chore: 移除四个一次性邮箱楔死探针

_probe_wedge/_probe_wedge2/_probe_stuck/_probe_scan 已完成使命: 根因查明为 SSC 的 u16EscAddrSendMbx 错位 —— 响应帧写到 SM1 start+4/+8 且逐会话累积 (断电才清零), 主站从固定 0x1200 读永远对不上帧头; SM 寄存器本身恒正确, 所以"SM0/SM1 配置正常却持续失败"就是该错位的判据。结论已沉淀进 ecat_server.py config_map 失败分支的 SM 现场转储(扫全 4 个 SM, 0x0800+8n)与注释, 固件 1.5.52+ 已加守护自动写回恢复。探针不再需要。
2026-09-03 21:42:45 +08:00
parent 85d326d445
commit 3bfa240dfa
4 changed files with 0 additions and 346 deletions
@@ -1,69 +0,0 @@
-"""_probe_scan.py — 精确定位响应帧头在 SM1 RAM 的偏移 + SM0 请求侧同步 dump。"""
-import struct
-import sys
-import time
-
-import ecat_server as es
-import pysoem
-
-r = es.api_open({"substr": "I226"})
-if not r.get("ok"):
-    sys.exit(1)
-m = es.g_master
-s = m.slaves[0]
-
-
-def fprd(addr, size):
-    try:
-        return bytes(s._fprd(addr, size, 20000))
-    except Exception:
-        return None
-
-
-def sm_reg(addr):
-    d = fprd(addr, 8)
-    if d is None:
-        return None
-    start, length = struct.unpack("<HH", d[:4])
-    return {"start": start, "len": length, "ctl": d[4], "st": d[5], "act": d[6]}
-
-
-m.state = pysoem.INIT_STATE | pysoem.STATE_ACK
-m.write_state()
-m.state_check(pysoem.INIT_STATE, 1_000_000)
-m.config_init()
-m.state = pysoem.PREOP_STATE | pysoem.STATE_ACK
-m.write_state()
-print("PREOP:", "OK" if m.state_check(pysoem.PREOP_STATE, 1_000_000) == pysoem.PREOP_STATE else "FAIL", flush=True)
-
-sm0, sm1 = sm_reg(0x0800), sm_reg(0x0808)
-print(f"SM0: start=0x{sm0['start']:04X} len={sm0['len']} | SM1: start=0x{sm1['start']:04X} len={sm1['len']}", flush=True)
-
-# 注入请求(SOEM 标准格式 SDO 读 0x1018:01)
-req = bytes([0x0A, 0x00, 0x00, 0x00, 0x00, 0x03,
-             0x00, 0x10, 0x40, 0x01, 0x18, 0x10, 0x01, 0x00, 0x00, 0x00])
-mbx = (req + bytes(sm0["len"]))[:sm0["len"]]
-s._fpwr(sm0["start"], mbx)
-print("请求已写入 SM0", flush=True)
-time.sleep(0.2)
-
-# 扫描 SM1 start-8 .. start+72
-base = sm1["start"]
-d = fprd(base - 8, 80)
-if d:
-    print(f"\nSM1 RAM 扫描 [0x{base - 8:04X} .. 0x{base + 72:04X}]:", flush=True)
-    for i in range(0, 80, 8):
-        chunk = d[i:i + 8]
-        off = i - 8
-        mark = " <-- SM1.start" if off == 0 else ""
-        print(f"  {off:+4d} (0x{base + off:04X}): {chunk.hex().upper()}{mark}", flush=True)
-
-st1 = sm_reg(0x0808)
-print(f"\nSM1 st=0x{st1['st']:02X}(bit3={st1['st'] >> 3 & 1})", flush=True)
-
-# 同步看 SM0 侧(请求是否被读走)
-st0 = sm_reg(0x0800)
-print(f"SM0 st=0x{st0['st']:02X}(bit3={st0['st'] >> 3 & 1})", flush=True)
-
-es.api_close({})
-print("DONE", flush=True)
@@ -1,77 +0,0 @@
-"""_probe_stuck.py — 验证"SM1 响应滞留 → 邮箱死锁"假说。
-板上现状: SM1 挂着一个未读走的响应(上一探针注入)。实验:
-  1. SOEM SDO 读 → 预期失败(复现楔死现象)
-  2. 手动读走 SM1 全长(清 bit3) → 模拟"主站把滞留响应读掉"
-  3. SOEM SDO 再读 → 是否恢复?
-若恢复 = 根治方向明确:邮箱死锁的物理本质是响应滞留,主站侧可自愈,从站侧可加超时复位。
-"""
-import struct
-import sys
-
-import ecat_server as es
-import pysoem
-
-r = es.api_open({"substr": "I226"})
-if not r.get("ok"):
-    sys.exit(1)
-m = es.g_master
-s = m.slaves[0]
-
-
-def fprd(addr, size):
-    try:
-        return bytes(s._fprd(addr, size, 20000))
-    except Exception:
-        return None
-
-
-def sm1_state(tag):
-    d = fprd(0x0808, 8)
-    if d is None:
-        print(f"[{tag}] SM1 读失败", flush=True)
-        return None
-    start, length = struct.unpack("<HH", d[:4])
-    st = d[5]
-    print(f"[{tag}] SM1 st=0x{st:02X}(bit3={st >> 3 & 1} 读邮箱满)", flush=True)
-    return {"start": start, "len": length, "st": st}
-
-
-m.state = pysoem.INIT_STATE | pysoem.STATE_ACK
-m.write_state()
-m.state_check(pysoem.INIT_STATE, 1_000_000)
-m.config_init()
-m.state = pysoem.PREOP_STATE | pysoem.STATE_ACK
-m.write_state()
-print("PREOP:", "OK" if m.state_check(pysoem.PREOP_STATE, 1_000_000) == pysoem.PREOP_STATE else "FAIL", flush=True)
-
-# --- 1. 现状: SM1 挂着滞留响应 ---
-sm1_state("实验前")
-
-print("\n--- SOEM SDO #1(预期失败) ---", flush=True)
-try:
-    d = bytes(s.sdo_read(0x1000, 0, 8))
-    print(f"  成功?! = {d.hex().upper()}", flush=True)
-except Exception as e:
-    print(f"  失败: {type(e).__name__}: {e}", flush=True)
-
-sm1_state("SDO#1 后")
-
-# --- 2. 读走 SM1 滞留响应(全长度读取,读到末字节才清 bit3) ---
-sm1 = sm1_state("读滞留前")
-if sm1 and (sm1["st"] & 0x08):
-    d = fprd(sm1["start"], sm1["len"])
-    print(f"  读走 SM1 {sm1['len']}B: {d[:16].hex().upper()}...", flush=True)
-    sm1_state("读走后")
-
-# --- 3. SOEM SDO 再试 ---
-print("\n--- SOEM SDO #2(读走滞留后) ---", flush=True)
-try:
-    d = bytes(s.sdo_read(0x1000, 0, 8))
-    print(f"  成功! = {d.hex().upper()}", flush=True)
-    print(">>> 假说成立:响应滞留是死锁根源,读走即恢复!", flush=True)
-except Exception as e:
-    print(f"  仍失败: {type(e).__name__}: {e}", flush=True)
-    sm1_state("SDO#2 后")
-
-es.api_close({})
-print("DONE", flush=True)
@@ -1,107 +0,0 @@
-"""_probe_wedge.py — 楔死现场逐环节定位(纠正之前 0x0810/0x0818=SM2/SM3 的标号错误,真邮箱 SM 是 0x0800/0x0808)。
-
-环节定位:
-  A. FPWR 写 SM0 RAM 的 WKC —— 写都进不去 = SM0 硬件层被拒(disabled/错址)
-  B. 写入后 0x220 bit0(SM0 写事件)是否置位 —— ESC 没置事件 = ESC 硬件楔死
-  C. 200ms 后 bit0 是否被 SSC 清掉 + SM1 status bit3(读邮箱满)是否置位 —— 没处理 = SSC 软件死了
-  D. SM1 RAM 里有没有滞留的旧响应(bSendMbxIsFull 死锁证据)
-"""
-import struct
-import sys
-import time
-
-import ecat_server as es
-import pysoem
-
-r = es.api_open({"substr": "I226"})
-if not r.get("ok"):
-    print("open 失败,板子可能已断电", flush=True)
-    sys.exit(1)
-m = es.g_master
-s = m.slaves[0]
-
-
-def fprd(addr, size):
-    try:
-        return bytes(s._fprd(addr, size, 20000))
-    except Exception:
-        return None
-
-
-def dump(tag):
-    al = fprd(0x0130, 8)
-    ev = fprd(0x0220, 2)
-    am = fprd(0x0204, 2)
-    sm0 = fprd(0x0800, 8)
-    sm1 = fprd(0x0808, 8)
-    def fmt(d):
-        if d is None:
-            return "ERR"
-        start, length = struct.unpack("<HH", d[:4])
-        return f"start=0x{start:04X} len={length} ctl=0x{d[4]:02X} st=0x{d[5]:02X} act=0x{d[6]:02X} pdi=0x{d[7]:02X}"
