Shutdown FSM

The Shutdown FSM (shutdown_fsm.c) is a critical safety component responsible for safely de-energizing the vehicle when a fault occurs or when the driver explicitly requests a stop.

Flow Diagram

States

State	Description
SYSTEM_SHUTDOWN_IDLE	FSM is inactive, vehicle is operating normally.
SYSTEM_SHUTDOWN_START	A shutdown has been requested. Evaluates whether the Shutdown Circuit (SDC) is already open or if the ECU needs to command it open.
SYSTEM_SHUTDOWN_WAIT	The ECU has commanded the SDC relay to open and is waiting for a 5-second delay to ensure hardware safety margins are met.

Transitions & Events

The Shutdown FSM is typically triggered by the ECU FSM requesting a mode change due to an AMS error, an SDC opening detected via CAN, or a driver stop request.

1. Shutdown Start (SYSTEM_SHUTDOWN_START):
   • When entered, it checks sdc_force_open_request.
   • If sdc_force_open_request == 0 (meaning the SDC opened physically without the ECU commanding it, or the fault cleared), and no active AMS/SDC faults are requested, the FSM transitions the ECU back to SYSTEM_IDLE.
   • If the ECU must force the SDC open, it pulls the SDC_RELAY_Pin low (or sets it as needed to open the relay) and transitions to SYSTEM_SHUTDOWN_WAIT.
2. Shutdown Wait (SYSTEM_SHUTDOWN_WAIT):
   • The FSM waits in this state until a 5-second timer (delay_elapsed) completes.
   • This ensures the hardware relay has physically settled and capacitors have time to drain.
   • Once the timer elapses, it requests the ECU FSM to transition to SYSTEM_IDLE and returns itself to SYSTEM_SHUTDOWN_IDLE.