Index: firmware/App/Controllers/Buttons.c
===================================================================
diff -u -r8592c629e9e6e212c1325239a21ceb641f9dc1fe -rbe83f01a4d54cbd0d92b68cb95a15dcbb06a9a51
--- firmware/App/Controllers/Buttons.c	(.../Buttons.c)	(revision 8592c629e9e6e212c1325239a21ceb641f9dc1fe)
+++ firmware/App/Controllers/Buttons.c	(.../Buttons.c)	(revision be83f01a4d54cbd0d92b68cb95a15dcbb06a9a51)
@@ -43,6 +43,7 @@
 #define OFF_REQUEST_PULSE_INTVL         50      // ms
 #define STOP_BUTTON_PENDING_TIMEOUT     500     // ms
 #define STUCK_BUTTON_TIMEOUT            1000    // ms
+#define OFF_REQUEST_EXPIRATION_TIME     (1000*60)  // ms (1 minute)
 
 #define USER_CONFIRMED                  1
 #define USER_REJECTED                   0
@@ -51,16 +52,17 @@
 
 DATA_DECL( BUTTON_STATE_T, OffButtonState, dataOffButtonState, BUTTON_STATE_RELEASED, BUTTON_STATE_PRESSED );
 static BUTTON_STATE_T prevOffButtonState = BUTTON_STATE_RELEASED;
+static BOOL offRequestAwaitingUserConfirmation = FALSE;
+static U32 offRequestPendingTimer = 0;
 static BOOL offButtonPressPending = FALSE;
+static U32 offRequestPulseCount = 0;
+static U32 offRequestPulseTimer = 0;
 
 DATA_DECL( BUTTON_STATE_T, StopButtonState, dataStopButtonState, BUTTON_STATE_RELEASED, BUTTON_STATE_PRESSED );
 static BUTTON_STATE_T prevStopButtonState = BUTTON_STATE_RELEASED;
 static BOOL stopButtonPressPending = FALSE;
 static U32  stopButtonPendingTimer = 0;
 
-static U32 offRequestPulseCount = 0;
-static U32 offRequestPulseTimer = 0;
-
 static BUTTON_SELF_TEST_STATE_T buttonSelfTestState = BUTTON_SELF_TEST_STATE_START;
 static U32 buttonSelfTestTimerCount = 0;
 
@@ -82,15 +84,16 @@
 void initButtons( void )
 {
     prevOffButtonState = BUTTON_STATE_RELEASED;
+    offRequestAwaitingUserConfirmation = FALSE;
+    offRequestPendingTimer = 0;
     offButtonPressPending = FALSE;
+    offRequestPulseCount = 0;
+    offRequestPulseTimer = 0;
 
     prevStopButtonState = BUTTON_STATE_RELEASED;
     stopButtonPressPending = FALSE;
     stopButtonPendingTimer = 0;
 
-    offRequestPulseCount = 0;
-    offRequestPulseTimer = 0;
-
     buttonSelfTestState = BUTTON_SELF_TEST_STATE_START;
     buttonSelfTestTimerCount = 0;
 }
@@ -165,35 +168,6 @@
 DATA_GET( BUTTON_STATE_T, getStopButtonState, dataStopButtonState )
 
 /*************************************************************************
- * @brief userConfirmOffButton
- * The userConfirmOffButton function handles user confirmation of the off \n
- * button.  The off request will be initiated here if confirmed or cancelled \n
- * if rejected by user.
- * @details
- * Inputs : current operation mode
- * Outputs : stopButtonPressPending
- * @param response : 1 = confirmed, 0 = rejected
- * @return none
- *************************************************************************/
-void userConfirmOffButton( U08 response )
-{
-    // did user confirm?
-    if ( USER_CONFIRMED == response )
-    {
-        if ( TRUE == isCurrentOpModeOkToTurnOff() )
-        {
-            offButtonPressPending = TRUE;
-            offRequestPulseCount = OFF_REQUEST_PULSE_COUNT;
-            offRequestPulseTimer = 0;
-        }
-    }
-    else // user did not confirm
-    {
-        // for now, don't need to do anything to reject off button press
-    }
-}
-
-/*************************************************************************
  * @brief execStuckButtonTest
  * The execStuckButtonTest function executes the stuck button test. \n
  * This function should be called periodically until a pass or fail \n
@@ -247,6 +221,39 @@
 }
 
 /*************************************************************************
+ * @brief userConfirmOffButton
+ * The userConfirmOffButton function handles user confirmation of the off \n
+ * button.  The off request will be initiated here if confirmed or cancelled \n
+ * if rejected by user.
+ * @details
+ * Inputs : current operation mode
+ * Outputs : stopButtonPressPending
+ * @param response : 1 = confirmed, 0 = rejected
+ * @return none
+ *************************************************************************/
+void userConfirmOffButton( U08 response )
+{
+    // is an off request pending user confirmation?
+    if ( TRUE == offRequestAwaitingUserConfirmation )
+    {
+        // did user confirm?
+        if ( USER_CONFIRMED == response )
+        {
+            if ( TRUE == isCurrentOpModeOkToTurnOff() )
+            {
+                offButtonPressPending = TRUE;
+                offRequestPulseCount = OFF_REQUEST_PULSE_COUNT;
+                offRequestPulseTimer = 0;
+            }
+        }
+        else // user did not confirm
+        {
+            offRequestAwaitingUserConfirmation = FALSE;
+        }
+    }
+}
+
+/*************************************************************************
  * @brief isCurrentOpModeOkToTurnOff
  * The isCurrentOpModeOkToTurnOff function determines whether the system can \n
  * be turned off in current operation mode.
@@ -290,7 +297,9 @@
             if ( TRUE == isCurrentOpModeOkToTurnOff() )
             {
                 // send off button to UI for user confirmation
-                sendOffButtonMsgToUI();
+                sendOffButtonMsgToUI( TRUE );
+                offRequestAwaitingUserConfirmation = TRUE;
+                offRequestPendingTimer = 0;
 #ifdef SIMULATE_UI
                 userConfirmOffButton( USER_CONFIRMED );
 #endif
@@ -299,6 +308,17 @@
         prevOffButtonState = getOffButtonState();
     }
 
+    // if off request has not been confirmed by user before it expires, cancel it
+    if ( TRUE == offRequestAwaitingUserConfirmation )
+    {
+        offRequestPendingTimer += TASK_PRIORITY_INTERVAL;
+        if ( offRequestPendingTimer >= OFF_REQUEST_EXPIRATION_TIME )
+        {
+            offRequestAwaitingUserConfirmation = FALSE;
+            sendOffButtonMsgToUI( FALSE );
+        }
+    }
+
     // if user confirmed off button press, manage off request sequence
     if ( TRUE == offButtonPressPending )
     {