Kernel Maturation, Sensors
Everything Between the CAN Bus Working and the RTOS Actually Being Ready to Fly Something

PWM — one dead pin, one alternate-function sweep

STM32's first PWM attempt was TIM1_CH1 on PE9 (Arduino D6). Every register checked out — CEN set, CC1E set, MOE set, GPIOE in the right alternate-function mode — and the pin produced nothing on the logic analyzer. Same class of problem as the CAN bus's PA11/PA12 not being broken out on this particular Nucleo variant. Moved to TIM2/PA0 instead, which worked cleanly once RCC_AHB4ENR's GPIOE enable bit turned out to be the thing missing on the first pin too — the peripheral clock gate had never been enabled, so every GPIOE register read back as garbage.

K64F's FTM driver ended up covering all four motor channels — PTC1, PTC5, PTC8, PTC9 across FTM0 and FTM3. Three of the four alternate-function numbers came straight from the datasheet's pin table. PTC5 did not.

The lesson that kept repeating across this entire stretch: never assume a sibling pin's alternate-function number applies to another pin on the same port, even when two different datasheet tables agree with each other and disagree with reality.

ADC — a clock nobody enabled, and a clean win

STM32's ADC1 driver followed the standard STM32H7 enable sequence — exit deep-power-down, enable the LDO regulator, calibrate, enable — and hung indefinitely at the calibration wait loop. Every step of the sequence looked correct against RM0433. The ADC simply never received a clock.

K64F's ADC0 driver was the one clean register hunt of this entire stretch — SIM_SCGC6's ADC0 clock-enable bit and SIM_SCGC5's PORTB bit were both taken from the established Kinetis SIM_SCGCx sequential pattern (FTM0=24, FTM1=25, FTM2=26, ADC0=27; PORTA=9…PORTE=13) without independent confirmation from the reference manual's bit tables, then verified purely by whether the driver worked on real hardware. It worked, first try — a pot swept the full 12-bit range (0–4095) cleanly in both directions.

I2C driver + MPU6050 + Kalman

The I2C1 driver (PB8=SCL, PB9=SDA, both AF4, 400kHz Fast Mode) came up cleanly against the MPU6050 first — WHO_AM_I returned 0x68, accelerometer/gyroscope data flowed, and a 4-state Kalman filter (roll, pitch, gyro bias x2) produced stable angle estimates from raw ±2g/±250°/s readings. This part was uneventful. The eventful part came later, when a second I2C device was added to the same bus — covered in its own section below, because the bug it exposed was serious enough to deserve one.

Software Timer

A fixed-size static pool of one-shot and auto-reload timers, built entirely on the existing systick_get_ms() abstraction already used by every _timeout primitive. Auto-reload timers schedule their next deadline from the previous deadline rather than from "now" — a timer serviced slightly late doesn't drift progressively later over many periods, the same anti-drift principle later reused by the Jitter Monitor.

Verified on both boards: exact fire counts for a one-shot (500ms) and a periodic timer (200ms) running concurrently, timer_stop() correctly halting an active periodic timer mid-run, and pool-exhaustion behavior returning an invalid handle once all 16 slots are in use.

Tickless Idle — and the config system it needed

The idle task was rewritten to compute the soonest of (a) the next blocked task's remaining delay and (b) the next active software timer's deadline, then put SysTick into a single long-period sleep instead of ticking every 1ms with nothing to do. Measuring the actual benefit required a dedicated counter — comparing idle-loop iteration counts between tickless-off and tickless-on across an identical 2.5-second workload.

Made opt-in rather than default, via a small tamgaos_config.h — both a compile-time default (TAMGAOS_TICKLESS_IDLE_DEFAULT) and a runtime sched_tickless_idle_enable()/disable() pair. Defaulting to off matters: a task that busy-spins on sched_yield() prevents the idle task from ever running at all, tickless or not, and an early ISR-safe-primitives test only worked once a low-priority keepalive task was added specifically to stop the idle task from sleeping through the test's own SysTick-based interrupt hook.

Deadline / Response-Time Monitor

Per-task begin()/end() timing with min/avg/max and an overrun counter against a configurable budget. Verified with a simulated variable-workload task — a periodic 10ms-budget cycle, four out of thirty cycles deliberately given a much heavier workload — and the monitor caught all four, with zero false positives, on both boards.

The metric here is response time, not execution time — if a higher-priority task or ISR preempts between begin() and end(), that time is included in the measurement. The module was deliberately relabeled from an earlier "WCET Monitor" name once this distinction became clear: true WCET requires static analysis tooling this project doesn't have, and claiming it without that tooling would be a real overstatement in a domain where the difference matters.

