The panel's heartbeat input and the CAN bus: the controller and the receive loop that answers the link's requests; see iomcu.h for the other files. More...

#include <stdio.h>
#include <string.h>
#include "pico/stdlib.h"
#include "iomcu.h"
#include "can_selftest.h"
#include "iomcu_pins.h"
#include "xl2515.h"

Functions
void	heartbeat_init (void)
	Set the heartbeat's pin up as an output, low.
void	can_start (void)
	Brings up the CAN controller at IOMCU_CAN_BITRATE.
void	can_service (uint32_t now)
	Empties the CAN receive buffers and answers each frame.

Variables
bool	s_beat_level
	The panel's safety line, watched in firmware as well as in hardware.
bool	s_can_up
	Tried at boot, and not fatal if it fails.
uint32_t	s_can_echoes
uint32_t	s_can_overflows
uint32_t	s_last_rx_ms
	When a frame was last taken out of the controller.

Detailed Description

The panel's heartbeat input and the CAN bus: the controller and the receive loop that answers the link's requests; see iomcu.h for the other files.

SPDX-License-Identifier: MIT

Function Documentation

◆ can_service()

void can_service ( uint32_t now )

Empties the CAN receive buffers and answers each frame.

Parameters

now	The pass's clock in ms, stamped on each frame received and passed to the link dispatcher.

◆ can_start()

void can_start ( void )

Brings up the CAN controller at IOMCU_CAN_BITRATE.

A failure is not fatal: it is reported on the USB serial port, and s_can_up stays false.

Variable Documentation

◆ s_beat_level

bool s_beat_level

The panel's safety line, watched in firmware as well as in hardware.

The heartbeat line's level at the last sample; see iomcu_can.c.

No board carries the retriggerable monostable that would gate the output enable in hardware (docs/Safety.md), so this monitor is the whole check. A ringing line, a short to a clock or a floating input next to a switching supply look like edges. heartbeat_mon_t knows the expected period and rejects what cannot be the panel's control task edging every 20ms.

The pin is sampled in the main loop rather than by an interrupt. A pass that turns over faster than HEARTBEAT_MIN_GAP_MS (4ms) cannot miss an edge the monitor would accept. The pass time is not measured: a printf every 3s goes to USB (Universal Serial Bus) stdio, and the supply's UART send blocks while its PIO FIFO is full. An ISR (interrupt service routine) would notice edges faster than the floor, which the monitor rejects anyway.

The panel's safety line, watched in firmware as well as in hardware.

◆ s_can_up

bool s_can_up

Tried at boot, and not fatal if it fails.

The CAN controller, its echoes and its receive overruns; see iomcu_can.c.

The controller either answers on SPI (Serial Peripheral Interface) or it does not, and the datasheet guarantees the mode it wakes in, so this distinguishes "no module fitted" and "SPI miswired" from anything on the CAN (Controller Area Network) bus itself.

The echo responder runs unconditionally. It costs one register read per loop, answers only frames addressed to a page the map does not use, and runs at the lowest priority on the bus, so it stays in every build.

Tried at boot, and not fatal if it fails.

◆ s_last_rx_ms

uint32_t s_last_rx_ms

When a frame was last taken out of the controller.

When a frame was last taken out of the controller; see iomcu_can.c.

can_service() empties both receive buffers every pass, so where this is read it is the age of the last frame on the bus rather than of the last one collected. The flash windows are opened against it: this core answers nothing while it writes, and the two buffers hold 260us of frames. Zero until the first frame, so a board that has heard nothing since boot reads as a quiet bus, which is what it has.