P13 Modbus 控制窗口打通：COMMIT/START 分离、命令应答与一致性状态读取 + PAUSE/RESUME 修复

本批完成内容： Modbus 控制窗口（新增 plsr_modbus_control/data + modbus_data_store）： - COMMIT 与 START 分离：COMMIT 校验通过后生效；COMMIT 后再修改 S0/S1，START 返回 BUSY，要求重新提交。 - 命令支持：停止、暂停、继续、位置设置、清零、保存；重复命令序号幂等，不重复执行。 - 四轴状态均可读取；32/64 位状态用首尾版本号保证一致性（防撕裂读取）。 - 控制窗口基址可配置：P13 暂用 D1200~D1455（非信捷固定地址），S0=D1600、S1=D1700。 PAUSE/RESUME 闭环修复： - PAUSE 不再终止当前 S0 路径，保留当前段与已发脉冲； RESUME 从 S2 起始速度重新激活速度曲线。 - 硬件定时器恢复时不清零脉冲计数，任务累计连续。 - 暂停回差补偿段时恢复专用速度参数。 - STOP_DECEL 正常收到减速完成事件并进入 STOPPED。 - Python 脚本增加"频率非零 + 计数增长"恢复判定，不再把 ACCEL+0Hz 误判为恢复成功。测试： - Host：3500 项检查全部通过（含控制窗口/命令/一致性/幂等）。 - IAR：0 errors，0 warnings。 - 上板验证（逻辑分析仪，Q0）： START 后 1000Hz 平滑加速至 2000Hz → 稳定段 → PAUSE 约 200ms 平滑减速停止，暂停期间 0 边沿恒低 → 重复 PAUSE 无第二次动作 → RESUME 从 ~1000Hz 重新加速 → STOP_DECEL 平滑减速至停。全程 0 个 <10µs 毛刺、无截断尾脉冲、无意外重启。
1 月之前 · fdbbe71aea
--- a/Core/Src/main.c
+++ b/Core/Src/main.c
@@ -26,6 +26,7 @@
 #include "modbus_rtu_slave.h"
 #include "plc_device.h"
 #include "plsr_core.h"
 #include "plsr_modbus_control.h"
 #include "plsr_self_test.h"
 #include "stdio.h"
 /* USER CODE END Includes */
@@ -37,6 +38,13 @@

 /* Private define ------------------------------------------------------------*/
 /* USER CODE BEGIN PD */
 #define PLSR_BOARD_TEST_CW_CCW       (9U)
 #define PLSR_BOARD_TEST_FAST_REFRESH (10U)
 #define PLSR_BOARD_TEST_DYNAMIC_FREQ (11U)
 #define PLSR_BOARD_TEST_MODBUS_DATA  (12U)
 #define PLSR_BOARD_TEST_MODBUS_CONTROL (13U)
 #define PLSR_BOARD_TEST_SELECT       PLSR_BOARD_TEST_MODBUS_CONTROL
 #define PLSR_MODBUS_CONTROL_TEST_BASE (1200U)

 /* USER CODE END PD */

@@ -80,6 +88,20 @@ static void AppTaskStart(void *pArg)
     * 初始化函数会立即启动USART1的DMA空闲接收
     */
    (void)ModbusSlaveInit(&huart1, MODBUS_SLAVE_DEFAULT_ADDRESS);
 #if PLSR_BOARD_TEST_SELECT == PLSR_BOARD_TEST_MODBUS_DATA
    /* P12 must be queued after the Modbus register store is ready. */
    if (PlsrModbusDataSelfTestQueue() != PLSR_RESULT_QUEUED)
    {
        Error_Handler();
    }
 #elif PLSR_BOARD_TEST_SELECT == PLSR_BOARD_TEST_MODBUS_CONTROL
    if ((PlsrModbusControlSelfTestPrepare() != PLSR_RESULT_OK)
        || (PlsrModbusControlInit(PLSR_MODBUS_CONTROL_TEST_BASE)
            != PLSR_RESULT_OK))
    {
        Error_Handler();
    }
 #endif
    //ModbusRetainedRegistersLoad();
    while (1)
    {
@@ -108,6 +130,7 @@ static void AppTaskStart(void *pArg)
         * 每1ms轮询一次，
         */
        ModbusSlavePoll();
        PlsrModbusControlPoll();
       // ModbusRetainedRegistersPoll();

        if (ModbusSlaveIsConnected(MODBUS_CONNECTION_TIMEOUT_MS) != 0U)
@@ -200,10 +223,19 @@ int main(void)
        Error_Handler();
    }

    /* 上电自测：延时 1s 后由 Q0/Q1 输出三段 AB 正交周期（验证后关闭）。 */
    /* 上电自测统一延时1s，当前P9配置见下方调用（验证后关闭）。 */
    HAL_Delay(1000U);
    /* P6 board test: Q0..Q3 run four independent PULSE/DIR jobs. */
    (void)PlsrFourAxisSelfTestQueue();
 #if PLSR_BOARD_TEST_SELECT == PLSR_BOARD_TEST_CW_CCW
    /* P9: Q0=CW, Q1=CCW; only one channel may pulse. */
    (void)PlsrCwCcwSelfTestQueue();
 #elif PLSR_BOARD_TEST_SELECT == PLSR_BOARD_TEST_FAST_REFRESH
    /* P10: Q0=1ms refresh, Q1=0.1ms refresh. */
    (void)PlsrFastRefreshSelfTestQueue();
 #elif PLSR_BOARD_TEST_SELECT == PLSR_BOARD_TEST_DYNAMIC_FREQ
    /* P11: automatic live-frequency schedule without Watch edits. */
    (void)PlsrDynamicFrequencySelfTestQueue();
 #endif
    //(void)PlsrDirectionLogicSelfTestQueue();
    OSStart();
    /* USER CODE END 2 */

--- a/Document/PLSR_document/ai问询记录/AI问询会话记录_2026.8.3-2026.8.9.md
+++ b/Document/PLSR_document/ai问询记录/AI问询会话记录_2026.8.3-2026.8.9.md
@@ -0,0 +1,309 @@
 # AI 问询会话记录（2026-08-03 ~ 2026-08-09）

 ---

 ## 周一（2026-08-03）：需求理解与地址映射设计

 **问：PLSR 指令的 S0/S1/S2/D 操作数分别是什么含义？我需要一份完整的语义说明来做解析层的接口设计。**
 答：S0 是段表起始地址，每段占 10 个字，字段依次为：目标频率（双字）、脉冲数或目标位置（双字，符号位表示方向）、加速时间、减速时间等；S1 是模式与起始段号，bit0 决定相对/绝对定位；S2 是参数组号，K0 对应 HSD460-539 固定区，K1~K4 对应 SFD950+ 的参数组（默认速度、加减速时间、最高速度、起始/终止速度、FOLLOW、前馈百分比、刷新代码等）；D 是输出轴号（Y0~Y3）。解析层要做的事：读取 S0/S1/S2 指向的软元件区 → 校验（段数上限、频率范围 1~100kHz、参数组合法性）→ 生成不可变任务快照 → 异步提交给核心执行。快照必须是"不可变"的：提交后不允许任何代码修改它，否则上位机在任务执行中改写 D 区数据会破坏执行一致性。

 **问：输出端口和定时器怎么对应？我查了手册，PF 口复用功能比较多，容易配错。**
 答：四路脉冲输出：Q0=PF6/TIM10_CH1（AF3）、Q1=PF8/TIM13_CH1（AF9）、Q2=PF7/TIM11_CH1（AF3）、Q3=PF9/TIM14_CH1（AF9）。时钟树：APB1 分频 4、APB2 分频 2，所以 TIM10/11 走 168MHz、TIM13/14 走 84MHz——这个时钟值必须写进轴映射表，不能四路都写 168MHz，否则 Q1/Q3 的实际频率会减半。GPIO 初始化用 AF_PP + 对应 AF 号，通道使能前输出级是断开的，不会有毛刺。

 **问：软元件存储怎么安排比较紧凑？HSD/SFD/SD/SM 都要有地址映射。**
 答：按四轴布局：HSD 384 字节（运行态 16 字/轴 + 配置区），SFD RAM 缓存 2080 字节覆盖 900~1419（每轴公共参数 130 字 + 4 套参数组各 20 字），SD 192 字节，SM 4 字节；轴间用宏常量 PLSR_SFD_AXIS_STRIDE=130 做偏移，杜绝魔法数。SFD 需要掉电保存——单独做持久化层：Flash 分页存储、写前擦除、加载失败自动回退出厂默认并置 PLSR_PERSISTENCE_DEFAULTED 标志，损坏数据自愈（保留最旧有效副本）。

 **问：S2 参数组有 K0~K4 五个，K0 和 K1~K4 的存储位置不一样？**
 答：对。K0 对应 HSD460-539（配置区，也是快照里默认参数组的来源）；K1~K4 对应 SFD 参数区（每套 20 字偏移）。解析时按 S2 操作数是常数还是寄存器地址来选：常数 0 取 HSD 区，常数 1~4 取 SFD 对应套，寄存器地址则运行时读取目标软元件。校验规则：默认速度 1~100000Hz、加减速时间非零、最高速度不低于默认速度、FOLLOW 1~100、前馈 0~100，非法则返回带定位信息的错误（错误块号 + 偏移）。

 ---

 ## 周二（2026-08-04）：状态机与命令体系设计

 **问：单轴运动状态机应该分几个状态？我之前设计的四态不够用，加减速和暂停分不开。**
 答：建议十态：IDLE / WAIT / ACCEL / RUN / DECEL / COMPLETED / STOPPED / PAUSED / ERROR / UNINITIALIZED。WAIT 是段间等待（ACT 计时/EXT 信号），ACCEL/RUN/DECEL 是运动三阶段，STOPPED 与 COMPLETED 分开（停止原因可查），PAUSED 从运动态进入、RESUME 恢复。所有转换走统一的 PlsrStateTransition 入口，用显式迁移表约束：比如 ACCEL 只允许去 RUN/DECEL/STOPPED/ERROR，PAUSED 只能去 RUN/DECEL/STOPPED；非法迁移直接返回错误，避免状态散落在各处 if 里改。

 **问：STOP、PAUSE、RESUME 这些命令怎么设计优先级？多个命令同时来怎么办？**
 答：命令队列固定深度，按优先级排序取最高者执行：STOP_IMMEDIATE（0）> STOP_DECEL（1）> PAUSE（2）> RESUME（3）> 其他（4）。同序号命令去重——记录 lastCommandSequence，重复序号直接返回上次结果，防止上位机重发造成二次执行。每个命令响应都带命令序号 + 轴状态 + 错误码，上位机可以确认"我发的命令到底执行了没有"。STOP_IMMEDIATE 直接关 PWM 停硬件并产生 STOP_IMMEDIATE_DONE 事件；STOP_DECEL 走受控减速（进入 DECEL 阶段平滑停）。

 **问：段间跳转（ACT/EXT/跳转链）在状态机里怎么表达？路径执行器每 tick 要做什么？**
 答：路径执行器（plsr_path）每 1ms tick 推进一次，内部维护当前段号、跳转链、WAIT/ACT 计时、EXT 信号轮询与完成标志，对外只返回 PATH_ACTION（NEXT_SEGMENT / WAIT / TERMINATE / ERROR），core 拿到 action 后统一应用到状态机——状态机本身不关心路径细节。两个边界必须处理：一是零脉冲跳转链，本轮预算耗尽时不能误启动一个 0 脉冲硬件段；二是极短段可能在 ACCEL 或 DECEL 阶段就完成，ACCEL/RUN/DECEL 三种状态都要能正确处理段完成事件，否则轴会卡在加速态整段。

 **问：事件体系怎么设计？段完成、任务完成这些怎么通知状态机？**
 答：每轴一个事件队列（位掩码），PlsrPostEvent 可从中断里调用；事件分两级：CRITICAL（软急停、限位、故障）每轮 PlsrProcess 最先处理，普通事件（ACCEL_COMPLETE、DECEL_COMPLETE、WAIT_BEGIN/COMPLETE、SEGMENT_COMPLETE、JOB_COMPLETE、STOP_IMMEDIATE_DONE）按序消费。中断里只 PostEvent，不做状态迁移——状态迁移全部在任务上下文完成，避免中断与任务的竞态。

 ---

 ## 周三（2026-08-05）：速度规划与测试框架

 **问：加减速曲线为什么用定点实现，不用浮点？F407 我记得是有 FPU 的。**
 答：F407 是 Cortex-M4F，有单精度 FPU——用定点不是硬件限制，是工程选择：定点运算在编译目标间行为完全确定（浮点舍入依赖编译器/库版本，同样的公式换个编译选项结果可能不同），且避免浮点库的代码与栈开销。实现：频率用 Q32.32 定点（uint64，整数部分 32 位），斜率步进 = slopeHzPerMs × 1000 / refreshHz 转 Q32.32；正弦曲线用 256 项 Q16 查表，注意 π/2 面积补偿（正弦段峰值增量 = 直线段增量 × π/2，否则面积不匹配会少发脉冲）；短距离自动退化为三角曲线（峰值频率用 f1²=f0²+2a 求根）。

 **问：1ms 刷新下低速起步会有什么问题？我用模拟器跑了一下，10Hz 起步好像有异常。**
 答：问题在于"ARR/PSC 预装载只在周期更新事件生效"：10Hz 起步首周期 100ms，这 100ms 内 1ms 速度规划已经推到 ~1000Hz，但中间所有调频都积压在预装载里，第一个周期结束后一次性加载最新参数——中间的 20~900Hz 根本不会真实出现在波形上。解法：按脉冲内频率积分计算首周期等效频率 f_eff=(f0+f1)/2，f1²=f0²+2a，把首周期从 100ms 压到 ~13ms；之后每个周期按同样的等效原则输出，加速曲线就平滑了（实测首周期 10.2ms，后续 168→232→279→314Hz…平滑递增）。

 **问：host 测试怎么组织？真机不方便每轮都烧录。**
 答：PLSR/Test 下 6 个套件（解析/状态机/路径/规划/HAL/设备）约 1400 项断言，编译参数 -std=c11 -Wall -Wextra -Werror -DPLSR_HOST_TEST（警告即错误），run_host_tests.ps1 一键全跑。HAL 层用寄存器模拟（PLSR_HW_TIMER_REGS：cr1/dier/sr/psc/arr/ccr1/cnt/ccmr1/ccer），把 F407 的实测语义也建模进去——比如"CNT 写到活动 CCR1 比较值会置 CC1IF"这条就是上板实测后补进 host 模型的，否则 host 测试会漏掉这类硬件行为。

 **问：正弦曲线的 π/2 补偿具体怎么算？**
 答：正弦段目标是在同样的加速时间内"面积"（脉冲数）与直线段一致。直线段频率线性上升，正弦段频率按 sin 变化——如果直接 f=f0+Δf·sin(π/2·t/T)，总面积比直线段小（正弦积分=1/π·2 vs 直线=1/2 的关系），所以要乘 π/2 系数把峰值增量放大到直线增量的 π/2 倍，面积才匹配。代码里 PlsrProfileSlopePerStepQ32 之后的正弦分支直接处理这个缩放。

 ---

 ## 周四（2026-08-06）：硬件层与上板准备

 **问：PWM 输出没方波，只有恒定电平，为什么？我配置了定时器但看不到波形。**
 答：CCMR1 复位值是冻结模式（OC1M=000）——输出比较不驱动通道，输出恒定。必须显式写 PWM 模式 1（OC1M=110）+ OC1PE（CCR 预装载），并且 CR1.ARPE=1 开 ARR 预装载。启动顺序很重要：先写 PSC/ARR/CCR 预装载 → EGR.UG 生成更新事件把预装载一次性加载进影子寄存器 → 再清 UIF → 最后 CC1E+CEN。如果不开 ARPE，运行中调频写入会在回绕瞬间生效，ARR 变小瞬间 CNT 超调提前回绕——每段加速会多出约 ln(f1/f0) 个假脉冲。

 **问：方向延时（SFD907）应该怎么生效？手册里"脉冲方向延时时间"这一行 PLSR 是"可不设"。**
 答：SFD907 出厂默认 10ms，解析进 S2 快照的 directionDelayMs。生效条件：只在方向发生变化时（首次启动 / 换向 / 方向点变化）进入 DIR_SETTLING 等待 10ms；段间同向衔接跳过等待直接进 PWM_PENDING——这样段间静默从 14.9ms 优化到约 2ms。手册 1-4-6 节表格里 PLSR 的"脉冲方向延时时间"确实标"可不设"（PLSF 才"必须设定"），与"同向不等待"的设计一致。

 **问：上电自测怎么安排？我想第一次上板就能看到波形。**
 答：上电 HAL_Delay(1000) 等电源/外设稳定，然后入队自测任务：Q0 发三段脉冲（2000Hz/1000 个、5000Hz/6000 个、1000Hz/500 个，H00 顺序衔接），同时验证完成事件、段间跳转、加减速三段曲线；方向点配 Y4（SFD906=4）。自测用静态数组实现 D 设备的读写回调（validateWords/readWord/readBit），任务源先写死在 main.c，正式 Modbus D 设备适配器留到联调阶段替换。

 **问：NVIC 优先级怎么分？中断服务和 OS 的优先级关系？**
 答：定时器更新/比较中断优先级设 1（抢占）——比 uC/OS-II 的 SysTick（15）高，保证脉冲计数不丢；OS 里 PlsrTask 用 OSTimeDly(1) 做 1ms 节拍。共享中断（如 TIM8_UP_TIM13_IRQn 同时服务 update 和 CC1）在 ISR 里必须分别查 UIF/CC1IF 的来源再处理，不能假设每次进入都是同一个事件。

 ---

 ## 周五（2026-08-07）：上板验证与波形分析

 **问：Y0~Y20都正常吗**
 答：Y 输出点本身是正常的——但要先确认你测的是什么。XDM 的 Y 输出是晶体管输出，测量方式和普通推挽输出不一样，我先确认一下你的测量方法。

 **问：现在的现象是，PE6置高Y5的指示灯不亮万用表测Y5物理脚0v，PE置低Y5的指示灯亮万用表测Y5物理脚0v**
 答：这个现象正好说明 Y5 是集电极开路（NPN 漏型）输出：PE6 置高时内部晶体管导通，Y5 物理脚被拉到 ≈0V，指示灯（如果接在 Y5 和 +24V 之间）应该亮——你说灯不亮，要查指示灯接法；PE6 置低时晶体管截止，Y5 悬空，万用表测 0V 是因为悬空没有驱动。关键点：**这种输出没有主动高电平**，只有导通（≈0V）和截止（悬空）两态。

 **问：告诉我你的依据，看的哪个文档里有写**
 答：信捷《XD/XL 系列 PLC 定位控制手册》1-4-4 节（PDF 页 166）：XDM 脉冲输出为集电极开路（OC）方式，晶体管导通时输出约 0V、截止时悬空——手册原文明确写了"集电极开路"字样。这是硬件特性，不是故障。

 **问：你的意思是他的输出口是开漏输出**
 答：对，准确说是集电极开路（OC），和开漏（OD）同类——NPN 漏型：只能拉低，不能主动拉高。所以万用表永远测不到"高电平"，要测高电平必须外部上拉（比如 1~10kΩ 到 +24V 或 +5V）。

 **问：那我逻辑分析仪接哪个口呢**
 答：逻辑分析仪不能直接测 Y 端子（OC 输出无上拉时测到的电平不确定）。两个选择：① 飞线到 MCU 引脚直接测（比如 Q0 就是 PF6，波形最干净）；② 在 Y 端子上加外部上拉电阻再测。建议先飞线 PF6。

 **问：我接不了mcu脚，只能接Y端子，我该怎么做**
 答：那就在 Y 端子和 +24V 之间接一个上拉电阻（1k~10kΩ），这样导通时测到 ≈0V、截止时被上拉拉高到 24V，逻辑分析仪就能看到完整方波。注意 24V 上拉的话逻辑分析仪要用高压探头或分压，安全起见也可以用 5V 上拉。

 **问：我现在飞线飞到PF6上了**
 答：好，PF6 就是 Q0 的 MCU 引脚（TIM10_CH1），信号最干净。采一段波形发我，我帮你分析有没有脉冲、频率对不对。

 **问：只有一段672ms的高电平，其余全是低电平**
 答：672ms 恒定高电平 + 全低——这说明 PWM 没起来，只有一个电平状态。两种可能：① 定时器没启动（CEN 没置位）；② 输出了但 CCMR1 是冻结模式——你用的 HAL 初始化可能没写 PWM 模式。先检查 CCMR1 的值，冻结（OC1M=000）时输出就是恒定的。

 **问：有脉冲了，加速段180ms,减速段180ms，这也在你意料之内吗**
 答：在。这是梯形速度曲线：加速 180ms + 匀速 + 减速 180ms，正好对应你配置的加减速时间。脉冲已经出来了，说明 PWM 模式和预装载都对，接下来验证脉冲数和段间衔接。

 **问：上电后延时一秒再PlsrSelfTestQueue();**
 答：好，改成 HAL_Delay(1000) 后入队自测——等电源和外设稳定再发脉冲，避免上电瞬间时序问题干扰判断。

 **问：这个加速段第一个脉冲不正常啊**
 答：看到了——加速段第一个脉冲之前有个异常的高电平（约 50ms）加一个 0.5ms 的低电平，然后才是正常加速。这个现象我先记下来（后面定义为"②段首压缩"问题），需要抓寄存器快照定位。

 **问：再测几个脉冲**
 答：好，多发几个文件我对比——最好把触发点放在加速段开始，方便看第一个周期的完整结构。

 **问：每段和段之间的延时是多少**
 答：从波形量：段间静默约 14.9ms。拆解：方向延时 10ms（首次启动）+ DONE 检测的 tick 边界（≤1ms）+ PWM 启动的 tick 边界（≤1ms）+ 段切换处理。这个 14.9ms 主要被方向延时占掉了。

 **问：显然差5ms太严重了，能优化吗**
 答：能。方向延时只在方向真正变化时才需要——段间同向衔接时跳过 DIR_SETTLING，直接进 PWM_PENDING。改动后段间应该能压到 2ms 以内（只剩 DONE 检测 + 启动两个 tick 边界）。改完重新烧录验证。

 **问：扫描一下这个文件...bin 帮我拟合出时频曲线，你写个py程序画图**
 答：写了个 plot_waveform.py：解析逻辑分析仪 bin（16 通道每采样 2 字节小端，信号在 bit0），自动探测采样率（100MS/s，用 2000/5000Hz 匀速段打分验证），提取上升沿算瞬时频率，输出两段图（原始波形 + 时频曲线）。分析结果：三段结构 2000/5000/1000Hz，总脉冲数 7517。

 **问：这样的时频图有问题吧**
 答：有问题——加速段在时频图上不是一条平滑斜线，而是折线：段2 起步先是 50ms 恒高 + 0.5ms 低，然后直接跳到 1000Hz 附近。这就是"②段首压缩"：第一个周期 100ms 内规划已经推到 ~1000Hz，但 ARR 预装载只在周期末生效，中间频率全被吞掉了。

 **问：你可以直接看2026-08-07_16-43-23.bin分析图像啊，图片只是给我看的**
 答：明白，我直接分析 bin 数据本身，不依赖截图。用脚本逐边沿提取：第一段下降沿到第二段上升沿间隔 14.9ms、总脉冲 7517、三段频率正确——和截图结论一致。

 **问：第一段的下降沿到第二段的上升沿的时间是14.9ms...**
 答：对，这就是段间静默：方向延时 10ms + 段切换处理约 4.9ms。优化方向不变：同向跳过方向延时，目标压到 2ms 内。

 **问：实际的脉冲个数是7517个**
 答：7517 vs 配置 7500，多了 17 个。根因：ARR 没开预装载时，调频写入在回绕瞬间生效，ARR 变小瞬间 CNT 超调提前回绕——每段加速多出约 ln(f1/f0) 个假脉冲。修复：ARPE=1 + 启动时 UG 加载影子，改完应回到精确 7500。

 **问：2026-08-07_17-19-03.bin这是我用新代码的波形，用那个py生个图我看看**
 答：生成好了。结果：总脉冲 7500 精确（修复生效），三段 1000/6000/500 结构正确，段间静默也降下来了。

 **问：现在的波形有什么问题**
 答：①段1→段2 衔接还有 14.9ms 静默（方向延时，待优化）；②段2 起步加速段仍是折线（首周期压缩未解决）；③段尾收尾有低频平台。我把这三个列成清单，逐个修。

 **问：把现在的bug修了**
 答：这次修了两个：①段间同向跳过方向延时（14.9ms→2ms）；②段尾收尾用硬件计数校准 profile 虚拟计数（SyncPulses），消除冻结频率补发平台。编译烧录后你测一下。

 **问：2026-08-08_19-14-34.bin**
 答：验证①：总脉冲 7500 精确；段间静默 2ms 达标；段尾收尾平滑（520ms 减速到停，无冻结平台）。①修复确认。

 **问：你有没有发现第二段的一开始加速度很大...频谱上表现出来的加速段不是一条斜线是一条折线**
 答：确认——②段首压缩还在：段2 起步"高 50ms + 低 0.5ms"后直接 1000Hz，时频图是折线不是斜线。这个问题的本质是"低速起步 + 周期末加载"的架构问题，我需要抓 tick 级快照定位。

 ---

 ## 周六（2026-08-08）：段首压缩排查与交接

 **问：生成一个git提交的描述**
 答：标题"P3a 硬件层上板验证：修复 PWM 输出两个硬件缺陷，优化段间衔接，扩展三段自测"；正文列：①CCMR1 冻结→PWM1+OC1PE；②ARPE+UG 影子加载（7517→7500）；③段间同向跳过方向延时（14.9ms→2ms）；④段尾硬件计数校准（SyncPulses）；⑤三段自测扩展；上板实测数据。

 **问：2026-08-08_19-23-37.bin**
 答：对比 19-14：段2 起步还是"高 50ms+低 0.5ms"结构——②未修复，确认与 19-14 同源。段1 起步正常（首周期 10.2ms 平滑），只有段2 起步异常——段1 有"上电后 1s 延时"缓冲，段2 是运动中直接切换，路径不同。

 **问：你的意思是bug还没修复**
 答：对，②段首压缩在段2/段3 起步仍然存在。现象、位置、结构都和之前完全一致——不是新问题，是同一个问题没修掉。

 **问：我该怎么帮你**
 答：最快的定位方式是抓寄存器快照：在 HAL 里加一个调试快照数组，每个 1ms tick 记录 reason/psc/arr/ccr/cnt 五字段，段2 起步时连续记录 64 条，然后从 IAR Watch 里读出来——快照能直接告诉我们周期结束时 ARR 到底加载了什么值，是不是"一次性加载了 1000Hz"。

 **问：（IAR Watch 截图）**
 答：截图里看到快照数组已经在跑了。reason=3 的条目（1ms tick）里 arr 有 55999——这是 divider(1000Hz) 的 ARR 值，说明周期结束瞬间加载的就是 1000Hz 参数——和"第一个周期吞掉加速"的模型一致。

 **问：Snipaste_2026-08-08_20-13-35.png**
 答：这张图里快照字段能对上：reason 交替 0/3，psc/arr/ccr 随段变化，cnt 在 653/ms 附近正常递增。但有几条 reason 值异常（256 之类），我怀疑是识图读错字段了。

 **问：我怀疑识图错了，你和我讲下 PlsrHwDbgSnap 数组（每条含 reason/psc/arr/ccr/cnt 五个字段）**
 答：字段布局：reason（uint8：0=PwmBegin、3=PlsrHwTick）、psc、arr、ccr、cnt（都是 uint32，按序排列），共 64 条。你在 IAR Watch 里按这个布局读，注意 Watch 的十六进制显示要转十进制——之前 GLM 识图把字段错位了（把高 16 位当成另一个字段），数字全不可信。

 **问：我不是叫你调用的是豆包吗**
 答：你说得对——之前用的 GLM 识图（glm_vision.py），数字字段错位不可靠。我换成豆包视觉模型重新读这些截图。

 **问：ark-fc26924a-b80c-49f2-867d-3d47ad79b09b-75f42这个apikey呢**
 答：用这个 key 配豆包（doubao-seed-2-1-pro），端点用火山引擎 v3 的 OpenAI 兼容格式：https://ark.cn-beijing.volces.com/api/v3/chat/completions。compatible 端点会 404，必须用 v3。

 **问：现在能看到了吗**
 答：能了——豆包读出来的字段对齐了：reason 0/3 交替正常，arr=55999 那条确认是 1000Hz 的 divider，cnt 653/ms 正常。识图通道已经可靠。

 **问：你现在能调用豆包识图了吗，我又重新配置了一下**
 答：可以了，v3 端点 + 你的 key 正常返回。以后截图直接发我，我用豆包读。

 **问：2026-08-08_21-02-32.bin；Snipaste_2026-08-08_21-02-45.png**
 答：波形：段2 起步还是 50ms+0.5ms 结构（②未修）；快照：周期末加载 arr=55999（1000Hz）实锤——"第一个周期结束后一次性加载最新 1000Hz 参数"的证据链完整。

 ---

 ## 周日（2026-08-09）：AB 验证、保护功能与多轴测试

 **问：2026-08-08_22-03-54.bin，看看吧**
 答：**②段首压缩修复了**！段2 起步首周期 10.2ms（~98Hz）→ 168→232→279→314→344→374→400→424→450→470→490→510→530Hz 平滑递增，无折线；总脉冲 7500 精确；三段 1000/6000/500；段间静默 ~2ms。新代码用"首周期等效频率"（f1²=f0²+2a 积分）解决了低速起步问题——这正是 Codex 说的"重新设计控制周期"的落地。

 **问：现在理论上段与段之间的延时时间是多少**
 答：理论构成：DONE 检测（≤1ms）+ 段切换（同 tick）+ PWM 启动（≤1ms）≈ 0~2ms；方向改变时 +directionDelayMs（SFD907，默认 10ms）。实测 22-03 段间 ~2ms 与理论吻合。

 **问：我是说现在plsr指令上的延时**
 答：你问的是 PLSR 指令配置的延时——SFD907 方向延时，出厂默认 10ms，Modbus 可改。

 **问：SFD907 方向延时 10ms，根据这个参数，段与段之间应该有10ms延时吧，为什么现在没有，是因为没应用吗**
 答：不是没应用，是**有条件应用**：directionChanged（首次启动/换向/方向点变化）才等 10ms，段间同向衔接跳过（plsr_hal_f407.c:486-488 的注释就是这个设计）。手册 1-4-6 表格里 PLSR 的方向延时本来标"可不设"（PLSF 才必须设）。自测三段同向所以看不到 10ms——把段2 改反向就能看到。

 **问：2026-08-08_22-42-03.bin；Snipaste_2026-08-08_22-42-40.png看一下波形是否符合图片的描述**
 答：对照截图 7 项结论：①Q0 波形正确 ✅；②7500 脉冲、分段 1000/6000/500 ✅；③首脉冲+减速尾段正确 ✅；④段间同向不额外等待 10ms ✅；⑤Y4 方向正向——bin 里 CH1-15 全低，Y4 通道没接到，无法从数据验证 ⚠️；⑥无毛刺无丢脉冲 ✅。结论：6/6 可验证项通过。

 **问：Q1的脉冲个数不是只有7500个吗**
 答：实测 Q1=7501（Q0 也是 7501）——多出的 1 个是段1 起步瞬间 A-R 与 B-R 同刻上升（0.37µs）的启动边沿，A/B 各多 1 个。去掉这个启动同升，Q1=7500 正好。全波形 A/B 同刻（<1µs）的边沿对只有这一对。

 **问：2026-08-08_23-20-24.bin；稳定频率处预计相位差：段1 2000Hz 90°=125µs、段2 5000Hz 50µs、段3 1000Hz -250µs...**
 答：实测：稳定段相位 +98.3°/+138.9°/-135.0°——**方向对但角度不对**（应 ±90°）。根因：起步 CNT 差 0.25T（90°）正确，但调频只写预装载不重置 CNT，两路独立定时器各自回绕时刻差 0.25T，1ms 调频期间两路加载的 ARR 不同步，相位随频率漂移。另外：段2 起步 A/B 上升沿重合（1µs）、B 相有 4µs 微毛刺、段间静默 23ms、Q1=7501。

 **问：你这个分析的原因可信度有多少**
 答：分三层：①实测数据（相位/毛刺/段间）100% 可信；②根因推理（调频↔相位漂移相关）50~70%——方向大概率对，但定量模型对不上（按 CNT 差保持算 seg2 应 198µs，实测 77µs），说明机制比我描述的复杂；③未知项（段间 23ms 原因、4µs 毛刺来源）<40% 纯推测。验证方法：恒定频率直启（无加速）看相位是否 90°——如果稳定 90° 则漂移 100% 锁定为调频引起。

 **问：2026-08-08_23-51-27.bin；三个稳定段的 A→B 相位：应持续接近 +90°、+90°、-90°，不能再逐段漂移...**
 答：**相位修复成功**：+90.2°/+90.6°/-89.9°（误差<1°），方向正确；但上升沿 8804/8804（每段多 300/900/100 个=各段调频次数）——"重写 CNT 保相位"方案引入边沿对；4µs 微毛刺仍在（5213 个 <10µs 间隔）；段间 26.8ms。结论：核心指标（相位）达标，但重写 CNT 引入新问题。

 **问：生成一个git提交描述**
 答：标题"P3b-2 AB 正交硬件层上板验证：双定时器同步分频 + 无毛刺相位建立，三段 AB 自测通过"；正文列：配对定时器 PSC 2 倍关系同步分频、CNT 初值 3/4T 与 1/2T 建立 90°、落后相 CC1 下降沿计完整 00 周期、运行中调频只写预装载、GPIO 保持低→update 分时释放引脚；上板实测：相位 +90.2/+90.6/-89.9、段间 3.57ms、调频毛刺 0、Q0/Q1 各 7501（启动边沿待消除）。

