Index: firmware/App/Controllers/DialOutFlow.c
===================================================================
diff -u -r1a685471524555a374854c0c9ec8e208e71fe2df -r933a18d740285e70be9d00696ed0f5a5381bc8e4
--- firmware/App/Controllers/DialOutFlow.c	(.../DialOutFlow.c)	(revision 1a685471524555a374854c0c9ec8e208e71fe2df)
+++ firmware/App/Controllers/DialOutFlow.c	(.../DialOutFlow.c)	(revision 933a18d740285e70be9d00696ed0f5a5381bc8e4)
@@ -25,6 +25,7 @@
 #include "InternalADC.h"
 #include "OperationModes.h"
 #include "PIControllers.h"
+#include "SafetyShutdown.h"
 #include "SystemCommMessages.h"
 #include "TaskGeneral.h"
 #include "TaskPriority.h"
@@ -56,7 +57,10 @@
 
 #define DOP_HOME_RATE                           100             ///< target pump speed (in estimate mL/min) for homing.
 #define DOP_HOME_TIMEOUT_MS                     10000           ///< maximum time allowed for homing to complete (in ms).
-#define DOP_SPEED_CALC_INTERVAL                 ( MS_PER_SECOND / TASK_PRIORITY_INTERVAL )  ///< interval (ms/task time) at which the dialysate outlet pump speed is calculated.
+/// interval (ms/task time) at which the blood pump speed is calculated (every 40 ms).
+#define DOP_SPEED_CALC_INTERVAL                 ( 40 / TASK_PRIORITY_INTERVAL )
+/// number of hall sensor counts kept in buffer to hold last 1 second of count data.
+#define DOP_SPEED_CALC_BUFFER__LEN              ( 1000 / DOP_SPEED_CALC_INTERVAL / TASK_PRIORITY_INTERVAL )
 #define DOP_HALL_EDGE_COUNTS_PER_REV            48              ///< number of hall sensor edge counts per motor revolution.
 
 #define DOP_MAX_MOTOR_SPEED_WHILE_OFF_RPM       100.0           ///< maximum motor speed (RPM) while motor is commanded off.
@@ -149,7 +153,8 @@
 static BOOL dopStopAtHomePosition = FALSE;                                                  ///< stop dialysate outlet pump at next home position
 static U32 dopHomeStartTime = 0;                                                            ///< when did dialysate outlet pump home command begin? (in ms)
 
-static U16 dopLastMotorHallSensorCount = 0;                                                 ///< last hall sensor count for the dialysate outlet pump motor
+static U16 dopLastMotorHallSensorCounts[ DOP_SPEED_CALC_BUFFER__LEN ];                      ///< last hall sensor count for the blood pump motor
+static U32 dopMotorSpeedCalcIdx = 0;                                                        ///< index into 1 second buffer of motor speed hall sensor counts
 static U32 dopMotorSpeedCalcTimerCtr = 0;                                                   ///< counter determines interval for calculating dialysate outlet pump motor speed from hall sensor count.
 
 static U32 errorDialOutMotorOffPersistTimerCtr = 0;                                         ///< persistence timer counter for motor off check error condition.
@@ -160,9 +165,6 @@
 static DIAL_OUT_PUMP_SELF_TEST_STATE_T dialOutPumpSelfTestState = DIAL_OUT_PUMP_SELF_TEST_STATE_START;  ///< Current state of the dialysate outlet pump self-test state machine.
 static U32 dialOutPumpSelfTestTimerCount = 0;                                               ///< Timer counter for time reference during self-test.
 
-// Broadcasting record
-DIAL_OUT_FLOW_DATA_T dialOutBroadCastVariables;                                             ///< Record containing latest dialysate outlet data for broadcasting.
-
 // ********** private function prototypes **********
 
 static DIAL_OUT_PUMP_STATE_T handleDialOutPumpOffState( void );
@@ -196,26 +198,22 @@
 {
     U32 i;
 
-    dopLastMotorHallSensorCount = getFPGADialOutPumpHallSensorCount();
-
     stopDialOutPump();
     setDialOutPumpDirection( MOTOR_DIR_FORWARD );
 
+    // zero motor hall sensors counts buffer
+    dopMotorSpeedCalcIdx = 0;
+    for ( i = 0; i < DOP_SPEED_CALC_BUFFER__LEN; i++ )
+    {
+        dopLastMotorHallSensorCounts[ i ] = 0;
+    }
+
     // initialize load cell weights
     for ( i = 0; i < NUM_OF_LOAD_CELLS; i++ )
     {
         loadCellWeightInGrams[ i ].data = 0.0;
     }
 