-    al_s = f"AL=0x{struct.unpack('<H', al[:2])[0]:04X} code=0x{struct.unpack('<H', al[4:6])[0]:04X}" if al else "AL=ERR"
-    ev_v = struct.unpack("<H", ev)[0] if ev else -1
-    am_v = struct.unpack("<H", am)[0] if am else -1
-    print(f"[{tag}] {al_s} 0x220=0x{ev_v:04X}(bit0={ev_v & 1}bit1={(ev_v >> 1) & 1}) 0x204=0x{am_v:04X}", flush=True)
-    print(f"        SM0(0x0800): {fmt(sm0)}", flush=True)
-    print(f"        SM1(0x0808): {fmt(sm1)}", flush=True)
-    return sm0, sm1, ev_v
-
-
-# --- 阶段 1: PREOP 下探(邮箱 SM 应处于使能态) ---
-m.state = pysoem.INIT_STATE | pysoem.STATE_ACK
-m.write_state()
-m.state_check(pysoem.INIT_STATE, 1_000_000)
-m.config_init()
-m.state = pysoem.PREOP_STATE | pysoem.STATE_ACK
-m.write_state()
-st = m.state_check(pysoem.PREOP_STATE, 1_000_000)
-print(f"PREOP state_check = 0x{st & 0x0F:02X}", flush=True)
-sm0, sm1, ev = dump("PREOP 稳态")
-
-if sm0 is None or sm1 is None:
-    print("SM0/SM1 读取失败", flush=True)
-    es.api_close({})
-    sys.exit(1)
-
-# SM0/SM1 RAM 内容(滞留响应证据)
-mbx0_addr, mbx0_len = struct.unpack("<HH", sm0[:4])
-mbx1_addr, mbx1_len = struct.unpack("<HH", sm1[:4])
-print(f"邮箱 RAM: SM0@0x{mbx0_addr:04X}({mbx0_len}B) SM1@0x{mbx1_addr:04X}({mbx1_len}B)", flush=True)
-for name, addr, ln in (("SM0", mbx0_addr, mbx0_len), ("SM1", mbx1_addr, mbx1_len)):
-    d = fprd(addr, 16)
-    if d:
-        print(f"        {name} RAM[0:16] = {d.hex().upper()}", flush=True)
-
-# --- 阶段 2: 手动注入一个合法 CoE SDO 读请求(0x1000:00 expedited upload) ---
-# 邮箱帧: len=0x000A addr=0x0000 pri=0 type=0x03(CoE, counter=0) | CANOpen=0x1000+8(UP_REQ) idx=0x1000 sub=0
-req = struct.pack("<HHBB", 10, 0, 0, 0x03) + struct.pack("<HBBB", 0x1000, 0x100 & 0xFF, 0x00, 0x00)[:5]
-req = bytes([0x0A, 0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00])
-print(f"\n--- 阶段A: FPWR 写 SM0 RAM(0x{mbx0_addr:04X}) {req.hex().upper()} ---", flush=True)
-try:
-    s._fpwr(mbx0_addr, req)
-    print("  写入 OK (WKC=1) —— SM0 硬件接受写入", flush=True)
-except Exception as e:
-    print(f"  写入失败: {type(e).__name__}: {e} —— SM0 硬件拒绝(环节A死点)", flush=True)
-
-ev2 = fprd(0x0220, 2)
-if ev2:
-    v = struct.unpack("<H", ev2)[0]
-    print(f"  阶段B: 0x220=0x{v:04X} bit0(SM0写事件)={v & 1} —— {'已置位' if v & 1 else '未置位!ESC 硬件楔死'}", flush=True)
-
-# --- 阶段 3: 给 SSC 200ms 处理时间 ---
-time.sleep(0.2)
-sm0b, sm1b, ev3 = dump("注入请求 200ms 后")
-sm1_st = sm1b[5] if sm1b else 0
-print(f"  阶段C: 0x220 bit0={ev3 & 1}(应=0,SSC 已读走) SM1 st=0x{sm1_st:02X}(bit3={sm1_st >> 3 & 1},应=1,响应就绪)", flush=True)
-if ev3 is not None and (ev3 & 1):
-    print("  >>> bit0 仍挂起:SSC 轮询没处理邮箱(环节C死点:MainLoop/ECAT_Main 邮箱分支死了)", flush=True)
-elif sm1_st & 0x08:
-    d = fprd(mbx1_addr, 16)
-    print(f"  阶段D: SM1 响应 RAM = {d.hex().upper() if d else 'ERR'}", flush=True)
-    print("  >>> SSC 活着!邮箱处理正常 —— 楔死只在特定条件下", flush=True)
-else:
-    print("  >>> bit0 被清了但 SM1 无响应:SSC 收到了但没回(处理链中途死)", flush=True)
-
-es.api_close({})
-print("DONE", flush=True)
@@ -1,93 +0,0 @@
-"""_probe_wedge2.py — 按真实邮箱协议探针: 检查写邮箱空 → 写满 256B → 查事件/响应。"""
-import struct
-import sys
-import time
-
-import ecat_server as es
-import pysoem
-
-r = es.api_open({"substr": "I226"})
-if not r.get("ok"):
-    sys.exit(1)
-m = es.g_master
-s = m.slaves[0]
-
-
-def fprd(addr, size):
-    try:
-        return bytes(s._fprd(addr, size, 20000))
-    except Exception:
-        return None
-
-
-def sm_reg(addr):
-    d = fprd(addr, 8)
-    if d is None:
-        return None
-    start, length = struct.unpack("<HH", d[:4])
-    return {"start": start, "len": length, "ctl": d[4], "st": d[5], "act": d[6],
-            "raw": d.hex().upper()}
-
-
-def show(tag):
-    sm0, sm1 = sm_reg(0x0800), sm_reg(0x0808)
-    ev = fprd(0x0220, 2)
-    al = fprd(0x0130, 8)
-    ev_v = struct.unpack("<H", ev)[0] if ev else -1
-    al_v = struct.unpack("<H", al[:2])[0] if al else -1
-    print(f"[{tag}] AL=0x{al_v:02X} 0x220=0x{ev_v:04X} SM0[st=0x{sm0['st']:02X} act=0x{sm0['act']:02X}] "
-          f"SM1[st=0x{sm1['st']:02X} act=0x{sm1['act']:02X}] (SM0.bit3={sm0['st'] >> 3 & 1}写满 SM1.bit3={sm1['st'] >> 3 & 1}读满)",
-          flush=True)
-    return sm0, sm1, ev_v
-
-
-m.state = pysoem.INIT_STATE | pysoem.STATE_ACK
-m.write_state()
-m.state_check(pysoem.INIT_STATE, 1_000_000)
-m.config_init()
-m.state = pysoem.PREOP_STATE | pysoem.STATE_ACK
-m.write_state()
-print("PREOP:", "OK" if m.state_check(pysoem.PREOP_STATE, 1_000_000) == pysoem.PREOP_STATE else "FAIL", flush=True)
-
-sm0, sm1, ev = show("稳态")
-
-# 合法 CoE SDO 读 0x1000:00(expedited), padded 到整个邮箱长度 256B
-req_hdr = bytes([0x0A, 0x00, 0x00, 0x00, 0x00, 0x03,  # len=10, addr=0, pri=0, type=CoE(cnt=0)
-                0x10, 0x00,  # CANOpen = 0x0010 (SDO req<<12 | 0x1000? 不对, 服务号 0x10?) —— 用标准 SOEM 格式
-                0x00, 0x10,  # Command = 0x40(up req, exp)
-                0x00, 0x10,  # Index = 0x1000
-                0x00, 0x00]) # sub=0, +pad
-# SOEM ecx_SDOread 的帧: CANOpen = (ECT_COES_SDOREQ<<12)=0x1000 | number; Command=0x40; Index; SubIndex
-req = bytes([0x0A, 0x00, 0x00, 0x00, 0x00, 0x03,
-             0x00, 0x10, 0x40, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00])
-mbx = (req + bytes(sm0["len"]))[:sm0["len"]]
-print(f"\n写满 SM0 RAM {sm0['len']}B(合法 CoE 读 0x1000:00)...", flush=True)
-try:
-    s._fpwr(sm0["start"], mbx)
-    print("  写入 OK (WKC=1)", flush=True)
-except Exception as e:
-    print(f"  写入失败: {e}", flush=True)
-
-sm0b, sm1b, ev2 = show("写入后立即")
-time.sleep(0.2)
-sm0c, sm1c, ev3 = show("写入后 200ms")
-
-if sm1c and (sm1c["st"] & 0x08):
-    d = fprd(sm1c["start"], 32)
-    print(f"*** SSC 响应了! SM1 RAM = {d.hex().upper() if d else 'ERR'}", flush=True)
-    print(">>> ESC+SSC 完全正常,楔死另有其因", flush=True)
-else:
-    print("\nSSC 无响应。检查 0x220 bit0 事件是否置位过...", flush=True)
-    if sm0c and (sm0c["st"] & 0x08):
-        print(f"SM0.bit3(写满)={sm0c['st'] >> 3 & 1} —— 写满标志挂着(主站侧协议已触发)", flush=True)
-        # 模拟 SSC 解锁: 读 SM0 首 word + 末 word
-        fprd(sm0c["start"], 2)
-        fprd(sm0c["start"] + sm0c["len"] - 2, 2)
-        sm0d, sm1d, ev4 = show("模拟 SSC 解锁后")
-        if not (sm0d["st"] & 0x08):
-            print("解锁有效(SM0.bit3 清零) —— SM 状态机活着", flush=True)
-    else:
-        print(f"SM0.bit3(写满)={sm0c['st'] >> 3 & 1 if sm0c else '?'} —— 写满标志都没置!写到末字节也没触发 mailbox full", flush=True)
-
-es.api_close({})
-print("DONE", flush=True)