Index: firmware/App/Drivers/SafetyShutdown.c =================================================================== diff -u -r30f049651877229042e3f8700c8596e5b9a1e0f4 -r8e50cc04fb92d9b4ee9045e445ca8451abe951ab --- firmware/App/Drivers/SafetyShutdown.c (.../SafetyShutdown.c) (revision 30f049651877229042e3f8700c8596e5b9a1e0f4) +++ firmware/App/Drivers/SafetyShutdown.c (.../SafetyShutdown.c) (revision 8e50cc04fb92d9b4ee9045e445ca8451abe951ab) @@ -17,9 +17,12 @@ #include #include "gio.h" - + +#include "FPGA.h" +#include "InternalADC.h" #include "SystemCommMessages.h" -#include "SafetyShutdown.h" +#include "SafetyShutdown.h" +#include "Timers.h" /** * @addtogroup SafetyShutdown @@ -29,16 +32,38 @@ // ********** private definitions ********** // GIO port A pin assignments for pins connected to CPLD -#define SAFETY_GIO_PORT_PIN 3U +#define SAFETY_GIO_PORT_PIN 3U // CPLD pin I/O macros -#define SET_SAFETY_SHUTDOWN() gioSetBit( gioPORTB, SAFETY_GIO_PORT_PIN, PIN_SIGNAL_HIGH ) -#define CLR_SAFETY_SHUTDOWN() gioSetBit( gioPORTB, SAFETY_GIO_PORT_PIN, PIN_SIGNAL_LOW ) +#define SET_SAFETY_SHUTDOWN() gioSetBit( gioPORTB, SAFETY_GIO_PORT_PIN, PIN_SIGNAL_HIGH ) +#define CLR_SAFETY_SHUTDOWN() gioSetBit( gioPORTB, SAFETY_GIO_PORT_PIN, PIN_SIGNAL_LOW ) + +#define SAFETY_SHUTDOWN_POST_TIMEOUT_MS 500 ///< Safety shutdown POST test timeout (in ms). +#define SAFETY_SHUTDOWN_RECOVERY_TIME_MS 500 ///< After safety shutdown POST test, wait this long (in ms) to recover before moving on. + +#define MAX_24V_LEVEL_ON_SAFETY_SHUTDOWN 5.0 ///< Maximum voltage on 24V line when safety shutdown asserted. +#define MIN_24V_LEVEL_ON_SAFETY_RECOVER 22.6 ///< Minimum voltage on 24V line when safety shutdown is recovered. +#define MIN_BACKUP_ALARM_CURRENT_MA 200.0 ///< Minimum backup alarm audio current (in mA) detected when safety shutdown asserted. +#define MAX_BACKUP_ALARM_CURRENT_MA 10.0 ///< Maximum backup alarm audio current (in mA) detected when safety shutdown is recovered. + +/// Enumeration of safety shutdown self-test states. +typedef enum Safety_Shutdown_Self_Test_States +{ + SAFETY_SHUTDOWN_SELF_TEST_STATE_START = 0, ///< Safety shutdown self-test start state + SAFETY_SHUTDOWN_SELF_TEST_STATE_IN_PROGRESS, ///< Safety shutdown self-test in progress state + SAFETY_SHUTDOWN_SELF_TEST_STATE_RECOVER, ///< Safety shutdown self-test recovery state + SAFETY_SHUTDOWN_SELF_TEST_STATE_COMPLETE, ///< Safety shutdown self-test completed state + NUM_OF_SAFETY_SHUTDOWN_SELF_TEST_STATES ///< Number of safety shutdown self-test states +} SAFETY_SHUTDOWN_SELF_TEST_STATE_T; -// ********** private definitions ********** +// ********** private data ********** -static BOOL safetyShutdownActivated = FALSE; ///< Status of safety shutdown signal. -static BOOL safetyShutdownOverrideResetState = FALSE; ///< Natural status of safety shutdown signal. Used to restore state on override reset. +static BOOL safetyShutdownActivated; ///< Status of safety shutdown signal. +static BOOL safetyShutdownOverrideResetState; ///< Natural status of safety shutdown signal. Used to restore state on override reset. +/// Current safety shutdown self-test state. +static SAFETY_SHUTDOWN_SELF_TEST_STATE_T safetyShutdownSelfTestState; +static SELF_TEST_STATUS_T safetyShutdownSelfTestStatus; ///< Safety shutdown self-test preliminary status. +static U32 safetyShutdownSelfTestTimerCount; ///< Safety shutdown self-test state timer counter. /*********************************************************************//** * @brief @@ -48,8 +73,13 @@ * @return none *************************************************************************/ void initSafetyShutdown( void ) -{ - CLR_SAFETY_SHUTDOWN(); +{ + safetyShutdownActivated = FALSE; + safetyShutdownOverrideResetState = FALSE; + safetyShutdownSelfTestState = SAFETY_SHUTDOWN_SELF_TEST_STATE_START; + safetyShutdownSelfTestStatus = SELF_TEST_STATUS_IN_PROGRESS; + safetyShutdownSelfTestTimerCount = 0; + CLR_SAFETY_SHUTDOWN(); } /*********************************************************************//** @@ -78,6 +108,94 @@ return safetyShutdownActivated; } +/*********************************************************************//** + * @brief + * The execSafetyShutdownTest function executes the safety shutdown test. + * This function should be called periodically until a pass or fail + * result is returned. + * @details Inputs: safetyShutdownSelfTestState + * @details Outputs: safetyShutdownSelfTestState + * @return in progress, passed, or failed + *************************************************************************/ +SELF_TEST_STATUS_T execSafetyShutdownTest( void ) +{ + SELF_TEST_STATUS_T result = SELF_TEST_STATUS_IN_PROGRESS; + + switch ( safetyShutdownSelfTestState ) + { + case SAFETY_SHUTDOWN_SELF_TEST_STATE_START: + safetyShutdownSelfTestState = SAFETY_SHUTDOWN_SELF_TEST_STATE_IN_PROGRESS; + safetyShutdownSelfTestTimerCount = getMSTimerCount(); + activateSafetyShutdown(); + break; + + case SAFETY_SHUTDOWN_SELF_TEST_STATE_IN_PROGRESS: + if ( TRUE == didTimeout( safetyShutdownSelfTestTimerCount, SAFETY_SHUTDOWN_POST_TIMEOUT_MS ) ) + { + F32 v24 = getIntADCVoltageConverted( INT_ADC_24V_ACTUATORS ); + F32 audioCurrent = getFPGABackupAlarmAudioCurrent(); + + // Verify 24V is down when w.d. expired + if ( v24 > MAX_24V_LEVEL_ON_SAFETY_SHUTDOWN ) + { + SET_ALARM_WITH_2_F32_DATA( ALARM_ID_HD_SAFETY_SHUTDOWN_POST_TEST_FAILED, 1.0, v24 ); + safetyShutdownSelfTestStatus = SELF_TEST_STATUS_FAILED; + } + // Verify backup alarm audio is on when w.d. expired + else if ( audioCurrent < MIN_BACKUP_ALARM_CURRENT_MA ) + { + SET_ALARM_WITH_2_F32_DATA( ALARM_ID_HD_SAFETY_SHUTDOWN_POST_TEST_FAILED, 2.0, audioCurrent ); + safetyShutdownSelfTestStatus = SELF_TEST_STATUS_FAILED; + } + safetyShutdownSelfTestTimerCount = getMSTimerCount(); + CLR_SAFETY_SHUTDOWN(); + safetyShutdownActivated = FALSE; + safetyShutdownSelfTestState = SAFETY_SHUTDOWN_SELF_TEST_STATE_RECOVER; + } + break; + + case SAFETY_SHUTDOWN_SELF_TEST_STATE_RECOVER: + if ( TRUE == didTimeout( safetyShutdownSelfTestTimerCount, SAFETY_SHUTDOWN_RECOVERY_TIME_MS ) ) + { + F32 v24 = getIntADCVoltageConverted( INT_ADC_24V_ACTUATORS ); + F32 audioCurrent = getFPGABackupAlarmAudioCurrent(); + + // Verify 24V is down when w.d. recovered + if ( v24 < MIN_24V_LEVEL_ON_SAFETY_RECOVER ) + { + SET_ALARM_WITH_2_F32_DATA( ALARM_ID_HD_SAFETY_SHUTDOWN_POST_TEST_FAILED, 3.0, v24 ); + safetyShutdownSelfTestStatus = SELF_TEST_STATUS_FAILED; + } + // Verify backup alarm audio is on when w.d. recovered + else if ( audioCurrent > MAX_BACKUP_ALARM_CURRENT_MA ) + { + SET_ALARM_WITH_2_F32_DATA( ALARM_ID_HD_SAFETY_SHUTDOWN_POST_TEST_FAILED, 4.0, audioCurrent ); + safetyShutdownSelfTestStatus = SELF_TEST_STATUS_FAILED; + } + else + { + safetyShutdownSelfTestStatus = SELF_TEST_STATUS_PASSED; + } + safetyShutdownSelfTestState = SAFETY_SHUTDOWN_SELF_TEST_STATE_COMPLETE; + result = safetyShutdownSelfTestStatus; + } + break; + + case SAFETY_SHUTDOWN_SELF_TEST_STATE_COMPLETE: + // If we get called in this state, assume we are doing self-test again + result = SELF_TEST_STATUS_IN_PROGRESS; + safetyShutdownSelfTestState = SAFETY_SHUTDOWN_SELF_TEST_STATE_START; + break; + + default: + result = SELF_TEST_STATUS_FAILED; + SET_ALARM_WITH_2_U32_DATA( ALARM_ID_HD_SOFTWARE_FAULT, SW_FAULT_ID_SAFETY_SHUTDOWN_INVALID_SELF_TEST_STATE, safetyShutdownSelfTestState ) + break; + } + + return result; +} + /*********************************************************************//** * @brief * The testSetSafetyShutdownOverride function overrides the HD safety