seb/saltylab-firmware
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat: remote e-stop over 4G MQTT — safety-critical motor kill for outdoor autonomous #63

New Issue
Closed
opened 2026-03-01 00:35:58 -05:00 by sl-firmware · 1 comment
sl-firmware commented 2026-03-01 00:35:58 -05:00
Collaborator
Copy Link

Problem

SaltyBot is going outdoor autonomous (SIM7600X 4G, issue #58). We need a remote kill switch that an operator or automated system can trigger over cellular to cut motors immediately.

Requirements

STM32 firmware

  • New CDC command E — immediate motor disable, latch ESTOP_REMOTE
  • New CDC command Z — clear remote estop (still requires RC arm hold to re-arm)
  • estop_state enum in safety.c: ESTOP_CLEAR=0, ESTOP_TILT=1, ESTOP_RC_KILL=2, ESTOP_REMOTE=3, ESTOP_CELLULAR_TIMEOUT=4
  • Motor cutoff is immediate — bypass PID, zero PWM, latch flag
  • LED: fast blink (200ms) during ESTOP_REMOTE / ESTOP_CELLULAR_TIMEOUT
  • Re-arm: explicit Z clear + RC arm hold — cannot re-arm from MQTT alone

Jetson bridge (ROS2 node)

  • Subscribe MQTT saltybot/estop
  • {"kill":true} → send E\n to STM32 immediately
  • {"kill":false} → send Z\n (still requires RC re-arm)
  • Cellular watchdog: if 4G drops >5s during AUTONOMOUS mode → auto-estop (ESTOP_CELLULAR_TIMEOUT)

Telemetry

  • Add "es" field to JSON: 0=clear, 1=tilt, 2=rc_kill, 3=remote, 4=cellular_timeout
  • Web UI: red REMOTE E-STOP banner when es≥3

Config

  • estop_params.yaml — mqtt_topic, cellular_timeout_s, auto_estop_on_disconnect

Safety rules

  • Motor cutoff IMMEDIATE — no ramp, no delay, no confirmation
  • Latch: once estopped, motors stay dead until explicit clear + RC arm
  • Defense in depth: layer 4 (after IWDG, tilt, RC kill)
  • Target latency: <500ms end-to-end (MQTT publish → motor zero)

Acceptance

  • E\n over serial cuts motors, es=3 in telemetry
  • Z\n clears latch, normal re-arm works
  • Watchdog fires after 5s 4G drop during AUTO mode → es=4
  • LED blinks fast (200ms) during remote estop
  • Cannot re-arm via MQTT alone
## Problem SaltyBot is going outdoor autonomous (SIM7600X 4G, issue #58). We need a remote kill switch that an operator or automated system can trigger over cellular to cut motors immediately. ## Requirements ### STM32 firmware - New CDC command `E` — immediate motor disable, latch `ESTOP_REMOTE` - New CDC command `Z` — clear remote estop (still requires RC arm hold to re-arm) - `estop_state` enum in safety.c: `ESTOP_CLEAR=0`, `ESTOP_TILT=1`, `ESTOP_RC_KILL=2`, `ESTOP_REMOTE=3`, `ESTOP_CELLULAR_TIMEOUT=4` - Motor cutoff is **immediate** — bypass PID, zero PWM, latch flag - LED: fast blink (200ms) during `ESTOP_REMOTE` / `ESTOP_CELLULAR_TIMEOUT` - Re-arm: explicit `Z` clear + RC arm hold — cannot re-arm from MQTT alone ### Jetson bridge (ROS2 node) - Subscribe MQTT `saltybot/estop` - `{"kill":true}` → send `E\n` to STM32 immediately - `{"kill":false}` → send `Z\n` (still requires RC re-arm) - Cellular watchdog: if 4G drops >5s during AUTONOMOUS mode → auto-estop (`ESTOP_CELLULAR_TIMEOUT`) ### Telemetry - Add `"es"` field to JSON: 0=clear, 1=tilt, 2=rc_kill, 3=remote, 4=cellular_timeout - Web UI: red REMOTE E-STOP banner when `es≥3` ### Config - `estop_params.yaml` — mqtt_topic, cellular_timeout_s, auto_estop_on_disconnect ## Safety rules - Motor cutoff **IMMEDIATE** — no ramp, no delay, no confirmation - Latch: once estopped, motors stay dead until explicit clear + RC arm - Defense in depth: layer 4 (after IWDG, tilt, RC kill) - Target latency: <500ms end-to-end (MQTT publish → motor zero) ## Acceptance - [ ] `E\n` over serial cuts motors, `es=3` in telemetry - [ ] `Z\n` clears latch, normal re-arm works - [ ] Watchdog fires after 5s 4G drop during AUTO mode → `es=4` - [ ] LED blinks fast (200ms) during remote estop - [ ] Cannot re-arm via MQTT alone
seb closed this issue 2026-03-01 00:41:28 -05:00
seb commented 2026-03-01 00:41:28 -05:00
Owner
Copy Link

Duplicate of #60. Closing.

Duplicate of #60. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
shaytac sl-controls sl-firmware sl-jetson sl-mechanical sl-perception sl-uwb sl-webui seb
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: seb/saltylab-firmware#63
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?