sl-firmware opened issue seb/saltylab-firmware#63

sl-firmware
Sun, 01 Mar 2026 00:35:58 -0500

63#feat: remote e-stop over 4G MQTT — safety-critical motor kill for outdoor autonomous#

Problem

SaltyBot is going outdoor autonomous (SIM7600X 4G, issue #58). We need a remote kill switch that an operator or automated system can trigger over cellular to cut motors immediately.

Requirements

STM32 firmware

New CDC command E — immediate motor disable, latch ESTOP_REMOTE

New CDC command Z — clear remote estop (still requires RC arm hold to re-arm)

estop_state enum in safety.c: ESTOP_CLEAR=0, ESTOP_TILT=1, ESTOP_RC_KILL=2, ESTOP_REMOTE=3, ESTOP_CELLULAR_TIMEOUT=4

Motor cutoff is immediate — bypass PID, zero PWM, latch flag

LED: fast blink (200ms) during ESTOP_REMOTE / ESTOP_CELLULAR_TIMEOUT

Re-arm: explicit Z clear + RC arm hold — cannot re-arm from MQTT alone

Jetson bridge (ROS2 node)

Subscribe MQTT saltybot/estop

{"kill":true} → send E\n to STM32 immediately

{"kill":false} → send Z\n (still requires RC re-arm)

Cellular watchdog: if 4G drops >5s during AUTONOMOUS mode → auto-estop (ESTOP_CELLULAR_TIMEOUT)

Telemetry

Add "es" field to JSON: 0=clear, 1=tilt, 2=rc_kill, 3=remote, 4=cellular_timeout

Web UI: red REMOTE E-STOP banner when es≥3

Config

estop_params.yaml — mqtt_topic, cellular_timeout_s, auto_estop_on_disconnect

Safety rules

Motor cutoff IMMEDIATE — no ramp, no delay, no confirmation

Latch: once estopped, motors stay dead until explicit clear + RC arm

Defense in depth: layer 4 (after IWDG, tilt, RC kill)

Target latency: <500ms end-to-end (MQTT publish → motor zero)

Acceptance

E\n over serial cuts motors, es=3 in telemetry

Z\n clears latch, normal re-arm works

Watchdog fires after 5s 4G drop during AUTO mode → es=4

LED blinks fast (200ms) during remote estop

Cannot re-arm via MQTT alone