turnAllPinsOff improvements #5429

firmware/CHANGELOG.md

@@ -32,6 +32,7 @@ Release template (copy/paste this for new release):
  - Dashpot for return-to-idle from coasting #5303
  - injector duty cycle limited at 50% for GDI engines #5416
  - STM32Cube v2.14 #5418
+ - turning coils and injectors off in case of extremely unexpected errors #5429
 
 ### Fixed
  - fuel_pump_control is accessible as getOutput("isFuelPumpOn") in Lua #5239 

firmware/controllers/core/error_handling.cpp

@@ -79,7 +79,7 @@ void checkLastBootError() {
 }
 
 void logHardFault(uint32_t type, uintptr_t faultAddress, port_extctx* ctx, uint32_t csfr) {
-    TURN_FATAL_LED();
+    criticalShutdown();
 #if EFI_BACKUP_SRAM
 	auto sramState = getBackupSram();
 	sramState->Cookie = ErrorCookie::HardFault;
@@ -250,8 +250,7 @@ void firmwareError(ObdCode code, const char *fmt, ...) {
 	chvsnprintf(warningBuffer, sizeof(warningBuffer), fmt, ap);
 	va_end(ap);
 #endif
-    TURN_FATAL_LED();
-	turnAllPinsOff();
+    criticalShutdown();
 	enginePins.communicationLedPin.setValue(1);
 
 	hasFirmwareErrorFlag = true;

firmware/controllers/core/error_handling.h

@@ -26,6 +26,10 @@ bool warning(ObdCode code, const char *fmt, ...);
 
 using critical_msg_t = char[CRITICAL_BUFFER_SIZE];
 
+#define criticalShutdown() \
+    TURN_FATAL_LED(); \
+    turnAllPinsOff();
+
 /**
  * Something really bad had happened - firmware cannot function, we cannot run the engine
  * We definitely use this critical error approach in case of invalid configuration. If user sets a self-contradicting