 **问：信捷手册里说的运行调频是什么意思**
 答：手册原文没有"调频"这个词——对应的官方概念是"脉冲频率刷新时间"（HSD474/SFD964：1ms 或 0.1ms，参数表里标"可不设"）：运行中每隔一个刷新周期按加减速斜率重新计算并更新输出频率，加减速就是靠这个周期刷新实现的。对应我们代码：refreshHz=1000（1ms）→ PlsrProfileStep 每 tick 算新频率 → PlsrHwSetFrequency（预装载写入）。

 **问：IAR编辑器界面怎么打开显示行数**
 答：Tools → Options → Editor → 勾选 Show line numbers。全局生效，所有文件左侧显示行号；也可以 Ctrl+G 跳行、看状态栏 Ln/Col。

 **问：2026-08-09_13-41-48.bin；是否符合Q0上升沿：7500、Q1上升沿：7500...**
 答：还是 7501/7501——启动同升（@0.110669，0.37µs）与 00:06 版同源未修。其余全过：相位 +90.2/+90.6/-89.9、分段 1000/6000/500、调频毛刺 0。

 **问：Q1的脉冲个数不是只有7500个吗**
 答：确认：Q1=7501（Q0=7501），多出的就是启动同升那一对（全波形唯一 <1µs 的同刻边沿对）。去掉它 Q1=7500 正好。Q1 不是单独问题——是 A/B 一起在启动时多跳了一次。

 **问：2026-08-09_13-57-30.bin；重点确认：Q0上升沿 = 7500...第一个周期应为：00→A-R：10→B-R：11→A-F：01→B-F：00...**
 答：仍 7501/7501；首周期 A-R 与 B-R 同刻（0.33µs，从 11 开始而非 00→10→11）。第 6 版同一现象。按你的标准（7500 才关闭）——不能关闭。定位建议：两个 ISR 打点验证 update 先后 / SetPwmMode1 移到 SetCc1e 之前。

 **问：2026-08-09_13-59-20.txt**
 答：与 13:57 同波形（txt 时间轴 +0.5147s 偏移），7501/7501、启动同升 0.34µs 仍在。四版（00:06/13:41/13:57/13:59）完全同一现象。

 **问：让你分析txt还是bin消耗的token少一点**
 答：差不多（都是写脚本算摘要再读结果），txt 略省（脚本更简单、不用 memmap 和采样率探测）。真正省 token 的是把分析脚本固化，每次只换文件名。

 **问：不用，你先扫一下代码吧，分析一下导致波形出问题的原因**
 答：扫描结果：启动序列 737-740 行先 SetCc1e(1) 再 SetPwmMode1——RM0090 明确"OC 模式从冻结切 PWM 时 OCREF 电平会跳变"，且落后相 CNT 初值=CCR（写入 CNT=CCR 会置 CC1IF，代码自己的 host 注释写的）。强嫌疑：①+②组合——B 相 CNT=CCR 写入触发比较事件，叠加 CC1E 先于模式切换的次序，使 OCREF 在启动序列中就变高。建议先试"SetPwmMode1 移到 SetCc1e 之前"。

 **问：这个bug其实也不是什么大bug是吧**
 答：影响确实小（1 个脉冲、仅启动瞬间、其余全达标），但 6 版没修好说明根因未明，可能掩盖更深时序问题。建议：降优先级不阻塞主流程，但别"关闭"——留待实验定位（ISR 打点 10 分钟能出结论）。

 **问：后面还要写多少批代码**
 答：按交接路线估 7~9 批：AB 收尾 → 四轴并发 → TIM6/NVIC → 运动语义闭环（STOP/PAUSE/ACT/EXT）→ 位置链路 → Modbus → 性能项 → 清理。

 **问：2026-08-09_15-05-32.bin；两段各移动1001工程单位，第一段输出1501脉冲，第二段输出1502脉冲，总计3003脉冲，稳定频率约1500Hz...**
 答：**全部符合**：Q0=3003（rise0..1500 段1=1501、rise1501..3002 段2=1502）；两段 median 1500Hz；时长 2.19s；**余数累计验证通过**（1001×1.5=1501.5 → 段1 出 1501 余 0.5；段2 再 +0.5 → 1502 余 0）；起步 120→200→282Hz 平滑、收尾 82Hz、毛刺 0。这是 plsr_position 单位换算模块的真机验证。

 **问：生成一次git提交描述**
 答：标题"工程单位/脉冲当量换算落地（余数累计真机验证）+ 位置链路闭环 + AB 启动预热"；正文：plsr_position 模块（单位校验/等效配置/双向换算/溢出检查）、job 解析（等效配置 + 工程单位段目标 + POSITION_OVERFLOW）、core 位置链路（logicalPosition/taskPulses/totalPulses 累加 + HSD 检查点 + 软急停/限位事件）、HAL AB 启动预热；上板实测 3003/1501/1502。

 **问：现在的代码还剩哪些部分没写**
 答：扫描结果：Modbus（D 设备适配器）、CW/CCW、0.1ms 刷新、硬件计数 TIM9/12、动态调频（无调用点）、SD 发布、限位接线、STOP/PAUSE 真机验证、自测/调试清理、TIM6——约 6 批。

 **问：我现在测试的全是发送低频，你觉得代码有没有可能在输出100k频率的信号会出问题，分析完代码再回答，别瞎猜**
 答：分析完：基础能力支持 100kHz（上限 100000Hz、PSC=0/ARR=1679 可表示、中断级计数、Q32.32 不溢出）；三个真实风险：①AB 模式高频加速段每 1ms 重定相吞 ~1µs（占 10% 周期，PULSE/DIR 无此问题）；②四轴 100kHz 逐脉冲中断 40 万次/秒（CPU 12~40%，Codex 早列为风险）；③100kHz 附近 ARR 每计数 60Hz 调频台阶。建议各测一次确认。

 **问：2026-08-09_16-04-17.bin；测试任务为：Q0脉冲、Q4方向、+10000目标、正软限位+500、1000Hz、减速100ms、方向延时10ms...**
 答：实测 502 个脉冲（验收 499~501，超 1）；恒定段 460 个@1000Hz → 减速段 42 个（84.5ms，535→134Hz 平滑）→ 停止后零边沿无毛刺；Q4 方向 CH1 全低测不到（接线问题）。触发点比理论（450）晚 9 个脉冲、超停 1~2 个——已列入已知问题清单。

 **问：这个不是什么严重bug吧**
 答：不是严重 bug（超停 1~2 个脉冲、提前减速逻辑生效、停止干净），但比 AB 启动边沿"重一点点"：软限位是安全功能，且偏差是系统性的（判定位置源/提前量公式），不会自己消失。建议不阻塞主流程但列入待办。

 **问：把之前和现在这两个小问题统计下来**
 答：已生成《已知问题清单_2026-08-09.md》：问题 1 AB 启动边沿（7501，6 版复现，根因方向+3 条验证方法）；问题 2 软限位边界精度（502，波形结构+根因方向+验证方法）；共同结论：小影响、非安全级、卡验收、实验定位后再修。

 **问：生成一次git提交描述**
 答：标题"P5 软限位保护 + 受控停止落地：限位提前减速真机验证 + 已知问题清单"；正文：PlsrProfileRequestStop 受控停止入口、软限位判定接入运动循环、PlsrProtectionSelfTestQueue 自测、main.c 切换、已知问题清单文档；上板实测 502（超停 1~2 已记录）。

 **问：2026-08-09_16-30-26.bin；预期：Q0 1000Hz/1000沿、Q1 2000Hz/2000沿、Q2 3000Hz/3000沿、Q3 4000Hz/4000沿，四路约1秒...**
 答：**四轴并发全过**：Q0~Q3 上升沿 1000/2000/3000/4000 全部精确、占空比 50.0%、时长 ~1s、四路独立无干扰；同时验证 84MHz 时钟修正有效（Q1=TIM13 精确 2000Hz、Q3=TIM14 精确 4000Hz 未减半）。这项可以直接关闭。

 **问：生成一次git提交的描述**
 答：标题"P6 四轴并发自测落地：Q0~Q3 四路独立 PULSE/DIR 真机验证 + 零加速段状态机修复"；正文：PlsrFourAxisSelfTestQueue（四轴独立 S0/S1/SFD 配置）、main.c 切换、零加速段补发 ACCEL_COMPLETE 修复、host 测试 +90 项；上板实测四路精确。

 **问：现在的代码还剩哪些部分没写**
 答：重扫后：Modbus（D 设备适配器）、CW/CCW、0.1ms 刷新+动态调频、硬件计数、四轴验证、限位接线、STOP/PAUSE 验证、清理——约 5~6 批。

 **问：我现在测试的全是发送低频，你觉得代码有没有可能在输出100k频率的信号会出问题，分析完代码再回答，别瞎猜**（重复确认）
 答：（同上）结论不变：能出 100kHz，PULSE/DIR 大概率没问题；AB 高频加速段重定相干扰是真正需要上板验证的点。

 **问：2026-08-09_16-55-57.bin；正反向齿隙补偿...预期：段1正向200、负向补偿20、段2负向200、正向补偿10、段3正向100、总计530...**
 答：**齿隙补偿全过**：530 脉冲精确（200/20/200/10/100）；负向补偿 20 脉冲呈三角曲线（229→987→220Hz）、正向补偿 10 脉冲（229→974→524Hz）；换向点只有 2 个（间隔 13.2ms = 末脉冲周期 + 10ms 延时 + 段处理）；补偿与正式段同向无缝（无第二个 10ms）；毛刺 0。Q4 方向信号 CH1 测不到（接线问题）。

 **问：Q4的信号在CH4**
 答：收到——重新提取 CH4：方向变化 3 次（0.0374 低→高初始建立、0.2477 高→低换向1、0.4987 低→高换向2）；段1 起步方向建立→首脉冲 9.8ms≈10ms 延时 ✅；两次换向各 11.7ms（含 10ms）✅；补偿→正式段 1.9ms 无第二个 10ms ✅；方向电平与验收表格完全一致。**齿隙补偿验收全过**（之前 CH1=0 只是接线，不是代码问题）。

 **问：软限位、硬限位和软件急停，补齐兼容错误码5/6。正反向齿隙补偿...I6000～I6399段事件及完整兼容错误码发布。独立定时器实现0.1ms控制刷新...FOLLOW和前馈补偿的实际运算。CW/CCW双脉冲输出及资源冲突检查。Modbus调用、原子提交、命令序号和状态读取的真实联调。收尾修复与压力测试...现在还剩哪些没完成了**
 答：逐项扫描：错误码 5/6（core:1115/1121 启动保护、1589/1606 运行中限位）✅；齿隙补偿 ✅（真机验证）；I 事件+完整错误码（plc_device:662-728，1/2/3/4/5/6/15/16/26）✅；0.1ms+动态调频 ❌（core:1833 固定 1000U、ResolveLiveFrequency 无调用）；FOLLOW/前馈 ❌（仅解析）；CW/CCW ✅（18:13 真机验证）；Modbus ❌（从站框架在、D 设备适配器未接）；收尾 ❌。**还剩 4 项**。

 **问：错误码 5/6是啥**
 答：5=正限位触发后停止（减速停止并禁止继续正向启动）、6=负限位触发后停止（减速停止并禁止继续反向启动）——需求规格 2.13.1 错误码表；同表还有 1（S0 段配置）、2（每转参数 0）、3（S2 块号）、4（参数块超限）、15/16（FOLLOW 参数）、26（资源分配失败）。

 **问：你重新扫一下代码，确定没写吗**
 答：**我上次判断错了，5/6 已经写了**——core:1115/1121（启动保护路径：PlsrCheckStartProtection 返回 LIMIT 时设 5/6 + stopReason）、1589/1606（运行中限位事件：设 5/6 + PlsrRequestControlledStop）；3/4 在 356/361。第一次扫描只看 300-345 行片段就下结论，漏了后面——向你更正。

 **问：2026-08-09_17-20-14.bin；复位运行，程序会自动执行：第一段：正向200个脉冲1000Hz，换向等待10ms，第二段：反向200个脉冲1000Hz...Q4正逻辑、Q5负逻辑...CH3是Q5，CH4是Q4**
 答：Q0/Q1 各 400 上升沿 ✅、换向静默 9.9995ms ✅；但方向电平与"NPN 低导通"预期相反（正向段 Q4 高、Q5 低）——在"高=ON"映射下代码完全正确（轴0 正逻辑正向 ON、轴1 负逻辑正向 OFF），两路一致地反说明是测量点极性/接线问题；Q5 启动有 1µs 毛刺、换向 55µs 过渡（非互补段仅此三处）。

 **问：2026-08-09_17-51-24.bin；预期波形：第一段Q0输出2000Hz周期500µs高250µs上升沿300个，Q1始终低；换向Q0停Q1开始不重叠；第二段Q1输出1000Hz周期1ms高500µs上升沿200个，Q0始终低；结束全低...**
 答：第一次分析误判"Q1 只出 4 个脉冲就停"——实际是我脚本的窗口裁剪 bug（按 Q0 范围裁掉了段2 的 Q1 边沿）。修正后：Q0=300/300、Q1=200/200 精确；段1 Q1 恒高问题已修复（0.000%）；段切换 0.9ms 不重叠；启动无同升。**CW/CCW 验收通过**，仅剩段尾截断窄脉冲。

 **问：位置在哪**
 答：两个 <10µs 间隔都在段尾：①段1 最后脉冲 0.167797→0.167800（2.5µs，第 300 个脉冲上升沿后即拉低）；②段2 最后脉冲 0.367690→0.367695（5.0µs）。性质：停止时机比 CC1 下降沿早半个周期，最后一个脉冲被截断——不是噪声毛刺，计数不受影响（300/200 精确），但严格说"微秒级间隔 0 个"不达标，需把停止对齐到完整周期末。

 **问：重新扫描一下代码，看一下这些功能还还有哪些没实现 软限位、硬限位和软件急停，补齐兼容错误码5/6。正反向齿隙补偿...（同前清单）**
 答：重扫确认：错误码 5/6 ✅、齿隙 ✅、I 事件+完整错误码 ✅、CW/CCW ✅（均真机验证）；**还剩 4 项**：0.1ms 控制刷新+动态调频、FOLLOW/前馈运算、Modbus 真实联调、收尾压力测试（AB 首沿/100kHz/双 AB 并发/删自检）。

--- a/Document/PLSR_document/ai问询记录/AI问询会话记录_2026.8.3-2026.8.9.zip
+++ b/Document/PLSR_document/ai问询记录/AI问询会话记录_2026.8.3-2026.8.9.zip
--- a/EWARM/Modbus.ewp
+++ b/EWARM/Modbus.ewp
@@ -1299,6 +1299,12 @@
        <file>
            <name>$PROJ_DIR$\..\PLSR\Inc\plsr_self_test.h</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\PLSR\Inc\plsr_modbus_data.h</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\PLSR\Inc\plsr_modbus_control.h</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\PLSR\Src\plsr_persistence.c</name>
        </file>
@@ -1326,6 +1332,12 @@
        <file>
            <name>$PROJ_DIR$\..\PLSR\Src\plsr_self_test.c</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\PLSR\Src\plsr_modbus_data.c</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\PLSR\Src\plsr_modbus_control.c</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\PLSR\Src\plsr_core.c</name>
        </file>
@@ -1335,8 +1347,14 @@
        <file>
            <name>$PROJ_DIR$\..\Modbus\Src\modbus_rtu_slave.c</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\Modbus\Src\modbus_data_store.c</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\Modbus\Inc\modbus_rtu_slave.h</name>
        </file>
        <file>
            <name>$PROJ_DIR$\..\Modbus\Inc\modbus_data_store.h</name>
        </file>
    </group>
 </project>
--- a/HostComputer/PLSR_MODBUS_CONTROL_TEST.md
+++ b/HostComputer/PLSR_MODBUS_CONTROL_TEST.md
@@ -0,0 +1,23 @@
 # PLSR P13 Modbus 命令与状态测试

 P13 使用可配置控制窗口，当前板测选择 D1200～D1455。该范围不属于信捷固定 PLSR 地址，仅是本工程上位机测试使用的动态通信窗口。

 运行：

 ```powershell
 python HostComputer\plsr_modbus_control_test.py --port COM5
 ```

 默认串口为 9600、8E1、从站地址 1。测试脚本会自动：

 1. 使用 0x10 写入 S0=D1600、S1=D1700。
 2. COMMIT 并检查完整参数校验结果。
 3. 修改 COMMIT 后的 S0，验证 START 被拒绝。
 4. 恢复参数、重新 COMMIT，然后 START Q0。
 5. 下发 PAUSE，等待减速至 PAUSED。
 6. 重发相同 PAUSE 序号，验证不会重复执行。
 7. 下发 RESUME，恢复脉冲输出。
 8. 下发 STOP_DECEL，等待减速进入 STOPPED。
 9. 检查状态首尾版本、命令序号、结果、逻辑位置和脉冲累计。

 逻辑分析仪接 Q0 和 GND，建议在运行脚本前开始采集至少 8 秒。预期只有一段有效 Q0 输出：启动并加速到 2000Hz，PAUSE 减速停止，静默至少 250ms（另加重复序号和状态回读的 RTU 耗时），RESUME 后重新加速，最后 STOP_DECEL 平滑停止；不得出现窄脉冲或命令切换毛刺。
--- a/HostComputer/PLSR_MODBUS_TEST.md
+++ b/HostComputer/PLSR_MODBUS_TEST.md
@@ -0,0 +1,43 @@
 # PLSR P12 Modbus 数据源测试

 本测试验证 PLSR 从真实 Modbus 寄存器读取 S0/S1，并在运行中通过 Modbus 原子更新当前段频率。

 ## 固件自测数据

 - S0：D1000，单段。
 - S1：D1100，相对定位，从第 1 段开始。
 - 当前段频率：D1010（低 16 位）、D1011（高 16 位）。
 - 脉冲数：100000，Q0 输出，Q4 为方向。
 - S2：K1，默认 1000Hz，最高 5000Hz，刷新周期 0.1ms。

 这些地址只是 P12 自测选择的动态 S0/S1 地址，不是新增的固定 PLSR 地址。

 ## 运行

 安装依赖：

 ```powershell
 py -m pip install -r HostComputer\requirements.txt
 ```

 连接当前工程使用的 Modbus 串口后运行：

 ```powershell
 py HostComputer\plsr_modbus_frequency_test.py --port COM5
 ```

 串口参数默认与固件一致：9600、8E1、从站地址 1。若电脑只有一个串口，可以省略 `--port`。

 脚本使用功能码 0x10 一次写入 D1010/D1011，再用 0x03 回读。不要用两次 0x06 更新一个 32 位值，否则两次 Modbus 事务之间必然存在半新半旧的中间值。

 ## 预期结果

 脚本依次写入：1000、4000、500、0、8000、-1、2000Hz。逻辑分析仪观察 Q0：

 - 1000→4000、4000→500、1000→5000、5000→2000 平滑变频，无窄脉冲。
 - 写入 0 后目标变为 S2 默认的 1000Hz。
 - 写入 8000 后目标被钳位为 5000Hz。
 - 写入 -1 后保持 5000Hz，随后可恢复到 2000Hz。
 - 全程脉冲连续，不因 Modbus 请求结束或主站断开而停止。

 IAR Watch 可辅助观察 `PlsrHwAxes[0].currentFrequencyHz`、`PlsrAxes[0].liveTargetFrequencyHz`、`PlsrAxes[0].liveFrequencyRejectCount` 和 `PlsrAxes[0].lastLiveFrequencyResult`。
--- a/HostComputer/pycache/plsr_modbus_frequency_test.cpython-39.pyc
+++ b/HostComputer/pycache/plsr_modbus_frequency_test.cpython-39.pyc
--- a/HostComputer/plsr_modbus_control_test.py
+++ b/HostComputer/plsr_modbus_control_test.py
@@ -0,0 +1,270 @@
 #!/usr/bin/env python3
 """PLSR P13 Modbus COMMIT/START/command/status integration test."""

 from __future__ import annotations

 import argparse
 import time

 import serial

 from plsr_modbus_frequency_test import RtuClient, choose_port, signed_dword_words


 CONTROL_BASE = 1200
 S0_BASE = 1600
 S1_BASE = 1700
 CALL_REQUEST = CONTROL_BASE + 8
 CALL_RESPONSE = CONTROL_BASE + 24
 COMMAND_REQUEST = CONTROL_BASE + 40
 COMMAND_RESPONSE = CONTROL_BASE + 48
 AXIS0_STATUS = CONTROL_BASE + 64

 RESULT_OK = 0
 RESULT_QUEUED = 1
 RESULT_BUSY = 8
 STATE_ACCEL = 2
 STATE_RUN = 3
 STATE_DECEL = 4
 STATE_PAUSED = 6
 STATE_STOPPED = 8

 CALL_COMMIT = 1
 CALL_START = 2
 CMD_STOP_DECEL = 1
 CMD_PAUSE = 3
 CMD_RESUME = 4


 def put_u32(words: list[int], offset: int, value: int) -> None:
    words[offset : offset + 2] = signed_dword_words(value)


 def put_u64(words: list[int], offset: int, value: int) -> None:
    raw = value & 0xFFFFFFFFFFFFFFFF
    words[offset : offset + 4] = [(raw >> shift) & 0xFFFF for shift in (0, 16, 32, 48)]


 def get_u32(words: list[int], offset: int) -> int:
    return words[offset] | (words[offset + 1] << 16)


 def get_u64(words: list[int], offset: int, signed: bool = False) -> int:
    raw = sum(words[offset + index] << (index * 16) for index in range(4))
    if signed and raw & (1 << 63):
        return raw - (1 << 64)
    return raw


 def wait_call_response(client: RtuClient, sequence: int, timeout: float = 2.0) -> list[int]:
    deadline = time.monotonic() + timeout
    while time.monotonic() < deadline:
        response = client.read_holding(CALL_RESPONSE, 12)
        if get_u32(response, 0) == sequence:
            return response
    raise RuntimeError(f"等待调用应答序号 {sequence} 超时")


 def send_call(client: RtuClient, sequence: int, operation: int) -> list[int]:
    request = [0] * 16
    put_u32(request, 0, sequence)
    request[2] = 0  # S0 device D
    put_u32(request, 3, S0_BASE)
    request[5] = 0  # S1 device D
    put_u32(request, 6, S1_BASE)
    request[8] = 0  # S2 constant
    request[9] = 0
    put_u32(request, 10, 1)  # K1
    request[12] = 0  # axis Y0/Q0
    request[13] = 0  # PULSE/DIR
    request[14] = operation
    client.write_multiple(CALL_REQUEST, request)
    return wait_call_response(client, sequence)


 def wait_command_response(client: RtuClient, sequence: int, timeout: float = 2.0) -> list[int]:
    deadline = time.monotonic() + timeout
    while time.monotonic() < deadline:
        response = client.read_holding(COMMAND_RESPONSE, 8)
        if get_u32(response, 0) == sequence:
            return response
    raise RuntimeError(f"等待命令应答序号 {sequence} 超时")


 def send_command(
    client: RtuClient, sequence: int, opcode: int, argument: int = 0
 ) -> list[int]:
    request = [0] * 8
    put_u32(request, 0, sequence)
    request[2] = opcode
    request[3] = 0
    put_u64(request, 4, argument)
    client.write_multiple(COMMAND_REQUEST, request)
    return wait_command_response(client, sequence)


 def read_axis_status(client: RtuClient) -> dict[str, int]:
    words = client.read_holding(AXIS0_STATUS, 48)
    generation_begin = get_u32(words, 0)
    generation_end = get_u32(words, 46)
    if generation_begin != generation_end or generation_begin & 1:
        raise RuntimeError(
            f"状态快照版本不一致：begin={generation_begin}, end={generation_end}"
        )
    return {
        "generation": generation_begin,
        "state": words[2],
        "flags": get_u32(words, 3),
        "error": words[6],
        "stop_reason": words[7],
        "last_result": words[8],
        "last_sequence": get_u32(words, 10),
        "logical_position": get_u64(words, 16, signed=True),
        "task_pulses": get_u64(words, 20, signed=True),
        "physical_pulses": get_u64(words, 28),
        "current_frequency": get_u32(words, 38),
        "target_frequency": get_u32(words, 40),
    }


 def wait_status(
    client: RtuClient,
    states: set[int],
    sequence: int | None = None,
    timeout: float = 5.0,
 ) -> dict[str, int]:
    deadline = time.monotonic() + timeout
    latest: dict[str, int] | None = None
    while time.monotonic() < deadline:
        latest = read_axis_status(client)
        sequence_ok = sequence is None or latest["last_sequence"] == sequence
        if latest["state"] in states and sequence_ok:
            return latest
    raise RuntimeError(f"等待状态 {sorted(states)} 超时，最后状态：{latest}")


 def wait_running_output(
    client: RtuClient, sequence: int, timeout: float = 5.0
 ) -> dict[str, int]:
    """等待真实脉冲恢复，不能只依据 ACCEL/RUN 状态标签。"""
    deadline = time.monotonic() + timeout
    latest: dict[str, int] | None = None
    while time.monotonic() < deadline:
        latest = read_axis_status(client)
        pulse_active = (latest["flags"] & (1 << 1)) != 0
        if (
            latest["last_sequence"] == sequence
            and latest["state"] in {STATE_ACCEL, STATE_RUN}
            and pulse_active
            and latest["current_frequency"] > 0
        ):
            return latest
    raise RuntimeError(f"等待实际脉冲恢复超时，最后状态：{latest}")


 def check_result(response: list[int], expected: int, label: str) -> None:
    result = response[3] if len(response) == 12 else response[4]
    if result != expected:
        raise RuntimeError(f"{label} 返回 {result}，期望 {expected}；应答={response}")


 def main() -> int:
    parser = argparse.ArgumentParser(description="PLSR P13 Modbus 控制接口自动测试")
    parser.add_argument("--port", help="串口，例如 COM5；只有一个串口时可省略")
    parser.add_argument("--baud", type=int, default=9600)
    parser.add_argument("--slave", type=int, default=1)
    args = parser.parse_args()

    with serial.Serial(
        port=choose_port(args.port),
        baudrate=args.baud,
        bytesize=serial.EIGHTBITS,
        parity=serial.PARITY_EVEN,
        stopbits=serial.STOPBITS_ONE,
        timeout=1.0,
        write_timeout=1.0,
    ) as uart:
        client = RtuClient(uart, args.slave)
        header = client.read_holding(CONTROL_BASE, 8)
        if header[:5] != [0x504C, 0x5352, 0x0100, 256, 0x0007]:
            raise RuntimeError(f"P13 控制窗口未就绪：{header}")
        print("P13 控制窗口就绪：D1200~D1455，协议 V1.0")

        s0 = [0] * 20
        put_u32(s0, 0, 1)
        put_u32(s0, 10, 2000)
        put_u32(s0, 12, 50000)
        s1 = [0] * 4
        client.write_multiple(S0_BASE, s0)
        client.write_multiple(S1_BASE, s1)
        print("S0=D1600、S1=D1700 已用 0x10 原子写入")

        response = send_call(client, 1, CALL_COMMIT)
        check_result(response, RESULT_OK, "COMMIT#1")
        if response[11] != 1:
            raise RuntimeError("COMMIT#1 未建立有效提交")
        print("COMMIT#1：完整校验通过")

        client.write_multiple(S0_BASE + 12, signed_dword_words(50001))
        response = send_call(client, 2, CALL_START)
        check_result(response, RESULT_BUSY, "篡改后的 START#2")
        print("START#2：正确拒绝 COMMIT 后被修改的 S0")

        client.write_multiple(S0_BASE + 12, signed_dword_words(50000))
        response = send_call(client, 3, CALL_COMMIT)
        check_result(response, RESULT_OK, "COMMIT#3")
        response = send_call(client, 4, CALL_START)
        check_result(response, RESULT_QUEUED, "START#4")
        status = wait_status(client, {STATE_ACCEL, STATE_RUN}, sequence=4)
        if status["last_result"] != RESULT_OK:
            raise RuntimeError(f"START#4 内核执行失败：{status}")
        print(
            f"START#4：Q0 已启动，当前 {status['current_frequency']}Hz，"
            f"目标 {status['target_frequency']}Hz"
        )

        time.sleep(0.5)
        response = send_command(client, 100, CMD_PAUSE)
        check_result(response, RESULT_QUEUED, "PAUSE#100")
        status = wait_status(client, {STATE_PAUSED}, sequence=100)
        print(f"PAUSE#100：已暂停，任务累计 {status['task_pulses']} 脉冲")

        # Resending the exact sequence must only replay the existing response.
        response = send_command(client, 100, CMD_PAUSE)
        check_result(response, RESULT_QUEUED, "重复 PAUSE#100")
        status = read_axis_status(client)
        if status["state"] != STATE_PAUSED or status["last_sequence"] != 100:
            raise RuntimeError(f"重复序号导致状态变化：{status}")
        print("重复 PAUSE#100：未重复执行")

        time.sleep(0.25)
        response = send_command(client, 101, CMD_RESUME)
        check_result(response, RESULT_QUEUED, "RESUME#101")
        status = wait_running_output(client, sequence=101)
        print(f"RESUME#101：恢复输出，当前 {status['current_frequency']}Hz")

        resumed_pulses = status["task_pulses"]
        time.sleep(0.5)
        status = read_axis_status(client)
        if status["task_pulses"] <= resumed_pulses:
            raise RuntimeError(f"RESUME#101 后脉冲计数未增长：{status}")
        response = send_command(client, 102, CMD_STOP_DECEL)
        check_result(response, RESULT_QUEUED, "STOP_DECEL#102")
        status = wait_status(client, {STATE_STOPPED}, sequence=102)
        print(
            f"STOP_DECEL#102：减速停止完成，逻辑位置={status['logical_position']}，"
            f"任务脉冲={status['task_pulses']}，物理脉冲={status['physical_pulses']}"
        )
        if status["error"] != 0:
            raise RuntimeError(f"最终状态存在错误：{status}")

        print("P13 全部自动测试 PASS，请核对 Q0 的启动/暂停/恢复/减速停止波形。")
    return 0


 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except (RuntimeError, serial.SerialException) as error:
        print(f"测试失败：{error}")
        raise SystemExit(1)
--- a/HostComputer/plsr_modbus_frequency_test.py
+++ b/HostComputer/plsr_modbus_frequency_test.py
@@ -0,0 +1,173 @@
 #!/usr/bin/env python3
 """PLSR P12 Modbus RTU live-frequency test.

