test: add debounce structural invariant test for DIG_6 AGC sync

Lock in the four structural invariants of the 2-frame confirmation debounce: local variable captures DIG_6 read, static prev initialized to false (matches FPGA boot), outerAgc.enabled gated by now==prev guard, and prev advances each frame. Prevents a naive refactor from silently removing the glitch protection. Credit: joyshmitz review on PR #93.
fix: propagate FPGA AGC enable to MCU outer loop via DIG_6 GPIO
2026-04-17 00:28:40 +05:45 · 2026-04-17 00:04:37 +05:45 · 2026-04-16 13:55:12 +03:00 · 2026-04-16 13:54:40 +03:00 · 2026-04-16 11:49:44 +03:00 · 2026-04-16 11:49:21 +03:00
21 changed files with 2556 additions and 161 deletions
@@ -18,7 +18,7 @@ ADAR1000_AGC::ADAR1000_AGC()
    , min_gain(0)
    , max_gain(127)
    , holdoff_frames(4)
-    , enabled(true)
+    , enabled(false)
    , holdoff_counter(0)
    , last_saturated(false)
    , saturation_event_count(0)
@@ -46,7 +46,9 @@ extern "C" {
 #include <vector>
 #include "stm32_spi.h"
 #include "stm32_delay.h"
-#include "TinyGPSPlus.h"
+extern "C" {
+#include "um982_gps.h"
+}
 extern "C" {
 #include "GY_85_HAL.h"
 }
@@ -121,8 +123,8 @@ UART_HandleTypeDef huart5;
 UART_HandleTypeDef huart3;

 /* USER CODE BEGIN PV */
-// The TinyGPSPlus object
-TinyGPSPlus gps;
+// UM982 dual-antenna GPS receiver
+UM982_GPS_t um982;

 // Global data structures
 GPS_Data_t current_gps_data = {0};
@@ -173,7 +175,7 @@ float RADAR_Altitude;
 double RADAR_Longitude = 0;
 double RADAR_Latitude = 0;

-extern uint8_t GUI_start_flag_received;
+extern uint8_t GUI_start_flag_received;  // [STM32-006] Legacy, unused -- kept for linker compat


 //RADAR
@@ -620,7 +622,8 @@ typedef enum {
    ERROR_POWER_SUPPLY,
    ERROR_TEMPERATURE_HIGH,
    ERROR_MEMORY_ALLOC,
-    ERROR_WATCHDOG_TIMEOUT
+    ERROR_WATCHDOG_TIMEOUT,
+    ERROR_COUNT  // must be last — used for bounds checking error_strings[]
 } SystemError_t;

 static SystemError_t last_error = ERROR_NONE;
@@ -631,6 +634,27 @@ static bool system_emergency_state = false;
 SystemError_t checkSystemHealth(void) {
    SystemError_t current_error = ERROR_NONE;

+    // 0. Watchdog: detect main-loop stall (checkSystemHealth not called for >60 s).
+    //    Timestamp is captured at function ENTRY and updated unconditionally, so
+    //    any early return from a sub-check below cannot leave a stale value that
+    //    would later trip a spurious ERROR_WATCHDOG_TIMEOUT. A dedicated cold-start
+    //    branch ensures the first call after boot never trips (last_health_check==0
+    //    would otherwise make `HAL_GetTick() - 0 > 60000` true forever after the
+    //    60-s mark of the init sequence).
+    static uint32_t last_health_check = 0;
+    uint32_t now_tick = HAL_GetTick();
+    if (last_health_check == 0) {
+        last_health_check = now_tick;          // cold start: seed only
+    } else {
+        uint32_t elapsed = now_tick - last_health_check;
+        last_health_check = now_tick;          // update BEFORE any early return
+        if (elapsed > 60000) {
+            current_error = ERROR_WATCHDOG_TIMEOUT;
+            DIAG_ERR("SYS", "Health check: Watchdog timeout (>60s since last check)");
+            return current_error;
+        }
+    }
+
    // 1. Check AD9523 Clock Generator
    static uint32_t last_clock_check = 0;
    if (HAL_GetTick() - last_clock_check > 5000) {
@@ -700,14 +724,11 @@ SystemError_t checkSystemHealth(void) {
        last_bmp_check = HAL_GetTick();
    }

-    // 6. Check GPS Communication
-    static uint32_t last_gps_fix = 0;
-    if (gps.location.isUpdated()) {
-        last_gps_fix = HAL_GetTick();
-    }
-    if (HAL_GetTick() - last_gps_fix > 30000) {
+    // 6. Check GPS Communication (30s grace period from boot / last valid fix)
+    uint32_t gps_fix_age = um982_position_age(&um982);
+    if (gps_fix_age > 30000) {
        current_error = ERROR_GPS_COMM;
-        DIAG_WARN("SYS", "Health check: GPS no fix for >30s");
+        DIAG_WARN("SYS", "Health check: GPS no fix for >30s (age=%lu ms)", (unsigned long)gps_fix_age);
        return current_error;
    }

@@ -734,14 +755,7 @@ SystemError_t checkSystemHealth(void) {
        return current_error;
    }

-    // 9. Simple watchdog check
-    static uint32_t last_health_check = 0;
-    if (HAL_GetTick() - last_health_check > 60000) {
-        current_error = ERROR_WATCHDOG_TIMEOUT;
-        DIAG_ERR("SYS", "Health check: Watchdog timeout (>60s since last check)");
-        return current_error;
-    }
-    last_health_check = HAL_GetTick();
+    // 9. Watchdog check is performed at function entry (see step 0).

    if (current_error != ERROR_NONE) {
        DIAG_ERR("SYS", "checkSystemHealth returning error code %d", current_error);
@@ -853,7 +867,7 @@ void handleSystemError(SystemError_t error) {
    DIAG_ERR("SYS", "handleSystemError: error=%d error_count=%lu", error, error_count);

    char error_msg[100];
-    const char* error_strings[] = {
+    static const char* const error_strings[] = {
        "No error",
        "AD9523 Clock failure",
        "ADF4382 TX LO unlocked",
@@ -873,9 +887,16 @@ void handleSystemError(SystemError_t error) {
        "Watchdog timeout"
    };

+    static_assert(sizeof(error_strings) / sizeof(error_strings[0]) == ERROR_COUNT,
+                  "error_strings[] and SystemError_t enum are out of sync");
+
+    const char* err_name = (error >= 0 && error < (int)(sizeof(error_strings) / sizeof(error_strings[0])))
+                           ? error_strings[error]
+                           : "Unknown error";
+
    snprintf(error_msg, sizeof(error_msg),
             "ERROR #%d: %s (Count: %lu)\r\n",
-             error, error_strings[error], error_count);
+             error, err_name, error_count);
    HAL_UART_Transmit(&huart3, (uint8_t*)error_msg, strlen(error_msg), 1000);

    // Blink LED pattern based on error code
@@ -885,9 +906,23 @@ void handleSystemError(SystemError_t error) {
        HAL_Delay(200);
    }

-    // Critical errors trigger emergency shutdown
-    if (error >= ERROR_RF_PA_OVERCURRENT && error <= ERROR_POWER_SUPPLY) {
-        DIAG_ERR("SYS", "CRITICAL ERROR (code %d: %s) -- initiating Emergency_Stop()", error, error_strings[error]);
+    // Critical errors trigger emergency shutdown.
+    //
+    // Safety-critical range: any fault that can damage the PAs or leave the
+    // system in an undefined state must cut the RF rails via Emergency_Stop().
+    // This covers:
+    //   ERROR_RF_PA_OVERCURRENT .. ERROR_POWER_SUPPLY (9..13) -- PA/supply faults
+    //   ERROR_TEMPERATURE_HIGH  (14) -- >75 C on the PA thermal sensors;
+    //                                  without cutting bias + 5V/5V5/RFPA rails
+    //                                  the GaN QPA2962 stage can thermal-runaway.
+    //   ERROR_WATCHDOG_TIMEOUT  (16) -- health-check loop has stalled (>60 s);
+    //                                  transmitter state is unknown, safest to
+    //                                  latch Emergency_Stop rather than rely on
+    //                                  IWDG reset (which re-energises the rails).
+    if ((error >= ERROR_RF_PA_OVERCURRENT && error <= ERROR_POWER_SUPPLY) ||
+        error == ERROR_TEMPERATURE_HIGH ||
+        error == ERROR_WATCHDOG_TIMEOUT) {
+        DIAG_ERR("SYS", "CRITICAL ERROR (code %d: %s) -- initiating Emergency_Stop()", error, err_name);
        snprintf(error_msg, sizeof(error_msg),
                 "CRITICAL ERROR! Initiating emergency shutdown.\r\n");
        HAL_UART_Transmit(&huart3, (uint8_t*)error_msg, strlen(error_msg), 1000);
@@ -1020,20 +1055,7 @@ static inline void delay_ms(uint32_t ms) { HAL_Delay(ms); }



-// This custom version of delay() ensures that the gps object
-// is being "fed".
-static void smartDelay(unsigned long ms)
-{
-    uint32_t start = HAL_GetTick();
-    uint8_t ch;
-
-    do {
-        // While there is new data available in UART (non-blocking)
-        if (HAL_UART_Receive(&huart5, &ch, 1, 0) == HAL_OK) {
-            gps.encode(ch);   // Pass received byte to TinyGPS++ equivalent parser
-        }
-    } while (HAL_GetTick() - start < ms);
-}
+// smartDelay removed -- replaced by non-blocking um982_process() in main loop

 // Small helper to enable DWT cycle counter for microdelay
 static void DWT_Init(void)
@@ -1177,7 +1199,14 @@ static int configure_ad9523(void)

    // init ad9523 defaults (fills any missing pdata defaults)
    DIAG("CLK", "Calling ad9523_init() -- fills pdata defaults");
-    ad9523_init(&init_param);
+    {
+        int32_t init_ret = ad9523_init(&init_param);
+        DIAG("CLK", "ad9523_init() returned %ld", (long)init_ret);
+        if (init_ret != 0) {
+            DIAG_ERR("CLK", "ad9523_init() FAILED (ret=%ld)", (long)init_ret);
+            return -1;
+        }
+    }

    /* [Bug #2 FIXED] Removed first ad9523_setup() call that was here.
     * It wrote to the chip while still in reset — writes were lost.
@@ -1566,6 +1595,12 @@ int main(void)
    Yaw_Sensor = (180*atan2(magRawY,magRawX)/PI) - Mag_Declination;

    if(Yaw_Sensor<0)Yaw_Sensor+=360;
+
+    // Override magnetometer heading with UM982 dual-antenna heading when available
+    if (um982_is_heading_valid(&um982)) {
+        Yaw_Sensor = um982_get_heading(&um982);
+    }
+
    RxEst_0 = RxEst_1;
    RyEst_0 = RyEst_1;
    RzEst_0 = RzEst_1;
@@ -1741,10 +1776,34 @@ int main(void)
  	//////////////////////////////////////////////////////////////////////////////////////
    //////////////////////////////////////////GPS/////////////////////////////////////////
    //////////////////////////////////////////////////////////////////////////////////////
-  for(int i=0; i<10;i++){
-  smartDelay(1000);
-  RADAR_Longitude = gps.location.lng();
-  RADAR_Latitude = gps.location.lat();
+  DIAG_SECTION("GPS INIT (UM982)");
+  DIAG("GPS", "Initializing UM982 on UART5 @ 115200 (baseline=50cm, tol=3cm)");
+  if (!um982_init(&um982, &huart5, 50.0f, 3.0f)) {
+      DIAG_WARN("GPS", "UM982 init: no VERSIONA response -- module may need more time");
+      // Not fatal: module may still start sending NMEA data after boot
+  } else {
+      DIAG("GPS", "UM982 init OK -- VERSIONA received");
+  }
+
+  // Collect GPS data for a few seconds (non-blocking pump)
+  DIAG("GPS", "Pumping GPS for 5 seconds to acquire initial fix...");
+  {
+      uint32_t gps_start = HAL_GetTick();
+      while (HAL_GetTick() - gps_start < 5000) {
+          um982_process(&um982);
+          HAL_Delay(10);
+      }
+  }
+  RADAR_Longitude = um982_get_longitude(&um982);
+  RADAR_Latitude = um982_get_latitude(&um982);
+  DIAG("GPS", "Initial position: lat=%.6f lon=%.6f fix=%d sats=%d",
+       RADAR_Latitude, RADAR_Longitude,
+       um982_get_fix_quality(&um982), um982_get_num_sats(&um982));
+
+  // Re-apply heading after GPS init so the north-alignment stepper move uses
+  // UM982 dual-antenna heading when available.
+  if (um982_is_heading_valid(&um982)) {
+      Yaw_Sensor = um982_get_heading(&um982);
  }

  //move Stepper to position 1 = 0°
@@ -1770,29 +1829,11 @@ int main(void)
      HAL_UART_Transmit(&huart3, (uint8_t*)gps_send_error, sizeof(gps_send_error) - 1, 1000);
  }

-  // Check if start flag was received and settings are ready
-  do{
-	  if (usbHandler.isStartFlagReceived() &&
-		  usbHandler.getState() == USBHandler::USBState::READY_FOR_DATA) {
-
-		  const RadarSettings& settings = usbHandler.getSettings();
-
-		  // Use the settings to configure your radar system
-		  /*
-			  settings.getSystemFrequency();
-			  settings.getChirpDuration1();
-			  settings.getChirpDuration2();
-			  settings.getChirpsPerPosition();
-			  settings.getFreqMin();
-			  settings.getFreqMax();
-			  settings.getPRF1();
-			  settings.getPRF2();
-			  settings.getMaxDistance();
-			  */
-
-
-              }
-  }while(!usbHandler.isStartFlagReceived());
+  /* [STM32-006 FIXED] Removed blocking do-while loop that waited for
+   * usbHandler.isStartFlagReceived().  The production V7 PyQt GUI does not
+   * send the legacy 4-byte start flag [23,46,158,237], so this loop hung
+   * the MCU at boot indefinitely.  The USB settings handshake (if ever
+   * re-enabled) should be handled non-blocking in the main loop. */

  /***************************************************************/
  /************RF Power Amplifier Powering up sequence************/
@@ -2017,6 +2058,18 @@ int main(void)
 	        }
 	        DIAG("SYS", "Exited safe mode blink loop -- system_emergency_state cleared");
 	    }
+
+	  //////////////////////////////////////////////////////////////////////////////////////
+	  ////////////////////////// GPS: Non-blocking NMEA processing ////////////////////////
+	  //////////////////////////////////////////////////////////////////////////////////////
+	  um982_process(&um982);
+
+	  // Update position globals continuously
+	  if (um982_is_position_valid(&um982)) {
+	      RADAR_Latitude = um982_get_latitude(&um982);
+	      RADAR_Longitude = um982_get_longitude(&um982);
+	  }
+
 	  //////////////////////////////////////////////////////////////////////////////////////
 	  ////////////////////////// Monitor ADF4382A lock status periodically//////////////////
 	  //////////////////////////////////////////////////////////////////////////////////////
@@ -2127,9 +2180,24 @@ int main(void)

      runRadarPulseSequence();

-      /* [AGC] Outer-loop AGC: read FPGA saturation flag (DIG_5 / PD13),
-       * adjust ADAR1000 VGA common gain once per radar frame (~258 ms).
-       * Only run when AGC is enabled — otherwise leave VGA gains untouched. */
+      /* [AGC] Outer-loop AGC: sync enable from FPGA via DIG_6 (PD14),
+       * then read saturation flag (DIG_5 / PD13) and adjust ADAR1000 VGA
+       * common gain once per radar frame (~258 ms).
+       * FPGA register host_agc_enable is the single source of truth —
+       * DIG_6 propagates it to MCU every frame.
+       * 2-frame confirmation debounce: only change outerAgc.enabled when
+       * two consecutive frames read the same DIG_6 value. Prevents a
+       * single-sample glitch from causing a spurious AGC state transition.
+       * Added latency: 1 extra frame (~258 ms), acceptable for control plane. */
+      {
+          bool dig6_now = (HAL_GPIO_ReadPin(FPGA_DIG6_GPIO_Port,
+                                            FPGA_DIG6_Pin) == GPIO_PIN_SET);
+          static bool dig6_prev = false;  // matches boot default (AGC off)
+          if (dig6_now == dig6_prev) {
+              outerAgc.enabled = dig6_now;
+          }
+          dig6_prev = dig6_now;
+      }
      if (outerAgc.enabled) {
          bool sat = HAL_GPIO_ReadPin(FPGA_DIG5_SAT_GPIO_Port,
                                      FPGA_DIG5_SAT_Pin) == GPIO_PIN_SET;
@@ -2567,7 +2635,7 @@ static void MX_UART5_Init(void)

