested = false;
unsigned long deadline = 0;
const unsigned long TIMEOUT_MS = 5000;

void startOperation() {
  deadline = millis() + TIMEOUT_MS;
  cancelRequested = false;
  // begin non-blocking or short-blocking step
}

void loop() {
  if (cancelRequested || (unsigned long)(millis() - deadline) >= 0) {
    cancelRequested = true;
    // call library-specific cleanup if available
    // e.g., Serial.end(); Wire.end();
    // re-initialize only after bus idle
    return;
  }
  // perform next cooperative step
}

Verification Steps

1. Record start = millis(), run the blocking call, print (unsigned long)(millis() - start). Output appears only after return → millis() did not abort it.
2. Enable WDT, omit wdt_reset() during a long operation, save MCUSR early in setup(). Confirm WDT reset flag set and no cleanup ran.
3. Check installed core headers for HardwareSerial::setTimeout, TwoWire::setTimeout, Wire.endTransmission() return values; behavior varies by core version.

One Missing Diagnostic

Is the blocking call a core Serial/Wire operation that honors setTimeout() or returns status, or a third-party routine with no cancellation point? The answer determines whether cooperative checks suffice or a hardware-level recovery (bus reset, power cycle) is required.