forcing a pin low

ManAtWork

For my motion control projects I need some sort of emergency shutdown. I have an enable pin that enables the power stages for the motors when high and cuts all currents when low.

Unfortunatelly, the propeller has the OUT and DIR signals of all pins driven by a large OR gate. So if any of the other cogs accidentally drives DIR and OUT of that pin high (by means of a software bug) it overrides driving it low. This would be just a false state in most applications but in my case it could burn expensive equipment.

On the P1 I solved this with an external flipflop that can be set only with a falling edge of a pin and is cleared by the alarm condition. But external circuits cost money and board space and I think the P2 can do better.

What about configuring the pin as smart pin constantly driving out low, for example as PWM output with Y=0. Of course, the smart pin mode and XY registers and DIR (reset) can still be overwritten by other cogs but if I do wrpin in an endless loop it should be pretty bullet proof. A cog running totally amok could cogstop the safety guard cog but that's very unlikely if no on-the-fly updates are made and no memory corruption occurs.

The P2 has no brown out circuit if IO remember correctly. But my voltage regulator has a "power good" signal driving reset.

Any objections or ideas for improvement?

Peter Jakacki

If you put the pin into smartpin mode with a 0% or 100% duty cycle then no other cogs can drive that "high" by simply using the output registers. They would have to pown the pin.

cgracey

Yeah, using a smart pin mode where the output is held in a desired state and some cog is holding the DIR high makes it foolproof. It doesn't matter what other cogs do with their own DIR and OUT bits for that pin. There is a problem if an errant cog does a WRPIN to that pin, though, and reconfigures it.

Tubular

I think what you've proposed is best.

I was thinking inverting the output (using CIO bits) could also help in that any other cog drvh's would cause a '0' to be output, but you still have the problem an errant wrpin could undo that protection

Rayman

I think the logic state of an I/O pin can be inverted now using wrpin.
I guess that would mean any cog could make it 0 instead of 1. Would that help?

I might take the cpu out of the equation and use relays for the safety mechanisms...

JRoark

As a continuation of ManAtWork’s thoughts re pin safety, what exactly does an unused cog do? Is it powered down, executing NOP’s, or what? What are the odds of an unused cog suddenly coming alive due to random noise (or a gamma/cosmic ray hit) and executing random instructions?

Peter Jakacki

The cog is stopped and shutdown and consumes very little power. The odds of waking up by itself are odd indeed but any extreme event beyond what we class as industrial spec will have many many other problems as well including affecting the running cog etc.

evanh

On a side note, regarding the shutdown of a cog. When I was testing power consumption I think I found that a cog running nonstop WAITX's was lower power than a stopped cog.