Motor stops unexpectedly after ~ 3 minutes and 1 km (shutdown.c)

[ddosoff]

I use VESC firmware to control paragliding winch towing systems and run a custom application that carefully updates timeouts to prevent unintended motor stops.

While working with STR500 controllers, I started experiencing unexpected motor stops after some operating time. Initially, I suspected a timeout misconfiguration or a hardware-related issue.

The problem was difficult to diagnose because it occurred very rarely and only after prolonged operation.

After further investigation, I discovered that the behavior is related to the following code in shutdown.c:

switch (conf->shutdown_mode) {
case SHUTDOWN_MODE_ALWAYS_OFF:
case SHUTDOWN_MODE_ALWAYS_ON: {
        m_inactivity_time += dt;
        // Without a shutdown switch use inactivity timer to estimate
        // when device is stopped. Check also distance between store
        // to prevent excessive flash write cycles.
        if (m_inactivity_time >= SHUTDOWN_SAVE_BACKUPDATA_TIMEOUT) {
                shutdown_reset_timer();
                // If at least 1km was done then we can store data 
                if ((mc_interface_get_odometer() - odometer_old) >= 1000) {
                        conf_general_store_backup_data();
                        odometer_old = mc_interface_get_odometer();
                }
        }
}
default:
        break;
}

This logic stores tachometer (odometer) data to flash after a minimum of ~3 minutes and 1 km of movement. Unfortunately, during this flash write operation, the motor is stopped, which is critical and unsafe in winch towing applications.

As a workaround, I resolved the issue by switching the shutdown mode to OFF_AFTER_5H, which effectively postpones this behavior.

However, this does not feel like the correct or intended place for such logic, and it is not what I would expect from code located in shutdown.c.

I do not yet have a clear proposal for a proper fix, but I would like to discuss and find a safer and more appropriate solution. At the very least, it’s necessary to check whether the motor is already running.