Modbus/docs/superpowers/specs/2026-08-02-modbus-rtu-long-connection-design.md

Modbus RTU Long-Connection Stability Design

Goal

Keep the existing Modbus RTU slave responsive during long-running TouchWin
communication. The primary acceptance test is a 24-hour TouchWin cyclic
read/write session with no timeout and no need to restart the HMI or slave.

Confirmed Cause

The uC/OS-II port defines CPU_CFG_KA_IPL_BOUNDARY as 4. Therefore only
interrupt priorities 4 through 15 are allowed to call uC/OS-II APIs.
The current SysTick priority is 0, but its handler calls OSIntEnter(),
OSTimeTick(), and OSIntExit(). It can preempt an OS critical section and
corrupt the scheduler or semaphore state.

Scope

• Keep the existing standard Modbus functions and private 0x41, 0x42,
  and 0x43 wire contracts unchanged.
• Keep the current TouchWin PSW mapping and RTC retention behavior unchanged.
• Assign SysTick an OS-aware priority of 4 and use the uC/OS-II Cortex-M
  SysTick wrapper so the handler obeys the port’s BASEPRI contract.
• Preserve TIM5 priority 5 and USART1 priority 6; both are already
  OS-aware and invoke OS services.
• Make UART receive rearming observable and recoverable. A failed
  HAL_UART_Receive_IT() result must not be discarded. The recovery path must
  first reset the UART RX state, then arm a one-byte receive operation, and
  record the result in the existing IAR debug snapshot.
• Do not add communication counters back into D registers or TouchWin.

Error Handling

The receive path must attempt recovery only after a frame has been processed
or after a UART error. It must not overwrite a completed frame. If rearming
fails, the code must capture the HAL status and continue with a bounded retry
path rather than silently leaving USART1 unarmed.

Verification

Static regression checks must prove that:

• SysTick priority is not lower-numbered than the OS-aware boundary.
• SysTick uses the port’s OS tick handler.
• AppTaskModbus() handles, rather than discards, receive-rearm failures.

Firmware verification consists of an IAR build followed by two hardware
tests with the final binary:

1. TouchWin cyclic standard/private Modbus requests for 24 hours, with zero
   status-code timeout and no HMI reconnect.
2. Modbus Poll one-second reads for one hour as an independent stress check.

The existing host Modbus protocol and RTC-backup tests remain required
regressions, but cannot replace the hardware communication tests.