  /* USER CODE END UART5_Init 1 */
  huart5.Instance = UART5;
-  huart5.Init.BaudRate = 9600;
+  huart5.Init.BaudRate = 115200;
  huart5.Init.WordLength = UART_WORDLENGTH_8B;
  huart5.Init.StopBits = UART_STOPBITS_1;
  huart5.Init.Parity = UART_PARITY_NONE;
@@ -0,0 +1,586 @@
+/*******************************************************************************
+ * um982_gps.c -- UM982 dual-antenna GNSS receiver driver implementation
+ *
+ * See um982_gps.h for API documentation.
+ * Command syntax per Unicore N4 Command Reference EN R1.14.
+ ******************************************************************************/
+#include "um982_gps.h"
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+/* ========================= Internal helpers ========================== */
+
+/**
+ * Advance to the next comma-delimited field in an NMEA sentence.
+ * Returns pointer to the start of the next field (after the comma),
+ * or NULL if no more commas found before end-of-string or '*'.
+ *
+ * Handles empty fields (consecutive commas) correctly by returning
+ * a pointer to the character after the comma (which may be another comma).
+ */
+static const char *next_field(const char *p)
+{
+    if (p == NULL) return NULL;
+    while (*p != '\0' && *p != ',' && *p != '*') {
+        p++;
+    }
+    if (*p == ',') return p + 1;
+    return NULL;  /* End of sentence or checksum marker */
+}
+
+/**
+ * Get the length of the current field (up to next comma, '*', or '\0').
+ */
+static int field_len(const char *p)
+{
+    int len = 0;
+    if (p == NULL) return 0;
+    while (p[len] != '\0' && p[len] != ',' && p[len] != '*') {
+        len++;
+    }
+    return len;
+}
+
+/**
+ * Check if a field is non-empty (has at least one character before delimiter).
+ */
+static bool field_valid(const char *p)
+{
+    return p != NULL && field_len(p) > 0;
+}
+
+/**
+ * Parse a floating-point value from a field, returning 0.0 if empty.
+ */
+static double field_to_double(const char *p)
+{
+    if (!field_valid(p)) return 0.0;
+    return strtod(p, NULL);
+}
+
+static float field_to_float(const char *p)
+{
+    return (float)field_to_double(p);
+}
+
+static int field_to_int(const char *p)
+{
+    if (!field_valid(p)) return 0;
+    return (int)strtol(p, NULL, 10);
+}
+
+/* ========================= Checksum ================================== */
+
+bool um982_verify_checksum(const char *sentence)
+{
+    if (sentence == NULL || sentence[0] != '$') return false;
+
+    const char *p = sentence + 1;  /* Skip '$' */
+    uint8_t computed = 0;
+
+    while (*p != '\0' && *p != '*') {
+        computed ^= (uint8_t)*p;
+        p++;
+    }
+
+    if (*p != '*') return false;  /* No checksum marker found */
+    p++;  /* Skip '*' */
+
+    /* Parse 2-char hex checksum */
+    if (p[0] == '\0' || p[1] == '\0') return false;
+
+    char hex_str[3] = { p[0], p[1], '\0' };
+    unsigned long expected = strtoul(hex_str, NULL, 16);
+
+    return computed == (uint8_t)expected;
+}
+
+/* ========================= Coordinate parsing ======================== */
+
+double um982_parse_coord(const char *field, char hemisphere)
+{
+    if (field == NULL || field[0] == '\0') return NAN;
+
+    /* Find the decimal point to determine degree digit count.
+     * Latitude:  ddmm.mmmm  (dot at index 4, degrees = 2)
+     * Longitude: dddmm.mmmm (dot at index 5, degrees = 3)
+     * General:   degree_digits = dot_position - 2
+     */
+    const char *dot = strchr(field, '.');
+    if (dot == NULL) return NAN;
+
+    int dot_pos = (int)(dot - field);
+    int deg_digits = dot_pos - 2;
+
+    if (deg_digits < 1 || deg_digits > 3) return NAN;
+
+    /* Extract degree portion */
+    double degrees = 0.0;
+    for (int i = 0; i < deg_digits; i++) {
+        if (field[i] < '0' || field[i] > '9') return NAN;
+        degrees = degrees * 10.0 + (field[i] - '0');
+    }
+
+    /* Extract minutes portion (everything from deg_digits onward) */
+    double minutes = strtod(field + deg_digits, NULL);
+    if (minutes < 0.0 || minutes >= 60.0) return NAN;
+
+    double result = degrees + minutes / 60.0;
+
+    /* Apply hemisphere sign */
+    if (hemisphere == 'S' || hemisphere == 'W') {
+        result = -result;
+    }
+
+    return result;
+}
+
+/* ========================= Sentence parsers ========================== */
+
+/**
+ * Identify the NMEA sentence type by skipping the 2-char talker ID
+ * and comparing the 3-letter formatter.
+ *
+ * "$GNGGA,..." -> talker="GN", formatter="GGA"
+ * "$GPTHS,..." -> talker="GP", formatter="THS"
+ *
+ * Returns pointer to the formatter (3 chars at sentence+3), or NULL
+ * if sentence is too short.
+ */
+static const char *get_formatter(const char *sentence)
+{
+    /* sentence starts with '$', followed by 2-char talker + 3-char formatter */
+    if (sentence == NULL || strlen(sentence) < 6) return NULL;
+    return sentence + 3;  /* Skip "$XX" -> points to formatter */
+}
+
+/**
+ * Parse GGA sentence — position and fix quality.
+ *
+ * Format: $--GGA,time,lat,N/S,lon,E/W,quality,numSat,hdop,alt,M,geoidSep,M,dgpsAge,refID*XX