Jitter Monitor

Measures how far a periodic task's actual wake-up time deviates from its expected schedule — independent of how long the task's own work takes, which is what the Deadline Monitor already covers. The expected time for the next cycle is advanced from the previous expected time, not from "now," for the same anti-drift reason used in the Software Timer.

The steady task's flat 2ms figure across min/avg/max isn't a context-switch cost — actual PendSV context switching on a 480MHz Cortex-M7 is sub-microsecond. It's the SysTick tick granularity itself: a 1ms-resolution scheduler has an inherent quantization error in exactly this range, separate from any real per-switch overhead.

ISR-Safe Primitives

Non-blocking queue_send_from_isr(), queue_receive_from_isr(), event_set_from_isr(), and event_clear_from_isr() variants — safe to call from a real UART or CAN RX interrupt, unlike the ordinary blocking queue_send()/event_wait() which would hang the CPU if ever called from ISR context. Tested from an actual interrupt via a weak systick_isr_hook() override rather than simulated from task context.

A task blocked on ordinary queue_receive() woke with 0ms measured latency when notified from the real SysTick ISR. A deliberate flood test — 1000 ISR-context sends against a 4-slot queue — correctly rejected 977 of them with an immediate error return instead of ever hanging the interrupt.

Task Notification

The lightest signal path in the kernel — a single value living directly in the target task's own task_t, no queue or event group needed. task_notify_give() reuses the already-proven-ISR-safe sched_wake_task() internally.

Stack High-Water Mark

Each task's stack is filled with a known pattern (0xA5) at creation, above the existing MPU guard region and canary word — scanning from the bottom up for the first still-untouched byte reveals the deepest point the stack has ever reached. Two tasks doing deliberately different recursion depths (2 vs. 15 levels) showed a consistent ~56–57 bytes per call level on both boards, and the deep task measured identically at 900 bytes on both STM32 and K64F — a tidy cross-architecture consistency check for a tool whose entire job is measuring architecture-specific stack usage.

The sensor that wasn't a BMP180

A full BMP180 driver was written first — 11 factory calibration coefficients read from EEPROM, Bosch's fixed-point compensation formula transcribed exactly from the datasheet, altitude derived from the barometric formula, a zero-reference calibration function so the current position reads as 0m. None of it worked. i2c_read() on the chip ID register returned -1 every time.

The eventual fix wasn't in the driver at all — it was a bus scanner that swept every valid 7-bit I2C address and reported which ones actually ACK'd. The sensor answered at 0x76, not the BMP180's fixed 0x77. That address, combined with the module's actual silkscreen text, identified it as a BMP280 — a completely different chip with a different register map, different calibration format, and a different (though related) compensation algorithm.

The BMP280 driver, once written against the correct chip ID (0x58) and register map, worked on the first flash — clean temperature/pressure readings, and a subsequent zero-altitude test showed the sensor tracking real vertical movement: lifted roughly a meter, the computed altitude climbed from 0.0m to 1.4m and back down to 0.0m on descent, tracking noise-level fluctuations of about ±0.2m throughout.

Root cause — the bus scan that broke a sensor that had just been working

Before the BMP280 misidentification was resolved, the bus scanner itself produced a genuinely alarming result: it reported zero devices — including the MPU6050, which had been streaming clean roll/pitch data moments earlier in a completely separate test binary.

After the fix, the same bus scanner correctly found the MPU6050 at 0x68 and, once wired in, the BMP280 at 0x76 — in the same scan, on the same bus, without a power cycle in between.

An ARINC825-inspired message layer over the existing CAN bus

No new hardware here — this restructures the same FDCAN/FlexCAN link proven in part 8 around a few organizing principles borrowed from ARINC825 (the CANaerospace-derived avionics messaging standard), not a full implementation of the standard itself: categorized CAN ID ranges by message criticality, a standard three-field header on every frame (node ID, sequence number, data type), and a periodic per-node heartbeat.

The practical payoff: the actuator node's fail-safe logic now triggers off a missing heartbeat, not off a missing attitude message specifically — distinguishing "sensor node is alive but between updates" from "sensor node is gone" in a way the original bare CAN link couldn't. Sequence-gap detection, present in the frame format since part 8 but never actually checked until now, is finally wired up per data-type stream.

This is explicitly not a certified or complete ARINC825 stack — no node discovery service, no parameter query protocol, none of the hundreds of pages the real standard covers. It borrows the organizing ideas that transfer cleanly to a two-node bus and leaves the rest out.