 The firmware starts a long Q0 move from S0=D1000 and S1=D1100.  This tool
 updates the current-segment frequency at D1010/D1011 with function 0x10, so
 the two 16-bit words are committed as one Modbus transaction.
 """

 from __future__ import annotations

 import argparse
 import struct
 import time
 from dataclasses import dataclass

 import serial
 from serial.tools import list_ports


 S0_BASE = 1000
 S1_BASE = 1100
 LIVE_FREQUENCY_ADDRESS = S0_BASE + 10
 SLAVE_DEFAULT = 1


 def crc16(data: bytes) -> int:
    crc = 0xFFFF
    for byte in data:
        crc ^= byte
        for _ in range(8):
            crc = (crc >> 1) ^ 0xA001 if crc & 1 else crc >> 1
    return crc & 0xFFFF


 def add_crc(payload: bytes) -> bytes:
    crc = crc16(payload)
    return payload + bytes((crc & 0xFF, crc >> 8))


 def signed_dword_words(value: int) -> list[int]:
    raw = value & 0xFFFFFFFF
    return [raw & 0xFFFF, (raw >> 16) & 0xFFFF]


@dataclass
 class RtuClient:
    port: serial.Serial
    slave: int

    def exchange(self, request_pdu: bytes, response_size: int) -> bytes:
        request = add_crc(bytes((self.slave,)) + request_pdu)
        self.port.reset_input_buffer()
        self.port.write(request)
        self.port.flush()
        response = self.port.read(response_size)
        if len(response) != response_size:
            raise RuntimeError(
                f"响应超时：期望 {response_size} 字节，收到 {len(response)} 字节"
            )
        if crc16(response[:-2]) != int.from_bytes(response[-2:], "little"):
            raise RuntimeError(f"响应 CRC 错误：{response.hex(' ')}")
        if response[0] != self.slave:
            raise RuntimeError(f"站号错误：收到 {response[0]}，期望 {self.slave}")
        if response[1] & 0x80:
            raise RuntimeError(
                f"Modbus 异常：功能码 0x{response[1]:02X}，异常码 0x{response[2]:02X}"
            )
        return response

    def read_holding(self, address: int, quantity: int) -> list[int]:
        pdu = bytes((0x03,)) + struct.pack(">HH", address, quantity)
        response = self.exchange(pdu, 5 + quantity * 2)
        if response[1] != 0x03 or response[2] != quantity * 2:
            raise RuntimeError(f"0x03 响应格式错误：{response.hex(' ')}")
        return list(struct.unpack(f">{quantity}H", response[3:-2]))

    def write_multiple(self, address: int, values: list[int]) -> None:
        encoded = struct.pack(f">{len(values)}H", *values)
        pdu = (
            bytes((0x10,))
            + struct.pack(">HHB", address, len(values), len(encoded))
            + encoded
        )
        response = self.exchange(pdu, 8)
        expected = bytes((self.slave, 0x10)) + struct.pack(">HH", address, len(values))
        if response[:6] != expected:
            raise RuntimeError(f"0x10 响应回显错误：{response.hex(' ')}")

    def write_dword(self, address: int, value: int) -> None:
        self.write_multiple(address, signed_dword_words(value))
        words = self.read_holding(address, 2)
        if words != signed_dword_words(value):
            raise RuntimeError(
                f"D{address} 回读不一致：写入 {signed_dword_words(value)}，回读 {words}"
            )


 def choose_port(requested: str | None) -> str:
    if requested:
        return requested
    ports = [item.device for item in list_ports.comports()]
    if len(ports) == 1:
        print(f"自动选择串口 {ports[0]}")
        return ports[0]
    available = ", ".join(ports) if ports else "未发现串口"
    raise RuntimeError(f"请用 --port 指定串口。当前串口：{available}")


 def wait_until(deadline: float) -> None:
    remaining = deadline - time.monotonic()
    if remaining > 0:
        time.sleep(remaining)


 def main() -> int:
    parser = argparse.ArgumentParser(description="PLSR P12 Modbus 动态频率自动测试")
    parser.add_argument("--port", help="串口，例如 COM5；只有一个串口时可省略")
    parser.add_argument("--baud", type=int, default=9600)
    parser.add_argument("--slave", type=int, default=SLAVE_DEFAULT)
    args = parser.parse_args()

    port_name = choose_port(args.port)
    with serial.Serial(
        port=port_name,
        baudrate=args.baud,
        bytesize=serial.EIGHTBITS,
        parity=serial.PARITY_EVEN,
        stopbits=serial.STOPBITS_ONE,
        timeout=1.0,
        write_timeout=1.0,
    ) as uart:
        client = RtuClient(uart, args.slave)
        header = client.read_holding(S0_BASE, 20)
        s1 = client.read_holding(S1_BASE, 4)
        if header[0] != 1 or header[12:14] != signed_dword_words(100000):
            raise RuntimeError(
                "P12 数据未就绪：请确认已烧录当前固件并复位开发板"
            )
        if any(s1):
            raise RuntimeError(f"S1 数据异常：{s1}")

        print("P12 已就绪：S0=D1000，S1=D1100，Q0 正在输出")
        print("所有 32 位频率均使用 0x10 一次写入两个寄存器。")
        schedule = [
            (0.0, 1000, "初始目标"),
            (1.0, 4000, "升至 4000Hz"),
            (1.5, 500, "降至 500Hz"),
            (2.0, 0, "0 使用 S2 默认 1000Hz"),
            (2.2, 8000, "超过上限，固件应钳位到 5000Hz"),
            (2.7, -1, "非法值，固件应保持上一次安全目标"),
            (2.9, 2000, "恢复到 2000Hz"),
        ]
        started = time.monotonic()
        for offset, frequency, description in schedule:
            wait_until(started + offset)
            before = time.monotonic()
            client.write_dword(LIVE_FREQUENCY_ADDRESS, frequency)
            latency_ms = (time.monotonic() - before) * 1000.0
            print(
                f"T+{time.monotonic() - started:6.3f}s  "
                f"D1010={frequency:6d}  {description}  RTU往返={latency_ms:6.1f}ms"
            )

        print("脚本测试完成。请按测试说明核对 Q0 波形与 IAR 状态变量。")
    return 0


 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except (RuntimeError, serial.SerialException) as error:
        print(f"测试失败：{error}")
        raise SystemExit(1)
--- a/Modbus/Inc/modbus_data_store.h
+++ b/Modbus/Inc/modbus_data_store.h
@@ -0,0 +1,51 @@
 #ifndef MODBUS_DATA_STORE_H
 #define MODBUS_DATA_STORE_H

 #include <stdint.h>

 #ifdef __cplusplus
 extern "C" {
 #endif

 /* Logical PLC word-device spaces.  These values intentionally match the
 * PLSR D/HD/FD device codes, but this module does not depend on PLSR. */
 typedef enum
 {
    MODBUS_DATA_DEVICE_D = 0,
    MODBUS_DATA_DEVICE_HD,
    MODBUS_DATA_DEVICE_FD
 } MODBUS_DATA_DEVICE;

 #define MODBUS_DATA_D_WORD_COUNT   (10000UL)
 #define MODBUS_DATA_HD_WORD_COUNT  (10000UL)
 #define MODBUS_DATA_FD_WORD_COUNT  (10000UL)

 uint8_t ModbusDataValidateWords(MODBUS_DATA_DEVICE device,
                                uint32_t firstAddress,
                                uint32_t wordCount);
 uint8_t ModbusDataReadWord(MODBUS_DATA_DEVICE device,
                           uint32_t address,
                           uint16_t *value);
 uint8_t ModbusDataReadDword(MODBUS_DATA_DEVICE device,
                            uint32_t lowAddress,
                            int32_t *value);
 uint8_t ModbusDataWriteWord(MODBUS_DATA_DEVICE device,
                            uint32_t address,
                            uint16_t value);
 uint8_t ModbusDataWriteWords(MODBUS_DATA_DEVICE device,
                             uint32_t firstAddress,
                             const uint16_t *values,
                             uint32_t wordCount);

 /* Existing function 0x48 uses a sparse linear address space:
 * 0..19999 are normal SRAM and 40000..69998 are CCMRAM. */
 uint8_t ModbusDataReadLinear(uint32_t address, uint16_t *value);

 /* Even means stable; odd means a multi-register write is in progress. */
 uint32_t ModbusDataGetWriteSequence(void);

 #ifdef __cplusplus
 }
 #endif

 #endif /* MODBUS_DATA_STORE_H */
--- a/Modbus/Src/modbus_data_store.c
+++ b/Modbus/Src/modbus_data_store.c
@@ -0,0 +1,349 @@
 #include "modbus_data_store.h"
 #include <stddef.h>

 #if defined(PLSR_HOST_TEST)
 #define MODBUS_DATA_BARRIER() __sync_synchronize()
 #else
 #include "stm32f4xx.h"
 #define MODBUS_DATA_BARRIER() __DMB()
 #endif

 #define MODBUS_DATA_SRAM_WORD_COUNT  (20000UL)
 #define MODBUS_DATA_CCM_WORD_COUNT   (29999UL)
 #define MODBUS_DATA_HD_SRAM_OFFSET   (10000UL)
 #define MODBUS_DATA_LINEAR_CCM_BASE  (40000UL)

 static uint16_t ModbusDataSram[MODBUS_DATA_SRAM_WORD_COUNT];

 #if !defined(PLSR_HOST_TEST)
 #pragma location = ".ccmram"
 #pragma data_alignment = 4
 __root
 #endif
 static uint16_t ModbusDataCcm[MODBUS_DATA_CCM_WORD_COUNT];

 static volatile uint32_t ModbusDataWriteSequence;
 static volatile uint32_t ModbusDataWriteFirstAddress;
 static volatile uint32_t ModbusDataWriteWordCount;
 static volatile MODBUS_DATA_DEVICE ModbusDataWriteDevice;

 static uint32_t ModbusDataEnterShortCritical(void)
 {
 #if defined(PLSR_HOST_TEST)
    return 0UL;
 #else
    uint32_t interruptState;

    interruptState = __get_PRIMASK();
    __disable_irq();
    return interruptState;
 #endif
 }

 static void ModbusDataExitShortCritical(uint32_t interruptState)
 {
 #if defined(PLSR_HOST_TEST)
    (void)interruptState;
 #else
    if (interruptState == 0UL)
    {
        __enable_irq();
    }
 #endif
 }

 static uint8_t ModbusDataResolve(MODBUS_DATA_DEVICE device,
                                 uint32_t address,
                                 uint16_t **word)
 {
    if (word == NULL)
    {
        return 0U;
    }
    switch (device)
    {
        case MODBUS_DATA_DEVICE_D:
            if (address >= MODBUS_DATA_D_WORD_COUNT)
            {
                return 0U;
            }
            *word = &ModbusDataSram[address];
            return 1U;

        case MODBUS_DATA_DEVICE_HD:
            if (address >= MODBUS_DATA_HD_WORD_COUNT)
            {
                return 0U;
            }
            *word = &ModbusDataSram[MODBUS_DATA_HD_SRAM_OFFSET + address];
            return 1U;

        case MODBUS_DATA_DEVICE_FD:
            if (address >= MODBUS_DATA_FD_WORD_COUNT)
            {
                return 0U;
            }
            *word = &ModbusDataCcm[address];
            return 1U;

        default:
            return 0U;
    }
 }

 static uint32_t ModbusDataCapacity(MODBUS_DATA_DEVICE device)
 {
    switch (device)
    {
        case MODBUS_DATA_DEVICE_D:
            return MODBUS_DATA_D_WORD_COUNT;

        case MODBUS_DATA_DEVICE_HD:
            return MODBUS_DATA_HD_WORD_COUNT;

        case MODBUS_DATA_DEVICE_FD:
            return MODBUS_DATA_FD_WORD_COUNT;

        default:
            return 0UL;
    }
 }

 static uint8_t ModbusDataWriteOverlaps(MODBUS_DATA_DEVICE device,
                                       uint32_t firstAddress,
                                       uint32_t wordCount)
 {
    uint32_t activeFirst;
    uint32_t activeCount;

    if (device != ModbusDataWriteDevice)
    {
        return 0U;
    }
    activeFirst = ModbusDataWriteFirstAddress;
    activeCount = ModbusDataWriteWordCount;
    if ((activeCount == 0UL) || (wordCount == 0UL))
    {
        return 0U;
    }
    return ((firstAddress < (activeFirst + activeCount))
            && (activeFirst < (firstAddress + wordCount)))
               ? 1U
               : 0U;
 }

 static void ModbusDataWriteBegin(MODBUS_DATA_DEVICE device,
                                 uint32_t firstAddress,
                                 uint32_t wordCount)
 {
    ModbusDataWriteDevice = device;
    ModbusDataWriteFirstAddress = firstAddress;
    ModbusDataWriteWordCount = wordCount;
    MODBUS_DATA_BARRIER();
    ModbusDataWriteSequence++;
    MODBUS_DATA_BARRIER();
 }

 static void ModbusDataWriteEnd(void)
 {
    MODBUS_DATA_BARRIER();
    ModbusDataWriteSequence++;
 }

 uint8_t ModbusDataValidateWords(MODBUS_DATA_DEVICE device,
                                uint32_t firstAddress,
                                uint32_t wordCount)
 {
    uint32_t capacity;

    capacity = ModbusDataCapacity(device);
    if ((capacity == 0UL) || (wordCount == 0UL)
        || (firstAddress >= capacity))
    {
        return 0U;
    }
    return (wordCount <= (capacity - firstAddress)) ? 1U : 0U;
 }

 uint8_t ModbusDataReadWord(MODBUS_DATA_DEVICE device,
                           uint32_t address,
                           uint16_t *value)
 {
    uint16_t *word;
    uint32_t before;
    uint32_t after;
    uint16_t snapshot;

    if ((value == NULL) || (ModbusDataResolve(device, address, &word) == 0U))
    {
        return 0U;
    }
    before = ModbusDataWriteSequence;
    if (((before & 1UL) != 0UL)
        && (ModbusDataWriteOverlaps(device, address, 1UL) != 0U))
    {
        return 0U;
    }
    MODBUS_DATA_BARRIER();
    snapshot = *word;
    MODBUS_DATA_BARRIER();
    after = ModbusDataWriteSequence;
    if ((before != after)
        && (ModbusDataWriteOverlaps(device, address, 1UL) != 0U))
    {
        return 0U;
    }
    if (((after & 1UL) != 0UL)
        && (ModbusDataWriteOverlaps(device, address, 1UL) != 0U))
    {
        return 0U;
    }
    *value = snapshot;
    return 1U;
 }

 uint8_t ModbusDataReadDword(MODBUS_DATA_DEVICE device,
                            uint32_t lowAddress,
                            int32_t *value)
 {
    uint16_t *lowWord;
    uint16_t *highWord;
    uint16_t lowSnapshot;
    uint16_t highSnapshot;
    uint32_t before;
    uint32_t after;

    if ((value == NULL)
        || (ModbusDataValidateWords(device, lowAddress, 2UL) == 0U)
        || (ModbusDataResolve(device, lowAddress, &lowWord) == 0U)
        || (ModbusDataResolve(device, lowAddress + 1UL, &highWord) == 0U))
    {
        return 0U;
    }
    before = ModbusDataWriteSequence;
    if (((before & 1UL) != 0UL)
        && (ModbusDataWriteOverlaps(device, lowAddress, 2UL) != 0U))
    {
        return 0U;
    }
    MODBUS_DATA_BARRIER();
    lowSnapshot = *lowWord;
    highSnapshot = *highWord;
    MODBUS_DATA_BARRIER();
    after = ModbusDataWriteSequence;
    if ((before != after)
        && (ModbusDataWriteOverlaps(device, lowAddress, 2UL) != 0U))
    {
        return 0U;
    }
    if (((after & 1UL) != 0UL)
        && (ModbusDataWriteOverlaps(device, lowAddress, 2UL) != 0U))
    {
        return 0U;
    }
    *value = (int32_t)(((uint32_t)highSnapshot << 16U) | lowSnapshot);
    return 1U;
 }

 uint8_t ModbusDataWriteWord(MODBUS_DATA_DEVICE device,
                            uint32_t address,
                            uint16_t value)
 {
    uint16_t *word;
    uint32_t interruptState;

    if (ModbusDataResolve(device, address, &word) == 0U)
    {
        return 0U;
    }
    interruptState = ModbusDataEnterShortCritical();
    ModbusDataWriteBegin(device, address, 1UL);
    *word = value;
    ModbusDataWriteEnd();
    ModbusDataExitShortCritical(interruptState);
    return 1U;
 }

 uint8_t ModbusDataWriteWords(MODBUS_DATA_DEVICE device,
                             uint32_t firstAddress,
                             const uint16_t *values,
                             uint32_t wordCount)
 {
    uint16_t *firstWord;
    uint32_t index;
    uint32_t interruptState = 1UL;

    if ((values == NULL)
        || (ModbusDataValidateWords(device, firstAddress, wordCount) == 0U)
        || (ModbusDataResolve(device, firstAddress, &firstWord) == 0U))
    {
        return 0U;
    }
    /* A live INT32 update is only two words.  Keep that very short commit
     * indivisible to the 100us ISR, so it sees either the old or new value.
     * Larger block writes use the non-blocking sequence protocol instead of
     * delaying pulse-related interrupts for an unbounded block copy. */
    if (wordCount <= 2UL)
    {
        interruptState = ModbusDataEnterShortCritical();
    }
    ModbusDataWriteBegin(device, firstAddress, wordCount);
    for (index = 0UL; index < wordCount; index++)
    {
        firstWord[index] = values[index];
    }
    ModbusDataWriteEnd();
    if (wordCount <= 2UL)
    {
        ModbusDataExitShortCritical(interruptState);
    }
    return 1U;
 }

 uint8_t ModbusDataReadLinear(uint32_t address, uint16_t *value)
 {
    if (address < MODBUS_DATA_SRAM_WORD_COUNT)
    {
        return ModbusDataReadWord((address < MODBUS_DATA_D_WORD_COUNT)
                                      ? MODBUS_DATA_DEVICE_D
                                      : MODBUS_DATA_DEVICE_HD,
                                  (address < MODBUS_DATA_D_WORD_COUNT)
                                      ? address
                                      : address - MODBUS_DATA_HD_SRAM_OFFSET,
                                  value);
    }
    if ((address >= MODBUS_DATA_LINEAR_CCM_BASE)
        && ((address - MODBUS_DATA_LINEAR_CCM_BASE)
            < MODBUS_DATA_CCM_WORD_COUNT))
    {
        uint32_t before;
        uint32_t after;
        uint16_t snapshot;

        if (value == NULL)
        {
            return 0U;
        }
        before = ModbusDataWriteSequence;
        if ((before & 1UL) != 0UL)
        {
            return 0U;
        }
        MODBUS_DATA_BARRIER();
        snapshot = ModbusDataCcm[address - MODBUS_DATA_LINEAR_CCM_BASE];
        MODBUS_DATA_BARRIER();
        after = ModbusDataWriteSequence;
        if ((before != after) || ((after & 1UL) != 0UL))
        {
            return 0U;
        }
        *value = snapshot;
        return 1U;
    }
    return 0U;
 }

 uint32_t ModbusDataGetWriteSequence(void)
 {
    return ModbusDataWriteSequence;
 }
--- a/Modbus/Src/modbus_rtu_slave.c
+++ b/Modbus/Src/modbus_rtu_slave.c
@@ -1,4 +1,5 @@
 #include "modbus_rtu_slave.h"
 #include "modbus_data_store.h"
 #include <string.h>

 #define MODBUS_RTU_ADU_SIZE_MAX (256U) // Modbus RTU 最大 ADU 长度，单位为字节
@@ -36,6 +37,7 @@ static uint8_t ModbusRxDmaBuffer[MODBUS_RTU_ADU_SIZE_MAX];
 static uint8_t ModbusRxAssemblyBuffer[MODBUS_RTU_ADU_SIZE_MAX];
 static uint8_t ModbusRxFrame[MODBUS_RTU_ADU_SIZE_MAX];
 static uint8_t ModbusTxFrame[MODBUS_RTU_ADU_SIZE_MAX];
 static uint16_t ModbusWriteRegisterScratch[MODBUS_WRITE_REGS_MAX];
 /* D100～D120 上一次已保存的值，用于检测数据是否变化 */
 static uint16_t ModbusRetainedSnapshot[MODBUS_RETAINED_D_COUNT];
 static volatile uint16_t ModbusRxFrameLength;
@@ -52,16 +54,8 @@ static volatile uint8_t ModbusHasReceivedValidFrame;
 static volatile MODBUS_BACKUP_DATA *ModbusBackupData =
    (volatile MODBUS_BACKUP_DATA *)BKPSRAM_BASE;

 /**
 * 10000 个保持寄存器占用 20000 字节；10000 个线圈按位存储，
 * 占用 1250 字节
 */
 static uint16_t ModbusHoldingRegisters[20000];

 #pragma location = ".ccmram"
 #pragma data_alignment = 4
 __root static uint16_t ModbusRegistersCcm[29999];

 /* Word data is owned by modbus_data_store.c.  This file keeps only the
 * protocol-facing coil space and RTU buffers. */
 static uint8_t ModbusCoils[(MODBUS_MAP_ITEM_COUNT + 7U) / 8U];

 volatile MODBUS_SLAVE_STATS ModbusSlaveStatistics;
@@ -442,7 +436,11 @@ tx:
        {
            address = (address - 20000U) * 2U + 1U;
        }
        value = ModbusHoldingRegisters[address];
        if (ModbusDataReadWord(MODBUS_DATA_DEVICE_D, address, &value) == 0U)
        {
            ModbusSlaveStatistics.illegalAddressCount++;
            return ModbusBuildException(request[1], MODBUS_EX_ILLEGAL_ADDRESS);
        }
        ModbusTxFrame[3U + index * 2U] = (uint8_t)(value >> 8U);
        ModbusTxFrame[4U + index * 2U] = (uint8_t)(value & 0x00FFU);
    }
@@ -484,7 +482,7 @@ static uint16_t ModbusProcessWriteSingleRegister(const uint8_t *request,
                                         
    }

    ModbusHoldingRegisters[address] = value;
    (void)ModbusDataWriteWord(MODBUS_DATA_DEVICE_D, address, value);

    if (isBroadcast != 0U)
    {
@@ -672,9 +670,13 @@ static uint16_t ModbusProcessWriteMultipleRegisters(const uint8_t *request,

    for (index = 0U; index < quantity; index++)
    {
        ModbusHoldingRegisters[start + index] =
        ModbusWriteRegisterScratch[index] =
            ModbusGetU16Be(&request[7U + index * 2U]);
    }
    (void)ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               start,
                               ModbusWriteRegisterScratch,
                               quantity);

    if (isBroadcast != 0U)
    {
@@ -723,11 +725,12 @@ static uint16_t ModbusProcessReadBigHolding(const uint8_t *request,
        return ModbusBuildException(request[1], MODBUS_EX_ILLEGAL_VALUE);
    }

    /*
     * 普通SRAM有40000个寄存器，CCMRAM有29999个寄存器，
     * 总地址范围为0～69998
     */
    if ((start >= 69999UL) || ((uint32_t)quantity > (69999UL - start)))
    /* Function 0x48 retains the existing sparse range: SRAM 0..19999 and
     * CCMRAM 40000..69998.  The unallocated 20000..39999 gap is rejected. */
    if ((start >= 69999UL) || ((uint32_t)quantity > (69999UL - start))
        || ((start < 40000UL)
            && ((start >= 20000UL)
                || ((start + quantity) > 20000UL))))

    {
        ModbusSlaveStatistics.illegalAddressCount++;
@@ -744,17 +747,11 @@ static uint16_t ModbusProcessReadBigHolding(const uint8_t *request,
    {
        currentAddress = start + (uint32_t)index;

        /*
         * 地址0～39999位于普通SRAM；
         * 地址40000～69998位于CCMRAM
         */
        if (currentAddress < 40000UL)
        {
            value = ModbusHoldingRegisters[currentAddress];
        }
        else
        /* The data-store layer validates the sparse physical range. */
        if (ModbusDataReadLinear(currentAddress, &value) == 0U)
        {
            value = ModbusRegistersCcm[currentAddress - 40000UL];
            ModbusSlaveStatistics.illegalAddressCount++;
            return ModbusBuildException(request[1], MODBUS_EX_ILLEGAL_ADDRESS);
        }

        /* 每个寄存器按照高字节、低字节装入响应帧 */
@@ -864,8 +861,6 @@ HAL_StatusTypeDef ModbusSlaveInit(UART_HandleTypeDef *huart,
    ModbusTxBusy = 0U;
    ModbusRtuTimingInit(huart->Init.BaudRate);

    //ModbusHoldingRegisters[HMI_REG_DEVICE_ID] = 0xF407U;

    return ModbusStartReceive();
 }

@@ -1019,8 +1014,7 @@ uint8_t ModbusSlaveSetHoldingRegister(uint16_t address, uint16_t value)
        return 0U;
    }

    ModbusHoldingRegisters[address] = value;
    return 1U;
    return ModbusDataWriteWord(MODBUS_DATA_DEVICE_D, address, value);
 }

 uint8_t ModbusSlaveGetHoldingRegister(uint16_t address, uint16_t *value)
@@ -1030,8 +1024,7 @@ uint8_t ModbusSlaveGetHoldingRegister(uint16_t address, uint16_t *value)
        return 0U;
    }

    *value = ModbusHoldingRegisters[address];
    return 1U;
    return ModbusDataReadWord(MODBUS_DATA_DEVICE_D, address, value);
 }

 uint8_t ModbusSlaveSetCoil(uint16_t address, uint8_t state)
@@ -1075,15 +1068,19 @@ void ModbusRetainedRegistersLoad(void)
    {
        for (index = 0U; index < MODBUS_RETAINED_D_COUNT; index++)
        {
            ModbusHoldingRegisters[MODBUS_RETAINED_D_START + index] =
                ModbusBackupData->retainedD[index];
            (void)ModbusDataWriteWord(
                MODBUS_DATA_DEVICE_D,
                MODBUS_RETAINED_D_START + index,
                ModbusBackupData->retainedD[index]);
        }
    }
    else
    {
        for (index = 0U; index < MODBUS_RETAINED_D_COUNT; index++)
        {
            ModbusHoldingRegisters[MODBUS_RETAINED_D_START + index] = 0U;
            (void)ModbusDataWriteWord(MODBUS_DATA_DEVICE_D,
                                      MODBUS_RETAINED_D_START + index,
                                      0U);

            ModbusBackupData->retainedD[index] = 0U;
        }
@@ -1102,7 +1099,9 @@ void ModbusRetainedRegistersPoll(void)

    for (index = 0; index < MODBUS_RETAINED_D_COUNT; index++)
    {
        value = ModbusHoldingRegisters[MODBUS_RETAINED_D_START + index];
        (void)ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                                 MODBUS_RETAINED_D_START + index,
                                 &value);
        if (value != ModbusRetainedSnapshot[index])
        {
            ModbusBackupData->retainedD[index] = value;
--- a/PLSR/Inc/plsr_core.h
+++ b/PLSR/Inc/plsr_core.h
@@ -12,8 +12,14 @@ extern "C" {
 PLSR_RESULT PlsrInit(void);
 void PlsrTask(void *argument);
 void PlsrProcess(void);
 void PlsrControlTick100us(void);
 void PlsrSetControlTickHook(void (*hook)(void));

 PLSR_RESULT PlsrPostCall(const PLSR_CALL *call);
 /* Side-effect-free COMMIT validation.  It parses the complete S0/S1/S2/D
 * model but does not reserve resources or start an axis. */
 PLSR_RESULT PlsrValidateCall(const PLSR_CALL *call,
                             PLSR_PARSE_DETAIL *detail);
 PLSR_RESULT PlsrPostCommand(const PLSR_COMMAND *command);
 PLSR_RESULT PlsrPostEvent(uint8_t axis, uint32_t eventMask);
 PLSR_RESULT PlsrGetStatus(uint8_t axis, PLSR_STATUS *status);
@@ -24,6 +30,10 @@ PLSR_RESULT PlsrGetLastParseDetail(uint8_t axis,
 /* 仅测试使用的低层启动入口：不解析 S0/S1/S2/D，直接申请资源进入 ACCEL。
 * 生产调用必须使用 PlsrPostCall()。 */
 PLSR_RESULT PlsrPostStart(const PLSR_START_REQUEST *request);
 uint32_t PlsrTestGetProfileRefreshHz(uint8_t axis);
 uint8_t PlsrTestGetProfileActive(uint8_t axis);
 uint8_t PlsrTestGetJobRefreshCode(uint8_t axis);
 uint32_t PlsrTestGetProfileFrequencyHz(uint8_t axis);
 #endif

 PLSR_RESULT PlsrStateTransition(uint8_t axis,
--- a/PLSR/Inc/plsr_hal_f407.h
+++ b/PLSR/Inc/plsr_hal_f407.h
@@ -27,6 +27,7 @@ typedef struct
    PLSR_OUTPUT_MODE outputMode;    /* PULSE/DIR、AB 或 CW/CCW */
    uint8_t directionPoint;         /* DIR 输出点（Y 点号，0xFF=无） */
    uint8_t directionPositive;
    uint8_t directionNegativeLogic; /* SFD900 Bit1: 1 reverses DIR ON/OFF */
    uint16_t directionDelayMs;
 } PLSR_HW_START_PARAMS;

@@ -34,7 +35,14 @@ PLSR_RESULT PlsrHwInit(void);

 PLSR_RESULT PlsrHwStartPulse(uint8_t axis, const PLSR_HW_START_PARAMS *params);
 PLSR_RESULT PlsrHwSetFrequency(uint8_t axis, uint32_t frequencyHz);
 /* Re-arm a PAUSE-stopped timer without clearing its emitted/target counters. */
 PLSR_RESULT PlsrHwResumePulse(uint8_t axis);
 PLSR_RESULT PlsrHwStopPulse(uint8_t axis);

 /* Batch related multi-axis DIR changes into one short GPIO commit window. */
 void PlsrHwBeginDirectionBatch(void);
 void PlsrHwEndDirectionBatch(void);

 uint8_t PlsrHwIsPulseActive(uint8_t axis);
 PLSR_HW_STATE PlsrHwGetState(uint8_t axis);
 uint32_t PlsrHwGetTimerClockHz(uint8_t axis);
@@ -65,6 +73,7 @@ uint8_t PlsrHwTestGetAbPhaseA(uint8_t axis);
 uint8_t PlsrHwTestGetAbPhaseB(uint8_t axis);
 uint8_t PlsrHwTestGetAbQuarter(uint8_t axis);
 void PlsrHwTestTriggerUpdate(uint8_t axis);
 void PlsrHwTestTriggerCompare(uint8_t axis);
 void PlsrHwTestAdvanceAbQuarter(uint8_t axis);
 #endif

--- a/PLSR/Inc/plsr_job.h
+++ b/PLSR/Inc/plsr_job.h
@@ -32,6 +32,10 @@ typedef uint8_t (*PLSR_READ_WORD_FN)(void *context,
                                     PLSR_DEVICE_TYPE device,
                                     uint32_t address,
                                     uint16_t *value);
 typedef uint8_t (*PLSR_READ_DWORD_FN)(void *context,
                                      PLSR_DEVICE_TYPE device,
                                      uint32_t address,
                                      int32_t *value);
 typedef uint8_t (*PLSR_READ_BIT_FN)(void *context,
                                    PLSR_DEVICE_TYPE device,
                                    uint32_t address,
@@ -42,6 +46,9 @@ typedef struct
    void *context;
    PLSR_VALIDATE_WORDS_FN validateWords;
    PLSR_READ_WORD_FN readWord;
    /* Optional atomic low-word/high-word snapshot.  A 0.1ms live-frequency
     * source should provide this callback to prevent torn 32-bit reads. */
    PLSR_READ_DWORD_FN readDword;
    PLSR_READ_BIT_FN readBit;
 } PLSR_DATA_SOURCE;

@@ -152,6 +159,8 @@ typedef struct
    PLSR_EQUIVALENT_CONFIG equivalent;
    PLSR_LIMIT_SNAPSHOT limits;
    PLSR_SEGMENT_SNAPSHOT segments[PLSR_MAX_SEGMENTS];
    uint16_t positiveBacklashPulses;
    uint16_t negativeBacklashPulses;
    uint32_t inputDefaultSpeed;
    uint32_t inputMaximumSpeed;
    uint32_t timerClockHz;
@@ -163,7 +172,7 @@ typedef struct
    uint8_t positioningMode;
    uint8_t outputMode;
    uint8_t directionPoint;
    uint8_t directionActiveHigh;
    uint8_t directionNegativeLogic;
    uint8_t initialDirectionPositive;
    uint8_t speedClamped;
    uint8_t hasSelfLoop;
@@ -202,6 +211,9 @@ PLSR_RESULT PlsrResolveLiveFrequency(const PLSR_JOB_SNAPSHOT *snapshot,
                                     uint16_t segment,
                                     uint32_t *frequency,
                                     uint8_t *clamped);
 PLSR_RESULT PlsrReadLiveFrequencyRaw(const PLSR_JOB_SNAPSHOT *snapshot,
                                     uint16_t segment,
                                     int32_t *rawFrequency);
 PLSR_RESULT PlsrCalculateTimerDivider(uint32_t timerClockHz,
                                      uint32_t frequencyHz,
                                      uint16_t *psc,
--- a/PLSR/Inc/plsr_modbus_control.h
+++ b/PLSR/Inc/plsr_modbus_control.h
@@ -0,0 +1,34 @@
 #ifndef PLSR_MODBUS_CONTROL_H
 #define PLSR_MODBUS_CONTROL_H

 #include "plsr_types.h"
 #include <stdint.h>

 #ifdef __cplusplus
 extern "C" {
 #endif

 #define PLSR_MODBUS_PROTOCOL_VERSION       (0x0100U)
 #define PLSR_MODBUS_WINDOW_WORDS           (256UL)

 #define PLSR_MODBUS_CALL_REQUEST_OFFSET    (8UL)
 #define PLSR_MODBUS_CALL_RESPONSE_OFFSET   (24UL)
 #define PLSR_MODBUS_COMMAND_REQUEST_OFFSET (40UL)
 #define PLSR_MODBUS_COMMAND_RESPONSE_OFFSET (48UL)
 #define PLSR_MODBUS_AXIS_STATUS_OFFSET     (64UL)
 #define PLSR_MODBUS_AXIS_STATUS_WORDS      (48UL)

 #define PLSR_MODBUS_CALL_NONE              (0U)
 #define PLSR_MODBUS_CALL_COMMIT            (1U)
 #define PLSR_MODBUS_CALL_START             (2U)

 PLSR_RESULT PlsrModbusControlInit(uint16_t baseAddress);
 void PlsrModbusControlPoll(void);
 uint8_t PlsrModbusControlIsEnabled(void);
 uint16_t PlsrModbusControlGetBaseAddress(void);

 #ifdef __cplusplus
 }
 #endif

 #endif /* PLSR_MODBUS_CONTROL_H */
--- a/PLSR/Inc/plsr_modbus_data.h
+++ b/PLSR/Inc/plsr_modbus_data.h
@@ -0,0 +1,18 @@
 #ifndef PLSR_MODBUS_DATA_H
 #define PLSR_MODBUS_DATA_H

 #include "plsr_job.h"

 #ifdef __cplusplus
 extern "C" {
 #endif

 /* Build a PLSR data source backed by the Modbus register store.  D, HD and FD
 * are separate logical spaces; standard Modbus holding registers expose D. */
 void PlsrModbusDataSourceInit(PLSR_DATA_SOURCE *source);

 #ifdef __cplusplus
 }
 #endif

 #endif /* PLSR_MODBUS_DATA_H */
--- a/PLSR/Inc/plsr_profile.h
+++ b/PLSR/Inc/plsr_profile.h
@@ -93,6 +93,14 @@ PLSR_RESULT PlsrProfileRetarget(PLSR_PROFILE_STATE *state,
 /* 从当前频率按既定减速斜率降到0，用于缓停、限位和暂停。 */
 PLSR_RESULT PlsrProfileRequestStop(PLSR_PROFILE_STATE *state);

 /* Resume a profile that was decelerated to zero by PAUSE.  Pulse progress and
 * the original segment total are retained; only the velocity trajectory is
 * rebuilt for the unexecuted remainder. */
 PLSR_RESULT PlsrProfileResume(PLSR_PROFILE_STATE *state,
                              uint32_t startFrequencyHz,
                              uint32_t targetFrequencyHz,
                              uint32_t stopFrequencyHz);

