How to Handle Arduino "Stalled" with Motor at High Speed

Hi, I'm designing a semi autonomous medium sized RC watercraft with motor, rudder etc. I'm using the nrf24l01 wireless units to use a wireless remote to control different things on the watercraft. There is also a semi-autonomous mode I'm developing. The exact use case is complicated so I'll keep things simple. This post is mainly concerned with the safety elements with using an Arduino with this sort of design.

MAIN QUESTION:
WHAT IF the Arduino mega unit on the watercraft:
-stalls out?
-out of memory stalls out?
-endless loop? (unlikely)
If this were to happen the motor PPM signal would remain the last used previous value. This could be dangerous as the watercraft could go off endlessly until the battery is dead. It could hit something etc. What can be done to handle this situation?

Here's the safety that I've already implemented.

  1. If the nrf24l01 wireless radio connection fails transmission for more than 2 sec, shut off motor.

  2. If the nrf24l01 wireless radio connection gets the same exact transmission motor signal for more than 2 sec, shut off motor. (i.e. if wireless connection motor signal stalls at 50% endlessly, shut off motor. It should never be a single value. The throttle button will likely hover up or down a specific amount due to the physical analog linear hall effect sensor controlling the throttle.

IDEAS THAT I HAVE THAT MIGHT (SORT-OF) SOLVE THIS:
Have a separate Arduino NANO unit connected to the main mega board. This NANO unit would communicate via serial communication to the main mega unit. This separate NANO arduino board would have one and only one job: Forward the PPM signal to the motor.
The main mega Arduino would send the motor signal to the NANO via serial and if the main mega board stalls out, that NANO could detect this and then shut off the motor. This would keep the code and memory on the NANO simple to reduce the chance of the NANO stalling out to a very small chance.

Any other ideas?

What do you mean by this ?

If the system runs out of memory then all bets are off and anything could happen

The code in the loop will be repeated

Isn't this the purpose of a watchdog timer?

Thanks for that tip. That might be a great next level of safety. I'll check it out.

The situation has to be avoided. Start debugging your code for the reason of the trouble.

Do you mean the Arduino code crashes? That's a job for a watchdog of some sort. Memory issues can be finessed by using only statically allocated memory.

If your broadcast commands include a timestamp or sequence number you can detect repeated transmissions (with a sequence number you can also detect lost packets).

Make all your commands idempotent(*), and send important commands (like emergency stop) repeatedly to allow for lost packets.

Normally you'd implement a keepalive signal for a comms link - every n seconds a keepalive packet is sent, whether or not there's any change in command, and if the receiver sees too long without any packet, it assumes control is lost and shuts down.

(*) idempotent means receiving the command several times means the exact same as receiving it once, ie "turn left by 10 degrees" is not idempotent, whereas "turn to heading 160" is idempotent.

Learned a new word today :slight_smile: