Observed on bench: a break event (desat via TIM1 BKIN) cleared MOE while ControlSupervisor stayed RUNNING and fault_list showed nothing. The PIs then wound to the voltage rails against undriven outputs; a later control start re-enabled MOE into wound-up integrators, slamming full voltage into a stalled motor and browning out the MCU (22 W on the gate rail).
Needed:
- break/BKIN IRQ hook (or MOE poll) that raises a latched fault and stops the supervisor
- PI/integrator reset on any start that follows a break
- telemetry for break events (count + timestamp)
Observed on bench: a break event (desat via TIM1 BKIN) cleared MOE while ControlSupervisor stayed RUNNING and fault_list showed nothing. The PIs then wound to the voltage rails against undriven outputs; a later control start re-enabled MOE into wound-up integrators, slamming full voltage into a stalled motor and browning out the MCU (22 W on the gate rail).
Needed: