ECU FSM

The ECU FSM (ecu_fsm.c) acts as the top-level orchestrator for the ECU's behavior. It dictates which sub-FSM should be active or if the system needs to enter a fault state.

Flow Diagram

States

State	Description
SYSTEM_INIT	Initial power-on state.
SYSTEM_IDLE	The default waiting state. The vehicle is inactive, awaiting the driver to initiate the R2D sequence.
SYSTEM_R2D	The Ready-to-Drive procedure is active. Hands off detailed control to the R2D FSM.
SYSTEM_CONTROL	The vehicle is active and ready to drive. Hands off detailed control to the Control FSM.
SYSTEM_SHUTDOWN	A fault or stop request occurred. Hands off control to the Shutdown FSM to safely open relays.

Transitions & Events

The ECU FSM monitors high-level system faults:

• SDC Fault Request: If can_sdc_fault_requested is true (originating from a CAN message indicating the Shutdown Circuit opened) and a shutdown hasn't already started, the FSM immediately transitions to SYSTEM_SHUTDOWN with the reason ECU_FSM_REASON_FAULT_CAN_SDC.
• AMS Fault Request: If can_ams_fault_requested is true (critical BMS error), the FSM immediately transitions to SYSTEM_SHUTDOWN with the reason ECU_FSM_REASON_FAULT_CAN_AMS.

The ECU FSM also acts on mode change requests initiated by its sub-FSMs (e.g., when the R2D FSM finishes its sequence, it requests the ECU FSM to transition to SYSTEM_CONTROL).