Thanks for the poster, that is a nice one to keep in mind for further improvements.
At this moment there is a state machine in LitexCNC (not in the original colorcnc), however it is simpler then the EtherCAT one:
- IDLE: Watchdog is timed out, all inputs / outputs are in safe state and the stepgens are stopped;
- INIT: The master requests header information to verify the configuration of the card and firmware. The watchdog is still timed out and the outputs stay in safe state and stepgen stopped.
- RESET: The master sends the reset signal to the FPGA and verifies it has been correctly received. This ensures the stepgen counters are reset to a known state, preventing uncommanded moves when the HAL-cycle starts sending data. The watchdog is still timed out.
- ACTIVE: The master reads data from the FPGA, processes it (by using other components) and at the end of the cycle sends the commands back to the FPGA. The watchdog is being petted and after a pre-defined time-out (1,5 ms in the examples)
- WATCHDOG_BITTEN: When the watchdog times out the inputs and outputs go to safe state and the stepgens are stopped. Depending on the settings, the stepgens are stopped gently (with keeping acceleration limits in mind) or harsh (stop direct).
At this moment the state-machine goes from top to bottom when LinuxCNC or the HAL is first started. An improvement is still required on the transition between WATCHDOG_BITTEN and ACTIVE. At this moment as soon as the watchdog is petted again, the movements start again. Theoretically the machine did not loose steps, but I think it is better to stop the machine and enforce a RESET state.
So: safety is in the design of LitexCNC and I really do appreciate people actively seeking for safety!