docs(power): production power-down/wake design (Opta I1 sensing, default-off bench gating) - #110
Open
dorkmo wants to merge 2 commits into
Open
docs(power): production power-down/wake design (Opta I1 sensing, default-off bench gating)#110dorkmo wants to merge 2 commits into
dorkmo wants to merge 2 commits into
Conversation
…ault-off gating Design draft only, no implementation. Captures the bench discussion: key-off sensing via the already-specced Opta I1 + battery_mv registers, H747-owned debounce, battery-bridged clean halt with farewell packet, self-holding power-relay release, base-station quiesce with idle-time surveys and a 927.5 MHz rendezvous channel. The consumer is default OFF (LIFETRAC_POWER_MGMT provisioned in production); absence of the flag IS bench mode, so bench radio testing needs no power signals and no new variable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This docs-only PR proposes production tractor power-down/wake behavior while preserving default-off bench operation.
Changes:
- Adds the production power-management design.
- Documents sensing, shutdown, battery, provisioning, and rendezvous behavior.
- Links the design from
TRACTOR_NODE.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 8 comments.
| File | Summary |
|---|---|
LifeTrac-v25/DESIGN-CONTROLLER/TRACTOR_NODE.md |
Adds a pointer to the power-management design. |
LifeTrac-v25/DESIGN-CONTROLLER/POWER_MANAGEMENT.md |
Documents the proposed architecture; unresolved critical and moderate issues affect farewell transmission, sensing, relay handshakes, wake behavior, provisioning, and radio fallback. |
Suppressed comments (4)
LifeTrac-v25/DESIGN-CONTROLLER/POWER_MANAGEMENT.md:57
on H747 commandis not yet a defined shutdown path: the H7 command handler has no power-management opcode, and the existing X8 UART path only forwards camera-related commands. Without a defined H747→Linux shutdown request plus a Linux completion signal, the clean-halt and subsequent power-release steps cannot be sequenced deterministically.
### Linux shutdown sequence (on H747 command)
1. Hydraulic outputs are already safe (Opta watchdog + PSR chain — not this doc's
job, and never gated by it).
2. Stop image/radio containers; park the LoRa radio in sleep.
3. Send a **farewell packet** to the base (see "Base station" below).
4. `sync` + clean halt.
5. Power release (see below).
LifeTrac-v25/DESIGN-CONTROLLER/POWER_MANAGEMENT.md:25
digital_inputsdoes not currently contain the proposed I1 signal:tractor_opta.inowrites only the E-stop loop and mode-switch bits (lines 346–348), and TODO.md still lists reading the D1608S inputs/ignition state as pending. Please label this as a proposed mapping until the Opta firmware publishes I1.
| Ignition present (digital) | Opta expansion input **I1 — ignition sense** ([TRACTOR_NODE.md](TRACTOR_NODE.md), I/O map) | `digital_inputs` 0x0101 |
LifeTrac-v25/DESIGN-CONTROLLER/POWER_MANAGEMENT.md:26
battery_mvis not currently a millivolt value:tractor_opta.ino:a0602_read()returnsae.pinCurrent(ch)as a raw ADC code, and the H7 forwards the values without conversion; TODO.md still lists scaling 0x0102–0x0107 as pending. The debounce design needs a defined calibration/threshold before using this register to distinguish a healthy from a collapsing rail.
| Battery rail voltage (analog) | **AI1 — battery voltage**, native 0–30 V range on the A0602 expansion (no external divider) | `battery_mv` 0x0102 |
LifeTrac-v25/DESIGN-CONTROLLER/POWER_MANAGEMENT.md:128
- RS-11.7 is currently a proposed manual maintenance survey: its documented v0 pauses the RX daemon, recommends a channel, and leaves APPLY manual; the periodic automation and coordinated switch are still pending in TODO.md lines 2278–2294. This section presents that extension as already operational, without defining what happens to wake hails while the receiver is paused.