 /* 虚拟发射计数校准到硬件实际计数（消除 ARPE 预装载滞后的累积偏差，
 * 保证 DONE 判定与硬件同步，段尾不再以冻结频率补发剩余脉冲）。 */
 void PlsrProfileSyncPulses(PLSR_PROFILE_STATE *state, uint64_t hwPulses);
--- a/PLSR/Inc/plsr_self_test.h
+++ b/PLSR/Inc/plsr_self_test.h
@@ -22,6 +22,30 @@ PLSR_RESULT PlsrProtectionSelfTestQueue(void);
 /* P6 board test: start four independent PULSE/DIR axes together. */
 PLSR_RESULT PlsrFourAxisSelfTestQueue(void);

 /* P7 board test: three segments exercise negative and positive backlash. */
 PLSR_RESULT PlsrBacklashSelfTestQueue(void);

 /* P8 board test: Q4/Q3 show positive/negative DIR logic side by side. */
 PLSR_RESULT PlsrDirectionLogicSelfTestQueue(void);

 /* P9 board test: Q0=CW and Q1=CCW, with strict channel interlock. */
 PLSR_RESULT PlsrCwCcwSelfTestQueue(void);

 /* P10 board test: Q0 uses 1ms refresh, Q1 uses 0.1ms refresh. */
 PLSR_RESULT PlsrFastRefreshSelfTestQueue(void);
 PLSR_RESULT PlsrDynamicFrequencySelfTestQueue(void);
 /* P12: S0=D1000, S1=D1100; D1010/D1011 is changed by a Modbus master. */
 PLSR_RESULT PlsrModbusDataSelfTestQueue(void);
 /* P13 prepares deterministic SFD K1 data; motion is commanded via Modbus. */
 PLSR_RESULT PlsrModbusControlSelfTestPrepare(void);
 void PlsrSelfTestControlTick100us(void);

 /* P11 board-test control.  Write this signed dword from IAR Watch while the
 * test is running; it represents the live S0 current-segment frequency. */
 extern volatile int32_t PlsrSelfTestLiveFrequencyHz;
 extern volatile uint32_t PlsrSelfTestDynamicTick100us;
 extern volatile uint8_t PlsrSelfTestDynamicPhase;

 #ifdef __cplusplus
 }
 #endif
--- a/PLSR/Inc/plsr_types.h
+++ b/PLSR/Inc/plsr_types.h
@@ -172,6 +172,7 @@ typedef struct
    int64_t logicalPosition;
    int64_t taskPulses;
    int64_t totalPulses;
    uint64_t physicalPulses;
    uint8_t busy;
    uint8_t pulseActive;
    uint8_t done;
@@ -187,9 +188,14 @@ typedef struct
    uint8_t positiveLimitActive;
    uint8_t negativeLimitActive;
    uint8_t emergencyLatched;
    uint8_t backlashActive;
    uint16_t segmentCount;
    uint16_t startSegment;
    uint16_t currentSegment;
    uint32_t currentFrequencyHz;
    uint32_t targetFrequencyHz;
    uint32_t liveFrequencyRejectCount;
    PLSR_RESULT lastLiveFrequencyResult;
 } PLSR_STATUS;

 #ifdef __cplusplus
--- a/PLSR/Src/plsr_core.c
+++ b/PLSR/Src/plsr_core.c
@@ -23,6 +23,7 @@ typedef struct
    uint16_t compatibleErrorBlock;
    PLSR_STOP_REASON stopReason;
    PLSR_STATE pendingTerminal;
    PLSR_STATE pauseReturnState;
    PLSR_RESOURCE_LEASE lease;
    PLSR_JOB_SNAPSHOT job;
    PLSR_PARSE_DETAIL parseDetail;
@@ -33,12 +34,19 @@ typedef struct
    int64_t logicalPosition;
    int64_t taskPulses;
    int64_t totalPulses;
    uint64_t physicalPulses;
    int64_t segmentAccountedPulses;
    int64_t equivalentCommandRemainder;
    PLSR_EQUIVALENT_CONFIG equivalent;
    PLSR_PATH_CONTEXT path;
    PLSR_PROFILE_STATE profile;
    uint8_t profileActive;
    int32_t liveFrequencyRaw;
    uint32_t liveTargetFrequencyHz;
    uint32_t pauseStopFrequencyHz;
    uint32_t liveFrequencyRejectCount;
    PLSR_RESULT lastLiveFrequencyResult;
    /* Publish gate shared by PlsrTask and the TIM6 100us control ISR. */
    volatile uint8_t profileActive;
    uint8_t profileWasAccel;
    uint8_t hasLastCommand;
    uint8_t done;
@@ -52,6 +60,11 @@ typedef struct
    uint8_t negativeLimitActive;
    uint8_t emergencyLatched;
    uint8_t segmentEventPublished;
    uint8_t backlashActive;
    uint8_t backlashBypassOnce;
    uint8_t lastUserDirectionValid;
    uint8_t lastUserDirectionPositive;
    uint8_t runtimeSpeedClamped;
 } PLSR_AXIS;

 typedef struct
@@ -70,6 +83,8 @@ static PLSR_COMMAND_SLOT PlsrCommandQueue[PLSR_COMMAND_QUEUE_DEPTH];
 static uint32_t PlsrNextTicket;
 static uint8_t PlsrInitialized;
 static PLSR_JOB_SNAPSHOT PlsrJobScratch;
 static PLSR_JOB_SNAPSHOT PlsrValidationScratch;
 static void (* volatile PlsrControlTickHook)(void);

 static void PlsrStopSegmentHardware(uint8_t axis, PLSR_AXIS *axisObject);
 static PLSR_RESULT PlsrStartSegmentHardware(uint8_t axis,
@@ -105,6 +120,23 @@ static void PlsrCoreExitCritical(uint32_t interruptState)
 #endif
 }

 static void PlsrSetProfileActive(PLSR_AXIS *axisObject, uint8_t active)
 {
    uint32_t interruptState = PlsrCoreEnterCritical();

    /* Ownership hand-off between PlsrTask and the TIM6 100us ISR. */
    axisObject->profileActive = active;
    PlsrCoreExitCritical(interruptState);
 }

 void PlsrSetControlTickHook(void (*hook)(void))
 {
    uint32_t interruptState = PlsrCoreEnterCritical();

    PlsrControlTickHook = hook;
    PlsrCoreExitCritical(interruptState);
 }

 static uint8_t PlsrStateIsBusy(PLSR_STATE state)
 {
    return ((state == PLSR_STATE_ACCEL) || (state == PLSR_STATE_RUN)
@@ -177,9 +209,15 @@ static void PlsrPublishSdDword(uint8_t axis,

 static int32_t PlsrGetCompatibleSegmentPulses(const PLSR_AXIS *axisObject)
 {
    int64_t signedPulses = (axisObject->directionPositive != 0U)
                               ? axisObject->segmentAccountedPulses
                               : -axisObject->segmentAccountedPulses;
    int64_t signedPulses;

    if (axisObject->backlashActive != 0U)
    {
        return 0;
    }
    signedPulses = (axisObject->directionPositive != 0U)
                       ? axisObject->segmentAccountedPulses
                       : -axisObject->segmentAccountedPulses;

    if (signedPulses > INT32_MAX)
    {
@@ -452,16 +490,26 @@ static int64_t PlsrGetBrakingDistance(const PLSR_AXIS *axisObject)
    uint64_t frequencyHz;
    uint64_t denominator;
    uint64_t numerator;
    uint64_t frequencyQ32;
    uint32_t decelSlopeHzPerMs;
    uint32_t interruptState;
    uint8_t profileActive;

    if ((axisObject->profileActive == 0U)
        || (axisObject->profile.decelSlopeHzPerMs == 0UL))
    /* frequencyQ32 is 64-bit and may be updated by TIM6.  Snapshot it with
     * the related fields so the 1ms protection pass cannot observe a torn
     * value or a mixture of two control ticks. */
    interruptState = PlsrCoreEnterCritical();
    profileActive = axisObject->profileActive;
    decelSlopeHzPerMs = axisObject->profile.decelSlopeHzPerMs;
    frequencyQ32 = axisObject->profile.frequencyQ32;
    PlsrCoreExitCritical(interruptState);
    if ((profileActive == 0U) || (decelSlopeHzPerMs == 0UL))
    {
        return 0;
    }
    frequencyHz = axisObject->profile.frequencyQ32 >> 32U;
    frequencyHz = frequencyQ32 >> 32U;
    numerator = frequencyHz * frequencyHz;
    denominator = UINT64_C(2000)
                  * axisObject->profile.decelSlopeHzPerMs;
    denominator = UINT64_C(2000) * decelSlopeHzPerMs;
    return (int64_t)((numerator + denominator - 1UL) / denominator);
 }

@@ -488,6 +536,7 @@ static PLSR_RESULT PlsrUpdateLimitState(PLSR_AXIS *axisObject,
    if (result != PLSR_RESULT_OK) return result;

    if ((job->limits.softLimitEnabled != 0U)
        && (axisObject->backlashActive == 0U)
        && (axisObject->positionValid != 0U))
    {
        if (includeBrakingDistance != 0U)
@@ -591,6 +640,21 @@ static void PlsrAccountHardwarePulses(uint8_t axis,
    {
        return;
    }
    if ((uint64_t)delta > UINT64_MAX - axisObject->physicalPulses)
    {
        axisObject->positionOverflow = 1U;
        axisObject->segmentAccountedPulses = emittedPulses;
        (void)PlsrPostEvent(axis, PLSR_EVENT_COUNTER_FAULT);
        return;
    }
    axisObject->physicalPulses += (uint64_t)delta;
    if (axisObject->backlashActive != 0U)
    {
        /* Backlash pulses move through mechanical clearance only. */
        axisObject->segmentAccountedPulses = emittedPulses;
        PlsrPublishRuntime(axis);
        return;
    }
    signedDelta = (axisObject->directionPositive != 0U) ? delta : -delta;
    if ((PlsrAddInt64Checked(axisObject->logicalPosition,
                             signedDelta,
@@ -676,6 +740,7 @@ static uint8_t PlsrTransitionIsAllowed(PLSR_STATE current,
        case PLSR_STATE_PAUSED:
            return ((target == PLSR_STATE_ACCEL)
                    || (target == PLSR_STATE_RUN)
                    || (target == PLSR_STATE_WAIT)
                    || (target == PLSR_STATE_STOPPED))
                       ? 1U
                       : 0U;
@@ -715,6 +780,8 @@ PLSR_RESULT PlsrStateTransition(uint8_t axis,
        axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
        axisObject->immediateStopPending = 0U;
        PlsrStopSegmentHardware(axis, axisObject);
        axisObject->backlashActive = 0U;
        axisObject->backlashBypassOnce = 0U;
        PlsrResourceRelease(&axisObject->lease);
        PlsrPublishAxis(axis);
        return PLSR_RESULT_INVALID_STATE;
@@ -873,6 +940,30 @@ static uint8_t PlsrPopHighestPriorityCommand(PLSR_COMMAND_SLOT *slot)
 }

 #ifdef PLSR_HOST_TEST
 uint32_t PlsrTestGetProfileRefreshHz(uint8_t axis)
 {
    return (axis < PLSR_AXIS_COUNT) ? PlsrAxes[axis].profile.refreshHz : 0UL;
 }

 uint8_t PlsrTestGetProfileActive(uint8_t axis)
 {
    return (axis < PLSR_AXIS_COUNT) ? PlsrAxes[axis].profileActive : 0U;
 }

 uint8_t PlsrTestGetJobRefreshCode(uint8_t axis)
 {
    return (axis < PLSR_AXIS_COUNT)
               ? PlsrAxes[axis].job.s2.refreshCode
               : 0U;
 }

 uint32_t PlsrTestGetProfileFrequencyHz(uint8_t axis)
 {
    return (axis < PLSR_AXIS_COUNT)
               ? (uint32_t)(PlsrAxes[axis].profile.frequencyQ32 >> 32U)
               : 0UL;
 }

 PLSR_RESULT PlsrPostStart(const PLSR_START_REQUEST *request)
 {
    PLSR_COMMAND command;
@@ -921,6 +1012,35 @@ PLSR_RESULT PlsrPostCall(const PLSR_CALL *call)
    return PlsrQueueCommand(&command, NULL, call);
 }

 PLSR_RESULT PlsrValidateCall(const PLSR_CALL *call,
                             PLSR_PARSE_DETAIL *detail)
 {
    PLSR_PARSE_CONTEXT parseContext;
    uint32_t interruptState;

    if ((call == NULL) || (detail == NULL))
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    if (call->dAxis >= PLSR_AXIS_COUNT)
    {
        return PLSR_RESULT_INVALID_AXIS;
    }
    if (PlsrInitialized == 0U)
    {
        return PLSR_RESULT_INVALID_STATE;
    }

    interruptState = PlsrCoreEnterCritical();
    parseContext.logicalPosition = PlsrAxes[call->dAxis].logicalPosition;
    parseContext.positionValid = PlsrAxes[call->dAxis].positionValid;
    PlsrCoreExitCritical(interruptState);
    return PlsrBuildJobSnapshot(call,
                                &parseContext,
                                &PlsrValidationScratch,
                                detail);
 }

 PLSR_RESULT PlsrPostCommand(const PLSR_COMMAND *command)
 {
    if (command == NULL)
@@ -1021,12 +1141,21 @@ static PLSR_RESULT PlsrStartAxis(PLSR_AXIS *axisObject,
    axisObject->compatibleErrorBlock = 0U;
    axisObject->stopReason = PLSR_STOP_REASON_NONE;
    axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
    axisObject->pauseReturnState = PLSR_STATE_UNINITIALIZED;
    axisObject->immediateStopPending = 0U;
    axisObject->done = 0U;
    axisObject->jobValid = 0U;
    axisObject->taskPulses = 0;
    axisObject->segmentAccountedPulses = 0;
    axisObject->segmentAccountingActive = 0U;
    axisObject->backlashActive = 0U;
    axisObject->backlashBypassOnce = 0U;
    axisObject->liveFrequencyRaw = 0;
    axisObject->liveTargetFrequencyHz = 0UL;
    axisObject->pauseStopFrequencyHz = 0UL;
    axisObject->liveFrequencyRejectCount = 0UL;
    axisObject->lastLiveFrequencyResult = PLSR_RESULT_OK;
    axisObject->runtimeSpeedClamped = 0U;
    result = PlsrStateTransition(start->axis,
                                 PLSR_STATE_ACCEL,
                                 PLSR_TRANSITION_START);
@@ -1141,12 +1270,21 @@ static PLSR_RESULT PlsrStartCall(PLSR_AXIS *axisObject,
    axisObject->compatibleErrorBlock = 0U;
    axisObject->stopReason = PLSR_STOP_REASON_NONE;
    axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
    axisObject->pauseReturnState = PLSR_STATE_UNINITIALIZED;
    axisObject->immediateStopPending = 0U;
    axisObject->done = 0U;
    axisObject->taskPulses = 0;
    axisObject->segmentAccountedPulses = 0;
    axisObject->segmentAccountingActive = 0U;
    axisObject->segmentEventPublished = 0U;
    axisObject->backlashActive = 0U;
    axisObject->backlashBypassOnce = 0U;
    axisObject->liveFrequencyRaw = 0;
    axisObject->liveTargetFrequencyHz = 0UL;
    axisObject->pauseStopFrequencyHz = 0UL;
    axisObject->liveFrequencyRejectCount = 0UL;
    axisObject->lastLiveFrequencyResult = PLSR_RESULT_OK;
    axisObject->runtimeSpeedClamped = 0U;
    PlsrPathBegin(&axisObject->path,
                  &axisObject->job,
                  axisObject->logicalPosition);
@@ -1252,11 +1390,15 @@ static PLSR_RESULT PlsrRequestControlledStop(uint8_t axis,
 {
    PLSR_AXIS *axisObject = &PlsrAxes[axis];
    PLSR_RESULT result;
    uint32_t interruptState;

    PlsrSetStopReason(axisObject, reason);
    axisObject->pendingTerminal = terminal;
    PlsrPublishSegmentEvent(axis, axisObject, reason);
    PlsrPathTerminate(&axisObject->path);
    if (terminal != PLSR_STATE_PAUSED)
    {
        PlsrPublishSegmentEvent(axis, axisObject, reason);
        PlsrPathTerminate(&axisObject->path);
    }

    if ((axisObject->state == PLSR_STATE_WAIT)
        || (axisObject->state == PLSR_STATE_PAUSED))
@@ -1274,7 +1416,9 @@ static PLSR_RESULT PlsrRequestControlledStop(uint8_t axis,
                                         PLSR_STATE_DECEL,
                                         PLSR_TRANSITION_DECEL_REQUEST);
    }
    interruptState = PlsrCoreEnterCritical();
    result = PlsrProfileRequestStop(&axisObject->profile);
    PlsrCoreExitCritical(interruptState);
    if (result != PLSR_RESULT_OK)
    {
        return result;
@@ -1315,6 +1459,7 @@ static PLSR_RESULT PlsrStopDecel(uint8_t axis)
 static PLSR_RESULT PlsrPause(uint8_t axis)
 {
    PLSR_AXIS *axisObject = &PlsrAxes[axis];
    uint32_t interruptState;

    if (axisObject->state == PLSR_STATE_PAUSED)
    {
@@ -1324,24 +1469,107 @@ static PLSR_RESULT PlsrPause(uint8_t axis)
    {
        return PLSR_RESULT_BUSY;
    }
    if (axisObject->state == PLSR_STATE_WAIT)
    {
        return PlsrRequestControlledStop(axis,
                                         PLSR_STATE_PAUSED,
                                         PLSR_STOP_REASON_PAUSE);
    }
    if ((axisObject->state != PLSR_STATE_ACCEL)
        && (axisObject->state != PLSR_STATE_RUN)
        && (axisObject->state != PLSR_STATE_DECEL))
        && (axisObject->state != PLSR_STATE_DECEL)
        && (axisObject->state != PLSR_STATE_WAIT))
    {
        return PLSR_RESULT_INVALID_STATE;
    }

    axisObject->pauseReturnState = axisObject->state;
    if (axisObject->profileActive != 0U)
    {
        interruptState = PlsrCoreEnterCritical();
        /* RequestStop temporarily replaces stopFrequencyHz with zero.  Keep
         * the segment-specific value (including backlash profiles) so RESUME
         * rebuilds the same trajectory rather than assuming the user S2 one. */
        axisObject->pauseStopFrequencyHz =
            axisObject->profile.stopFrequencyHz;
        PlsrCoreExitCritical(interruptState);
    }
    return PlsrRequestControlledStop(axis,
                                     PLSR_STATE_PAUSED,
                                     PLSR_STOP_REASON_PAUSE);
 }

 static PLSR_RESULT PlsrResume(uint8_t axis)
 {
    PLSR_AXIS *axisObject = &PlsrAxes[axis];
    PLSR_RESULT result;
    PLSR_STATE targetState;
    uint64_t emittedPulses;

    if (axisObject->state != PLSR_STATE_PAUSED)
    {
        return PLSR_RESULT_INVALID_STATE;
    }
    if (axisObject->pauseReturnState == PLSR_STATE_WAIT)
    {
        axisObject->stopReason = PLSR_STOP_REASON_NONE;
        axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
        axisObject->pauseReturnState = PLSR_STATE_UNINITIALIZED;
        return PlsrStateTransition(axis,
                                   PLSR_STATE_WAIT,
                                   PLSR_TRANSITION_WAIT_COMPLETE);
    }
    if (axisObject->jobValid == 0U)
    {
        /* The snapshot-less start entry exists only for host state-machine
         * tests; preserve its historical transition-only resume semantics. */
        axisObject->stopReason = PLSR_STOP_REASON_NONE;
        axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
        axisObject->pauseReturnState = PLSR_STATE_UNINITIALIZED;
        return PlsrStateTransition(axis,
                                   PLSR_STATE_ACCEL,
                                   PLSR_TRANSITION_WAIT_COMPLETE);
    }

    emittedPulses = (uint64_t)PlsrHwGetEmittedPulses(axis);
    PlsrProfileSyncPulses(&axisObject->profile, emittedPulses);
    if (emittedPulses >= (uint64_t)axisObject->profile.totalPulses)
    {
        axisObject->stopReason = PLSR_STOP_REASON_NONE;
        axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
        axisObject->pauseReturnState = PLSR_STATE_UNINITIALIZED;
        result = PlsrStateTransition(axis,
                                     PLSR_STATE_ACCEL,
                                     PLSR_TRANSITION_WAIT_COMPLETE);
        if (result == PLSR_RESULT_OK)
        {
            (void)PlsrPostEvent(axis, PLSR_EVENT_SEGMENT_COMPLETE);
        }
        return result;
    }

    result = PlsrProfileResume(&axisObject->profile,
                               axisObject->profile.startFrequencyHz,
                               axisObject->liveTargetFrequencyHz,
                               axisObject->pauseStopFrequencyHz);
    if (result != PLSR_RESULT_OK)
    {
        return result;
    }
    result = PlsrHwResumePulse(axis);
    if (result != PLSR_RESULT_OK)
    {
        return result;
    }

    axisObject->stopReason = PLSR_STOP_REASON_NONE;
    axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
    axisObject->pauseReturnState = PLSR_STATE_UNINITIALIZED;
    PlsrSetProfileActive(axisObject, 1U);
    axisObject->profileWasAccel =
        (axisObject->profile.phase == PLSR_PROFILE_PHASE_ACCEL) ? 1U : 0U;
    targetState = (axisObject->profileWasAccel != 0U)
                      ? PLSR_STATE_ACCEL
                      : PLSR_STATE_RUN;
    return PlsrStateTransition(axis,
                               targetState,
                               PLSR_TRANSITION_WAIT_COMPLETE);
 }

 static PLSR_RESULT PlsrExecuteCommand(const PLSR_COMMAND_SLOT *slot)
 {
    PLSR_AXIS *axisObject = &PlsrAxes[slot->command.axis];
@@ -1376,18 +1604,7 @@ static PLSR_RESULT PlsrExecuteCommand(const PLSR_COMMAND_SLOT *slot)
            break;

        case PLSR_CMD_RESUME:
            if (axisObject->state != PLSR_STATE_PAUSED)
            {
                result = PLSR_RESULT_INVALID_STATE;
            }
            else
            {
                axisObject->stopReason = PLSR_STOP_REASON_NONE;
                axisObject->pendingTerminal = PLSR_STATE_UNINITIALIZED;
                result = PlsrStateTransition(slot->command.axis,
                                             PLSR_STATE_ACCEL,
                                             PLSR_TRANSITION_WAIT_COMPLETE);
            }
            result = PlsrResume(slot->command.axis);
            break;

        case PLSR_CMD_SET_POSITION:
@@ -1657,6 +1874,11 @@ static PLSR_RESULT PlsrStartSegmentHardware(uint8_t axis,
    int64_t targetPosition;
    int64_t nextEquivalentRemainder =
        axisObject->equivalentCommandRemainder;
    int64_t outputPulses;
    int32_t liveFrequencyRaw;
    uint32_t gapSlopeHzPerMs;
    uint16_t backlashPulses = 0U;
    uint8_t runBacklash = 0U;
    uint8_t positive;

    if (job->positioningMode == 0U)
@@ -1737,48 +1959,114 @@ static PLSR_RESULT PlsrStartSegmentHardware(uint8_t axis,
        return PLSR_RESULT_OK;
    }

    /* A future segment edited before it becomes current must still use the
     * COMMIT snapshot.  Capture the source value only as a change-detection
     * baseline; a later edit, made while this segment is current, is live. */
    result = PlsrReadLiveFrequencyRaw(job,
                                      axisObject->path.currentSegment,
                                      &liveFrequencyRaw);
    if (result == PLSR_RESULT_OK)
    {
        axisObject->liveFrequencyRaw = liveFrequencyRaw;
        axisObject->lastLiveFrequencyResult = PLSR_RESULT_OK;
    }
    else
    {
        axisObject->lastLiveFrequencyResult = result;
        if (axisObject->liveFrequencyRejectCount != UINT32_MAX)
        {
            axisObject->liveFrequencyRejectCount++;
        }
    }
    axisObject->liveTargetFrequencyHz = segment->targetFrequency;

    if (axisObject->backlashBypassOnce != 0U)
    {
        /* The internal block has just completed; start the user segment. */
        axisObject->backlashBypassOnce = 0U;
    }
    else if ((axisObject->lastUserDirectionValid != 0U)
             && (axisObject->lastUserDirectionPositive != positive))
    {
        backlashPulses = (positive != 0U)
                             ? job->positiveBacklashPulses
                             : job->negativeBacklashPulses;
        runBacklash = (backlashPulses != 0U) ? 1U : 0U;
    }

    (void)memset(&profileRequest, 0, sizeof(profileRequest));
    profileRequest.targetFrequencyHz = segment->targetFrequency;
    profileRequest.startFrequencyHz = job->s2.startSpeed;
    profileRequest.stopFrequencyHz = job->s2.stopSpeed;
    profileRequest.maxFrequencyHz = job->s2.maximumSpeed;
    profileRequest.accelSlopeHzPerMs =
        (job->s2.accelerationMs != 0U)
            ? job->s2.defaultSpeed / job->s2.accelerationMs
            : 0UL;
    profileRequest.decelSlopeHzPerMs =
        (job->s2.decelerationMs != 0U)
            ? job->s2.defaultSpeed / job->s2.decelerationMs
            : 0UL;
    profileRequest.curveMode = job->s2.curveMode;
    outputPulses = pulses;
    if (runBacklash != 0U)
    {
        outputPulses = backlashPulses;
        profileRequest.startFrequencyHz =
            (job->s2.gapAccelerationMs == 0U)
                ? segment->targetFrequency
                : 0UL;
        profileRequest.stopFrequencyHz = 0UL;
        gapSlopeHzPerMs =
            (job->s2.gapAccelerationMs != 0U)
                ? segment->targetFrequency / job->s2.gapAccelerationMs
                : 0UL;
        if ((job->s2.gapAccelerationMs != 0U)
            && (gapSlopeHzPerMs == 0UL))
        {
            gapSlopeHzPerMs = 1UL;
        }
        profileRequest.accelSlopeHzPerMs = gapSlopeHzPerMs;
        profileRequest.decelSlopeHzPerMs = gapSlopeHzPerMs;
    }
    else
    {
        profileRequest.startFrequencyHz = job->s2.startSpeed;
        profileRequest.stopFrequencyHz = job->s2.stopSpeed;
        profileRequest.accelSlopeHzPerMs =
            (job->s2.accelerationMs != 0U)
                ? job->s2.defaultSpeed / job->s2.accelerationMs
                : 0UL;
        profileRequest.decelSlopeHzPerMs =
            (job->s2.decelerationMs != 0U)
                ? job->s2.defaultSpeed / job->s2.decelerationMs
                : 0UL;
    }

    result = PlsrProfileStart(&axisObject->profile,
                              &profileRequest,
                              pulses,
                              1000U);
                              outputPulses,
                              (job->s2.refreshCode == 2U) ? 10000U : 1000U);
    if (result != PLSR_RESULT_OK)
    {
        return result;
    }

    params.frequencyHz = job->s2.startSpeed;
    params.targetPulses = pulses;
    params.frequencyHz = profileRequest.startFrequencyHz;
    params.targetPulses = outputPulses;
    params.outputMode = (PLSR_OUTPUT_MODE)job->outputMode;
    params.directionPoint = job->directionPoint;
    params.directionPositive = positive;
    params.directionNegativeLogic = job->directionNegativeLogic;
    params.directionDelayMs = job->s2.directionDelayMs;
    result = PlsrHwStartPulse(axis, &params);
    if (result != PLSR_RESULT_OK)
    {
        axisObject->profileActive = 0U;
        PlsrSetProfileActive(axisObject, 0U);
        axisObject->profileWasAccel = 0U;
        return result;
    }
    axisObject->equivalentCommandRemainder = nextEquivalentRemainder;
    axisObject->directionPositive = positive;
    axisObject->segmentAccountedPulses = 0;
    axisObject->segmentAccountingActive = 1U;
    axisObject->profileActive = 1U;
    axisObject->backlashActive = runBacklash;
    if (runBacklash == 0U)
    {
        axisObject->equivalentCommandRemainder = nextEquivalentRemainder;
        axisObject->lastUserDirectionValid = 1U;
        axisObject->lastUserDirectionPositive = positive;
    }
    PlsrSetProfileActive(axisObject, 1U);
    axisObject->profileWasAccel =
        (axisObject->profile.phase == PLSR_PROFILE_PHASE_ACCEL) ? 1U : 0U;
    PlsrPublishAxis(axis);
@@ -1795,7 +2083,7 @@ static PLSR_RESULT PlsrStartSegmentHardware(uint8_t axis,
 static void PlsrStopSegmentHardware(uint8_t axis, PLSR_AXIS *axisObject)
 {
    PlsrAccountHardwarePulses(axis, axisObject);
    axisObject->profileActive = 0U;
    PlsrSetProfileActive(axisObject, 0U);
    axisObject->profileWasAccel = 0U;
    (void)PlsrHwStopPulse(axis);
    PlsrAccountHardwarePulses(axis, axisObject);
@@ -1973,6 +2261,50 @@ static void PlsrProcessNormalEvents(uint8_t axis, uint32_t events)
    {
        PLSR_PATH_ACTION action;

        if (axisObject->backlashActive != 0U)
        {
            PLSR_RESULT startResult;

            /* Internal compensation completion is not a user segment
             * completion and therefore must not publish I6000..I6399 or
             * advance the path. */
            PlsrStopSegmentHardware(axis, axisObject);
            axisObject->backlashActive = 0U;
            axisObject->backlashBypassOnce = 1U;
            (void)PlsrStateTransition(axis,
                                      PLSR_STATE_ACCEL,
                                      PLSR_TRANSITION_START);
            startResult = PlsrStartSegmentHardware(axis, axisObject);
            if ((startResult == PLSR_RESULT_LIMIT_POSITIVE)
                || (startResult == PLSR_RESULT_LIMIT_NEGATIVE))
            {
                axisObject->error =
                    (startResult == PLSR_RESULT_LIMIT_POSITIVE)
                        ? PLSR_ERROR_LIMIT_POSITIVE
                        : PLSR_ERROR_LIMIT_NEGATIVE;
                axisObject->compatibleErrorCode =
                    (startResult == PLSR_RESULT_LIMIT_POSITIVE) ? 5U : 6U;
                PlsrSetStopReason(
                    axisObject,
                    (startResult == PLSR_RESULT_LIMIT_POSITIVE)
                        ? PLSR_STOP_REASON_LIMIT_POSITIVE
                        : PLSR_STOP_REASON_LIMIT_NEGATIVE);
                (void)PlsrStateTransition(axis,
                                          PLSR_STATE_STOPPED,
                                          PLSR_TRANSITION_STOP);
            }
            else if (startResult != PLSR_RESULT_OK)
            {
                axisObject->error = PLSR_ERROR_TIMER_FAULT;
                PlsrSetStopReason(axisObject, PLSR_STOP_REASON_FAULT);
                axisObject->done = 0U;
                (void)PlsrStateTransition(axis,
                                          PLSR_STATE_ERROR,
                                          PLSR_TRANSITION_FAULT);
            }
            return;
        }

        PlsrPublishSegmentEvent(axis,
                                axisObject,
                                PLSR_STOP_REASON_NORMAL_COMPLETE);
@@ -2006,6 +2338,7 @@ PLSR_RESULT PlsrInit(void)
    PlsrNextTicket = 0UL;
    PlsrResourceInit();
    (void)PlsrHwInit();
    PlsrControlTickHook = NULL;
    PlsrInitialized = 1U;

    restoredPositionValid = PlcDeviceGetRestoredHsdPositionValid();
@@ -2039,6 +2372,156 @@ PLSR_RESULT PlsrInit(void)
    return PLSR_RESULT_OK;
 }

 static void PlsrStepProfileAxis(uint8_t axis)
 {
    PLSR_AXIS *axisObject = &PlsrAxes[axis];
    PLSR_RESULT liveResult;
    int32_t liveRaw;
    uint32_t frequencyHz;
    uint32_t liveFrequencyHz;
    uint32_t outputFrequencyHz;
    uint64_t hardwarePulses;
    uint64_t remainingPulses;
    uint8_t profileDone;
    uint8_t liveClamped;
    uint8_t wasAccel;

    if ((axisObject->profileActive == 0U)
        || (PlsrHwGetState(axis) == PLSR_HW_STATE_DIR_SETTLING))
    {
        return;
    }

