# Modbus RTU Long-Connection Stability Design

## Goal

Keep the existing Modbus RTU slave responsive during long-running TouchWin
communication. The primary acceptance test is a 24-hour TouchWin cyclic
read/write session with no timeout and no need to restart the HMI or slave.

## Confirmed Cause

The uC/OS-II port defines `CPU_CFG_KA_IPL_BOUNDARY` as `4`. Therefore only
interrupt priorities `4` through `15` are allowed to call uC/OS-II APIs.
The current SysTick priority is `0`, but its handler calls `OSIntEnter()`,
`OSTimeTick()`, and `OSIntExit()`. It can preempt an OS critical section and
corrupt the scheduler or semaphore state.

## Scope

- Keep the existing standard Modbus functions and private `0x41`, `0x42`,
  and `0x43` wire contracts unchanged.
- Keep the current TouchWin PSW mapping and RTC retention behavior unchanged.
- Assign SysTick an OS-aware priority of `4` and use the uC/OS-II Cortex-M
  SysTick wrapper so the handler obeys the port's BASEPRI contract.
- Preserve TIM5 priority `5` and USART1 priority `6`; both are already
  OS-aware and invoke OS services.
- Make UART receive rearming observable and recoverable. A failed
  `HAL_UART_Receive_IT()` result must not be discarded. The recovery path must
  first reset the UART RX state, then arm a one-byte receive operation, and
  record the result in the existing IAR debug snapshot.
- Do not add communication counters back into D registers or TouchWin.

## Error Handling

The receive path must attempt recovery only after a frame has been processed
or after a UART error. It must not overwrite a completed frame. If rearming
fails, the code must capture the HAL status and continue with a bounded retry
path rather than silently leaving USART1 unarmed.

## Verification

Static regression checks must prove that:

- SysTick priority is not lower-numbered than the OS-aware boundary.
- SysTick uses the port's OS tick handler.
- `AppTaskModbus()` handles, rather than discards, receive-rearm failures.

Firmware verification consists of an IAR build followed by two hardware
tests with the final binary:

1. TouchWin cyclic standard/private Modbus requests for 24 hours, with zero
   status-code timeout and no HMI reconnect.
2. Modbus Poll one-second reads for one hour as an independent stress check.

The existing host Modbus protocol and RTC-backup tests remain required
regressions, but cannot replace the hardware communication tests.