+ *         field:  1    2   3    4   5     6      7     8    9 10    11    12   13     14
+ */
+static void parse_gga(UM982_GPS_t *gps, const char *sentence)
+{
+    /* Skip to first field (after "$XXGGA,") */
+    const char *f = strchr(sentence, ',');
+    if (f == NULL) return;
+    f++;  /* f -> field 1 (time) */
+
+    /* Field 1: UTC time — skip for now */
+    const char *f2 = next_field(f);   /* lat */
+    const char *f3 = next_field(f2);  /* N/S */
+    const char *f4 = next_field(f3);  /* lon */
+    const char *f5 = next_field(f4);  /* E/W */
+    const char *f6 = next_field(f5);  /* quality */
+    const char *f7 = next_field(f6);  /* numSat */
+    const char *f8 = next_field(f7);  /* hdop */
+    const char *f9 = next_field(f8);  /* altitude */
+    const char *f10 = next_field(f9); /* M */
+    const char *f11 = next_field(f10); /* geoid sep */
+
+    uint32_t now = HAL_GetTick();
+
+    /* Parse fix quality first — if 0, position is meaningless */
+    gps->fix_quality = (uint8_t)field_to_int(f6);
+
+    /* Parse coordinates */
+    if (field_valid(f2) && field_valid(f3)) {
+        char hem = field_valid(f3) ? *f3 : 'N';
+        double lat = um982_parse_coord(f2, hem);
+        if (!isnan(lat)) gps->latitude = lat;
+    }
+
+    if (field_valid(f4) && field_valid(f5)) {
+        char hem = field_valid(f5) ? *f5 : 'E';
+        double lon = um982_parse_coord(f4, hem);
+        if (!isnan(lon)) gps->longitude = lon;
+    }
+
+    /* Number of satellites */
+    gps->num_satellites = (uint8_t)field_to_int(f7);
+
+    /* HDOP */
+    if (field_valid(f8)) {
+        gps->hdop = field_to_float(f8);
+    }
+
+    /* Altitude */
+    if (field_valid(f9)) {
+        gps->altitude = field_to_float(f9);
+    }
+
+    /* Geoid separation */
+    if (field_valid(f11)) {
+        gps->geoid_sep = field_to_float(f11);
+    }
+
+    gps->last_gga_tick = now;
+    if (gps->fix_quality != UM982_FIX_NONE) {
+        gps->last_fix_tick = now;
+    }
+}
+
+/**
+ * Parse RMC sentence — recommended minimum (position, speed, date).
+ *
+ * Format: $--RMC,time,status,lat,N/S,lon,E/W,speed,course,date,magVar,E/W,mode*XX
+ *         field:  1     2      3   4   5   6    7      8     9    10    11   12
+ */
+static void parse_rmc(UM982_GPS_t *gps, const char *sentence)
+{
+    const char *f = strchr(sentence, ',');
+    if (f == NULL) return;
+    f++;  /* f -> field 1 (time) */
+
+    const char *f2 = next_field(f);   /* status */
+    const char *f3 = next_field(f2);  /* lat */
+    const char *f4 = next_field(f3);  /* N/S */
+    const char *f5 = next_field(f4);  /* lon */
+    const char *f6 = next_field(f5);  /* E/W */
+    const char *f7 = next_field(f6);  /* speed knots */
+    const char *f8 = next_field(f7);  /* course true */
+
+    /* Status */
+    if (field_valid(f2)) {
+        gps->rmc_status = *f2;
+    }
+
+    /* Position (only if status = A for valid) */
+    if (field_valid(f2) && *f2 == 'A') {
+        if (field_valid(f3) && field_valid(f4)) {
+            double lat = um982_parse_coord(f3, *f4);
+            if (!isnan(lat)) gps->latitude = lat;
+        }
+        if (field_valid(f5) && field_valid(f6)) {
+            double lon = um982_parse_coord(f5, *f6);
+            if (!isnan(lon)) gps->longitude = lon;
+        }
+    }
+
+    /* Speed (knots) */
+    if (field_valid(f7)) {
+        gps->speed_knots = field_to_float(f7);
+    }
+
+    /* Course */
+    if (field_valid(f8)) {
+        gps->course_true = field_to_float(f8);
+    }
+
+    gps->last_rmc_tick = HAL_GetTick();
+}
+
+/**
+ * Parse THS sentence — true heading and status (UM982-specific).
+ *
+ * Format: $--THS,heading,mode*XX
+ *         field:    1      2
+ */
+static void parse_ths(UM982_GPS_t *gps, const char *sentence)
+{
+    const char *f = strchr(sentence, ',');
+    if (f == NULL) return;
+    f++;  /* f -> field 1 (heading) */
+
+    const char *f2 = next_field(f);  /* mode */
+
+    /* Heading */
+    if (field_valid(f)) {
+        gps->heading = field_to_float(f);
+    } else {
+        gps->heading = NAN;
+    }
+
+    /* Mode */
+    if (field_valid(f2)) {
+        gps->heading_mode = *f2;
+    } else {
+        gps->heading_mode = 'V';  /* Not valid if missing */
+    }
+
+    gps->last_ths_tick = HAL_GetTick();
+}
+
+/**
+ * Parse VTG sentence — course and speed over ground.
+ *
+ * Format: $--VTG,courseTrue,T,courseMag,M,speedKnots,N,speedKmh,K,mode*XX
+ *         field:     1      2     3      4     5      6    7     8   9
+ */
+static void parse_vtg(UM982_GPS_t *gps, const char *sentence)
+{
+    const char *f = strchr(sentence, ',');
+    if (f == NULL) return;
+    f++;  /* f -> field 1 (course true) */
+
+    const char *f2 = next_field(f);   /* T */
+    const char *f3 = next_field(f2);  /* course mag */
+    const char *f4 = next_field(f3);  /* M */
+    const char *f5 = next_field(f4);  /* speed knots */
+    const char *f6 = next_field(f5);  /* N */
+    const char *f7 = next_field(f6);  /* speed km/h */
+
+    /* Course true */
+    if (field_valid(f)) {
+        gps->course_true = field_to_float(f);
+    }
+
+    /* Speed knots */
+    if (field_valid(f5)) {
+        gps->speed_knots = field_to_float(f5);
+    }
+
+    /* Speed km/h */
+    if (field_valid(f7)) {
+        gps->speed_kmh = field_to_float(f7);
+    }
+
+    gps->last_vtg_tick = HAL_GetTick();
+}
+
+/* ========================= Sentence dispatch ========================= */
+
+void um982_parse_sentence(UM982_GPS_t *gps, const char *sentence)
+{
+    if (sentence == NULL || sentence[0] != '$') return;
+
+    /* Verify checksum before parsing */
+    if (!um982_verify_checksum(sentence)) return;
+
+    /* Check for VERSIONA response (starts with '#', not '$') -- handled separately */
+    /* Actually VERSIONA starts with '#', so it won't enter here. We check in feed(). */
+
+    /* Identify sentence type */
+    const char *fmt = get_formatter(sentence);
+    if (fmt == NULL) return;
+
+    if (strncmp(fmt, "GGA", 3) == 0) {
+        gps->initialized = true;
+        parse_gga(gps, sentence);
+    } else if (strncmp(fmt, "RMC", 3) == 0) {
+        gps->initialized = true;
+        parse_rmc(gps, sentence);
+    } else if (strncmp(fmt, "THS", 3) == 0) {
+        gps->initialized = true;
+        parse_ths(gps, sentence);
+    } else if (strncmp(fmt, "VTG", 3) == 0) {
+        gps->initialized = true;
+        parse_vtg(gps, sentence);
+    }
+    /* Other sentences silently ignored */
+}
+
+/* ========================= Command interface ========================= */
+
+bool um982_send_command(UM982_GPS_t *gps, const char *cmd)
+{
+    if (gps == NULL || gps->huart == NULL || cmd == NULL) return false;
+
+    /* Build command with \r\n termination */
+    char buf[UM982_CMD_BUF_SIZE];
+    int len = snprintf(buf, sizeof(buf), "%s\r\n", cmd);
+    if (len <= 0 || (size_t)len >= sizeof(buf)) return false;
+
+    HAL_StatusTypeDef status = HAL_UART_Transmit(
+        gps->huart, (const uint8_t *)buf, (uint16_t)len, 100);
+
+    return status == HAL_OK;
+}
+
+/* ========================= Line assembly + feed ====================== */
+
+/**
+ * Process a completed line from the line buffer.
+ */
+static void process_line(UM982_GPS_t *gps, const char *line)
+{
+    if (line == NULL || line[0] == '\0') return;
+
+    /* NMEA sentence starts with '$' */
+    if (line[0] == '$') {
+        um982_parse_sentence(gps, line);
+        return;
+    }
+
+    /* Unicore proprietary response starts with '#' (e.g. #VERSIONA) */
+    if (line[0] == '#') {
+        if (strncmp(line + 1, "VERSIONA", 8) == 0) {
+            gps->version_received = true;
+            gps->initialized = true;
+        }
+        return;
+    }
+}
+
+void um982_feed(UM982_GPS_t *gps, const uint8_t *data, uint16_t len)
+{
+    if (gps == NULL || data == NULL || len == 0) return;
+
+    for (uint16_t i = 0; i < len; i++) {
+        uint8_t ch = data[i];
+
+        /* End of line: process if we have content */
+        if (ch == '\n' || ch == '\r') {
+            if (gps->line_len > 0 && !gps->line_overflow) {
+                gps->line_buf[gps->line_len] = '\0';
+                process_line(gps, gps->line_buf);
+            }
+            gps->line_len = 0;
+            gps->line_overflow = false;
+            continue;
+        }
+
+        /* Accumulate into line buffer */
+        if (gps->line_len < UM982_LINE_BUF_SIZE - 1) {
+            gps->line_buf[gps->line_len++] = (char)ch;
+        } else {
+            gps->line_overflow = true;
+        }
+    }
+}
+
+/* ========================= UART process (production) ================= */
+
+void um982_process(UM982_GPS_t *gps)
+{
+    if (gps == NULL || gps->huart == NULL) return;
+
+    /* Read all available bytes from the UART one at a time.
+     * At 115200 baud (~11.5 KB/s) and a typical main-loop period of ~10 ms,
+     * we expect ~115 bytes per call — negligible overhead on a 168 MHz STM32.
+     *
+     * Note: batch reads (HAL_UART_Receive with Size > 1 and Timeout = 0) are
+     * NOT safe here because the HAL consumes bytes from the data register as
+     * it reads them.  If fewer than Size bytes are available, the consumed
+     * bytes are lost (HAL_TIMEOUT is returned and the caller has no way to
+     * know how many bytes were actually placed into the buffer). */
+    uint8_t ch;
+    while (HAL_UART_Receive(gps->huart, &ch, 1, 0) == HAL_OK) {
+        um982_feed(gps, &ch, 1);
+    }
+}
+
+/* ========================= Validity checks =========================== */
+
+bool um982_is_heading_valid(const UM982_GPS_t *gps)
+{
+    if (gps == NULL) return false;
+    if (isnan(gps->heading)) return false;
+
+    /* Mode must be Autonomous or Differential */
+    if (gps->heading_mode != 'A' && gps->heading_mode != 'D') return false;
+
+    /* Check age */
+    uint32_t age = HAL_GetTick() - gps->last_ths_tick;
+    return age < UM982_HEADING_TIMEOUT_MS;
+}
+
+bool um982_is_position_valid(const UM982_GPS_t *gps)
+{
+    if (gps == NULL) return false;
+    if (gps->fix_quality == UM982_FIX_NONE) return false;
+
+    /* Check age of the last valid fix */
+    uint32_t age = HAL_GetTick() - gps->last_fix_tick;
+    return age < UM982_POSITION_TIMEOUT_MS;
+}
+