    /* Only the current segment frequency remains live after COMMIT.  Poll the
     * raw dword every selected control tick; conversion/divider validation is
     * performed only when the raw value actually changes. */
    if ((axisObject->backlashActive == 0U)
        && (axisObject->jobValid != 0U))
    {
        liveResult = PlsrReadLiveFrequencyRaw(
            &axisObject->job,
            axisObject->path.currentSegment,
            &liveRaw);
        if (liveResult != PLSR_RESULT_OK)
        {
            if (axisObject->lastLiveFrequencyResult != liveResult)
            {
                if (axisObject->liveFrequencyRejectCount != UINT32_MAX)
                {
                    axisObject->liveFrequencyRejectCount++;
                }
            }
            axisObject->lastLiveFrequencyResult = liveResult;
        }
        else if (liveRaw != axisObject->liveFrequencyRaw)
        {
            axisObject->liveFrequencyRaw = liveRaw;
            liveResult = PlsrResolveLiveFrequency(
                &axisObject->job,
                axisObject->path.currentSegment,
                &liveFrequencyHz,
                &liveClamped);
            if (liveResult == PLSR_RESULT_OK)
            {
                liveResult = PlsrProfileRetarget(&axisObject->profile,
                                                 liveFrequencyHz);
            }
            if (liveResult == PLSR_RESULT_OK)
            {
                axisObject->liveTargetFrequencyHz = liveFrequencyHz;
                axisObject->lastLiveFrequencyResult = PLSR_RESULT_OK;
                if (liveClamped != 0U)
                {
                    axisObject->runtimeSpeedClamped = 1U;
                }
            }
            else
            {
                axisObject->lastLiveFrequencyResult = liveResult;
                if (axisObject->liveFrequencyRejectCount != UINT32_MAX)
                {
                    axisObject->liveFrequencyRejectCount++;
                }
            }
        }
        else
        {
            axisObject->lastLiveFrequencyResult = PLSR_RESULT_OK;
        }
    }

    hardwarePulses = (uint64_t)PlsrHwGetEmittedPulses(axis);
    PlsrProfileSyncPulses(&axisObject->profile, hardwarePulses);
    wasAccel = axisObject->profileWasAccel;
    (void)PlsrProfileStep(&axisObject->profile,
                          &frequencyHz,
                          &profileDone);
    outputFrequencyHz = frequencyHz;
    if ((PlsrHwGetState(axis) == PLSR_HW_STATE_RUNNING)
        && (axisObject->profile.phase != PLSR_PROFILE_PHASE_ACCEL)
        && ((axisObject->profile.phase != PLSR_PROFILE_PHASE_DECEL)
            || (axisObject->profile.decelTargetHz
                == axisObject->profile.stopFrequencyHz))
        && (axisObject->pendingTerminal == PLSR_STATE_UNINITIALIZED)
        && ((uint64_t)axisObject->profile.totalPulses
            > hardwarePulses + 1UL))
    {
        remainingPulses = (uint64_t)axisObject->profile.totalPulses
                          - hardwarePulses - 1UL;
        outputFrequencyHz =
            PlsrProfileGetBrakingOutputFrequency(&axisObject->profile,
                                                  remainingPulses);
    }
    if ((PlsrHwGetState(axis) == PLSR_HW_STATE_PWM_PENDING)
        && (axisObject->profile.phase == PLSR_PROFILE_PHASE_ACCEL))
    {
        outputFrequencyHz =
            PlsrProfileGetInitialOutputFrequency(&axisObject->profile);
    }
    if ((profileDone == 0U) || (outputFrequencyHz != 0UL))
    {
        (void)PlsrHwSetFrequency(axis, outputFrequencyHz);
    }
    if ((profileDone != 0U)
        && (axisObject->pendingTerminal != PLSR_STATE_UNINITIALIZED))
    {
        (void)PlsrHwSetFrequency(axis, 0UL);
        PlsrSetProfileActive(axisObject, 0U);
        (void)PlsrPostEvent(axis, PLSR_EVENT_DECEL_COMPLETE);
    }
    axisObject->profileWasAccel =
        (axisObject->profile.phase == PLSR_PROFILE_PHASE_ACCEL) ? 1U : 0U;
    if ((wasAccel != 0U)
        && (axisObject->profileWasAccel == 0U)
        && (axisObject->state == PLSR_STATE_ACCEL))
    {
        (void)PlsrPostEvent(axis, PLSR_EVENT_ACCEL_COMPLETE);
    }
 }

 void PlsrControlTick100us(void)
 {
    void (*hook)(void);
    uint8_t axis;

    if (PlsrInitialized == 0U)
    {
        return;
    }
    hook = PlsrControlTickHook;
    if (hook != NULL)
    {
        hook();
    }
    for (axis = 0U; axis < PLSR_AXIS_COUNT; axis++)
    {
        if (PlsrAxes[axis].job.s2.refreshCode == 2U)
        {
            PlsrStepProfileAxis(axis);
        }
    }
 }

 void PlsrProcess(void)
 {
    PLSR_COMMAND_SLOT slot;
@@ -2070,6 +2553,9 @@ void PlsrProcess(void)
        }
    }

    /* Apply related multi-axis DIR changes after all commands and segment
     * events, keeping cross-port GPIO writes in one short commit window. */
    PlsrHwBeginDirectionBatch();
    while ((processedCommands < PLSR_COMMAND_QUEUE_DEPTH)
           && (PlsrPopHighestPriorityCommand(&slot) != 0U))
    {
@@ -2101,18 +2587,14 @@ void PlsrProcess(void)
        }
    }

    PlsrHwEndDirectionBatch();

    /* 1ms tick：路径执行器推进（WAIT/ACT 计时、信号/EXT 轮询、跳转链）
     * + 速度曲线推进（P2） + HAL 状态机（DIR 延时）。 */
    for (axis = 0U; axis < PLSR_AXIS_COUNT; axis++)
    {
        PLSR_AXIS *axisObject = &PlsrAxes[axis];
        PLSR_PATH_ACTION action;
        uint32_t frequencyHz;
        uint32_t outputFrequencyHz;
        uint64_t hardwarePulses;
        uint64_t remainingPulses;
        uint8_t profileDone;
        uint8_t wasAccel;

        PlsrHwTick(axis);
        PlsrAccountHardwarePulses(axis, axisObject);
@@ -2126,75 +2608,19 @@ void PlsrProcess(void)
        {
            continue;
        }
        action = PlsrPathTick(&axisObject->path,
                              &axisObject->job,
                              axisObject->logicalPosition);
        action = (axisObject->backlashActive != 0U)
                     ? PLSR_PATH_ACTION_NONE
                     : PlsrPathTick(&axisObject->path,
                                    &axisObject->job,
                                    axisObject->logicalPosition);
        if (action != PLSR_PATH_ACTION_NONE)
        {
            PlsrApplyPathAction(axis, action);
        }

        if ((axisObject->profileActive != 0U)
            && (PlsrHwGetState(axis) != PLSR_HW_STATE_DIR_SETTLING))
        if (axisObject->job.s2.refreshCode != 2U)
        {
            /* 虚拟计数校准到硬件实际计数：ARPE 预装载滞后的偏差不累积，
             * 保证 profile DONE 与硬件计数同步（消除段尾冻结频率收尾）。 */
            hardwarePulses = (uint64_t)PlsrHwGetEmittedPulses(axis);
            PlsrProfileSyncPulses(&axisObject->profile, hardwarePulses);
            wasAccel = axisObject->profileWasAccel;
            (void)PlsrProfileStep(&axisObject->profile,
                                  &frequencyHz,
                                  &profileDone);
            outputFrequencyHz = frequencyHz;
            if ((PlsrHwGetState(axis) == PLSR_HW_STATE_RUNNING)
                && (wasAccel == 0U)
                && (axisObject->pendingTerminal
                    == PLSR_STATE_UNINITIALIZED)
                && ((uint64_t)axisObject->profile.totalPulses
                    > hardwarePulses + 1UL))
            {
                /* ARR 预装载在当前脉冲结束后生效，因此计算的是
                 * “当前脉冲之后”剩余的脉冲。用位置反推减速频率，
                 * 避免 1 ms 时间曲线与预装载滞后造成段尾突停。 */
                remainingPulses =
                    (uint64_t)axisObject->profile.totalPulses
                    - hardwarePulses - 1UL;
                outputFrequencyHz =
                    PlsrProfileGetBrakingOutputFrequency(
                        &axisObject->profile,
                        remainingPulses);
            }
            if ((PlsrHwGetState(axis) == PLSR_HW_STATE_PWM_PENDING)
                && (axisObject->profile.phase
                    == PLSR_PROFILE_PHASE_ACCEL))
            {
                outputFrequencyHz =
                    PlsrProfileGetInitialOutputFrequency(
                        &axisObject->profile);
            }
            if ((profileDone == 0U) || (outputFrequencyHz != 0UL))
            {
                (void)PlsrHwSetFrequency(axis, outputFrequencyHz);
            }
            if ((profileDone != 0U)
                && (axisObject->pendingTerminal
                    != PLSR_STATE_UNINITIALIZED))
            {
                (void)PlsrHwSetFrequency(axis, 0UL);
                axisObject->profileActive = 0U;
                (void)PlsrPostEvent(axis, PLSR_EVENT_DECEL_COMPLETE);
            }
            axisObject->profileWasAccel =
                (axisObject->profile.phase == PLSR_PROFILE_PHASE_ACCEL)
                    ? 1U
                    : 0U;
            if ((wasAccel != 0U)
                && (axisObject->profileWasAccel == 0U)
                && (axisObject->state == PLSR_STATE_ACCEL))
            {
                /* 加速完成（曲线进入匀速/减速）→ 状态机推进到 RUN。 */
                (void)PlsrPostEvent(axis, PLSR_EVENT_ACCEL_COMPLETE);
            }
            PlsrStepProfileAxis(axis);
        }
    }
 }
@@ -2240,6 +2666,7 @@ PLSR_RESULT PlsrGetStatus(uint8_t axis, PLSR_STATUS *status)
    status->logicalPosition = axisObject->logicalPosition;
    status->taskPulses = axisObject->taskPulses;
    status->totalPulses = axisObject->totalPulses;
    status->physicalPulses = axisObject->physicalPulses;
    status->busy = PlsrStateIsBusy(axisObject->state);
    status->pulseActive = PlsrStateIsPulseActive(axisObject->state);
    status->done = axisObject->done;
@@ -2255,9 +2682,12 @@ PLSR_RESULT PlsrGetStatus(uint8_t axis, PLSR_STATUS *status)
    status->positiveLimitActive = axisObject->positiveLimitActive;
    status->negativeLimitActive = axisObject->negativeLimitActive;
    status->emergencyLatched = axisObject->emergencyLatched;
    status->backlashActive = axisObject->backlashActive;
    status->s2Set = (axisObject->jobValid != 0U) ? axisObject->job.s2Set : 0U;
    status->speedClamped = (axisObject->jobValid != 0U)
                               ? axisObject->job.speedClamped
                               ? (uint8_t)((axisObject->job.speedClamped != 0U)
                                           || (axisObject->runtimeSpeedClamped
                                               != 0U))
                               : 0U;
    status->segmentCount = (axisObject->jobValid != 0U)
                               ? axisObject->job.segmentCount
@@ -2269,6 +2699,14 @@ PLSR_RESULT PlsrGetStatus(uint8_t axis, PLSR_STATUS *status)
                                 ? PlsrPathGetCurrentSegment(
                                       &axisObject->path)
                                 : 0U;
    status->currentFrequencyHz = PlsrHwGetCurrentFrequencyHz(axis);
    status->targetFrequencyHz = (axisObject->jobValid != 0U)
                                    ? axisObject->liveTargetFrequencyHz
                                    : 0UL;
    status->liveFrequencyRejectCount =
        axisObject->liveFrequencyRejectCount;
    status->lastLiveFrequencyResult =
        axisObject->lastLiveFrequencyResult;
    PlsrCoreExitCritical(interruptState);
    return PLSR_RESULT_OK;
 }
--- a/PLSR/Src/plsr_hal_f407.c
+++ b/PLSR/Src/plsr_hal_f407.c
@@ -145,7 +145,11 @@ typedef struct
    int64_t emittedPulses;
    uint16_t directionDelayRemainingMs;
    uint8_t directionPoint;
    uint8_t configuredDirectionPoint;
    uint8_t directionPositive;
    uint8_t directionNegativeLogic;
    uint8_t directionTerminalOn;
    uint8_t directionOutputPending;
    uint8_t abQuarter;
    uint8_t abCountAxis;
    uint8_t abStartupPriming;
@@ -157,9 +161,12 @@ typedef struct
    uint16_t abPendingPairPsc;
    uint16_t abPendingArr;
    uint8_t abFrequencyPending;
    uint8_t cwActiveAxis;
    uint8_t cwStopPending;
 } PLSR_HW_AXIS_STATE;

 static PLSR_HW_AXIS_STATE PlsrHwAxes[PLSR_HW_AXIS_COUNT];
 static uint8_t PlsrHwDirectionBatchActive;

 /* 调试快照：当前上板自测只记录 Q0 的 160 ms，避免四轴
 * PlsrHwTick 互相混入，同时控制临时 RAM 占用。reason=0 表示段启动，
@@ -395,19 +402,19 @@ static uint8_t PlsrHwTimerHasCc1if(uint8_t axis)

 /* ---- DIR 输出 ----
 * XDM 为晶体管（NPN 漏型）输出：ON（导通）= 引脚低电平。
 * 信捷正逻辑：正向发脉冲时方向端子置 ON（低）。 */
 * 正逻辑：正向=ON；负逻辑：正向=OFF。逻辑运动方向始终单独保存，
 * 不能因电气极性反转而改变位置符号、AB相序或SM方向标志。 */

 static void PlsrHwSetDirLevel(uint8_t axis, uint8_t positive)
 static void PlsrHwApplyDirLevel(uint8_t axis)
 {
    PLSR_HW_AXIS_STATE *state = &PlsrHwAxes[axis];

    state->directionPositive = (positive != 0U) ? 1U : 0U;
    if (state->directionPoint == PLSR_HW_DIR_POINT_NONE)
    {
        return;
    }
 #ifdef PLSR_HOST_TEST
    PlsrHwTimers[axis].dirLevel = (positive != 0U) ? 1U : 0U;
    PlsrHwTimers[axis].dirLevel = state->directionTerminalOn;
    state->configuredDirectionPoint = state->directionPoint;
 #else
    if (state->directionPoint < PLSR_HW_OUTPUT_POINT_COUNT)
    {
@@ -418,16 +425,19 @@ static void PlsrHwSetDirLevel(uint8_t axis, uint8_t positive)
        if (pin->port != NULL)
        {
            /* DIR 点按需配置为推挽输出（上电默认高阻=截止，安全）。 */
            gpio.Pin = pin->pin;
            gpio.Mode = GPIO_MODE_OUTPUT_PP;
            gpio.Pull = GPIO_NOPULL;
            gpio.Speed = GPIO_SPEED_FREQ_VERY_HIGH;
            HAL_GPIO_Init(pin->port, &gpio);
            pin->port->BSRR = (state->directionTerminalOn != 0U)
                                  ? ((uint32_t)pin->pin << 16U)
                                  : (uint32_t)pin->pin;
            if (state->configuredDirectionPoint != state->directionPoint)
            {
                gpio.Pin = pin->pin;
                gpio.Mode = GPIO_MODE_OUTPUT_PP;
                gpio.Pull = GPIO_NOPULL;
                gpio.Speed = GPIO_SPEED_FREQ_VERY_HIGH;
                HAL_GPIO_Init(pin->port, &gpio);
                state->configuredDirectionPoint = state->directionPoint;
            }
            /* 漏型输出：ON（导通）= 低电平。 */
            HAL_GPIO_WritePin(pin->port,
                              pin->pin,
                              (positive != 0U) ? GPIO_PIN_RESET
                                               : GPIO_PIN_SET);
        }
    }
 #endif
@@ -438,6 +448,63 @@ static void PlsrHwSetDirLevel(uint8_t axis, uint8_t positive)
 * 避免 ARR 变小瞬间 CNT 超调提前回绕（每段加速会多出 ~ln(f1/f0) 个假脉冲）。
 * 首次启动用 EGR.UG 把预装载值加载到影子寄存器，杜绝首个周期用复位值。 */

 static void PlsrHwSetDirLevel(uint8_t axis,
                              uint8_t positive,
                              uint8_t negativeLogic)
 {
    PLSR_HW_AXIS_STATE *state = &PlsrHwAxes[axis];

    state->directionPositive = (positive != 0U) ? 1U : 0U;
    state->directionNegativeLogic =
        (negativeLogic != 0U) ? 1U : 0U;
    state->directionTerminalOn =
        (uint8_t)(state->directionPositive
                  ^ state->directionNegativeLogic);
    if (state->directionPoint == PLSR_HW_DIR_POINT_NONE)
    {
        return;
    }
    if ((PlsrHwDirectionBatchActive != 0U)
        && (state->configuredDirectionPoint == state->directionPoint))
    {
        state->directionOutputPending = 1U;
        return;
    }
    PlsrHwApplyDirLevel(axis);
 }

 void PlsrHwBeginDirectionBatch(void)
 {
    PlsrHwDirectionBatchActive = 1U;
 }

 void PlsrHwEndDirectionBatch(void)
 {
    uint8_t axis;
 #ifndef PLSR_HOST_TEST
    uint32_t interruptState = __get_PRIMASK();

    __disable_irq();
    __DMB();
 #endif
    PlsrHwDirectionBatchActive = 0U;
    for (axis = 0U; axis < PLSR_HW_AXIS_COUNT; axis++)
    {
        if (PlsrHwAxes[axis].directionOutputPending != 0U)
        {
            PlsrHwAxes[axis].directionOutputPending = 0U;
            PlsrHwApplyDirLevel(axis);
        }
    }
 #ifndef PLSR_HOST_TEST
    __DMB();
    if (interruptState == 0UL)
    {
        __enable_irq();
    }
 #endif
 }

 static void PlsrHwTimerSetArpe(uint8_t axis, uint32_t value)
 {
 #ifdef PLSR_HOST_TEST
@@ -470,6 +537,9 @@ static void PlsrHwConfigurePwm(uint8_t axis, uint32_t frequencyHz)
 {
    uint16_t psc;
    uint16_t arr;
 #ifndef PLSR_HOST_TEST
    uint32_t interruptState;
 #endif

    if (PlsrCalculateTimerDivider(PlsrHwAxisMap[axis].timerClockHz,
                                  frequencyHz,
@@ -478,11 +548,23 @@ static void PlsrHwConfigurePwm(uint8_t axis, uint32_t frequencyHz)
    {
        return;
    }
 #ifndef PLSR_HOST_TEST
    interruptState = __get_PRIMASK();
    __disable_irq();
    __DMB();
 #endif
    PlsrHwTimerSetPsc(axis, psc);
    PlsrHwTimerSetArr(axis, arr);
    PlsrHwTimerSetCcr(axis, (uint32_t)arr / 2UL);   /* 50% 占空比 */
    PlsrHwTimerSetPwmMode1(axis);
    PlsrHwTimerSetArpe(axis, 1UL);
 #ifndef PLSR_HOST_TEST
    __DMB();
    if (interruptState == 0UL)
    {
        __enable_irq();
    }
 #endif
 }

 /* 首次启动输出：加载影子寄存器后使能更新中断、通道与计数。 */
@@ -759,6 +841,105 @@ static void PlsrHwBeginAbOutput(uint8_t axis, uint8_t debugReason)
    PlsrHwDbgCapture(axis, debugReason);
 }

 static void PlsrHwConfigureCwCcwPwm(uint8_t axis, uint32_t frequencyHz)
 {
    PLSR_HW_AXIS_STATE *state = &PlsrHwAxes[axis];
    uint8_t activeAxis = state->cwActiveAxis;
    uint16_t psc;
    uint16_t arr;
 #ifndef PLSR_HOST_TEST
    uint32_t interruptState;
 #endif

    if (PlsrCalculateTimerDivider(PlsrHwAxisMap[activeAxis].timerClockHz,
                                  frequencyHz,
                                  &psc,
                                  &arr) != PLSR_RESULT_OK)
    {
        return;
    }
 #ifndef PLSR_HOST_TEST
    interruptState = __get_PRIMASK();
    __disable_irq();
    __DMB();
 #endif
    /* The compare ISR may arm final-pulse shutdown while TIM6 is calculating
     * a new divider.  Recheck under the same short critical section as the
     * preload writes so the tail period can no longer be changed afterwards. */
    if (state->cwStopPending == 0U)
    {
        PlsrHwTimerSetPsc(activeAxis, psc);
        PlsrHwTimerSetArr(activeAxis, arr);
        PlsrHwTimerSetCcr(activeAxis, (uint32_t)arr / 2UL);
        PlsrHwTimerSetPwmMode1(activeAxis);
        PlsrHwTimerSetArpe(activeAxis, 1UL);
    }
 #ifndef PLSR_HOST_TEST
    __DMB();
    if (interruptState == 0UL)
    {
        __enable_irq();
    }
 #endif
 }

 static void PlsrHwBeginCwCcwOutput(uint8_t axis)
 {
    PLSR_HW_AXIS_STATE *state = &PlsrHwAxes[axis];
    uint8_t pairAxis = PlsrHwGetPairedAxis(axis);
    uint8_t activeAxis = state->cwActiveAxis;
 #ifndef PLSR_HOST_TEST
    uint32_t interruptState = __get_PRIMASK();

    __disable_irq();
    __DMB();
 #endif
    /* Keep both pins in timer AF. On this output chain, switching a channel
     * to GPIO-low is observable as an asserted Q edge. CC1E=0 is the tested
     * inactive level and avoids the extra start/end edge. */
    PlsrHwStopPwmTimer(axis);
    PlsrHwStopPwmTimer(pairAxis);
    state->cwStopPending = 0U;
    PlsrHwTimerSetUg(activeAxis);
    PlsrHwTimerClearUif(activeAxis);
    PlsrHwTimerClearCc1if(activeAxis);
    PlsrHwTimerSetCnt(activeAxis, 0UL);
    PlsrHwTimerSetUie(activeAxis, 0UL);
    PlsrHwTimerSetCc1ie(activeAxis, 1UL);
    PlsrHwTimerSetCc1e(activeAxis, 1UL);
    PlsrHwTimerSetCen(activeAxis, 1UL);
 #ifndef PLSR_HOST_TEST
    __DMB();
    if (interruptState == 0UL)
    {
        __enable_irq();
    }
 #endif
 }

 static void PlsrHwStopCwCcwOutput(uint8_t axis)
 {
    uint8_t pairAxis = PlsrHwGetPairedAxis(axis);
 #ifndef PLSR_HOST_TEST
    uint32_t interruptState = __get_PRIMASK();

    __disable_irq();
    __DMB();
 #endif
    /* Disable both compare outputs while retaining AF mode; do not force
     * either pin through GPIO during the direction handover. */
    PlsrHwStopPwmTimer(axis);
    PlsrHwStopPwmTimer(pairAxis);
    PlsrHwAxes[axis].cwStopPending = 0U;
 #ifndef PLSR_HOST_TEST
    __DMB();
    if (interruptState == 0UL)
    {
        __enable_irq();
    }
 #endif
 }

 static void PlsrHwConfigureActiveOutput(uint8_t axis,
                                        PLSR_OUTPUT_MODE outputMode,
                                        uint32_t frequencyHz)
@@ -767,6 +948,10 @@ static void PlsrHwConfigureActiveOutput(uint8_t axis,
    {
        (void)PlsrHwConfigureAbPwm(axis, frequencyHz);
    }
    else if (outputMode == PLSR_OUTPUT_CW_CCW)
    {
        PlsrHwConfigureCwCcwPwm(axis, frequencyHz);
    }
    else
    {
        PlsrHwConfigurePwm(axis, frequencyHz);
@@ -780,6 +965,10 @@ static void PlsrHwBeginActiveOutput(uint8_t axis,
    {
        PlsrHwBeginAbOutput(axis, 0U);
    }
    else if (outputMode == PLSR_OUTPUT_CW_CCW)
    {
        PlsrHwBeginCwCcwOutput(axis);
    }
    else
    {
        PlsrHwPwmBegin(axis);
@@ -812,6 +1001,11 @@ static void PlsrHwStopActiveOutput(uint8_t axis,
        }
 #endif
    }
    else if ((outputMode == PLSR_OUTPUT_CW_CCW)
             && (PlsrHwIsAbBaseAxis(axis) != 0U))
    {
        PlsrHwStopCwCcwOutput(axis);
    }
    else
    {
        PlsrHwStopPwmTimer(axis);
@@ -845,10 +1039,13 @@ PLSR_RESULT PlsrHwInit(void)
    uint8_t axis;

    (void)memset(PlsrHwAxes, 0, sizeof(PlsrHwAxes));
    PlsrHwDirectionBatchActive = 0U;
    for (axis = 0U; axis < PLSR_HW_AXIS_COUNT; axis++)
    {
        PlsrHwAxes[axis].state = PLSR_HW_STATE_IDLE;
        PlsrHwAxes[axis].directionPoint = PLSR_HW_DIR_POINT_NONE;
        PlsrHwAxes[axis].configuredDirectionPoint =
            PLSR_HW_DIR_POINT_NONE;
 #ifdef PLSR_HOST_TEST
        (void)memset(&PlsrHwTimers[axis], 0, sizeof(PlsrHwTimers[axis]));
 #else
@@ -862,6 +1059,9 @@ PLSR_RESULT PlsrHwInit(void)
 #ifndef PLSR_HOST_TEST
    {
        GPIO_InitTypeDef gpio;
        uint32_t tim6ClockHz;
        uint16_t tim6Psc;
        uint16_t tim6Arr;

        /* 1. 输出点 GPIO 时钟（DIR 点按需配置时使用）。 */
        __HAL_RCC_GPIOF_CLK_ENABLE();
@@ -879,6 +1079,31 @@ PLSR_RESULT PlsrHwInit(void)
        __HAL_RCC_TIM11_CLK_ENABLE();
        __HAL_RCC_TIM13_CLK_ENABLE();
        __HAL_RCC_TIM14_CLK_ENABLE();
        __HAL_RCC_TIM6_CLK_ENABLE();

        /* Independent 10kHz control clock for S2 refreshCode=2. */
        tim6ClockHz = HAL_RCC_GetPCLK1Freq();
        if ((RCC->CFGR & RCC_CFGR_PPRE1) != RCC_CFGR_PPRE1_DIV1)
        {
            tim6ClockHz *= 2UL;
        }
        if (PlsrCalculateTimerDivider(tim6ClockHz,
                                      10000UL,
                                      &tim6Psc,
                                      &tim6Arr) != PLSR_RESULT_OK)
        {
            return PLSR_RESULT_DIVIDER_UNREPRESENTABLE;
        }
        TIM6->CR1 = 0UL;
        TIM6->DIER = 0UL;
        TIM6->PSC = tim6Psc;
        TIM6->ARR = tim6Arr;
        TIM6->EGR = TIM_EGR_UG;
        TIM6->SR = 0UL;
        TIM6->DIER = TIM_DIER_UIE;
        HAL_NVIC_SetPriority(TIM6_DAC_IRQn, 2U, 0U);
        HAL_NVIC_EnableIRQ(TIM6_DAC_IRQn);
        TIM6->CR1 = TIM_CR1_ARPE | TIM_CR1_CEN;

        /* 4. 脉冲点切定时器复用（PF6/7=AF3、PF8/9=AF9）。
         * 定时器通道尚未使能（CC1E=0），输出级断开，无毛刺。 */
@@ -923,15 +1148,12 @@ PLSR_RESULT PlsrHwStartPulse(uint8_t axis, const PLSR_HW_START_PARAMS *params)
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    if ((params->outputMode == PLSR_OUTPUT_AB)
    if (((params->outputMode == PLSR_OUTPUT_AB)
         || (params->outputMode == PLSR_OUTPUT_CW_CCW))
        && (PlsrHwIsAbBaseAxis(axis) == 0U))
    {
        return PLSR_RESULT_INVALID_AXIS;
    }
    if (params->outputMode == PLSR_OUTPUT_CW_CCW)
    {
        return PLSR_RESULT_NOT_SUPPORTED;
    }
    state = &PlsrHwAxes[axis];
    if (state->state == PLSR_HW_STATE_RUNNING)
    {
@@ -945,7 +1167,9 @@ PLSR_RESULT PlsrHwStartPulse(uint8_t axis, const PLSR_HW_START_PARAMS *params)
        directionChanged =
            (state->directionPoint == PLSR_HW_DIR_POINT_NONE)
            || (state->directionPoint != params->directionPoint)
            || (state->directionPositive != params->directionPositive);
            || (state->directionPositive != params->directionPositive)
            || (state->directionNegativeLogic
                != params->directionNegativeLogic);
    }

    state->outputMode = params->outputMode;
@@ -965,12 +1189,21 @@ PLSR_RESULT PlsrHwStartPulse(uint8_t axis, const PLSR_HW_START_PARAMS *params)
    state->abFrequencyPending = 0U;
    if (params->outputMode == PLSR_OUTPUT_PULSE_DIR)
    {
        PlsrHwSetDirLevel(axis, params->directionPositive);
        PlsrHwSetDirLevel(axis,
                          params->directionPositive,
                          params->directionNegativeLogic);
    }
    else
    {
        state->directionPositive =
            (params->directionPositive != 0U) ? 1U : 0U;
        state->directionNegativeLogic = 0U;
    }
    if (params->outputMode == PLSR_OUTPUT_CW_CCW)
    {
        state->cwActiveAxis = (state->directionPositive != 0U)
                                  ? axis
                                  : PlsrHwGetPairedAxis(axis);
    }
    state->state = (state->directionDelayRemainingMs > 0U)
                       ? PLSR_HW_STATE_DIR_SETTLING
@@ -987,6 +1220,13 @@ PLSR_RESULT PlsrHwSetFrequency(uint8_t axis, uint32_t frequencyHz)
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    state = &PlsrHwAxes[axis];
    if ((state->outputMode == PLSR_OUTPUT_CW_CCW)
        && (state->cwStopPending != 0U))
    {
        /* Preserve the final physical high width until its natural update
         * boundary; no later profile write may move that boundary. */
        return PLSR_RESULT_OK;
    }
    state->currentFrequencyHz = frequencyHz;
    if (state->state == PLSR_HW_STATE_RUNNING)
    {
@@ -1023,6 +1263,29 @@ PLSR_RESULT PlsrHwSetFrequency(uint8_t axis, uint32_t frequencyHz)
    return PLSR_RESULT_OK;
 }

 PLSR_RESULT PlsrHwResumePulse(uint8_t axis)
 {
    PLSR_HW_AXIS_STATE *state;

    if (axis >= PLSR_HW_AXIS_COUNT)
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    state = &PlsrHwAxes[axis];
    if ((state->state != PLSR_HW_STATE_RUNNING)
        || (state->currentFrequencyHz != 0UL)
        || (state->emittedPulses >= state->targetPulses))
    {
        return PLSR_RESULT_INVALID_STATE;
    }

    /* PlsrHwSetFrequency(0) stopped the physical timer but deliberately kept
     * the segment counters.  PWM_PENDING makes the next non-zero control-tick
     * update take the normal clean-start path without resetting those counts. */
    state->state = PLSR_HW_STATE_PWM_PENDING;
    return PLSR_RESULT_OK;
 }

 PLSR_RESULT PlsrHwStopPulse(uint8_t axis)
 {
    PLSR_HW_AXIS_STATE *state;
@@ -1225,6 +1488,43 @@ void PlsrHwOnTimerUpdate(uint8_t axis)
        return;
    }

    if ((state->state == PLSR_HW_STATE_RUNNING)
        && (state->outputMode == PLSR_OUTPUT_CW_CCW))
    {
        uint8_t hasUif = PlsrHwTimerHasUif(axis);

        if (hasUif != 0U)
        {
            PlsrHwTimerClearUif(axis);
        }
        if (axis != state->cwActiveAxis)
        {
            return;
        }
        if (hasCc1 != 0U)
        {
            state->emittedPulses++;
            if (state->emittedPulses >= state->targetPulses)
            {
                /* The board output is inverted relative to OC1REF: CC1 is
                 * the physical rising edge. Arm the tail here, then stop on
                 * the following update (physical falling edge). */
                state->cwStopPending = 1U;
                PlsrHwTimerSetCc1ie(axis, 0UL);
                PlsrHwTimerClearUif(axis);
                PlsrHwTimerSetUie(axis, 1UL);
            }
            return;
        }
        if ((hasUif != 0U) && (state->cwStopPending != 0U))
        {
            PlsrHwStopActiveOutput(ownerAxis, state->outputMode);
            state->state = PLSR_HW_STATE_DONE;
            (void)PlsrPostEvent(ownerAxis, PLSR_EVENT_SEGMENT_COMPLETE);
        }
        return;
    }

    if (hasCc1 != 0U)
    {
        /* 非运行态/非 AB 模式的 CC1 仅作为杂散标志消费。 */
@@ -1381,6 +1681,15 @@ void PlsrHwTestTriggerUpdate(uint8_t axis)
    }
    PlsrHwOnTimerUpdate(axis);
 }

 void PlsrHwTestTriggerCompare(uint8_t axis)
 {
    if (axis < PLSR_HW_AXIS_COUNT)
    {
        PlsrHwTimers[axis].sr |= PLSR_HW_TIMER_CC1_BIT;
    }
    PlsrHwOnTimerUpdate(axis);
 }
 #endif

 #ifndef PLSR_HOST_TEST
@@ -1403,4 +1712,13 @@ void TIM8_TRG_COM_TIM14_IRQHandler(void)
 {
    PlsrHwOnTimerUpdate(3U);
 }

 void TIM6_DAC_IRQHandler(void)
 {
    if ((TIM6->SR & TIM_SR_UIF) != 0UL)
    {
        TIM6->SR &= ~TIM_SR_UIF;
        PlsrControlTick100us();
    }
 }
 #endif
--- a/PLSR/Src/plsr_job.c
+++ b/PLSR/Src/plsr_job.c
@@ -137,6 +137,23 @@ static PLSR_RESULT PlsrReadInt32(const PLSR_DATA_SOURCE *source,
                      segment);
        return PLSR_RESULT_ADDRESS_OVERFLOW;
    }
    if (source->readDword != NULL)
    {
        if (source->readDword(source->context,
                              device,
                              address,
                              value) == 0U)
        {
            PlsrSetDetail(detail,
                          PLSR_RESULT_DATA_ACCESS,
                          block,
                          address,
                          0,
                          segment);
            return PLSR_RESULT_DATA_ACCESS;
        }
        return PLSR_RESULT_OK;
    }
    result = PlsrReadWord(source,
                          device,
                          address,
@@ -486,12 +503,23 @@ static PLSR_RESULT PlsrLoadS2(const PLSR_CALL *call,
    result = PlsrReadFixedWord(0U, commonBase, &word, detail);
    if (result != PLSR_RESULT_OK) return result;
    commonFlags = word;
    snapshot->directionActiveHigh =
    snapshot->directionNegativeLogic =
        ((commonFlags & (1U << 1U)) != 0U) ? 1U : 0U;
    snapshot->limits.softLimitEnabled =
        ((commonFlags & (1U << 2U)) != 0U) ? 1U : 0U;
    snapshot->equivalent.unitCode =
        (uint8_t)((commonFlags >> 8U) & 0x07U);

    result = PlsrReadFixedWord(0U,
                               (uint16_t)(commonBase + 8U),
                               &snapshot->positiveBacklashPulses,
                               detail);
    if (result != PLSR_RESULT_OK) return result;
    result = PlsrReadFixedWord(0U,
                               (uint16_t)(commonBase + 9U),
                               &snapshot->negativeBacklashPulses,
                               detail);
    if (result != PLSR_RESULT_OK) return result;
    if (PlsrPositionUnitCodeIsValid(snapshot->equivalent.unitCode) == 0U)
    {
        PlsrSetDetail(detail,
@@ -681,6 +709,28 @@ static PLSR_RESULT PlsrLoadS2(const PLSR_CALL *call,
    return PLSR_RESULT_OK;
 }

 PLSR_RESULT PlsrReadLiveFrequencyRaw(const PLSR_JOB_SNAPSHOT *snapshot,
                                     uint16_t segment,
                                     int32_t *rawFrequency)
 {
    uint32_t segmentAddress;

    if ((snapshot == NULL) || (rawFrequency == NULL)
        || (segment < 1U) || (segment > snapshot->segmentCount))
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    segmentAddress = snapshot->s0.address
                     + (uint32_t)segment * PLSR_S0_SEGMENT_WORDS;
    return PlsrReadInt32(&snapshot->source,
                         snapshot->s0.device,
                         segmentAddress,
                         rawFrequency,
                         PLSR_PARSE_BLOCK_S0,
                         segment,
                         NULL);
 }

 static PLSR_RESULT PlsrValidateVariableReference(
    const PLSR_CALL *call,
    uint8_t sourceCode,
@@ -1447,7 +1497,6 @@ PLSR_RESULT PlsrResolveLiveFrequency(const PLSR_JOB_SNAPSHOT *snapshot,
                                     uint8_t *clamped)
 {
    int32_t rawFrequency;
    uint32_t segmentAddress;
    PLSR_RESULT result;

    if ((snapshot == NULL) || (frequency == NULL) || (clamped == NULL)
@@ -1463,15 +1512,7 @@ PLSR_RESULT PlsrResolveLiveFrequency(const PLSR_JOB_SNAPSHOT *snapshot,
        *clamped = 0U;
        return PLSR_RESULT_OK;
    }
    segmentAddress = snapshot->s0.address
                     + (uint32_t)segment * PLSR_S0_SEGMENT_WORDS;
    result = PlsrReadInt32(&snapshot->source,
                           snapshot->s0.device,
                           segmentAddress,
                           &rawFrequency,
                           PLSR_PARSE_BLOCK_S0,
                           segment,
                           NULL);
    result = PlsrReadLiveFrequencyRaw(snapshot, segment, &rawFrequency);
    if (result != PLSR_RESULT_OK) return result;
    if (rawFrequency < 0) return PLSR_RESULT_INVALID_FREQUENCY;
    *frequency = (rawFrequency == 0) ? snapshot->inputDefaultSpeed
--- a/PLSR/Src/plsr_modbus_control.c
+++ b/PLSR/Src/plsr_modbus_control.c
@@ -0,0 +1,570 @@
 #include "plsr_modbus_control.h"
 #include "modbus_data_store.h"
 #include "plsr_address_map.h"
 #include "plsr_core.h"
 #include "plsr_job.h"
 #include "plsr_modbus_data.h"
 #include <stddef.h>
 #include <string.h>

 #define PLSR_MODBUS_MAGIC_LOW             (0x504CU)
 #define PLSR_MODBUS_MAGIC_HIGH            (0x5352U)
 #define PLSR_MODBUS_CAPABILITIES          (0x0007U)
 #define PLSR_MODBUS_CALL_REQUEST_WORDS    (16UL)
 #define PLSR_MODBUS_CALL_RESPONSE_WORDS   (12UL)
 #define PLSR_MODBUS_COMMAND_REQUEST_WORDS (8UL)
 #define PLSR_MODBUS_COMMAND_RESPONSE_WORDS (8UL)
 #define PLSR_MODBUS_S0_HEADER_WORDS       (10UL)
 #define PLSR_MODBUS_S0_SEGMENT_WORDS      (10UL)
 #define PLSR_MODBUS_S1_WORDS              (4UL)
 #define PLSR_MODBUS_HASH_OFFSET           (2166136261UL)
 #define PLSR_MODBUS_HASH_PRIME            (16777619UL)

 typedef struct
 {
    PLSR_CALL call;
    uint32_t fingerprint;
    uint8_t valid;
 } PLSR_MODBUS_COMMITTED_CALL;

 static uint16_t PlsrModbusBaseAddress;
 static uint8_t PlsrModbusEnabled;
 static uint32_t PlsrModbusLastCallRequestSequence;
 static uint32_t PlsrModbusLastCommandRequestSequence;
 static uint32_t PlsrModbusStatusGeneration[PLSR_AXIS_COUNT];
 static PLSR_MODBUS_COMMITTED_CALL PlsrModbusCommitted[PLSR_AXIS_COUNT];
 static uint16_t PlsrModbusStatusWords[PLSR_AXIS_COUNT]
                                      [PLSR_MODBUS_AXIS_STATUS_WORDS];
 static const uint16_t PlsrModbusZeroWindow[PLSR_MODBUS_WINDOW_WORDS] = {0U};

 static void PlsrModbusPutU32(uint16_t *words,
                             uint32_t offset,
                             uint32_t value)
 {
    words[offset] = (uint16_t)(value & 0xFFFFUL);
    words[offset + 1UL] = (uint16_t)(value >> 16U);
 }

 static void PlsrModbusPutU64(uint16_t *words,
                             uint32_t offset,
                             uint64_t value)
 {
    words[offset] = (uint16_t)(value & 0xFFFFULL);
    words[offset + 1UL] = (uint16_t)((value >> 16U) & 0xFFFFULL);
    words[offset + 2UL] = (uint16_t)((value >> 32U) & 0xFFFFULL);
    words[offset + 3UL] = (uint16_t)(value >> 48U);
 }

 static uint32_t PlsrModbusGetU32(const uint16_t *words, uint32_t offset)
 {
    return ((uint32_t)words[offset + 1UL] << 16U) | words[offset];
 }

 static uint64_t PlsrModbusGetU64(const uint16_t *words, uint32_t offset)
 {
    return ((uint64_t)words[offset + 3UL] << 48U)
           | ((uint64_t)words[offset + 2UL] << 32U)
           | ((uint64_t)words[offset + 1UL] << 16U)
           | words[offset];
 }

 static uint8_t PlsrModbusReadWords(uint32_t offset,
                                   uint16_t *words,
                                   uint32_t wordCount)
 {
    uint32_t index;

    if (words == NULL)
    {
        return 0U;
    }
    for (index = 0UL; index < wordCount; index++)
    {
        if (ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                               (uint32_t)PlsrModbusBaseAddress + offset + index,
                               &words[index]) == 0U)
        {
            return 0U;
        }
    }
    return 1U;
 }

 static uint8_t PlsrModbusRangesOverlap(uint32_t firstA,
                                       uint32_t countA,
                                       uint32_t firstB,
                                       uint32_t countB)
 {
    return ((firstA < (firstB + countB)) && (firstB < (firstA + countA)))
               ? 1U
               : 0U;
 }

 static uint32_t PlsrModbusHashWord(uint32_t hash, uint16_t value)
 {
    hash ^= (uint8_t)(value & 0x00FFU);
    hash *= PLSR_MODBUS_HASH_PRIME;
    hash ^= (uint8_t)(value >> 8U);
    hash *= PLSR_MODBUS_HASH_PRIME;
    return hash;
 }

 static uint32_t PlsrModbusHashU32(uint32_t hash, uint32_t value)
 {
    hash = PlsrModbusHashWord(hash, (uint16_t)(value & 0xFFFFUL));
    return PlsrModbusHashWord(hash, (uint16_t)(value >> 16U));
 }

 static PLSR_RESULT PlsrModbusFingerprintCall(const PLSR_CALL *call,
                                              uint32_t *fingerprint)
 {
    uint16_t word;
    int32_t segmentCount;
    uint32_t s0Words;
    uint32_t index;
    uint32_t hash = PLSR_MODBUS_HASH_OFFSET;

    if ((call == NULL) || (fingerprint == NULL)
        || (call->source.readDword == NULL)
        || (call->source.readWord == NULL)
        || (call->source.validateWords == NULL))
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    if (call->source.readDword(call->source.context,
                               call->s0.device,
                               call->s0.address,
                               &segmentCount) == 0U)
    {
        return PLSR_RESULT_DATA_ACCESS;
    }
    if ((segmentCount < 1) || (segmentCount > (int32_t)PLSR_MAX_SEGMENTS))
    {
        return PLSR_RESULT_SEGMENT_OVERFLOW;
    }
    s0Words = PLSR_MODBUS_S0_HEADER_WORDS
              + (uint32_t)segmentCount * PLSR_MODBUS_S0_SEGMENT_WORDS;
    if ((call->source.validateWords(call->source.context,
                                    call->s0.device,
                                    call->s0.address,
                                    s0Words) == 0U)
        || (call->source.validateWords(call->source.context,
                                       call->s1.device,
                                       call->s1.address,
                                       PLSR_MODBUS_S1_WORDS) == 0U))
    {
        return PLSR_RESULT_DATA_ACCESS;
    }
    if (((call->s0.device == PLSR_DEVICE_D)
         && (PlsrModbusRangesOverlap(call->s0.address,
                                     s0Words,
                                     PlsrModbusBaseAddress,
                                     PLSR_MODBUS_WINDOW_WORDS) != 0U))
        || ((call->s1.device == PLSR_DEVICE_D)
            && (PlsrModbusRangesOverlap(call->s1.address,
                                        PLSR_MODBUS_S1_WORDS,
                                        PlsrModbusBaseAddress,
                                        PLSR_MODBUS_WINDOW_WORDS) != 0U)))
    {
        return PLSR_RESULT_BLOCK_OVERLAP;
    }

    hash = PlsrModbusHashWord(hash, (uint16_t)call->s0.device);
    hash = PlsrModbusHashU32(hash, call->s0.address);
    for (index = 0UL; index < s0Words; index++)
    {
        if (call->source.readWord(call->source.context,
                                  call->s0.device,
                                  call->s0.address + index,
                                  &word) == 0U)
        {
            return PLSR_RESULT_DATA_ACCESS;
        }
        hash = PlsrModbusHashWord(hash, word);
    }
    hash = PlsrModbusHashWord(hash, (uint16_t)call->s1.device);
    hash = PlsrModbusHashU32(hash, call->s1.address);
    for (index = 0UL; index < PLSR_MODBUS_S1_WORDS; index++)
    {
        if (call->source.readWord(call->source.context,
                                  call->s1.device,
                                  call->s1.address + index,
                                  &word) == 0U)
        {
            return PLSR_RESULT_DATA_ACCESS;
        }
        hash = PlsrModbusHashWord(hash, word);
    }
    hash = PlsrModbusHashWord(hash, (uint16_t)call->s2.type);
    hash = PlsrModbusHashWord(hash, (uint16_t)call->s2.data.device);
    hash = PlsrModbusHashU32(hash, call->s2.data.address);
    hash = PlsrModbusHashU32(hash, (uint32_t)call->s2.constant);
    if (call->s2.type == PLSR_OPERAND_DATA)
    {
        for (index = 0UL; index < 2UL; index++)
        {
            if (call->source.readWord(call->source.context,
                                      call->s2.data.device,
                                      call->s2.data.address + index,
                                      &word) == 0U)
            {
                return PLSR_RESULT_DATA_ACCESS;
            }
            hash = PlsrModbusHashWord(hash, word);
        }
    }
    hash = PlsrModbusHashWord(hash, call->dAxis);
    hash = PlsrModbusHashWord(hash, call->outputModeOverride);
    *fingerprint = hash;
    return PLSR_RESULT_OK;
 }

 static PLSR_RESULT PlsrModbusBuildCall(const uint16_t *request,
                                        PLSR_CALL *call)
 {
    uint16_t s2Type;
    uint16_t outputMode;

    if ((request == NULL) || (call == NULL))
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    s2Type = request[8UL];
    outputMode = request[13UL];
    if ((request[2UL] > (uint16_t)PLSR_DEVICE_FD)
        || (request[5UL] > (uint16_t)PLSR_DEVICE_FD)
        || (s2Type > (uint16_t)PLSR_OPERAND_DATA)
        || ((s2Type == (uint16_t)PLSR_OPERAND_DATA)
            && (request[9UL] > (uint16_t)PLSR_DEVICE_FD))
        || (request[12UL] >= PLSR_AXIS_COUNT)
        || ((outputMode > (uint16_t)PLSR_OUTPUT_CW_CCW)
            && (outputMode != PLSR_OUTPUT_MODE_FROM_SFD)))
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }

    (void)memset(call, 0, sizeof(*call));
    call->sequence = PlsrModbusGetU32(request, 0UL);
    call->s0.device = (PLSR_DEVICE_TYPE)request[2UL];
    call->s0.address = PlsrModbusGetU32(request, 3UL);
    call->s1.device = (PLSR_DEVICE_TYPE)request[5UL];
    call->s1.address = PlsrModbusGetU32(request, 6UL);
    call->s2.type = (PLSR_OPERAND_TYPE)s2Type;
    call->s2.data.device = (PLSR_DEVICE_TYPE)request[9UL];
    call->s2.data.address = PlsrModbusGetU32(request, 10UL);
    call->s2.constant = (int32_t)PlsrModbusGetU32(request, 10UL);
    call->dAxis = (uint8_t)request[12UL];
    call->outputModeOverride = (uint8_t)outputMode;
    PlsrModbusDataSourceInit(&call->source);
    return PLSR_RESULT_OK;
 }

 static void PlsrModbusPublishCallResponse(uint32_t sequence,
                                          uint16_t operation,
                                          PLSR_RESULT result,
                                          const PLSR_PARSE_DETAIL *detail,
                                          uint8_t committed)
 {
    uint16_t response[PLSR_MODBUS_CALL_RESPONSE_WORDS] = {0U};

    PlsrModbusPutU32(response, 0UL, sequence);
    response[2UL] = operation;
    response[3UL] = (uint16_t)result;
    if (detail != NULL)
    {
        response[4UL] = (uint16_t)detail->result;
        response[5UL] = (uint16_t)detail->block;
        PlsrModbusPutU32(response, 6UL, detail->address);
        PlsrModbusPutU32(response, 8UL, (uint32_t)detail->value);
        response[10UL] = detail->segment;
    }
    response[11UL] = committed;
    (void)ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               (uint32_t)PlsrModbusBaseAddress
                                   + PLSR_MODBUS_CALL_RESPONSE_OFFSET,
                               response,
                               PLSR_MODBUS_CALL_RESPONSE_WORDS);
 }

 static void PlsrModbusHandleCallRequest(void)
 {
    uint16_t request[PLSR_MODBUS_CALL_REQUEST_WORDS];
    PLSR_CALL call;
    PLSR_PARSE_DETAIL detail;
    PLSR_RESULT result;
    uint32_t sequence;
    uint32_t fingerprint;
    uint16_t operation;
    uint8_t axis = 0U;

    if (PlsrModbusReadWords(PLSR_MODBUS_CALL_REQUEST_OFFSET,
                            request,
                            PLSR_MODBUS_CALL_REQUEST_WORDS) == 0U)
    {
        return;
    }
    sequence = PlsrModbusGetU32(request, 0UL);
    if ((sequence == 0UL) || (sequence == PlsrModbusLastCallRequestSequence))
    {
        return;
    }
    PlsrModbusLastCallRequestSequence = sequence;
    operation = request[14UL];
    (void)memset(&detail, 0, sizeof(detail));
    result = PlsrModbusBuildCall(request, &call);
    if (result == PLSR_RESULT_OK)
    {
        axis = call.dAxis;
    }

    if ((result == PLSR_RESULT_OK) && (operation == PLSR_MODBUS_CALL_COMMIT))
    {
        result = PlsrValidateCall(&call, &detail);
        if (result == PLSR_RESULT_OK)
        {
            result = PlsrModbusFingerprintCall(&call, &fingerprint);
        }
        if (result == PLSR_RESULT_OK)
        {
            PlsrModbusCommitted[axis].call = call;
            PlsrModbusCommitted[axis].fingerprint = fingerprint;
            PlsrModbusCommitted[axis].valid = 1U;
        }
        else
        {
            PlsrModbusCommitted[axis].valid = 0U;
        }
    }
    else if ((result == PLSR_RESULT_OK)
             && (operation == PLSR_MODBUS_CALL_START))
    {
        if (PlsrModbusCommitted[axis].valid == 0U)
        {
            result = PLSR_RESULT_INVALID_STATE;
        }
        else
        {
            result = PlsrModbusFingerprintCall(
                &PlsrModbusCommitted[axis].call,
                &fingerprint);
            if ((result == PLSR_RESULT_OK)
                && (fingerprint != PlsrModbusCommitted[axis].fingerprint))
            {
                result = PLSR_RESULT_BUSY;
            }
            if (result == PLSR_RESULT_OK)
            {
                result = PlsrValidateCall(&PlsrModbusCommitted[axis].call,
                                          &detail);
            }
            if (result == PLSR_RESULT_OK)
            {
                PlsrModbusCommitted[axis].call.sequence = sequence;
                result = PlsrPostCall(&PlsrModbusCommitted[axis].call);
            }
        }
    }
    else if (result == PLSR_RESULT_OK)
    {
        result = PLSR_RESULT_INVALID_ARGUMENT;
    }

    PlsrModbusPublishCallResponse(
        sequence,
        operation,
        result,
        &detail,
        (axis < PLSR_AXIS_COUNT) ? PlsrModbusCommitted[axis].valid : 0U);
 }

 static void PlsrModbusPublishCommandResponse(uint32_t sequence,
                                             uint16_t opcode,
                                             uint16_t axis,
                                             PLSR_RESULT result)
 {
    uint16_t response[PLSR_MODBUS_COMMAND_RESPONSE_WORDS] = {0U};

    PlsrModbusPutU32(response, 0UL, sequence);
    response[2UL] = opcode;
    response[3UL] = axis;
    response[4UL] = (uint16_t)result;
    (void)ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               (uint32_t)PlsrModbusBaseAddress
                                   + PLSR_MODBUS_COMMAND_RESPONSE_OFFSET,
                               response,
                               PLSR_MODBUS_COMMAND_RESPONSE_WORDS);
 }

 static void PlsrModbusHandleCommandRequest(void)
 {
    uint16_t request[PLSR_MODBUS_COMMAND_REQUEST_WORDS];
    PLSR_COMMAND command;
    PLSR_RESULT result;
    uint32_t sequence;

    if (PlsrModbusReadWords(PLSR_MODBUS_COMMAND_REQUEST_OFFSET,
                            request,
                            PLSR_MODBUS_COMMAND_REQUEST_WORDS) == 0U)
    {
        return;
    }
    sequence = PlsrModbusGetU32(request, 0UL);
    if ((sequence == 0UL)
        || (sequence == PlsrModbusLastCommandRequestSequence))
    {
        return;
    }
    PlsrModbusLastCommandRequestSequence = sequence;
    (void)memset(&command, 0, sizeof(command));
    if ((request[2UL] > (uint16_t)PLSR_CMD_SELF_TEST)
        || (request[2UL] == (uint16_t)PLSR_CMD_START)
        || (request[3UL] >= PLSR_AXIS_COUNT))
    {
        result = PLSR_RESULT_INVALID_ARGUMENT;
    }
    else
    {
        command.sequence = sequence;
        command.opcode = (PLSR_COMMAND_OPCODE)request[2UL];
        command.axis = (uint8_t)request[3UL];
        command.argument = (int64_t)PlsrModbusGetU64(request, 4UL);
        result = PlsrPostCommand(&command);
    }
    PlsrModbusPublishCommandResponse(sequence,
                                     request[2UL],
                                     request[3UL],
                                     result);
 }

 static void PlsrModbusPublishAxisStatus(uint8_t axis)
 {
    PLSR_STATUS status;
    uint16_t *words = PlsrModbusStatusWords[axis];
    uint32_t flags = 0UL;
    uint32_t generation;

    if (PlsrGetStatus(axis, &status) != PLSR_RESULT_OK)
    {
        return;
    }
    generation = PlsrModbusStatusGeneration[axis] + 2UL;
    if (generation == 0UL)
    {
        generation = 2UL;
    }
    PlsrModbusStatusGeneration[axis] = generation;
    (void)memset(words, 0, sizeof(PlsrModbusStatusWords[axis]));
    if (status.busy != 0U) flags |= (1UL << 0U);
    if (status.pulseActive != 0U) flags |= (1UL << 1U);
    if (status.done != 0U) flags |= (1UL << 2U);
    if (status.wait != 0U) flags |= (1UL << 3U);
    if (status.directionPositive != 0U) flags |= (1UL << 4U);
    if (status.positionValid != 0U) flags |= (1UL << 5U);
    if (status.jobValid != 0U) flags |= (1UL << 6U);
    if (status.speedClamped != 0U) flags |= (1UL << 7U);
    if (status.positionOverflow != 0U) flags |= (1UL << 8U);
    if (status.positiveLimitActive != 0U) flags |= (1UL << 9U);
    if (status.negativeLimitActive != 0U) flags |= (1UL << 10U);
    if (status.emergencyLatched != 0U) flags |= (1UL << 11U);
    if (status.backlashActive != 0U) flags |= (1UL << 12U);

    PlsrModbusPutU32(words, 0UL, generation);
    words[2UL] = (uint16_t)status.state;
    PlsrModbusPutU32(words, 3UL, flags);
    words[5UL] = (uint16_t)status.outputMode;
    words[6UL] = (uint16_t)status.error;
    words[7UL] = (uint16_t)status.stopReason;
    words[8UL] = (uint16_t)status.lastCommandResult;
    words[9UL] = status.s2Set;
    PlsrModbusPutU32(words, 10UL, status.lastCommandSequence);
    PlsrModbusPutU32(words, 12UL, status.illegalTransitionCount);
    PlsrModbusPutU32(words, 14UL, status.pendingEvents);
    PlsrModbusPutU64(words, 16UL, (uint64_t)status.logicalPosition);
    PlsrModbusPutU64(words, 20UL, (uint64_t)status.taskPulses);
    PlsrModbusPutU64(words, 24UL, (uint64_t)status.totalPulses);
    PlsrModbusPutU64(words, 28UL, status.physicalPulses);
    words[32UL] = status.segmentCount;
    words[33UL] = status.startSegment;
    words[34UL] = status.currentSegment;
    words[35UL] = status.directionPoint;
    words[36UL] = status.highResourceMask;
    PlsrModbusPutU32(words, 38UL, status.currentFrequencyHz);
    PlsrModbusPutU32(words, 40UL, status.targetFrequencyHz);
    PlsrModbusPutU32(words, 42UL, status.liveFrequencyRejectCount);
    words[44UL] = (uint16_t)status.lastLiveFrequencyResult;
    PlsrModbusPutU32(words, 46UL, generation);
    (void)ModbusDataWriteWords(
        MODBUS_DATA_DEVICE_D,
        (uint32_t)PlsrModbusBaseAddress + PLSR_MODBUS_AXIS_STATUS_OFFSET
            + (uint32_t)axis * PLSR_MODBUS_AXIS_STATUS_WORDS,
        words,
        PLSR_MODBUS_AXIS_STATUS_WORDS);
 }

 PLSR_RESULT PlsrModbusControlInit(uint16_t baseAddress)
 {
    uint16_t header[8] = {0U};

    if (ModbusDataValidateWords(MODBUS_DATA_DEVICE_D,
                                baseAddress,
                                PLSR_MODBUS_WINDOW_WORDS) == 0U)
    {
        return PLSR_RESULT_DATA_ACCESS;
    }
    PlsrModbusBaseAddress = baseAddress;
    PlsrModbusEnabled = 0U;
    PlsrModbusLastCallRequestSequence = 0UL;
    PlsrModbusLastCommandRequestSequence = 0UL;
    (void)memset(PlsrModbusCommitted, 0, sizeof(PlsrModbusCommitted));
    (void)memset(PlsrModbusStatusGeneration,
                 0,
                 sizeof(PlsrModbusStatusGeneration));
    if (ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                             baseAddress,
                             PlsrModbusZeroWindow,
                             PLSR_MODBUS_WINDOW_WORDS) == 0U)
    {
        return PLSR_RESULT_DATA_ACCESS;
    }
    header[0UL] = PLSR_MODBUS_MAGIC_LOW;
    header[1UL] = PLSR_MODBUS_MAGIC_HIGH;
    header[2UL] = PLSR_MODBUS_PROTOCOL_VERSION;
    header[3UL] = (uint16_t)PLSR_MODBUS_WINDOW_WORDS;
    header[4UL] = PLSR_MODBUS_CAPABILITIES;
    if (ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                             baseAddress,
                             header,
                             8UL) == 0U)
    {
        return PLSR_RESULT_DATA_ACCESS;
    }
    PlsrModbusEnabled = 1U;
    PlsrModbusControlPoll();
    return PLSR_RESULT_OK;
 }

 void PlsrModbusControlPoll(void)
 {
    uint8_t axis;

    if (PlsrModbusEnabled == 0U)
    {
        return;
    }
    PlsrModbusHandleCallRequest();
    PlsrModbusHandleCommandRequest();
    for (axis = 0U; axis < PLSR_AXIS_COUNT; axis++)
    {
        PlsrModbusPublishAxisStatus(axis);
    }
 }

 uint8_t PlsrModbusControlIsEnabled(void)
 {
    return PlsrModbusEnabled;
 }

 uint16_t PlsrModbusControlGetBaseAddress(void)
 {
    return PlsrModbusBaseAddress;
 }
--- a/PLSR/Src/plsr_modbus_data.c
+++ b/PLSR/Src/plsr_modbus_data.c
@@ -0,0 +1,72 @@
 #include "plsr_modbus_data.h"
 #include "modbus_data_store.h"
 #include <stddef.h>

 static uint8_t PlsrModbusDevice(PLSR_DEVICE_TYPE device,
                                MODBUS_DATA_DEVICE *modbusDevice)
 {
    if ((modbusDevice == NULL) || (device > PLSR_DEVICE_FD))
    {
        return 0U;
    }
    *modbusDevice = (MODBUS_DATA_DEVICE)device;
    return 1U;
 }

 static uint8_t PlsrModbusValidateWords(void *context,
                                       PLSR_DEVICE_TYPE device,
                                       uint32_t firstAddress,
                                       uint32_t wordCount)
 {
    MODBUS_DATA_DEVICE modbusDevice;

    (void)context;
    if (PlsrModbusDevice(device, &modbusDevice) == 0U)
    {
        return 0U;
    }
    return ModbusDataValidateWords(modbusDevice, firstAddress, wordCount);
 }

 static uint8_t PlsrModbusReadWord(void *context,
                                  PLSR_DEVICE_TYPE device,
                                  uint32_t address,
                                  uint16_t *value)
 {
    MODBUS_DATA_DEVICE modbusDevice;

    (void)context;
    if (PlsrModbusDevice(device, &modbusDevice) == 0U)
    {
        return 0U;
    }
    return ModbusDataReadWord(modbusDevice, address, value);
 }

 static uint8_t PlsrModbusReadDword(void *context,
                                   PLSR_DEVICE_TYPE device,
                                   uint32_t address,
                                   int32_t *value)
 {
    MODBUS_DATA_DEVICE modbusDevice;

    (void)context;
    if (PlsrModbusDevice(device, &modbusDevice) == 0U)
    {
        return 0U;
    }
    return ModbusDataReadDword(modbusDevice, address, value);
 }

 void PlsrModbusDataSourceInit(PLSR_DATA_SOURCE *source)
 {
    if (source == NULL)
    {
        return;
    }
    source->context = NULL;
    source->validateWords = PlsrModbusValidateWords;
    source->readWord = PlsrModbusReadWord;
    source->readDword = PlsrModbusReadDword;
    source->readBit = NULL;
 }
--- a/PLSR/Src/plsr_path.c
+++ b/PLSR/Src/plsr_path.c
@@ -16,6 +16,10 @@ static uint8_t PlsrPathReadDword(const PLSR_DATA_SOURCE *source,
    uint16_t lowWord;
    uint16_t highWord;

    if (source->readDword != NULL)
    {
        return source->readDword(source->context, device, address, value);
    }
    if ((source->readWord == NULL)
        || (source->readWord(source->context,
                             device,
--- a/PLSR/Src/plsr_profile.c
+++ b/PLSR/Src/plsr_profile.c
@@ -499,6 +499,49 @@ PLSR_RESULT PlsrProfileRequestStop(PLSR_PROFILE_STATE *state)
    return PLSR_RESULT_OK;
 }

 PLSR_RESULT PlsrProfileResume(PLSR_PROFILE_STATE *state,
                              uint32_t startFrequencyHz,
                              uint32_t targetFrequencyHz,
                              uint32_t stopFrequencyHz)
 {
    uint64_t totalPulsesQ32;

    if ((state == NULL) || (state->started == 0U)
        || (state->phase != PLSR_PROFILE_PHASE_DONE)
        || (state->totalPulses <= 0) || (targetFrequencyHz == 0UL))
    {
        return PLSR_RESULT_INVALID_ARGUMENT;
    }
    totalPulsesQ32 = (uint64_t)state->totalPulses
                     * PLSR_PROFILE_Q32_ONE;
    if (state->emittedPulsesQ32 >= totalPulsesQ32)
    {
        return PLSR_RESULT_INVALID_STATE;
    }

    state->targetFrequencyHz = targetFrequencyHz;
    state->startFrequencyHz = startFrequencyHz;
    state->stopFrequencyHz = stopFrequencyHz;
    state->decelTargetHz = stopFrequencyHz;
    if (startFrequencyHz > targetFrequencyHz)
    {
        startFrequencyHz = targetFrequencyHz;
    }
    state->frequencyQ32 = PlsrProfileHzToQ32(startFrequencyHz);
    state->phase = PLSR_PROFILE_PHASE_ACCEL;
    if ((startFrequencyHz >= targetFrequencyHz)
        || (state->accelSlopeHzPerMs == 0UL))
    {
        state->frequencyQ32 = PlsrProfileHzToQ32(targetFrequencyHz);
        state->phase = PLSR_PROFILE_PHASE_CRUISE;
    }
    else
    {
        PlsrProfileBeginAccel(state);
    }
    return PLSR_RESULT_OK;
 }

 PLSR_RESULT PlsrProfilePlan(const PLSR_PROFILE_REQUEST *request,
                            int64_t pulses,
                            PLSR_PROFILE_PLAN *plan)
--- a/PLSR/Src/plsr_self_test.c
+++ b/PLSR/Src/plsr_self_test.c
@@ -1,7 +1,9 @@
 #include "plsr_self_test.h"
 #include "plc_device.h"
 #include "modbus_data_store.h"
 #include "plsr_core.h"
 #include "plsr_job.h"
 #include "plsr_modbus_data.h"
 #include <string.h>

 /* 上电自测（验证后可删除）：
@@ -18,8 +20,62 @@
 #define SELF_TEST_DIR_POINT         (4U)
 #define SELF_TEST_SFD_AXIS_STRIDE   (130U)
 #define SELF_TEST_SFD_SET_OFFSET    (50U)
 #define SELF_TEST_MODBUS_S0_BASE    (1000UL)
 #define SELF_TEST_MODBUS_S1_BASE    (1100UL)

 static uint16_t SelfTestWords[3][SELF_TEST_WORD_CAPACITY];
 volatile int32_t PlsrSelfTestLiveFrequencyHz;
 volatile uint32_t PlsrSelfTestDynamicTick100us;
 volatile uint8_t PlsrSelfTestDynamicPhase;
 static volatile uint8_t PlsrSelfTestDynamicEnabled;

 void PlsrSelfTestControlTick100us(void)
 {
    if (PlsrSelfTestDynamicEnabled == 0U)
    {
        return;
    }
    if (PlsrSelfTestDynamicTick100us != UINT32_MAX)
    {
        PlsrSelfTestDynamicTick100us++;
    }
    switch (PlsrSelfTestDynamicTick100us)
    {
        case 10000UL: /* 1.0s: 1000 -> 4000Hz. */
            PlsrSelfTestLiveFrequencyHz = 4000;
            PlsrSelfTestDynamicPhase = 1U;
            break;

        case 15000UL: /* 1.5s: 4000 -> 500Hz. */
            PlsrSelfTestLiveFrequencyHz = 500;
            PlsrSelfTestDynamicPhase = 2U;
            break;

        case 20000UL: /* 2.0s: zero selects the 1000Hz S2 default. */
            PlsrSelfTestLiveFrequencyHz = 0;
            PlsrSelfTestDynamicPhase = 3U;
            break;

        case 22000UL: /* 2.2s: 8000 is clamped to the 5000Hz maximum. */
            PlsrSelfTestLiveFrequencyHz = 8000;
            PlsrSelfTestDynamicPhase = 4U;
            break;

        case 27000UL: /* 2.7s: invalid value must retain the safe target. */
            PlsrSelfTestLiveFrequencyHz = -1;
            PlsrSelfTestDynamicPhase = 5U;
            break;

        case 29000UL: /* 2.9s: recover and hold 2000Hz. */
            PlsrSelfTestLiveFrequencyHz = 2000;
            PlsrSelfTestDynamicPhase = 6U;
            PlsrSelfTestDynamicEnabled = 0U;
            break;

        default:
            break;
    }
 }

 static uint8_t SelfTestValidateWords(void *context,
                                     PLSR_DEVICE_TYPE device,
@@ -52,6 +108,37 @@ static uint8_t SelfTestReadWord(void *context,
    return 1U;
 }

 static uint8_t SelfTestReadDwordLive(void *context,
                                     PLSR_DEVICE_TYPE device,
                                     uint32_t address,
                                     int32_t *value)
 {
    uint16_t lowWord;
    uint16_t highWord;

    if (value == NULL)
    {
        return 0U;
    }
    if ((device == PLSR_DEVICE_D)
        && (address == SELF_TEST_S0_BASE + 10UL))
    {
        /* Aligned Cortex-M4 dword load: atomic source for the TIM6 ISR. */
        *value = PlsrSelfTestLiveFrequencyHz;
        return 1U;
    }
    if ((SelfTestReadWord(context, device, address, &lowWord) == 0U)
        || (SelfTestReadWord(context,
                             device,
                             address + 1UL,
                             &highWord) == 0U))
    {
        return 0U;
    }
    *value = (int32_t)(((uint32_t)highWord << 16U) | lowWord);
    return 1U;
 }

 static uint8_t SelfTestReadBit(void *context,
                               PLSR_DEVICE_TYPE device,
                               uint32_t address,
@@ -341,3 +428,539 @@ PLSR_RESULT PlsrFourAxisSelfTestQueue(void)
    }
    return PLSR_RESULT_QUEUED;
 }

