feat: Add fault propagation to FaultController

[jorgesg82]

Summary

Add automatic fault propagation to FaultController so that when a board enters FAULT, it sends the FAULT order (ID 0) to all registered TCP peers, and conversely detects incoming FAULT orders from peers to enter FAULT automatically.

Changes

FaultController.hpp

• Added #ifdef STLIB_ETH guarded includes for Order.hpp and OrderProtocol.hpp
• New public API: register_fault_propagation(OrderProtocol* socket, Order* fault_order)
• New private members: FaultPropagationTarget struct, static storage for up to 8 targets, propagate_fault(), on_fault_order_received()

FaultController.cpp

• register_fault_propagation(): stores socket+order pair and replaces the order's callback with on_fault_order_received so that when the FAULT order arrives on that socket, FaultController enters FAULT automatically.
• on_fault_order_received(): calls request_fault() — this is the reception path.
• propagate_fault(): iterates all registered sockets and sends the FAULT order via send_order().
• request_fault() now calls propagate_fault() inside the if (!faulted) block — so propagation only fires on the initial fault entry, not on subsequent duplicate calls.

Loop Prevention

The if (!faulted) guard in request_fault() is the only loop breaker. Each board propagates exactly once, on the !faulted → faulted transition. No fault_received_from_peer flag needed.

Designed for star topology (VCU at center):

Scenario	Sequence
Local fault (e.g. HVBMS faults)	HVBMS: !faulted → faulted → propagate to VCU. VCU: !faulted → faulted → propagate to CS, HVBMS, PCU, LCU. All replies: already faulted → stop.
CS commands FAULT to VCU	VCU: !faulted → faulted → propagate to CS, HVBMS, PCU, LCU. All replies: already faulted → stop.

• Works with both Socket* and ServerSocket* (both inherit from OrderProtocol).
• No-op on boards built without STLIB_ETH (all code guarded).

Usage (application side)

// After creating sockets and the FAULT order:
FaultController::register_fault_propagation(socket_a, fault_order);
FaultController::register_fault_propagation(socket_b, fault_order);
// ...

Registration enables both reception (callback hijack) and sending (propagation on local fault). Without registration, neither works.

[github-actions]

ST-LIB Release Plan

• Current version: 6.2.0
• Pending changesets: 2
• Highest requested bump: minor
• Next version if merged now: 6.3.0

Pending changes

• minor Add fault propagation to FaultController for sending FAULT order to remote peers with single-shot loop prevention via the !faulted guard (.changesets/fault-propagation.md)
• patch try to fix input capture by reducing noise in interrupt callback and add hardware filtering when configuring the input capture (.changesets/fix-ic-noise.md)

[Copilot]

Pull request overview

Adds Ethernet-enabled fault propagation to FaultController so that entering FAULT locally broadcasts a FAULT order to registered TCP peers, and receiving a FAULT order from a peer forces the local controller into FAULT while suppressing re-propagation loops.

Changes:

• Introduces FaultController::register_fault_propagation(OrderProtocol*, Order*) (guarded by STLIB_ETH) plus internal tracking of up to 8 propagation targets.
• Adds reception path via an order callback (on_fault_order_received) that triggers request_fault(), and a send path (propagate_fault()) invoked only on first transition into FAULT.
• Adds a changeset documenting the new (backwards-compatible) feature.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
Src/ST-LIB_HIGH/Protections/FaultController.cpp	Implements registration, reception callback, and propagation-on-fault entry (guarded by STLIB_ETH).
Inc/ST-LIB_HIGH/Protections/FaultController.hpp	Declares the new public API and the private propagation state/handlers (guarded by STLIB_ETH).
.changesets/fault-propagation.md	Adds release note entry for the new fault propagation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

[jorgesg82]

Copilot Review Responses

Addressed 4 of 7 comments in 6a61145e:

#	Comment	Action
1+5	Propagation state never reset in install_runtime()/clear()	Fixed — reset_runtime_storage() now clears propagation_targets and propagation_target_count under STLIB_ETH. Both install_runtime<> and TestAccess::FaultController::clear() call reset_runtime_storage(), so both paths are covered.
3	Hard-coded diagnostic metadata (line=0, file="")	Fixed — on_fault_order_received() now uses __LINE__, __func__, __FILE__.
4	propagate_fault() doesn't null-check fault_order	Fixed — added && target.fault_order != nullptr guard.
6	Changeset missing blank line after summary:	Fixed — added blank line + extra context per template.
2	register_fault_propagation doesn't validate order ID == 0	Won't fix — the API is intentionally generic. The application controls which Order* it registers; coupling ST-LIB to a specific order ID would be a layering violation.
7	No unit tests for STLIB_ETH paths	Won't fix in this PR — the test suite doesn't build with STLIB_ETH defined, so testing these paths requires test infrastructure changes outside this PR's scope.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[jorgesg82]

Re: boot-time fault clearing propagation targets

Valid catch. Fixed in b7b229fd.

Root cause: reset_runtime_storage() was clearing propagation_targets, but it's called by reconstruct_runtime_machine() which is invoked by rebuild_as_fault() during request_fault() when !runtime_started. This cleared targets before propagate_fault() ran.

Fix: Moved the propagation state reset out of reset_runtime_storage() and into:

• install_runtime<>() — resets targets on policy reinstall (after reconstruct_runtime_machine)
• TestAccess::FaultController::clear() — resets targets for test isolation

reconstruct_runtime_machine() (and by extension rebuild_as_fault()) no longer touches propagation state, so boot-time faults propagate correctly.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

[jorgesg82]

Copilot Review Round 3 Responses

Addressed 2 of 5 new comments in d781bb5b:

#	Comment	Action
3	send_order() return value ignored; emit diagnostic on failure	Fixed — propagate_fault() now checks the send_order() return and emits a runtime_warning diagnostic + flush_urgent() on failure.
5	Changeset summary says "suppressing re-propagation on received faults" — stale wording	Fixed — reworded to "with single-shot loop prevention via the !faulted guard".
1	register_fault_propagation should return bool for null/capacity failures	Won't fix — the only caller is init-time configuration in VCU.hpp. A return value would be ignored. If registration fails, the board simply doesn't propagate — which is a misconfiguration bug, not a runtime failure.
2	Validate fault_order->get_id() == 0 and return bool	Won't fix — same reasoning as round 2: the API is intentionally generic. Coupling ST-LIB to a specific order ID would be a layering violation.
4	No unit tests (dup of earlier comment)	Won't fix in this PR — same as before: test suite doesn't build with STLIB_ETH defined.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.