+uint32_t um982_heading_age(const UM982_GPS_t *gps)
+{
+    if (gps == NULL) return UINT32_MAX;
+    return HAL_GetTick() - gps->last_ths_tick;
+}
+
+uint32_t um982_position_age(const UM982_GPS_t *gps)
+{
+    if (gps == NULL) return UINT32_MAX;
+    return HAL_GetTick() - gps->last_fix_tick;
+}
+
+/* ========================= Initialization ============================ */
+
+bool um982_init(UM982_GPS_t *gps, UART_HandleTypeDef *huart,
+                float baseline_cm, float tolerance_cm)
+{
+    if (gps == NULL || huart == NULL) return false;
+
+    /* Zero-init entire structure */
+    memset(gps, 0, sizeof(UM982_GPS_t));
+
+    gps->huart = huart;
+    gps->heading = NAN;
+    gps->heading_mode = 'V';
+    gps->rmc_status = 'V';
+    gps->speed_knots = 0.0f;
+
+    /* Seed fix timestamp so position_age() returns ~0 instead of uptime.
+     * Gives the module a full 30s grace window from init to acquire a fix
+     * before the health check fires ERROR_GPS_COMM. */
+    gps->last_fix_tick = HAL_GetTick();
+    gps->speed_kmh = 0.0f;
+    gps->course_true = 0.0f;
+
+    /* Step 1: Stop all current output to get a clean slate */
+    um982_send_command(gps, "UNLOG");
+    HAL_Delay(100);
+
+    /* Step 2: Configure heading mode
+     * Per N4 Reference 4.18: CONFIG HEADING FIXLENGTH (default mode)
+     * "The distance between ANT1 and ANT2 is fixed. They move synchronously." */
+    um982_send_command(gps, "CONFIG HEADING FIXLENGTH");
+    HAL_Delay(50);
+
+    /* Step 3: Set baseline length if specified
+     * Per N4 Reference: CONFIG HEADING LENGTH <cm> <tolerance_cm>
+     * "parameter1: Fixed baseline length (cm), valid range >= 0"
+     * "parameter2: Tolerable error margin (cm), valid range > 0" */
+    if (baseline_cm > 0.0f) {
+        char cmd[64];
+        if (tolerance_cm > 0.0f) {
+            snprintf(cmd, sizeof(cmd), "CONFIG HEADING LENGTH %.0f %.0f",
+                     baseline_cm, tolerance_cm);
+        } else {
+            snprintf(cmd, sizeof(cmd), "CONFIG HEADING LENGTH %.0f",
+                     baseline_cm);
+        }
+        um982_send_command(gps, cmd);
+        HAL_Delay(50);
+    }
+
+    /* Step 4: Enable NMEA output sentences on COM2.
+     * Per N4 Reference: "When requesting NMEA messages, users should add GP
+     * before each command name"
+     *
+     * We target COM2 because the ELT0213 board (GNSS.STORE) exposes COM2
+     * (RXD2/TXD2) on its 12-pin JST connector (pins 5 & 6).  The STM32
+     * UART5 (PC12-TX, PD2-RX) connects to these pins via JP8.
+     * COM2 defaults to 115200 baud — matching our UART5 config. */
+    um982_send_command(gps, "GPGGA COM2 1");     /* GGA at 1 Hz */
+    HAL_Delay(50);
+    um982_send_command(gps, "GPRMC COM2 1");     /* RMC at 1 Hz */
+    HAL_Delay(50);
+    um982_send_command(gps, "GPTHS COM2 0.2");   /* THS at 5 Hz (heading primary) */
+    HAL_Delay(50);
+
+    /* Step 5: Skip SAVECONFIG -- NMEA config is re-sent every boot anyway.
+     * Saving to NVM on every power cycle would wear flash.  If persistent
+     * config is needed, call um982_send_command(gps, "SAVECONFIG") once
+     * during commissioning. */
+
+    /* Step 6: Query version to verify communication */
+    gps->version_received = false;
+    um982_send_command(gps, "VERSIONA");
+
+    /* Wait for VERSIONA response (non-blocking poll) */
+    uint32_t start = HAL_GetTick();
+    while (!gps->version_received &&
+           (HAL_GetTick() - start) < UM982_INIT_TIMEOUT_MS) {
+        um982_process(gps);
+        HAL_Delay(10);
+    }
+
+    gps->initialized = gps->version_received;
+    return gps->initialized;
+}
@@ -0,0 +1,213 @@
+/*******************************************************************************
+ * um982_gps.h -- UM982 dual-antenna GNSS receiver driver
+ *
+ * Parses NMEA sentences (GGA, RMC, THS, VTG) from the Unicore UM982 module
+ * and provides position, heading, and velocity data.
+ *
+ * Design principles:
+ *   - Non-blocking: process() reads available UART bytes without waiting
+ *   - Correct NMEA parsing: proper tokenizer handles empty fields
+ *   - Longitude handles 3-digit degrees (dddmm.mmmm) via decimal-point detection
+ *   - Checksum verified on every sentence
+ *   - Command syntax verified against Unicore N4 Command Reference EN R1.14
+ *
+ * Hardware: UM982 on UART5 @ 115200 baud, dual-antenna heading mode
+ ******************************************************************************/
+#ifndef UM982_GPS_H
+#define UM982_GPS_H
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <math.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Forward-declare the HAL UART handle type.  The real definition comes from
+ * stm32f7xx_hal.h (production) or stm32_hal_mock.h (tests). */
+#ifndef STM32_HAL_MOCK_H
+#include "stm32f7xx_hal.h"
+#else
+/* Already included via mock -- nothing to do */
+#endif
+
+/* ========================= Constants ================================= */
+
+#define UM982_RX_BUF_SIZE    512   /* Ring buffer for incoming UART bytes */
+#define UM982_LINE_BUF_SIZE   96   /* Max NMEA sentence (82 chars + margin) */