- **Idle-time channel surveys.** RS-11.6 established that channel picks perish in
hours and a same-day survey is a correctness requirement. A quiesced base runs
the survey automatically every few hours (the RS-11.7 automation, extended), so
the current clean-channel pick is always ready when the tractor returns.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+54
to
+57
| 2. Stop image/radio containers; park the LoRa radio in sleep. | ||
| 3. Send a **farewell packet** to the base (see "Base station" below). | ||
| 4. `sync` + clean halt. | ||
| 5. Power release (see below). |
Comment on lines
+36
to
+38
| The **Max Carrier H747 co-MCU** owns the debounce and the shutdown decision. It is | ||
| the always-alive component (it survives Linux crashes and reboots by design) and it | ||
| already polls the Opta as Modbus master, so it sees I1 and `battery_mv` every cycle. |
Comment on lines
+64
to
+68
| Preferred: a **self-holding power relay** — energized at key-on, held by an X8/H747 | ||
| output, released when halt completes. This makes power-off fully automatic, removes | ||
| any dependence on the operator throwing the master cutoff promptly, and shrinks the | ||
| 18650's duty to the bridge window only. Fallback: operator opens the master cutoff; | ||
| acceptable, but then post-halt battery drain matters (below). |
Comment on lines
+121
to
+124
| - On receiving the tractor's **farewell packet**, the base stops the image pipeline | ||
| and drops to low-duty listen. The web UI stays up and shows "tractor off | ||
| (expected)" — distinct from lost-link, so nobody chases a phantom outage and the | ||
| base does not burn airtime on retries. |
Comment on lines
+129
to
+133
| - **Rendezvous protocol.** The tractor wakes with a weeks-stale channel pin. It | ||
| hails on a fixed **home channel, 927.5 MHz** (the only 3/3-clean channel across | ||
| the 2026-08 surveys; plausibly band-edge-protected). The base answers with | ||
| today's channel assignment; both hop; the session resumes. Session start is | ||
| therefore: hello on home channel → channel assignment → traffic. |
Comment on lines
+99
to
+101
| - Setting (name provisional): `LIFETRAC_POWER_MGMT=1` — reaches the H747 via its | ||
| config path at provisioning time; documented in | ||
| [SETTINGS_REFERENCE.md](SETTINGS_REFERENCE.md) once implemented. |
Comment on lines
+44
to
+48
| - `battery_mv` disambiguates: key-off shows I1 low with a healthy rail; a genuine | ||
| electrical failure shows the rail collapsing with I1 still high. The second case | ||
| should trigger an *urgent* shutdown (shorter debounce) plus a telemetry alarm. | ||
| - Modbus silence from the Opta keeps its existing meaning (safety event → coils | ||
| drop via the Opta's own watchdog). It is **never** interpreted as key-off. |
Comment on lines
+28
to
+32
| Power topology (already consistent with the TRACTOR_NODE.md wiring tree): the Opta | ||
| and Max Carrier are fed from the constant (master-cutoff-side) distribution, **not** | ||
| key-switched power. The ignition circuit lands only on I1. The Opta therefore stays | ||
| alive through the grace window and can report key-off; "weeks off" is the master | ||
| cutoff opening after shutdown completes. |
…d against source Copilot findings verified against tractor_opta.ino / tractor_h7.ino / SETTINGS_REFERENCE.md before amending; every one was correct: - farewell now sent BEFORE radio teardown (original sequence parked the radio first and could not transmit) - I1/battery_mv mapping relabeled PROPOSED with verified current-state notes (Opta publishes only E-stop+mode bits; H7 reads only 0x0102 x6; analog block is raw ADC, mV scaling pending) + prerequisites checklist - SHUTDOWN_REQ/ACK opcodes named as new X8-H747 UART surface - self-holding relay release now has an explicit handshake + 300 s fail-safe cap, with crash-only rootfs a stated prerequisite - battery_mv failure-mode caveat: staleness bound + independent H747-side rail measurement required (Modbus dies with the rail) - wake path defined: key-on energizes hold coil directly (diode-OR); master cutoff documented as service disconnect requiring manual close - enable gate moved from env var to persisted parameter delivered to H747 at boot, DISARMED default (env var mirrors Linux side only) - rendezvous: hail SET from stability ranking replaces single channel; grid-offset caveat recorded (927.5 is not a chantab center; no table channel has bench stability data yet); survey-vs-hail listen windows bounded so a wake hail cannot be stranded Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dorkmo
added a commit
that referenced
this pull request
Aug 22, 2026
… ideas From the 2026-08-22 session: PR #110 review surfaced that all bench channel-stability data sits on the x.0/x.5 MHz survey grid while the production FHSS table centers sit on x.25/x.75 (offset 250 kHz, zero shared channels) -> RS-11.8 tracks chantab-grid survey passes. PM-1 tracks the power-down/wake design (PR #110) with its verified implementation prerequisites and cheap bench checks. RS-12.9 gains two idle-time items (/sys/class/power_supply check, optional chantab pass) and bench ops ideas (overnight quiesce vs halt, smart plug). Root TODO banner gets a dated update line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dorkmo
added a commit
that referenced
this pull request
Aug 23, 2026
…e order Root banner now names the complete validated mitigation (-NoParkLast 1 PLUS LIFETRAC_NO_PARK_LAST_GAP_MS=80 strict hold, env-gated not default) instead of implying the CLI flag alone suffices, and the session block declares the merge-order prerequisite (#110 and #111 land the referenced design doc, evidence dirs, seq= change and CI fix -- merge them before this PR so no reference dangles). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Design draft only — no implementation, no behavior change.
Adds
DESIGN-CONTROLLER/POWER_MANAGEMENT.mdcapturing the production power-down / wake design discussed at the bench today, plus a one-paragraph pointer inTRACTOR_NODE.md:digital_inputs0x0101,battery_mv0x0102).battery_mvdisambiguating key-off from electrical failure. Modbus silence keeps its existing safety-only meaning.LIFETRAC_POWER_MGMT=1, name provisional). Absence of the flag IS bench mode — no ignition/VIN logic armed, radios testable with no Opta attached. Matches theLIFETRAC_NO_PARK_LASTenv-gating pattern. Valve-safety watchdogs are explicitly out of this flag''s scope.Open bench checks listed in-doc:
/sys/class/power_supply/exposure on the X8, post-halt 18650 drain, harness confirmation that ignition sense lands on I1.No conflict with #109 (that PR touches only the two TODO.md files).
🤖 Generated with Claude Code