From 83d69b2c0aa2890c85fe97f7f024a858ab859b6d Mon Sep 17 00:00:00 2001
From: rusefi <rusefillc@gmail.com>
Date: Fri, 21 Jul 2023 21:37:41 -0400
Subject: [PATCH] turnAllPinsOff improvements #5429

---
 firmware/CHANGELOG.md                        | 1 +
 firmware/controllers/core/error_handling.cpp | 5 ++---
 firmware/controllers/core/error_handling.h   | 4 ++++
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/firmware/CHANGELOG.md b/firmware/CHANGELOG.md
index fd9790b967..ab5b583221 100644
--- a/firmware/CHANGELOG.md
+++ b/firmware/CHANGELOG.md
@@ -32,6 +32,7 @@ Release template (copy/paste this for new release):
  - Dashpot for return-to-idle from coasting #5303
  - injector duty cycle limited at 50% for GDI engines #5416
  - STM32Cube v2.14 #5418
+ - turning coils and injectors off in case of extremely unexpected errors #5429
 
 ### Fixed
  - fuel_pump_control is accessible as getOutput("isFuelPumpOn") in Lua #5239 
diff --git a/firmware/controllers/core/error_handling.cpp b/firmware/controllers/core/error_handling.cpp
index d3fbd92308..24f94a7491 100644
--- a/firmware/controllers/core/error_handling.cpp
+++ b/firmware/controllers/core/error_handling.cpp
@@ -79,7 +79,7 @@ void checkLastBootError() {
 }
 
 void logHardFault(uint32_t type, uintptr_t faultAddress, port_extctx* ctx, uint32_t csfr) {
-    TURN_FATAL_LED();
+    criticalShutdown();
 #if EFI_BACKUP_SRAM
 	auto sramState = getBackupSram();
 	sramState->Cookie = ErrorCookie::HardFault;
@@ -250,8 +250,7 @@ void firmwareError(ObdCode code, const char *fmt, ...) {
 	chvsnprintf(warningBuffer, sizeof(warningBuffer), fmt, ap);
 	va_end(ap);
 #endif
-    TURN_FATAL_LED();
-	turnAllPinsOff();
+    criticalShutdown();
 	enginePins.communicationLedPin.setValue(1);
 
 	hasFirmwareErrorFlag = true;
diff --git a/firmware/controllers/core/error_handling.h b/firmware/controllers/core/error_handling.h
index ba9d53c3fd..49fa8bc13f 100644
--- a/firmware/controllers/core/error_handling.h
+++ b/firmware/controllers/core/error_handling.h
@@ -26,6 +26,10 @@ bool warning(ObdCode code, const char *fmt, ...);
 
 using critical_msg_t = char[CRITICAL_BUFFER_SIZE];
 
+#define criticalShutdown() \
+    TURN_FATAL_LED(); \
+    turnAllPinsOff();
+
 /**
  * Something really bad had happened - firmware cannot function, we cannot run the engine
  * We definitely use this critical error approach in case of invalid configuration. If user sets a self-contradicting