Decides whether a valid frame is allowed to ARM or UN-ARM the rocket. More...

#include <stdint.h>
#include "frame.h"

Include dependency graph for arm_gate.h:

This graph shows which files directly or indirectly include this file:

Classes
class	radio_link::ArmGate

Namespaces
namespace	radio_link

Enumerations
enum class	radio_link::ArmAction : uint8_t { radio_link::None = 0 , radio_link::Pending , radio_link::Arm , radio_link::Disarm , radio_link::RejectKey , radio_link::RejectTarget , radio_link::RejectStale }

Variables
constexpr uint32_t	radio_link::kArmKey = 0xA5C3965Au
	PLACEHOLDER: lead to choose the real key before flight.
constexpr uint32_t	radio_link::kArmConfirmWindowMs = 2000
	Max time between the two ARM frames.

Detailed Description

Decides whether a valid frame is allowed to ARM or UN-ARM the rocket.

Protects against accidents and noise, NOT a deliberate attacker (there is no secret). Rules for ARM:

key must equal kArmKey and the next field must equal ~kArmKey
target_id must match this rocket
sequence must be newer than the last ARM/UN_ARM seen (wrap-safe). The ground's counter must keep increasing across ground-station restarts; otherwise ARM is rejected until the rocket reboots (open decision, see README "Decisions for the lead").
a SECOND valid ARM with seq == first.seq + 1 must arrive within kArmConfirmWindowMs of the first; only then does on_frame() return Arm Any rejected ARM cancels a pending first ARM. UN_ARM is deliberately easy (disarming is the safe direction): always honored, cancels a pending ARM, and is not subject to the stale-sequence rule or the target id (any rocket in range disarms).

The gate only says whether a command is valid. Whether arming is allowed right now (on the pad, in Idle, not in flight) is the state machine's call.

Time is passed in (now_ms) so tests need no clock. Unsigned subtraction makes a wrapping 32-bit millisecond counter safe.

Definition in file arm_gate.h.

Classes