Safe on failure

A sensor gets hit by a meteorite, a cable is cut, someone removes the wrong display. Something always fails. The only question is what your setup does then.

The safe direction per device#

For every device your chip switches you decide beforehand: what is the safe state when the chip no longer knows anything?

There is no general rule like “everything off on failure”. An alarm that switches off on a failure is useless.

Catch NaN everywhere#

Every value you read with Average can become NaN. One property helps here: every comparison with NaN is false. If you phrase a condition so that “true” is the unsafe direction, NaN lands in the safe state by itself:

slt heat temp LOWER      # NaN: 0 = heater off, safe
slt warn temp COLD       # NaN: 0 = no warning, wrong

The second line tips into the wrong direction on a failure. There you need an explicit snan:

snan missing temp
or warn warn missing     # no sensor: warning on

Go through every line that uses a reading and ask: what happens here with NaN?

State after a restart#

In the game the chip keeps its registers when you upload new code or re-insert it. Only sp and the program line start at 0 again. So a state register can be sitting in the middle of an old step. That is why a block before the start label belongs in every script, bringing everything into a known state:

move step 0          # sequence idle
move heat 0          # heater off
start:
yield