Safety Critical System (SCS) Verification

The SCS Verification module (scs_verif.c) acts as a watchdog for vital sensor data streaming into the ECU. Since the ECU depends heavily on the Front and Rear Gateways for pedal and shutdown states, it must guarantee these nodes are alive.

Timeout Watchdogs

The module tracks the timestamps of incoming CAN messages. Every time a relevant CAN frame is received in can_comm.c, a corresponding last_msg_time variable is updated.

The check_scs_timeouts() function periodically evaluates the elapsed time since these updates against a MAX_SCS_TIMEOUT threshold.

Monitored Signals

1. APPS (Accelerator Pedal Position Sensor):
   • Monitors both APPS1 and APPS2 timestamps.
   • If either sensor's data ceases to arrive within the timeout window, the ECU immediately commands the ECU FSM to transition to SYSTEM_SHUTDOWN with the fault reason ECU_FSM_REASON_FAULT_APPS_TIMEOUT.
2. Brake Pressure:
   • Monitors the brake pressure sensor timestamp.
   • A timeout forces the system into SYSTEM_SHUTDOWN with ECU_FSM_REASON_FAULT_BRAKE_TIMEOUT.
3. Shutdown Circuit (SDC):
   • Monitors the state of the SDC node timestamp.
   • A timeout forces a shutdown with ECU_FSM_REASON_FAULT_SDC_TIMEOUT.

By actively monitoring these streams, the ECU guarantees that it will safely shut down the vehicle if communication is severed with the critical gateways.

Speed-Source Fallback Watchdog (IMU & GPS)

In addition to the shutdown-triggering SCS watchdogs, the module monitors the communication health of the speed estimation sensors:

• IMU: Tracks the timestamp of incoming IMU messages (last_imu_rx_time).
• GPS: Tracks the timestamp of incoming GPS speed/angle messages (last_gps_msg_time).

How It Works

Within check_speed_source_timeout(), the elapsed time since the last update for both sensors is evaluated against MAX_SCS_TIMEOUT (500 ms).

• If either sensor stops transmitting (i.e., the elapsed time since the last frame exceeds the threshold), the speed_source_apps_fallback flag is set to 1.
• If both sensors are communicating within the timeout window, the flag is cleared (0).

Unlike the core SCS timeouts, this watchdog does not command a state transition to SYSTEM_SHUTDOWN.

Why This Is Done (Rationale)

• Closed-Loop Control Dependency: The advanced closed-loop motor control algorithms (Torque Vectoring and Slip Control) rely on real-time vehicle state estimation (velocity, side-slip angle, and yaw rate) computed by the Unscented Kalman Filter (UKF). The UKF relies directly on the IMU (accel, gyro) and GPS (ground speed) sensors.
• Safety Risk of Unreliable Feedback: If either sensor drops offline, the Kalman Filter's state estimation becomes highly inaccurate. Feeding an incorrect velocity or yaw rate estimate into the closed-loop control would lead to erratic, asymmetric torque demands, posing a severe hazard to vehicle handling and safety on the track.
• Graceful Degradation: To prevent a sudden loss of propulsion during driving (which itself could be dangerous or lead to a DNF), the ECU degrades gracefully. Instead of cutting power entirely, the control FSM falls back to Direct APPS passthrough mode, where driver pedal inputs are routed equally and directly to both left and right motors. This allows the driver to maintain manual control and drive the vehicle safely.
• Automatic Recovery: The watchdog state is non-latching. As soon as both sensors resume CAN broadcasts and their timestamps are updated, the watchdog clears (speed_source_apps_fallback = 0), restoring active torque vectoring and slip control.