 PLSR_RESULT PlsrBacklashSelfTestQueue(void)
 {
    PLSR_CALL call;
    PLSR_COMMAND command;
    PLSR_RESULT result;

    (void)memset(SelfTestWords, 0, sizeof(SelfTestWords));

    /* Pulse unit, Q4 direction, +10/-20 pulse backlash. */
    (void)PlcDeviceWriteSfd(900U, 0U);
    SelfTestWriteSfdDword(902U, 1UL);
    SelfTestWriteSfdDword(904U, 1UL);
    (void)PlcDeviceWriteSfd(906U, SELF_TEST_DIR_POINT);
    (void)PlcDeviceWriteSfd(907U, 10U);
    (void)PlcDeviceWriteSfd(908U, 10U);
    (void)PlcDeviceWriteSfd(909U, 20U);
    (void)PlcDeviceWriteSfd(912U, 0U);
    (void)PlcDeviceWriteSfd(915U, 0xFFFFU);

    /* K1 user segments are fixed 1kHz.  Backlash blocks use a 20ms
     * acceleration/deceleration parameter. */
    SelfTestWriteSfdDword(950U, 1000UL);
    (void)PlcDeviceWriteSfd(952U, 0U);
    (void)PlcDeviceWriteSfd(953U, 0U);
    (void)PlcDeviceWriteSfd(954U, 20U);
    (void)PlcDeviceWriteSfd(955U, 0U);
    SelfTestWriteSfdDword(956U, 100000UL);
    SelfTestWriteSfdDword(958U, 1000UL);
    SelfTestWriteSfdDword(960U, 0UL);
    (void)PlcDeviceWriteSfd(962U, 50U);
    (void)PlcDeviceWriteSfd(963U, 0U);
    (void)PlcDeviceWriteSfd(964U, 0U);
    SelfTestWriteSfdDword(966U, 2000UL);
    SelfTestWriteSfdDword(968U, 200UL);

    SelfTestWriteDword(PLSR_DEVICE_D, SELF_TEST_S0_BASE, 3U);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 10U,
                       1000UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 12U,
                       200UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 20U,
                       1000UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 22U,
                       (uint32_t)(int32_t)-200);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 30U,
                       1000UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 32U,
                       100UL);
    SelfTestWriteDword(PLSR_DEVICE_D, SELF_TEST_S1_BASE, 0U);

    (void)memset(&command, 0, sizeof(command));
    command.sequence = 0xA700UL;
    command.axis = 0U;
    command.opcode = PLSR_CMD_SET_POSITION;
    command.argument = 0;
    result = PlsrPostCommand(&command);
    if (result != PLSR_RESULT_QUEUED)
    {
        return result;
    }

    (void)memset(&call, 0, sizeof(call));
    call.sequence = 0xA701UL;
    call.source.context = NULL;
    call.source.validateWords = SelfTestValidateWords;
    call.source.readWord = SelfTestReadWord;
    call.source.readBit = SelfTestReadBit;
    call.s0.device = PLSR_DEVICE_D;
    call.s0.address = SELF_TEST_S0_BASE;
    call.s1.device = PLSR_DEVICE_D;
    call.s1.address = SELF_TEST_S1_BASE;
    call.s2.type = PLSR_OPERAND_CONSTANT;
    call.s2.constant = 1;
    call.dAxis = 0U;
    call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
    return PlsrPostCall(&call);
 }

 PLSR_RESULT PlsrDirectionLogicSelfTestQueue(void)
 {
    static const uint16_t s0Base[2] = {10U, 40U};
    static const uint16_t s1Base[2] = {160U, 164U};
    static const uint8_t directionPoint[2] = {4U, 3U};
    PLSR_CALL call;
    PLSR_COMMAND command;
    PLSR_RESULT result;
    uint16_t commonBase;
    uint16_t setBase;
    uint8_t axis;

    (void)memset(SelfTestWords, 0, sizeof(SelfTestWords));

    for (axis = 0U; axis < 2U; axis++)
    {
        commonBase = (uint16_t)(900U
                                + (uint16_t)axis
                                      * SELF_TEST_SFD_AXIS_STRIDE);
        setBase = (uint16_t)(commonBase + SELF_TEST_SFD_SET_OFFSET);

        /* Axis 0 uses positive logic; axis 1 uses negative logic. */
        (void)PlcDeviceWriteSfd(commonBase,
                                (axis == 0U) ? 0U : (1U << 1U));
        SelfTestWriteSfdDword((uint16_t)(commonBase + 2U), 1UL);
        SelfTestWriteSfdDword((uint16_t)(commonBase + 4U), 1UL);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 6U),
                                directionPoint[axis]);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 7U), 10U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 8U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 9U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 12U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 15U), 0xFFFFU);

        SelfTestWriteSfdDword(setBase, 1000UL);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 2U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 3U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 4U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 5U), 0U);
        SelfTestWriteSfdDword((uint16_t)(setBase + 6U), 100000UL);
        SelfTestWriteSfdDword((uint16_t)(setBase + 8U), 1000UL);
        SelfTestWriteSfdDword((uint16_t)(setBase + 10U), 0UL);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 12U), 50U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 13U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 14U), 0U);
        SelfTestWriteSfdDword((uint16_t)(setBase + 16U), 2000UL);
        SelfTestWriteSfdDword((uint16_t)(setBase + 18U), 200UL);

        SelfTestWriteDword(PLSR_DEVICE_D, s0Base[axis], 2U);
        SelfTestWriteDword(PLSR_DEVICE_D,
                           (uint32_t)s0Base[axis] + 10UL,
                           1000UL);
        SelfTestWriteDword(PLSR_DEVICE_D,
                           (uint32_t)s0Base[axis] + 12UL,
                           200UL);
        SelfTestWriteDword(PLSR_DEVICE_D,
                           (uint32_t)s0Base[axis] + 20UL,
                           1000UL);
        SelfTestWriteDword(PLSR_DEVICE_D,
                           (uint32_t)s0Base[axis] + 22UL,
                           (uint32_t)(int32_t)-200);
        SelfTestWriteDword(PLSR_DEVICE_D, s1Base[axis], 0U);

        (void)memset(&command, 0, sizeof(command));
        command.sequence = 0xA800UL + axis;
        command.axis = axis;
        command.opcode = PLSR_CMD_SET_POSITION;
        command.argument = 0;
        result = PlsrPostCommand(&command);
        if (result != PLSR_RESULT_QUEUED)
        {
            return result;
        }

        (void)memset(&call, 0, sizeof(call));
        call.sequence = 0xA810UL + axis;
        call.source.context = NULL;
        call.source.validateWords = SelfTestValidateWords;
        call.source.readWord = SelfTestReadWord;
        call.source.readBit = SelfTestReadBit;
        call.s0.device = PLSR_DEVICE_D;
        call.s0.address = s0Base[axis];
        call.s1.device = PLSR_DEVICE_D;
        call.s1.address = s1Base[axis];
        call.s2.type = PLSR_OPERAND_CONSTANT;
        call.s2.constant = 1;
        call.dAxis = axis;
        call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
        result = PlsrPostCall(&call);
        if (result != PLSR_RESULT_QUEUED)
        {
            return result;
        }
    }
    return PLSR_RESULT_QUEUED;
 }

 PLSR_RESULT PlsrCwCcwSelfTestQueue(void)
 {
    const uint16_t commonBase = 900U;
    const uint16_t setBase =
        (uint16_t)(commonBase + SELF_TEST_SFD_SET_OFFSET);
    PLSR_CALL call;
    PLSR_COMMAND command;
    PLSR_RESULT result;

    (void)memset(SelfTestWords, 0, sizeof(SelfTestWords));
    (void)PlcDeviceWriteSfd(commonBase, 0U);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 2U), 1UL);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 4U), 1UL);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 6U),
                            SELF_TEST_DIR_POINT);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 7U), 10U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 8U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 9U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 12U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 15U), 0xFFFFU);

    SelfTestWriteSfdDword(setBase, 2000UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 2U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 3U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 4U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 5U), 0U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 6U), 100000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 8U), 1000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 10U), 0UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 12U), 50U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 13U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 14U), 0U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 16U), 2000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 18U), 200UL);

    SelfTestWriteDword(PLSR_DEVICE_D, SELF_TEST_S0_BASE, 2U);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 10UL,
                       2000UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 12UL,
                       300UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 20UL,
                       1000UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 22UL,
                       (uint32_t)(int32_t)-200);
    SelfTestWriteDword(PLSR_DEVICE_D, SELF_TEST_S1_BASE, 0U);

    (void)memset(&command, 0, sizeof(command));
    command.sequence = 0xA900UL;
    command.axis = 0U;
    command.opcode = PLSR_CMD_SET_POSITION;
    result = PlsrPostCommand(&command);
    if (result != PLSR_RESULT_QUEUED)
    {
        return result;
    }

    (void)memset(&call, 0, sizeof(call));
    call.sequence = 0xA901UL;
    call.source.context = NULL;
    call.source.validateWords = SelfTestValidateWords;
    call.source.readWord = SelfTestReadWord;
    call.source.readBit = SelfTestReadBit;
    call.s0.device = PLSR_DEVICE_D;
    call.s0.address = SELF_TEST_S0_BASE;
    call.s1.device = PLSR_DEVICE_D;
    call.s1.address = SELF_TEST_S1_BASE;
    call.s2.type = PLSR_OPERAND_CONSTANT;
    call.s2.constant = 1;
    call.dAxis = 0U;
    call.outputModeOverride = PLSR_OUTPUT_CW_CCW;
    return PlsrPostCall(&call);
 }

 PLSR_RESULT PlsrFastRefreshSelfTestQueue(void)
 {
    static const uint16_t s0Base[2] = {10U, 40U};
    static const uint16_t s1Base[2] = {160U, 164U};
    static const uint8_t directionPoint[2] = {4U, 3U};
    PLSR_CALL call;
    PLSR_COMMAND command;
    PLSR_RESULT result;
    uint16_t commonBase;
    uint16_t setBase;
    uint8_t axis;

    (void)memset(SelfTestWords, 0, sizeof(SelfTestWords));
    for (axis = 0U; axis < 2U; axis++)
    {
        commonBase = (uint16_t)(900U
                                + (uint16_t)axis
                                      * SELF_TEST_SFD_AXIS_STRIDE);
        setBase = (uint16_t)(commonBase + SELF_TEST_SFD_SET_OFFSET);
        (void)PlcDeviceWriteSfd(commonBase, 0U);
        SelfTestWriteSfdDword((uint16_t)(commonBase + 2U), 1UL);
        SelfTestWriteSfdDword((uint16_t)(commonBase + 4U), 1UL);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 6U),
                                directionPoint[axis]);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 7U), 10U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 8U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 9U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 12U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 15U), 0xFFFFU);

        SelfTestWriteSfdDword(setBase, 5000UL);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 2U), 100U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 3U), 100U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 4U), 0U);
        /* Linear curve keeps the 1ms/0.1ms update granularity visible. */
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 5U), 0U);
        SelfTestWriteSfdDword((uint16_t)(setBase + 6U), 100000UL);
        SelfTestWriteSfdDword((uint16_t)(setBase + 8U), 100UL);
        SelfTestWriteSfdDword((uint16_t)(setBase + 10U), 100UL);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 12U), 50U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 13U), 0U);
        (void)PlcDeviceWriteSfd((uint16_t)(setBase + 14U),
                                (axis == 0U) ? 0U : 2U);
        SelfTestWriteSfdDword((uint16_t)(setBase + 16U), 2000UL);
        SelfTestWriteSfdDword((uint16_t)(setBase + 18U), 200UL);

        SelfTestWriteDword(PLSR_DEVICE_D, s0Base[axis], 1U);
        SelfTestWriteDword(PLSR_DEVICE_D,
                           (uint32_t)s0Base[axis] + 10UL,
                           5000UL);
        SelfTestWriteDword(PLSR_DEVICE_D,
                           (uint32_t)s0Base[axis] + 12UL,
                           2000UL);
        SelfTestWriteDword(PLSR_DEVICE_D, s1Base[axis], 0U);

        (void)memset(&command, 0, sizeof(command));
        command.sequence = 0xAA00UL + axis;
        command.axis = axis;
        command.opcode = PLSR_CMD_SET_POSITION;
        result = PlsrPostCommand(&command);
        if (result != PLSR_RESULT_QUEUED)
        {
            return result;
        }

        (void)memset(&call, 0, sizeof(call));
        call.sequence = 0xAA10UL + axis;
        call.source.context = NULL;
        call.source.validateWords = SelfTestValidateWords;
        call.source.readWord = SelfTestReadWord;
        call.source.readBit = SelfTestReadBit;
        call.s0.device = PLSR_DEVICE_D;
        call.s0.address = s0Base[axis];
        call.s1.device = PLSR_DEVICE_D;
        call.s1.address = s1Base[axis];
        call.s2.type = PLSR_OPERAND_CONSTANT;
        call.s2.constant = 1;
        call.dAxis = axis;
        call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
        result = PlsrPostCall(&call);
        if (result != PLSR_RESULT_QUEUED)
        {
            return result;
        }
    }
    return PLSR_RESULT_QUEUED;
 }

 PLSR_RESULT PlsrDynamicFrequencySelfTestQueue(void)
 {
    const uint16_t commonBase = 900U;
    const uint16_t setBase =
        (uint16_t)(commonBase + SELF_TEST_SFD_SET_OFFSET);
    PLSR_CALL call;
    PLSR_COMMAND command;
    PLSR_RESULT result;

    (void)memset(SelfTestWords, 0, sizeof(SelfTestWords));
    PlsrSelfTestLiveFrequencyHz = 1000;
    PlsrSelfTestDynamicTick100us = 0UL;
    PlsrSelfTestDynamicPhase = 0U;
    PlsrSelfTestDynamicEnabled = 1U;
    PlsrSetControlTickHook(PlsrSelfTestControlTick100us);
    (void)PlcDeviceWriteSfd(commonBase, 0U);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 2U), 1UL);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 4U), 1UL);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 6U), 4U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 7U), 10U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 8U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 9U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 12U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 15U), 0xFFFFU);

    /* 1000Hz default, 5000Hz maximum, 10Hz/ms slope, 0.1ms refresh. */
    SelfTestWriteSfdDword(setBase, 1000UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 2U), 100U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 3U), 100U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 4U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 5U), 0U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 6U), 5000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 8U), 1000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 10U), 0UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 12U), 50U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 13U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 14U), 2U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 16U), 2000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 18U), 200UL);

    SelfTestWriteDword(PLSR_DEVICE_D, SELF_TEST_S0_BASE, 1U);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 10UL,
                       1000UL);
    SelfTestWriteDword(PLSR_DEVICE_D,
                       SELF_TEST_S0_BASE + 12UL,
                       100000UL);
    SelfTestWriteDword(PLSR_DEVICE_D, SELF_TEST_S1_BASE, 0U);

    (void)memset(&command, 0, sizeof(command));
    command.sequence = 0xAB00UL;
    command.axis = 0U;
    command.opcode = PLSR_CMD_SET_POSITION;
    result = PlsrPostCommand(&command);
    if (result != PLSR_RESULT_QUEUED)
    {
        return result;
    }

    (void)memset(&call, 0, sizeof(call));
    call.sequence = 0xAB01UL;
    call.source.context = NULL;
    call.source.validateWords = SelfTestValidateWords;
    call.source.readWord = SelfTestReadWord;
    call.source.readDword = SelfTestReadDwordLive;
    call.source.readBit = SelfTestReadBit;
    call.s0.device = PLSR_DEVICE_D;
    call.s0.address = SELF_TEST_S0_BASE;
    call.s1.device = PLSR_DEVICE_D;
    call.s1.address = SELF_TEST_S1_BASE;
    call.s2.type = PLSR_OPERAND_CONSTANT;
    call.s2.constant = 1;
    call.dAxis = 0U;
    call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
    return PlsrPostCall(&call);
 }

 PLSR_RESULT PlsrModbusDataSelfTestQueue(void)
 {
    const uint16_t commonBase = 900U;
    const uint16_t setBase =
        (uint16_t)(commonBase + SELF_TEST_SFD_SET_OFFSET);
    uint16_t s0Words[20] = {0U};
    uint16_t s1Words[4] = {0U};
    PLSR_CALL call;
    PLSR_COMMAND command;
    PLSR_RESULT result;

    /* P12 uses D1000 as S0 and D1100 as S1.  D1010/D1011 is the live
     * current-segment frequency written atomically by Modbus function 0x10. */
    s0Words[0] = 1U;
    s0Words[10] = 1000U;
    s0Words[11] = 0U;
    s0Words[12] = (uint16_t)(100000UL & 0xFFFFUL);
    s0Words[13] = (uint16_t)(100000UL >> 16U);
    if ((ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                              SELF_TEST_MODBUS_S0_BASE,
                              s0Words,
                              20UL) == 0U)
        || (ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                                 SELF_TEST_MODBUS_S1_BASE,
                                 s1Words,
                                 4UL) == 0U))
    {
        return PLSR_RESULT_DATA_ACCESS;
    }

    (void)PlcDeviceWriteSfd(commonBase, 0U);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 2U), 1UL);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 4U), 1UL);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 6U), 4U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 7U), 10U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 8U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 9U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 12U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 15U), 0xFFFFU);

    /* Same limits as P11: 1000Hz default, 5000Hz maximum, 10Hz/ms ramp,
     * and a 0.1ms live-frequency refresh. */
    SelfTestWriteSfdDword(setBase, 1000UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 2U), 100U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 3U), 100U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 4U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 5U), 0U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 6U), 5000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 8U), 1000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 10U), 0UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 12U), 50U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 13U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 14U), 2U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 16U), 2000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 18U), 200UL);

    (void)memset(&command, 0, sizeof(command));
    command.sequence = 0xAC00UL;
    command.axis = 0U;
    command.opcode = PLSR_CMD_SET_POSITION;
    result = PlsrPostCommand(&command);
    if (result != PLSR_RESULT_QUEUED)
    {
        return result;
    }

    (void)memset(&call, 0, sizeof(call));
    call.sequence = 0xAC01UL;
    PlsrModbusDataSourceInit(&call.source);
    call.s0.device = PLSR_DEVICE_D;
    call.s0.address = SELF_TEST_MODBUS_S0_BASE;
    call.s1.device = PLSR_DEVICE_D;
    call.s1.address = SELF_TEST_MODBUS_S1_BASE;
    call.s2.type = PLSR_OPERAND_CONSTANT;
    call.s2.constant = 1;
    call.dAxis = 0U;
    call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
    return PlsrPostCall(&call);
 }

 PLSR_RESULT PlsrModbusControlSelfTestPrepare(void)
 {
    const uint16_t commonBase = 900U;
    const uint16_t setBase =
        (uint16_t)(commonBase + SELF_TEST_SFD_SET_OFFSET);

    (void)PlcDeviceWriteSfd(commonBase, 0U);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 2U), 1UL);
    SelfTestWriteSfdDword((uint16_t)(commonBase + 4U), 1UL);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 6U), 4U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 7U), 10U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 8U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 9U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 12U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(commonBase + 15U), 0xFFFFU);

    /* K1: 1000Hz default/start, 5000Hz maximum, 100ms ramps, 1ms refresh. */
    SelfTestWriteSfdDword(setBase, 1000UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 2U), 100U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 3U), 100U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 4U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 5U), 0U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 6U), 5000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 8U), 1000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 10U), 0UL);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 12U), 50U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 13U), 0U);
    (void)PlcDeviceWriteSfd((uint16_t)(setBase + 14U), 0U);
    SelfTestWriteSfdDword((uint16_t)(setBase + 16U), 2000UL);
    SelfTestWriteSfdDword((uint16_t)(setBase + 18U), 200UL);
    return PLSR_RESULT_OK;
 }
--- a/PLSR/Test/run_host_tests.ps1
+++ b/PLSR/Test/run_host_tests.ps1
@@ -96,8 +96,19 @@ $tests = @(
            "$workspacePath\PLSR\Src\plsr_hal_f407.c"
            "$workspacePath\PLSR\Src\plsr_core.c"
            "$workspacePath\PLSR\Src\plsr_self_test.c"
            "$workspacePath\PLSR\Src\plsr_modbus_data.c"
            "$workspacePath\PLSR\Src\plsr_modbus_control.c"
            "$workspacePath\Modbus\Src\modbus_data_store.c"
            "$workspacePath\PLSR\Test\test_plsr_hal.c"
        )
    },
    @{
        Name = 'test_plsr_modbus_data'
        Sources = @(
            "$workspacePath\Modbus\Src\modbus_data_store.c"
            "$workspacePath\PLSR\Src\plsr_modbus_data.c"
            "$workspacePath\PLSR\Test\test_plsr_modbus_data.c"
        )
    }
 )

@@ -111,6 +122,7 @@ foreach ($test in $tests)
        '-Werror'
        '-DPLSR_HOST_TEST'
        "-I$workspacePath\PLSR\Inc"
        "-I$workspacePath\Modbus\Inc"
    ) + $test.Sources + @('-o', $outputPath, '-lm')

    try
--- a/PLSR/Test/test_plsr_hal.c
+++ b/PLSR/Test/test_plsr_hal.c
@@ -1,7 +1,9 @@
 #include "plc_device.h"
 #include "modbus_data_store.h"
 #include "plsr_core.h"
 #include "plsr_hal_f407.h"
 #include "plsr_job.h"
 #include "plsr_modbus_control.h"
 #include "plsr_persistence.h"
 #include "plsr_resource.h"
 #include "plsr_self_test.h"
@@ -254,6 +256,267 @@ static void TestDirDelaySequence(void)
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_DIR_SETTLING);
    CHECK(PlsrHwTestGetDirLevel(0U) == 0U);

    /* Bit1 negative logic reverses only the electrical DIR terminal. */
    params.directionNegativeLogic = 1U;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_DIR_SETTLING);
    CHECK(PlsrHwTestGetDirLevel(0U) == 1U);
    params.directionPositive = 1U;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwTestGetDirLevel(0U) == 0U);
 }

 static void TestDirectionBatch(void)
 {
    PLSR_HW_START_PARAMS params;

    (void)PlsrHwInit();
    (void)memset(&params, 0, sizeof(params));
    params.frequencyHz = 0UL;
    params.targetPulses = 10;
    params.outputMode = PLSR_OUTPUT_PULSE_DIR;
    params.directionPoint = 4U;
    params.directionPositive = 1U;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    params.directionPoint = 3U;
    params.directionNegativeLogic = 1U;
    CHECK(PlsrHwStartPulse(1U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwTestGetDirLevel(0U) == 1U);
    CHECK(PlsrHwTestGetDirLevel(1U) == 0U);

    PlsrHwBeginDirectionBatch();
    params.directionPoint = 4U;
    params.directionPositive = 0U;
    params.directionNegativeLogic = 0U;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    params.directionPoint = 3U;
    params.directionNegativeLogic = 1U;
    CHECK(PlsrHwStartPulse(1U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwTestGetDirLevel(0U) == 1U);
    CHECK(PlsrHwTestGetDirLevel(1U) == 0U);
    PlsrHwEndDirectionBatch();
    CHECK(PlsrHwTestGetDirLevel(0U) == 0U);
    CHECK(PlsrHwTestGetDirLevel(1U) == 1U);
 }

 static void TestCwCcwSequence(void)
 {
    PLSR_HW_START_PARAMS params;
    uint16_t psc;
    uint16_t arr;

    (void)PlsrHwInit();
    (void)memset(&params, 0, sizeof(params));
    params.frequencyHz = 2000UL;
    params.targetPulses = 3;
    params.outputMode = PLSR_OUTPUT_CW_CCW;
    params.directionPoint = PLSR_HW_DIR_POINT_NONE;
    params.directionPositive = 1U;
    params.directionDelayMs = 10U;

    CHECK(PlsrHwStartPulse(1U, &params) == PLSR_RESULT_INVALID_AXIS);
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_PWM_PENDING);
    CHECK(PlsrHwSetFrequency(0U, 2000UL) == PLSR_RESULT_OK);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 1U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 0U);
    PlsrHwTestTriggerCompare(1U);
    CHECK(PlsrHwGetEmittedPulses(0U) == 0);
    PlsrHwTestTriggerCompare(0U);
    PlsrHwTestTriggerCompare(0U);
    PlsrHwTestTriggerCompare(0U);
    CHECK(PlsrHwGetEmittedPulses(0U) == 3);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_RUNNING);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 1U);
    PlsrHwTestTriggerUpdate(0U);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_DONE);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 0U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 0U);

    params.frequencyHz = 1000UL;
    params.targetPulses = 2;
    params.directionPositive = 0U;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_OK);
    CHECK(PlsrHwSetFrequency(0U, 1000UL) == PLSR_RESULT_OK);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 0U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 1U);
    CHECK(PlsrCalculateTimerDivider(84000000UL, 1000UL, &psc, &arr)
          == PLSR_RESULT_OK);
    CHECK(PlsrHwTestGetPsc(1U) == psc);
    CHECK(PlsrHwTestGetArr(1U) == arr);
    PlsrHwTestTriggerCompare(1U);
    PlsrHwTestTriggerCompare(1U);
    CHECK(PlsrHwGetEmittedPulses(0U) == 2);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_RUNNING);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 1U);
    PlsrHwTestTriggerUpdate(1U);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_DONE);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 0U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 0U);
 }

 static void TestFastRefreshControlTick(void)
 {
    TEST_MEMORY memory;
    PLSR_CALL call;
    PLSR_STATUS status;
    int tick;

    TestResetEnvironment();
    (void)memset(&memory, 0, sizeof(memory));
    CHECK(PlcDeviceWriteSfd(900U, 0U) == PLC_DEVICE_OK);
    TestWriteSfdDword(902U, 1UL);
    TestWriteSfdDword(904U, 1UL);
    CHECK(PlcDeviceWriteSfd(906U, 4U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(907U, 0U) == PLC_DEVICE_OK);
    TestWriteSfdDword(950U, 1000UL);
    CHECK(PlcDeviceWriteSfd(952U, 100U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(953U, 100U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(954U, 0U) == PLC_DEVICE_OK);
    /* Linear curve: 10Hz/ms becomes exactly 1Hz per 0.1ms tick. */
    CHECK(PlcDeviceWriteSfd(955U, 0U) == PLC_DEVICE_OK);
    TestWriteSfdDword(956U, 100000UL);
    TestWriteSfdDword(958U, 0UL);
    TestWriteSfdDword(960U, 0UL);
    CHECK(PlcDeviceWriteSfd(962U, 50U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(963U, 0U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(964U, 2U) == PLC_DEVICE_OK);
    TestWriteSfdDword(966U, 2000UL);
    TestWriteSfdDword(968U, 200UL);

    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE, 1);
    TestSetSegment(&memory, 1U, 1000U, 10000);
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S1_BASE, 0);
    call = TestMakeCall(&memory);
    call.sequence = 0xB000UL;
    call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
    CHECK(PlsrPostCall(&call) == PLSR_RESULT_QUEUED);
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.state == PLSR_STATE_ACCEL);
    CHECK(status.jobValid != 0U);
    CHECK(PlsrTestGetJobRefreshCode(0U) == 2U);
    CHECK(PlsrTestGetProfileRefreshHz(0U) == 10000UL);
    CHECK(PlsrTestGetProfileActive(0U) != 0U);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_PWM_PENDING);
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) == 0UL);

    /* A normal 1ms process pass must not advance a 0.1ms profile. */
    PlsrProcess();
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) == 0UL);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_PWM_PENDING);
    CHECK(PlsrTestGetJobRefreshCode(0U) == 2U);
    CHECK(PlsrTestGetProfileActive(0U) != 0U);
    PlsrControlTick100us();
    CHECK(PlsrTestGetProfileFrequencyHz(0U) == 1UL);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_RUNNING);
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) > 0UL);
    for (tick = 1; tick < 10; tick++)
    {
        PlsrControlTick100us();
    }
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) == 10UL);
    PlsrProcess();
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) == 10UL);
    for (tick = 0; tick < 10; tick++)
    {
        PlsrControlTick100us();
    }
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) == 20UL);
 }

 static void TestDynamicFrequencyRetarget(void)
 {
    TEST_MEMORY memory;
    PLSR_CALL call;
    PLSR_STATUS status;

    TestResetEnvironment();
    (void)memset(&memory, 0, sizeof(memory));
    CHECK(PlcDeviceWriteSfd(900U, 0U) == PLC_DEVICE_OK);
    TestWriteSfdDword(902U, 1UL);
    TestWriteSfdDword(904U, 1UL);
    CHECK(PlcDeviceWriteSfd(906U, 4U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(907U, 0U) == PLC_DEVICE_OK);
    TestWriteSfdDword(950U, 1000UL);
    CHECK(PlcDeviceWriteSfd(952U, 100U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(953U, 100U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(954U, 0U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(955U, 0U) == PLC_DEVICE_OK);
    TestWriteSfdDword(956U, 5000UL);
    TestWriteSfdDword(958U, 1000UL);
    TestWriteSfdDword(960U, 0UL);
    CHECK(PlcDeviceWriteSfd(962U, 50U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(963U, 0U) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(964U, 2U) == PLC_DEVICE_OK);
    TestWriteSfdDword(966U, 2000UL);
    TestWriteSfdDword(968U, 200UL);

    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE, 1);
    TestSetSegment(&memory, 1U, 1000U, 100000);
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S1_BASE, 0);
    call = TestMakeCall(&memory);
    call.sequence = 0xB100UL;
    call.outputModeOverride = PLSR_OUTPUT_PULSE_DIR;
    CHECK(PlsrPostCall(&call) == PLSR_RESULT_QUEUED);
    PlsrProcess();
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.currentFrequencyHz == 1000UL);
    CHECK(status.targetFrequencyHz == 1000UL);

    /* Only the 100us control tick may observe/apply a refreshCode=2 edit. */
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE + 10U, 4000);
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 1000UL);
    CHECK(status.currentFrequencyHz == 1000UL);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 4000UL);
    CHECK(status.currentFrequencyHz == 1001UL);
    PlsrControlTick100us();
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) == 1002UL);

    /* Down-retarget follows the configured slope instead of jumping. */
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE + 10U, 500);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 500UL);
    CHECK(status.currentFrequencyHz == 1001UL);

    /* Raw zero means the immutable S2 default speed. */
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE + 10U, 0);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 1000UL);
    CHECK(status.currentFrequencyHz == 1000UL);

    /* Above-maximum values clamp; invalid negatives retain the last safe
     * target and produce one sticky rejection for that observed value. */
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE + 10U, 8000);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 5000UL);
    CHECK(status.currentFrequencyHz == 1001UL);
    CHECK(status.speedClamped != 0U);
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE + 10U, -1);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 5000UL);
    CHECK(status.currentFrequencyHz == 1002UL);
    CHECK(status.lastLiveFrequencyResult == PLSR_RESULT_INVALID_FREQUENCY);
    CHECK(status.liveFrequencyRejectCount == 1UL);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.liveFrequencyRejectCount == 1UL);
    TestWriteDword(&memory, PLSR_DEVICE_D, TEST_S0_BASE + 10U, 2000);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 2000UL);
    CHECK(status.currentFrequencyHz == 1004UL);
    CHECK(status.lastLiveFrequencyResult == PLSR_RESULT_OK);
 }

 static void TestZeroFrequencyWaits(void)
@@ -562,7 +825,7 @@ static void TestStopAndInvalidArgs(void)
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_INVALID_ARGUMENT);
    params.targetPulses = 1;
    params.outputMode = PLSR_OUTPUT_CW_CCW;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_NOT_SUPPORTED);
    CHECK(PlsrHwStartPulse(1U, &params) == PLSR_RESULT_INVALID_AXIS);
    params.outputMode = (PLSR_OUTPUT_MODE)99;
    CHECK(PlsrHwStartPulse(0U, &params) == PLSR_RESULT_INVALID_ARGUMENT);
    CHECK(PlsrHwSetFrequency(4U, 1000UL) == PLSR_RESULT_INVALID_ARGUMENT);
@@ -1332,6 +1595,647 @@ static void TestFourAxisSelfTest(void)
    CHECK(PlsrResourceCheckInvariant() != 0U);
 }

 static void TestBacklashSelfTest(void)
 {
    PLC_DEVICE_EVENT_RECORD eventRecord;
    PLSR_STATUS status;
    int32_t hsdPosition;
    int ticks;

    TestResetEnvironment();
    CHECK(PlsrBacklashSelfTestQueue() == PLSR_RESULT_QUEUED);
    PlsrProcess();
    for (ticks = 0; ticks < 10; ticks++)
    {
        PlsrProcess();
    }

    /* Segment 1: +200 user pulses, with no compensation on first motion. */
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_RUNNING);
    for (ticks = 0; ticks < 200; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
    }
    PlsrProcess();
    status = TestGetStatus();
    CHECK(status.currentSegment == 2U);
    CHECK(status.backlashActive != 0U);
    CHECK(status.directionPositive == 0U);
    CHECK(status.logicalPosition == 200);
    CHECK(status.taskPulses == 200);
    CHECK(status.totalPulses == 200);
    CHECK(status.physicalPulses == 200UL);
    CHECK(PlcDeviceReadEvent(6000U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 1UL);
    CHECK(PlcDeviceReadEvent(6001U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 0UL);

    /* Direction change to negative: 20 physical compensation pulses first. */
    for (ticks = 0; ticks < 10; ticks++)
    {
        PlsrProcess();
    }
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_RUNNING);
    for (ticks = 0; ticks < 20; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
    }
    PlsrProcess();
    status = TestGetStatus();
    CHECK(status.backlashActive == 0U);
    CHECK(status.currentSegment == 2U);
    CHECK(status.logicalPosition == 200);
    CHECK(status.taskPulses == 200);
    CHECK(status.totalPulses == 200);
    CHECK(status.physicalPulses == 220UL);
    CHECK(PlcDeviceReadEvent(6001U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 0UL);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_RUNNING);

    /* The real segment 2 contributes -200 to user position/counting. */
    for (ticks = 0; ticks < 200; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
    }
    PlsrProcess();
    status = TestGetStatus();
    CHECK(status.currentSegment == 3U);
    CHECK(status.backlashActive != 0U);
    CHECK(status.directionPositive != 0U);
    CHECK(status.logicalPosition == 0);
    CHECK(status.taskPulses == 0);
    CHECK(status.totalPulses == 400);
    CHECK(status.physicalPulses == 420UL);
    CHECK(PlcDeviceReadEvent(6001U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 1UL);
    CHECK(PlcDeviceReadEvent(6002U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 0UL);

    /* Direction change back to positive: 10 compensation, then +100 user. */
    for (ticks = 0; ticks < 10; ticks++)
    {
        PlsrProcess();
    }
    for (ticks = 0; ticks < 10; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
    }
    PlsrProcess();
    status = TestGetStatus();
    CHECK(status.backlashActive == 0U);
    CHECK(status.logicalPosition == 0);
    CHECK(status.totalPulses == 400);
    CHECK(status.physicalPulses == 430UL);
    CHECK(PlcDeviceReadEvent(6002U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 0UL);

    for (ticks = 0; ticks < 100; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
    }
    PlsrProcess();
    status = TestGetStatus();
    CHECK(status.state == PLSR_STATE_COMPLETED);
    CHECK(status.done != 0U);
    CHECK(status.logicalPosition == 100);
    CHECK(status.taskPulses == 100);
    CHECK(status.totalPulses == 500);
    CHECK(status.physicalPulses == 530UL);
    CHECK(PlcDeviceReadHsdDword(0U, &hsdPosition) == PLC_DEVICE_OK);
    CHECK(hsdPosition == 100);
    CHECK(PlcDeviceReadEvent(6002U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 1UL);
    CHECK(eventRecord.lastReason == PLSR_STOP_REASON_NORMAL_COMPLETE);
 }

 static void TestDirectionLogicSelfTest(void)
 {
    static const uint8_t expectedDirectionPoint[2] = {4U, 3U};
    PLC_DEVICE_EVENT_RECORD eventRecord;
    PLSR_STATUS status;
    uint8_t smDirection;
    uint8_t axis;
    int ticks;

    TestResetEnvironment();
    CHECK(PlsrDirectionLogicSelfTestQueue() == PLSR_RESULT_QUEUED);
    PlsrProcess();
    for (ticks = 0; ticks < 10; ticks++)
    {
        PlsrProcess();
    }

    /* Both axes move logically positive.  Electrical DIR terminals are
     * complementary because axis 1 has SFD1030 Bit1 set. */
    CHECK(PlsrHwTestGetDirLevel(0U) == 1U);
    CHECK(PlsrHwTestGetDirLevel(1U) == 0U);
    for (axis = 0U; axis < 2U; axis++)
    {
        CHECK(PlsrGetStatus(axis, &status) == PLSR_RESULT_OK);
        CHECK(status.state == PLSR_STATE_RUN);
        CHECK(status.directionPoint == expectedDirectionPoint[axis]);
        CHECK(status.directionPositive != 0U);
        CHECK(PlsrHwGetState(axis) == PLSR_HW_STATE_RUNNING);
    }

    for (ticks = 0; ticks < 200; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
        PlsrHwTestTriggerUpdate(1U);
    }
    PlsrProcess();

    /* Both reverse logically; only the physical terminal mapping differs. */
    CHECK(PlsrHwTestGetDirLevel(0U) == 0U);
    CHECK(PlsrHwTestGetDirLevel(1U) == 1U);
    for (axis = 0U; axis < 2U; axis++)
    {
        CHECK(PlsrGetStatus(axis, &status) == PLSR_RESULT_OK);
        CHECK(status.currentSegment == 2U);
        CHECK(status.directionPositive == 0U);
        CHECK(status.logicalPosition == 200);
        CHECK(status.totalPulses == 200);
        CHECK(PlsrHwGetState(axis) == PLSR_HW_STATE_DIR_SETTLING);
    }

    for (ticks = 0; ticks < 10; ticks++)
    {
        PlsrProcess();
    }
    for (ticks = 0; ticks < 200; ticks++)
    {
        PlsrHwTestTriggerUpdate(0U);
        PlsrHwTestTriggerUpdate(1U);
    }
    PlsrProcess();

    for (axis = 0U; axis < 2U; axis++)
    {
        CHECK(PlsrGetStatus(axis, &status) == PLSR_RESULT_OK);
        CHECK(status.state == PLSR_STATE_COMPLETED);
        CHECK(status.done != 0U);
        CHECK(status.directionPositive == 0U);
        CHECK(status.logicalPosition == 0);
        CHECK(status.taskPulses == 0);
        CHECK(status.totalPulses == 400);
        CHECK(status.physicalPulses == 400UL);
        CHECK(PlcDeviceReadSm((uint16_t)(1001U
                                         + (uint16_t)axis * 20U),
                              &smDirection) == PLC_DEVICE_OK);
        CHECK(smDirection == 0U);
        CHECK(PlcDeviceReadEvent((uint16_t)(6000U
                                            + (uint16_t)axis * 100U),
                                 &eventRecord) == PLC_DEVICE_OK);
        CHECK(eventRecord.count == 1UL);
        CHECK(PlcDeviceReadEvent((uint16_t)(6001U
                                            + (uint16_t)axis * 100U),
                                 &eventRecord) == PLC_DEVICE_OK);
        CHECK(eventRecord.count == 1UL);
    }
    CHECK(PlsrHwTestGetDirLevel(0U) == 0U);
    CHECK(PlsrHwTestGetDirLevel(1U) == 1U);
 }

 static void TestCwCcwSelfTest(void)
 {
    PLC_DEVICE_EVENT_RECORD eventRecord;
    PLSR_STATUS status;
    int pulse;

    TestResetEnvironment();
    CHECK(PlsrCwCcwSelfTestQueue() == PLSR_RESULT_QUEUED);
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.state == PLSR_STATE_RUN);
    CHECK(status.outputMode == PLSR_OUTPUT_CW_CCW);
    CHECK(status.directionPositive != 0U);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 1U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 0U);

    for (pulse = 0; pulse < 300; pulse++)
    {
        PlsrHwTestTriggerCompare(0U);
    }
    PlsrHwTestTriggerUpdate(0U);
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.currentSegment == 2U);
    CHECK(status.directionPositive == 0U);
    CHECK(status.logicalPosition == 300);
    CHECK(status.totalPulses == 300);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 0U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 1U);

    for (pulse = 0; pulse < 200; pulse++)
    {
        PlsrHwTestTriggerCompare(1U);
    }
    PlsrHwTestTriggerUpdate(1U);
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.state == PLSR_STATE_COMPLETED);
    CHECK(status.done != 0U);
    CHECK(status.logicalPosition == 100);
    CHECK(status.taskPulses == 100);
    CHECK(status.totalPulses == 500);
    CHECK(status.physicalPulses == 500UL);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 0U);
    CHECK(PlsrHwTestGetPwmEnabled(1U) == 0U);
    CHECK(PlcDeviceReadEvent(6000U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 1UL);
    CHECK(PlcDeviceReadEvent(6001U, &eventRecord) == PLC_DEVICE_OK);
    CHECK(eventRecord.count == 1UL);
 }

 static void TestFastRefreshSelfTest(void)
 {
    PLSR_STATUS status;
    uint32_t beforeFastHz;
    uint16_t refreshCode;
    int tick;

    TestResetEnvironment();
    CHECK(PlsrFastRefreshSelfTestQueue() == PLSR_RESULT_QUEUED);
    PlsrProcess();
    for (tick = 0; tick < 10; tick++)
    {
        PlsrProcess();
    }
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.state == PLSR_STATE_ACCEL);
    CHECK(status.directionPoint == 4U);
    CHECK(PlsrHwGetCurrentFrequencyHz(0U) > 0UL);
    CHECK(PlsrGetStatus(1U, &status) == PLSR_RESULT_OK);
    CHECK(status.state == PLSR_STATE_ACCEL);
    CHECK(status.directionPoint == 3U);
    CHECK(PlsrTestGetJobRefreshCode(1U) == 2U);
    CHECK(PlsrTestGetProfileRefreshHz(1U) == 10000UL);
    beforeFastHz = PlsrTestGetProfileFrequencyHz(1U);
    PlsrControlTick100us();
    CHECK(PlsrTestGetProfileFrequencyHz(1U) > beforeFastHz);
    CHECK(PlcDeviceReadSfd(964U, &refreshCode) == PLC_DEVICE_OK);
    CHECK(refreshCode == 0U);
    CHECK(PlcDeviceReadSfd(1094U, &refreshCode) == PLC_DEVICE_OK);
    CHECK(refreshCode == 2U);
 }

 static void TestDynamicFrequencySelfTest(void)
 {
    PLSR_STATUS status;
    int tick;

    TestResetEnvironment();
    CHECK(PlsrDynamicFrequencySelfTestQueue() == PLSR_RESULT_QUEUED);
    PlsrProcess();
    for (tick = 0; tick < 10; tick++)
    {
        PlsrProcess();
    }
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.currentFrequencyHz == 1000UL);
    CHECK(status.targetFrequencyHz == 1000UL);

    PlsrSelfTestLiveFrequencyHz = 4000;
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.currentFrequencyHz == 1001UL);
    CHECK(status.targetFrequencyHz == 4000UL);

    PlsrSelfTestLiveFrequencyHz = 500;
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.currentFrequencyHz == 1000UL);
    CHECK(status.targetFrequencyHz == 500UL);
    CHECK(status.liveFrequencyRejectCount == 0UL);
 }

 static void TestDynamicFrequencySchedule(void)
 {
    int tick;

    TestResetEnvironment();
    CHECK(PlsrDynamicFrequencySelfTestQueue() == PLSR_RESULT_QUEUED);
    CHECK(PlsrSelfTestLiveFrequencyHz == 1000);
    CHECK(PlsrSelfTestDynamicPhase == 0U);
    for (tick = 0; tick < 9999; tick++)
    {
        PlsrSelfTestControlTick100us();
    }
    CHECK(PlsrSelfTestLiveFrequencyHz == 1000);
    PlsrSelfTestControlTick100us();
    CHECK(PlsrSelfTestLiveFrequencyHz == 4000);
    CHECK(PlsrSelfTestDynamicPhase == 1U);
    for (tick = 0; tick < 5000; tick++)
    {
        PlsrSelfTestControlTick100us();
    }
    CHECK(PlsrSelfTestLiveFrequencyHz == 500);
    CHECK(PlsrSelfTestDynamicPhase == 2U);
    for (tick = 0; tick < 5000; tick++)
    {
        PlsrSelfTestControlTick100us();
    }
    CHECK(PlsrSelfTestLiveFrequencyHz == 0);
    CHECK(PlsrSelfTestDynamicPhase == 3U);
    for (tick = 0; tick < 2000; tick++)
    {
        PlsrSelfTestControlTick100us();
    }
    CHECK(PlsrSelfTestLiveFrequencyHz == 8000);
    CHECK(PlsrSelfTestDynamicPhase == 4U);
    for (tick = 0; tick < 5000; tick++)
    {
        PlsrSelfTestControlTick100us();
    }
    CHECK(PlsrSelfTestLiveFrequencyHz == -1);
    CHECK(PlsrSelfTestDynamicPhase == 5U);
    for (tick = 0; tick < 2000; tick++)
    {
        PlsrSelfTestControlTick100us();
    }
    CHECK(PlsrSelfTestLiveFrequencyHz == 2000);
    CHECK(PlsrSelfTestDynamicPhase == 6U);
    CHECK(PlsrSelfTestDynamicTick100us == 29000UL);
    PlsrSelfTestControlTick100us();
    CHECK(PlsrSelfTestDynamicTick100us == 29000UL);
 }

 static void TestModbusDataSelfTest(void)
 {
    PLSR_STATUS status;
    uint16_t frequencyWords[2];
    uint16_t word;
    int tick;

    TestResetEnvironment();
    CHECK(PlsrModbusDataSelfTestQueue() == PLSR_RESULT_QUEUED);
    PlsrProcess();
    for (tick = 0; tick < 10; tick++)
    {
        PlsrProcess();
    }
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D, 1000UL, &word) == 1U);
    CHECK(word == 1U);
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK((status.state == PLSR_STATE_ACCEL) || (status.state == PLSR_STATE_RUN));
    CHECK(PlsrHwIsPulseActive(0U) == 1U);
    CHECK(status.currentFrequencyHz == 1000UL);
    CHECK(status.targetFrequencyHz == 1000UL);

    frequencyWords[0] = 4000U;
    frequencyWords[1] = 0U;
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               1010UL,
                               frequencyWords,
                               2UL) == 1U);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.currentFrequencyHz == 1001UL);
    CHECK(status.targetFrequencyHz == 4000UL);
    CHECK(status.liveFrequencyRejectCount == 0UL);

    frequencyWords[0] = 0xFFFFU;
    frequencyWords[1] = 0xFFFFU;
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               1010UL,
                               frequencyWords,
                               2UL) == 1U);
    PlsrControlTick100us();
    CHECK(PlsrGetStatus(0U, &status) == PLSR_RESULT_OK);
    CHECK(status.targetFrequencyHz == 4000UL);
    CHECK(status.liveFrequencyRejectCount == 1UL);
    CHECK(status.lastLiveFrequencyResult == PLSR_RESULT_INVALID_FREQUENCY);
 }

 static void TestModbusControlProtocol(void)
 {
    const uint32_t controlBase = 1200UL;
    const uint32_t s0Base = 1600UL;
    const uint32_t s1Base = 1700UL;
    uint16_t s0Words[20] = {0U};
    uint16_t s1Words[4] = {0U};
    uint16_t callRequest[16] = {0U};
    uint16_t callResponse[12];
    uint16_t commandRequest[8] = {0U};
    uint16_t commandResponse[8];
    uint16_t axisStatus[48];
    uint16_t pulseWords[2];
    uint32_t generationBegin;
    uint32_t generationEnd;
    PLSR_STATUS coreStatus;
    int64_t pausedPulses;
    int tick;

    TestResetEnvironment();
    CHECK(PlsrModbusControlSelfTestPrepare() == PLSR_RESULT_OK);
    CHECK(PlsrModbusControlInit((uint16_t)controlBase) == PLSR_RESULT_OK);
    CHECK(PlsrModbusControlIsEnabled() == 1U);
    CHECK(PlsrModbusControlGetBaseAddress() == controlBase);

    s0Words[0] = 1U;
    s0Words[10] = 2000U;
    s0Words[12] = (uint16_t)(50000UL & 0xFFFFUL);
    s0Words[13] = (uint16_t)(50000UL >> 16U);
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               s0Base,
                               s0Words,
                               20UL) == 1U);
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               s1Base,
                               s1Words,
                               4UL) == 1U);

    callRequest[0] = 1U;
    callRequest[2] = PLSR_DEVICE_D;
    callRequest[3] = (uint16_t)s0Base;
    callRequest[5] = PLSR_DEVICE_D;
    callRequest[6] = (uint16_t)s1Base;
    callRequest[8] = PLSR_OPERAND_CONSTANT;
    callRequest[10] = 1U;
    callRequest[12] = 0U;
    callRequest[13] = PLSR_OUTPUT_PULSE_DIR;
    callRequest[14] = PLSR_MODBUS_CALL_COMMIT;
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               controlBase + PLSR_MODBUS_CALL_REQUEST_OFFSET,
                               callRequest,
                               16UL) == 1U);
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_CALL_RESPONSE_OFFSET,
                             &callResponse[0]) == 1U);
    for (tick = 1; tick < 12; tick++)
    {
        CHECK(ModbusDataReadWord(
                  MODBUS_DATA_DEVICE_D,
                  controlBase + PLSR_MODBUS_CALL_RESPONSE_OFFSET
                      + (uint32_t)tick,
                  &callResponse[tick]) == 1U);
    }
    CHECK(callResponse[0] == 1U);
    CHECK(callResponse[2] == PLSR_MODBUS_CALL_COMMIT);
    CHECK(callResponse[3] == PLSR_RESULT_OK);
    CHECK(callResponse[11] == 1U);

    /* Any S0 edit after COMMIT invalidates START until a new COMMIT. */
    pulseWords[0] = (uint16_t)(50001UL & 0xFFFFUL);
    pulseWords[1] = (uint16_t)(50001UL >> 16U);
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               s0Base + 12UL,
                               pulseWords,
                               2UL) == 1U);
    callRequest[0] = 2U;
    callRequest[14] = PLSR_MODBUS_CALL_START;
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               controlBase + PLSR_MODBUS_CALL_REQUEST_OFFSET,
                               callRequest,
                               16UL) == 1U);
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_CALL_RESPONSE_OFFSET
                                 + 3UL,
                             &callResponse[3]) == 1U);
    CHECK(callResponse[3] == PLSR_RESULT_BUSY);

    pulseWords[0] = (uint16_t)(50000UL & 0xFFFFUL);
    pulseWords[1] = (uint16_t)(50000UL >> 16U);
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               s0Base + 12UL,
                               pulseWords,
                               2UL) == 1U);
    callRequest[0] = 3U;
    callRequest[14] = PLSR_MODBUS_CALL_COMMIT;
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               controlBase + PLSR_MODBUS_CALL_REQUEST_OFFSET,
                               callRequest,
                               16UL) == 1U);
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_CALL_RESPONSE_OFFSET
                                 + 3UL,
                             &callResponse[3]) == 1U);
    CHECK(callResponse[3] == PLSR_RESULT_OK);

    callRequest[0] = 4U;
    callRequest[14] = PLSR_MODBUS_CALL_START;
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D,
                               controlBase + PLSR_MODBUS_CALL_REQUEST_OFFSET,
                               callRequest,
                               16UL) == 1U);
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_CALL_RESPONSE_OFFSET
                                 + 3UL,
                             &callResponse[3]) == 1U);
    CHECK(callResponse[3] == PLSR_RESULT_QUEUED);
    for (tick = 0; tick < 10; tick++)
    {
        PlsrProcess();
    }
    PlsrModbusControlPoll();
    for (tick = 0; tick < 48; tick++)
    {
        CHECK(ModbusDataReadWord(
                  MODBUS_DATA_DEVICE_D,
                  controlBase + PLSR_MODBUS_AXIS_STATUS_OFFSET
                      + (uint32_t)tick,
                  &axisStatus[tick]) == 1U);
    }
    generationBegin = (uint32_t)axisStatus[0]
                      | ((uint32_t)axisStatus[1] << 16U);
    generationEnd = (uint32_t)axisStatus[46]
                    | ((uint32_t)axisStatus[47] << 16U);
    CHECK(generationBegin == generationEnd);
    CHECK((generationBegin & 1UL) == 0UL);
    CHECK((axisStatus[2] == PLSR_STATE_ACCEL)
          || (axisStatus[2] == PLSR_STATE_RUN));
    CHECK(axisStatus[10] == 4U);
    CHECK(axisStatus[11] == 0U);
    CHECK(axisStatus[8] == PLSR_RESULT_OK);

    commandRequest[0] = 10U;
    commandRequest[2] = PLSR_CMD_PAUSE;
    commandRequest[3] = 0U;
    CHECK(ModbusDataWriteWords(
              MODBUS_DATA_DEVICE_D,
              controlBase + PLSR_MODBUS_COMMAND_REQUEST_OFFSET,
              commandRequest,
              8UL) == 1U);
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_COMMAND_RESPONSE_OFFSET
                                 + 4UL,
                             &commandResponse[4]) == 1U);
    CHECK(commandResponse[4] == PLSR_RESULT_QUEUED);
    for (tick = 0; tick < 400; tick++)
    {
        PlsrProcess();
        CHECK(PlsrGetStatus(0U, &coreStatus) == PLSR_RESULT_OK);
        if (coreStatus.state == PLSR_STATE_PAUSED)
        {
            break;
        }
    }
    CHECK(coreStatus.state == PLSR_STATE_PAUSED);
    CHECK(coreStatus.currentFrequencyHz == 0UL);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 0U);
    pausedPulses = coreStatus.taskPulses;
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_AXIS_STATUS_OFFSET + 2UL,
                             &axisStatus[2]) == 1U);
    CHECK(axisStatus[2] == PLSR_STATE_PAUSED);

    /* Polling an unchanged request sequence must not execute PAUSE twice. */
    PlsrModbusControlPoll();
    commandRequest[0] = 11U;
    commandRequest[2] = PLSR_CMD_RESUME;
    CHECK(ModbusDataWriteWords(
              MODBUS_DATA_DEVICE_D,
              controlBase + PLSR_MODBUS_COMMAND_REQUEST_OFFSET,
              commandRequest,
              8UL) == 1U);
    PlsrModbusControlPoll();
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &coreStatus) == PLSR_RESULT_OK);
    CHECK(coreStatus.currentFrequencyHz > 0UL);
    CHECK(PlsrHwTestGetPwmEnabled(0U) == 1U);
    for (tick = 0; tick < 10; tick++)
    {
        PlsrHwTestTriggerUpdate(0U);
    }
    PlsrProcess();
    CHECK(PlsrGetStatus(0U, &coreStatus) == PLSR_RESULT_OK);
    CHECK(coreStatus.taskPulses == pausedPulses + 10);
    PlsrModbusControlPoll();
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D,
                             controlBase + PLSR_MODBUS_AXIS_STATUS_OFFSET + 2UL,
                             &axisStatus[2]) == 1U);
    CHECK((axisStatus[2] == PLSR_STATE_ACCEL)
          || (axisStatus[2] == PLSR_STATE_RUN));

    commandRequest[0] = 12U;
    commandRequest[2] = PLSR_CMD_STOP_DECEL;
    CHECK(ModbusDataWriteWords(
              MODBUS_DATA_DEVICE_D,
              controlBase + PLSR_MODBUS_COMMAND_REQUEST_OFFSET,
              commandRequest,
              8UL) == 1U);
    PlsrModbusControlPoll();
    for (tick = 0; tick < 400; tick++)
    {
        PlsrProcess();
        CHECK(PlsrGetStatus(0U, &coreStatus) == PLSR_RESULT_OK);
        if (coreStatus.state == PLSR_STATE_STOPPED)
        {
            break;
        }
    }
    CHECK(coreStatus.state == PLSR_STATE_STOPPED);
    CHECK(coreStatus.currentFrequencyHz == 0UL);
    CHECK(PlsrHwGetState(0U) == PLSR_HW_STATE_IDLE);
 }

 static void TestStopStopsHardware(void)
 {
    TEST_MEMORY memory;
@@ -1376,6 +2280,10 @@ int main(void)
 {
    TestMapping();
    TestDirDelaySequence();
    TestDirectionBatch();
    TestCwCcwSequence();
    TestFastRefreshControlTick();
    TestDynamicFrequencyRetarget();
    TestZeroFrequencyWaits();
    TestPulseCounting();
    TestAbPhaseAndCounting();
@@ -1394,6 +2302,14 @@ int main(void)
    TestEquivalentSelfTest();
    TestProtectionSelfTest();
    TestFourAxisSelfTest();
    TestBacklashSelfTest();
    TestDirectionLogicSelfTest();
    TestCwCcwSelfTest();
    TestFastRefreshSelfTest();
    TestDynamicFrequencySelfTest();
    TestDynamicFrequencySchedule();
    TestModbusDataSelfTest();
    TestModbusControlProtocol();
    TestStopStopsHardware();

    if (TestFailures != 0)
--- a/PLSR/Test/test_plsr_job.c
+++ b/PLSR/Test/test_plsr_job.c
@@ -102,6 +102,8 @@ static void TestConfigureAxis0K1(void)
    CHECK(PlcDeviceWriteSfd(900U, 0) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(906U, 4) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(907U, 10) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(908U, 17) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(909U, 23) == PLC_DEVICE_OK);
    TestWriteSfdDword(950U, 1000UL);
    CHECK(PlcDeviceWriteSfd(952U, 100) == PLC_DEVICE_OK);
    CHECK(PlcDeviceWriteSfd(953U, 120) == PLC_DEVICE_OK);
@@ -184,6 +186,9 @@ static void TestValidSnapshotAndLiveFrequency(void)
    CHECK(snapshot.s2Set == 1U);
    CHECK(snapshot.outputMode == PLSR_OUTPUT_PULSE_DIR);
    CHECK(snapshot.directionPoint == 4U);
    CHECK(snapshot.directionNegativeLogic == 0U);
    CHECK(snapshot.positiveBacklashPulses == 17U);
    CHECK(snapshot.negativeBacklashPulses == 23U);
    CHECK(snapshot.s2.defaultSpeed == 1000UL);
    CHECK(snapshot.s2.maximumSpeed == 100000UL);
    CHECK(snapshot.s2.startSpeed == 100000UL);
@@ -198,6 +203,13 @@ static void TestValidSnapshotAndLiveFrequency(void)
    CHECK(snapshot.hasSelfLoop == 1U);
    CHECK(snapshot.initialDirectionPositive == 1U);

    CHECK(PlcDeviceWriteSfd(900U, (1U << 1U)) == PLC_DEVICE_OK);
    CHECK(PlsrBuildJobSnapshot(&call, &context, &snapshot, &detail)
          == PLSR_RESULT_OK);
    CHECK(snapshot.directionNegativeLogic == 1U);
    CHECK(snapshot.initialDirectionPositive == 1U);
    CHECK(PlcDeviceWriteSfd(900U, 0U) == PLC_DEVICE_OK);

    TestWriteDword(&memory, PLSR_DEVICE_D, 112U, 9999);
    CHECK(snapshot.segments[0].pulseOrTarget == 100);
    TestWriteDword(&memory, PLSR_DEVICE_D, 110U, 2500);
--- a/PLSR/Test/test_plsr_modbus_data.c
+++ b/PLSR/Test/test_plsr_modbus_data.c
@@ -0,0 +1,84 @@
 #include "modbus_data_store.h"
 #include "plsr_modbus_data.h"
 #include <stdint.h>
 #include <stdio.h>

 static unsigned TestChecks;

 #define CHECK(condition)                                                     \
    do                                                                       \
    {                                                                        \
        TestChecks++;                                                        \
        if (!(condition))                                                    \
        {                                                                    \
            (void)printf("FAIL line %d: %s\n", __LINE__, #condition);       \
            return 1;                                                        \
        }                                                                    \
    } while (0)

 int main(void)
 {
    PLSR_DATA_SOURCE source;
    uint16_t words[4] = {0x5678U, 0x1234U, 0xFFFEU, 0xFFFFU};
    uint16_t word;
    int32_t dword;
    uint32_t sequence;

    CHECK(ModbusDataValidateWords(MODBUS_DATA_DEVICE_D, 0UL, 1UL) == 1U);
    CHECK(ModbusDataValidateWords(MODBUS_DATA_DEVICE_HD, 9998UL, 2UL) == 1U);
    CHECK(ModbusDataValidateWords(MODBUS_DATA_DEVICE_FD, 9999UL, 2UL) == 0U);
    CHECK(ModbusDataValidateWords(MODBUS_DATA_DEVICE_D, 0UL, 0UL) == 0U);
    CHECK(ModbusDataValidateWords((MODBUS_DATA_DEVICE)3, 0UL, 1UL) == 0U);

    sequence = ModbusDataGetWriteSequence();
    CHECK((sequence & 1UL) == 0UL);
    CHECK(ModbusDataWriteWords(MODBUS_DATA_DEVICE_D, 1000UL, words, 4UL)
          == 1U);
    CHECK(ModbusDataGetWriteSequence() == sequence + 2UL);
    CHECK(ModbusDataReadDword(MODBUS_DATA_DEVICE_D, 1000UL, &dword) == 1U);
    CHECK(dword == (int32_t)0x12345678UL);
    CHECK(ModbusDataReadDword(MODBUS_DATA_DEVICE_D, 1002UL, &dword) == 1U);
    CHECK(dword == -2);

    CHECK(ModbusDataWriteWord(MODBUS_DATA_DEVICE_HD, 5UL, 0xA55AU) == 1U);
    CHECK(ModbusDataWriteWord(MODBUS_DATA_DEVICE_FD, 5UL, 0x5AA5U) == 1U);
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_D, 5UL, &word) == 1U);
    CHECK(word == 0U);
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_HD, 5UL, &word) == 1U);
    CHECK(word == 0xA55AU);
    CHECK(ModbusDataReadWord(MODBUS_DATA_DEVICE_FD, 5UL, &word) == 1U);
    CHECK(word == 0x5AA5U);

    CHECK(ModbusDataReadLinear(10005UL, &word) == 1U);
    CHECK(word == 0xA55AU);
    CHECK(ModbusDataReadLinear(40005UL, &word) == 1U);
    CHECK(word == 0x5AA5U);
    CHECK(ModbusDataReadLinear(20000UL, &word) == 0U);
    CHECK(ModbusDataReadLinear(39999UL, &word) == 0U);
    CHECK(ModbusDataReadLinear(69999UL, &word) == 0U);

    PlsrModbusDataSourceInit(&source);
    CHECK(source.context == NULL);
    CHECK(source.validateWords != NULL);
    CHECK(source.readWord != NULL);
    CHECK(source.readDword != NULL);
    CHECK(source.readBit == NULL);
    CHECK(source.validateWords(source.context, PLSR_DEVICE_D, 1000UL, 4UL)
          == 1U);
    CHECK(source.validateWords(source.context, PLSR_DEVICE_X, 0UL, 1UL)
          == 0U);
    CHECK(source.readDword(source.context,
                           PLSR_DEVICE_D,
                           1000UL,
                           &dword) == 1U);
    CHECK(dword == (int32_t)0x12345678UL);
    CHECK(source.readWord(source.context, PLSR_DEVICE_HD, 5UL, &word) == 1U);
    CHECK(word == 0xA55AU);
    CHECK(source.readWord(source.context, PLSR_DEVICE_FD, 5UL, &word) == 1U);
    CHECK(word == 0x5AA5U);
    CHECK(source.readWord(source.context, PLSR_DEVICE_M, 5UL, &word) == 0U);

    PlsrModbusDataSourceInit(NULL);
    (void)printf("PASS: %u Modbus data-source checks\n", TestChecks);
    return 0;
 }
--- a/PLSR/Test/test_plsr_profile.c
+++ b/PLSR/Test/test_plsr_profile.c
@@ -348,6 +348,7 @@ static void TestControlledStop(void)
                                                10U, 10U, 0U);
    PLSR_PROFILE_STATE state;
    uint32_t frequency = 0U;
    uint64_t pausedPulsesQ32;
    uint8_t completed = 0U;
    int step;

@@ -365,12 +366,28 @@ static void TestControlledStop(void)
    CHECK(frequency == 0U);
    CHECK(state.phase == PLSR_PROFILE_PHASE_DONE);

    pausedPulsesQ32 = state.emittedPulsesQ32;
    CHECK(PlsrProfileResume(&state, 500U, 2000U, 0U)
          == PLSR_RESULT_OK);
    CHECK(state.phase == PLSR_PROFILE_PHASE_ACCEL);
    CHECK(state.emittedPulsesQ32 == pausedPulsesQ32);
    CHECK(PlsrProfileStep(&state, &frequency, &completed)
          == PLSR_RESULT_OK);
    CHECK(completed == 0U);
    CHECK(frequency > 500U);

    request.decelSlopeHzPerMs = 0U;
    CHECK(PlsrProfileStart(&state, &request, 10000, 1000U)
          == PLSR_RESULT_OK);
    CHECK(PlsrProfileRequestStop(&state) == PLSR_RESULT_OK);
    CHECK(state.phase == PLSR_PROFILE_PHASE_DONE);
    CHECK(PlsrProfileRequestStop(NULL) == PLSR_RESULT_INVALID_ARGUMENT);
    CHECK(PlsrProfileResume(NULL, 500U, 2000U, 0U)
          == PLSR_RESULT_INVALID_ARGUMENT);
    state.emittedPulsesQ32 = (uint64_t)state.totalPulses
                             * PLSR_PROFILE_Q32_ONE;
    CHECK(PlsrProfileResume(&state, 500U, 2000U, 0U)
          == PLSR_RESULT_INVALID_STATE);
 }

 static void TestPlan(void)