eagletrt / fenice-bms-hv-sw Goto Github PK

Implement CAN communication

Implement a centralized logging framework to log everything on the SD Card

It is possible to implement State Of Charge estimation through current integration and EEPROM storage. Ask @volpx for actual implementation.

The precharge procedure timeouts right after activation. The consecutive precharge cycles behave nominally.

Implement advanced completion system

Inspiration: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/configuration/15mt/fundamentals-15-mt-book/cf-cli-basics.pdf (page 3)

The error subsystem relies on llist to store errors ordered by priority. This is problematic because llist uses dynamic allocations at runtime. With this method an insert operation is O(n) and a removal is O(1) (with the help of an array that stores the index of allocations).

To replace llist it would be adequate to find a solution that is at least as efficient as llist is now. min-heap seems to be a good candidate if paired with list_ref.

While runtime memory allocation is not ideal, it doesn't affect my sleep too much, so this issue is not really an urgent one.

Develop SD card communication

Develop a constant current/constant voltage charging curve in order to maximize the energy delivered in the battery.
Basically we want to maximize at-rest voltage

Calculate an send consumption for the last minute over CAN

Most of the functions does not check the parameters passed to it. It would be great to fix this in order to avoid misuses (and to understand how the porco works <3)

The stack monitor ltc offers the possibibility to check the chip status with some diagnostic calls.
Check with come frequency the status.

Read input from IMD to check status. Might handle it like a feedback bit

This function contains a series of bugs that for whatever reason ( I think the compiler helped) did never occured to you but to me and @cannox227 yes.

1. The following sum error->timestamp + error_timeouts[error->id] - HAL_GetTick() is implicitly casted to integer and then back to uint32_t in the assignment (very dangerous). The first problem arises when HAL_GetTick() > error->timestamp + error_timeouts[error->id] (i.e. when the error is caught too late) the sum is negative value casted back to uint -> overflow.
2. return delta <= error_timeouts[error->id] ? delta : 0; will become 0 only when delta overflows, that is not a good behaviour.
3. error_timeouts[error->id] when equals to SOFT has values UINT32_MAX. This value should not be used because it causes a chain of very dangerous overflows: delta (overflows) which is then used by:
   

   fenice-bms-hv-sw/mainboard/Src/error/error.c

   Lines 78 to 80 in 6f4628d

   	volatile uint16_t delta = get_timeout_delta(error);
   	uint16_t cnt = __HAL_TIM_GET_COUNTER(&HTIM_ERR);
   	__HAL_TIM_SET_COMPARE(&HTIM_ERR, TIM_CHANNEL_1, cnt + TIM_MS_TO_TICKS(&HTIM_ERR, delta));

   
   Here delta undergoes multiplications and divisions and then another sum by cnt (which is a 32 bit counter running at KHz speeds).

Our solution:

1. Change SOFT to (uint32_t)(UINT32_MAX>>1)

--- a/Core/Lib/errors/error.h
+++ b/Core/Lib/errors/error.h

-typedef enum { SOFT = UINT32_MAX, SHORT = 500, REGULAR = 1000, INSTANT = 0 } __attribute__((__packed__)) error_timeout;
+typedef enum {
+    SOFT    = (uint32_t)(UINT32_MAX >> 1),  //@10KHz: 2 d + 11 h + 39 min + 8.3648 s
+    SHORT   = 500,
+    REGULAR = 1000,
+    INSTANT = 0
+} __attribute__((__packed__)) error_timeout;
 
 /**
  * @brief an error is active when it enters the error list (ERROR_ACTIVE)

This will remove all overflows that happen when using soft errors
2) Change get_timout_delta to

--- a/Core/Lib/errors/error.c
+++ b/Core/Lib/errors/error.c

 uint32_t get_timeout_delta(error_t *error) {
-    uint32_t delta = error->timestamp + error_timeouts[error->id] - HAL_GetTick();
-    return delta <= error_timeouts[error->id] ? delta : 0;
+    uint32_t error_timeout = error->timestamp + error_timeouts[error->id];
+    uint32_t current_tick  = HAL_GetTick();
+    uint32_t delta         = 0;
+
+    // 2 options for delta
+    if (current_tick <= error_timeout) {
+        // 1) CurrentTick < error_timeout
+        //     err_arrival          error_timeout
+        //          |----------------------|
+        //          |------------| ← current_tick
+        //                       |  delta  |
+        delta = error_timeout - current_tick;
+    } else {
+        // 2) CurrentTick > error_timeout
+        //     err_arrival      err_timeout
+        //          |-----------------|
+        //          |-------------------------| ← current_tick
+        //          |                ↑      we missed the error timout
+        // we should have trigered here, therefore the delta will be 0 because we need to trigger instantly
+        delta = 0;
+    }
+
+    // WARNING: do not compute delta as an int becase some error_timouts[*] are
+    //          UINT32_MAX (overflow risk)
+    // EDGE CASE BUG: when current_tick overflows to 0 and err_timout not: this
+    //                happens when the uC stays on for more the 2^32 ms ~50 days
+
+    return delta;
 }

These change take into account all the overflowing that happens in point 2 and the implicit castings in point 1.

This code was tested in bms-lv-sw and works correctly.

Basically add interrupts to the ADC setup process in order to make it non-blocking

Starting ADC1 in DMA mode does only one conversion and then stops. Read values seem to overflow at 255, meaning only 8 bits are used. Should not be a problem since ADC2 and ADC3 are used to measure current and the feedbacks can only be read in polling mode since they are multiplexed