-    // initialize broadcast data
-    dialOutBroadCastVariables.refUFVolMl = 0.0;
-    dialOutBroadCastVariables.measUFVolMl = 0.0;
-    dialOutBroadCastVariables.measRotSpdRPM = 0.0;
-    dialOutBroadCastVariables.measSpdRPM = 0.0;
-    dialOutBroadCastVariables.measMCSpdRPM = 0.0;
-    dialOutBroadCastVariables.measMCCurrmA = 0.0;
-    dialOutBroadCastVariables.setPWMpct = 0.0;
-
     // initialize dialysate outlet flow PI controller
     initializePIController( PI_CONTROLLER_ID_ULTRAFILTRATION, MIN_DIAL_OUT_PUMP_PWM_DUTY_CYCLE,
                             DOP_P_COEFFICIENT, DOP_I_COEFFICIENT,
@@ -722,6 +720,8 @@
     // publish dialysate outlet pump and UF volume data on interval
     if ( ++dialOutFlowDataPublicationTimerCounter >= getPublishDialOutDataInterval() )
     {
+        DIAL_OUT_FLOW_DATA_T dialOutBroadCastVariables;
+
         dialOutBroadCastVariables.refUFVolMl = getTotalTargetDialOutUFVolumeInMl();
         dialOutBroadCastVariables.measUFVolMl = getTotalMeasuredUFVolumeInMl();
         dialOutBroadCastVariables.measRotSpdRPM = getMeasuredDialOutPumpRotorSpeed();
@@ -749,7 +749,10 @@
     if ( ++dopMotorSpeedCalcTimerCtr >= DOP_SPEED_CALC_INTERVAL )
     {
         U16 dopMotorHallSensorCount = getFPGADialOutPumpHallSensorCount();
-        U16 incDelta = ( dopMotorHallSensorCount >= dopLastMotorHallSensorCount ? dopMotorHallSensorCount - dopLastMotorHallSensorCount : ( HEX_64_K - dopLastMotorHallSensorCount ) + dopMotorHallSensorCount );
+        U32 nextIdx = INC_WRAP( dopMotorSpeedCalcIdx, 0, DOP_SPEED_CALC_BUFFER__LEN - 1 );
+        U16 incDelta = ( dopMotorHallSensorCount >= dopLastMotorHallSensorCounts[ nextIdx ] ? \
+                         dopMotorHallSensorCount - dopLastMotorHallSensorCounts[ nextIdx ] : \
+                       ( HEX_64_K - dopLastMotorHallSensorCounts[ nextIdx ] ) + dopMotorHallSensorCount );
         U16 decDelta = HEX_64_K - incDelta;
         U16 delta;
 
@@ -766,7 +769,8 @@
         }
 
         // update last count for next time
-        dopLastMotorHallSensorCount = dopMotorHallSensorCount;
+        dopLastMotorHallSensorCounts[ nextIdx ] = dopMotorHallSensorCount;
+        dopMotorSpeedCalcIdx = nextIdx;
         dopMotorSpeedCalcTimerCtr = 0;
     }
 }
@@ -870,6 +874,7 @@
             {
 #ifndef DISABLE_PUMP_SPEED_CHECKS
                 SET_ALARM_WITH_1_F32_DATA( ALARM_ID_DIAL_OUT_PUMP_OFF_CHECK, measMotorSpeed );
+                activateSafetyShutdown();
 #endif
             }
         }
@@ -1245,26 +1250,6 @@
 
 /*********************************************************************//**
  * @brief
- * The testResetTargetDialOutFlowRateOverride function resets the override of the
- * target dialysate outlet flow rate.
- * @details Inputs: none
- * @details Outputs: pump stopped
- * @return TRUE if override reset successful, FALSE if not
- *************************************************************************/
-BOOL testResetTargetDialOutFlowRateOverride( void )
-{
-    BOOL result = FALSE;
-
-    if ( TRUE == isTestingActivated() )
-    {
-        result = setDialOutPumpTargetRate( 0, dialOutPumpDirection, dialOutPumpControlMode );
-    }
-
-    return result;
-}
-
-/*********************************************************************//**
- * @brief
  * The testSetDialOutUFRefVolumeOverride function overrides the target
  * dialout vol rate.
  * @details Inputs: referenceUFVolumeInMl