+#define UM982_CMD_BUF_SIZE   128   /* Outgoing command buffer */
+#define UM982_INIT_TIMEOUT_MS 3000 /* Timeout waiting for VERSIONA response */
+
+/* Fix quality values (from GGA field 6) */
+#define UM982_FIX_NONE       0
+#define UM982_FIX_GPS        1
+#define UM982_FIX_DGPS       2
+#define UM982_FIX_RTK_FIXED  4
+#define UM982_FIX_RTK_FLOAT  5
+
+/* Validity timeout defaults (ms) */
+#define UM982_HEADING_TIMEOUT_MS 2000
+#define UM982_POSITION_TIMEOUT_MS 5000
+
+/* ========================= Data Types ================================ */
+
+typedef struct {
+    /* Position */
+    double   latitude;       /* Decimal degrees, positive = North */
+    double   longitude;      /* Decimal degrees, positive = East */
+    float    altitude;       /* Meters above MSL */
+    float    geoid_sep;      /* Geoid separation (meters) */
+
+    /* Heading (from dual-antenna THS) */
+    float    heading;        /* True heading 0-360 degrees, NAN if invalid */
+    char     heading_mode;   /* A=autonomous, D=diff, E=est, M=manual, S=sim, V=invalid */
+
+    /* Velocity */
+    float    speed_knots;    /* Speed over ground (knots) */
+    float    speed_kmh;      /* Speed over ground (km/h) */
+    float    course_true;    /* Course over ground (degrees true) */
+
+    /* Quality */
+    uint8_t  fix_quality;    /* 0=none, 1=GPS, 2=DGPS, 4=RTK fixed, 5=RTK float */
+    uint8_t  num_satellites; /* Satellites used in fix */
+    float    hdop;           /* Horizontal dilution of precision */
+
+    /* RMC status */
+    char     rmc_status;     /* A=valid, V=warning */
+
+    /* Timestamps (HAL_GetTick() at last update) */
+    uint32_t last_fix_tick;   /* Last valid GGA fix (fix_quality > 0) */
+    uint32_t last_gga_tick;
+    uint32_t last_rmc_tick;
+    uint32_t last_ths_tick;
+    uint32_t last_vtg_tick;
+
+    /* Communication state */
+    bool     initialized;      /* VERSIONA or supported NMEA traffic seen */
+    bool     version_received; /* VERSIONA response seen */
+
+    /* ---- Internal parser state (not for external use) ---- */
+
+    /* Ring buffer */
+    uint8_t  rx_buf[UM982_RX_BUF_SIZE];
+    uint16_t rx_head;        /* Write index */
+    uint16_t rx_tail;        /* Read index */
+
+    /* Line assembler */
+    char     line_buf[UM982_LINE_BUF_SIZE];
+    uint8_t  line_len;
+    bool     line_overflow;  /* Current line exceeded buffer */
+
+    /* UART handle */
+    UART_HandleTypeDef *huart;
+
+} UM982_GPS_t;
+
+/* ========================= Public API ================================ */
+
+/**
+ * Initialize the UM982_GPS_t structure and configure the module.
+ *
+ * Sends: UNLOG, CONFIG HEADING, optional CONFIG HEADING LENGTH,
+ *        GPGGA, GPRMC, GPTHS
+ * Queries VERSIONA to verify communication.
+ *
+ * @param gps          Pointer to UM982_GPS_t instance
+ * @param huart        UART handle (e.g. &huart5)
+ * @param baseline_cm  Distance between antennas in cm (0 = use module default)
+ * @param tolerance_cm Baseline tolerance in cm (0 = use module default)
+ * @return true if VERSIONA response received within timeout
+ */
+bool um982_init(UM982_GPS_t *gps, UART_HandleTypeDef *huart,
+                float baseline_cm, float tolerance_cm);
+
+/**
+ * Process available UART data. Call from main loop — non-blocking.
+ *
+ * Reads all available bytes from UART, assembles lines, and dispatches
+ * complete NMEA sentences to the appropriate parser.
+ *
+ * @param gps  Pointer to UM982_GPS_t instance
+ */
+void um982_process(UM982_GPS_t *gps);
+
+/**
+ * Feed raw bytes directly into the parser (useful for testing).
+ * In production, um982_process() calls this internally after UART read.
+ *
+ * @param gps   Pointer to UM982_GPS_t instance
+ * @param data  Pointer to byte array
+ * @param len   Number of bytes
+ */
+void um982_feed(UM982_GPS_t *gps, const uint8_t *data, uint16_t len);
+
+/* ---- Getters ---- */
+
+static inline float    um982_get_heading(const UM982_GPS_t *gps)     { return gps->heading; }
+static inline double   um982_get_latitude(const UM982_GPS_t *gps)    { return gps->latitude; }
+static inline double   um982_get_longitude(const UM982_GPS_t *gps)   { return gps->longitude; }
+static inline float    um982_get_altitude(const UM982_GPS_t *gps)    { return gps->altitude; }
+static inline uint8_t  um982_get_fix_quality(const UM982_GPS_t *gps) { return gps->fix_quality; }
+static inline uint8_t  um982_get_num_sats(const UM982_GPS_t *gps)    { return gps->num_satellites; }
+static inline float    um982_get_hdop(const UM982_GPS_t *gps)        { return gps->hdop; }
+static inline float    um982_get_speed_knots(const UM982_GPS_t *gps) { return gps->speed_knots; }
+static inline float    um982_get_speed_kmh(const UM982_GPS_t *gps)   { return gps->speed_kmh; }
+static inline float    um982_get_course(const UM982_GPS_t *gps)      { return gps->course_true; }
+
+/**
+ * Check if heading is valid (mode A or D, and within timeout).
+ */
+bool um982_is_heading_valid(const UM982_GPS_t *gps);
+
+/**
+ * Check if position is valid (fix_quality > 0, and within timeout).
+ */
+bool um982_is_position_valid(const UM982_GPS_t *gps);
+
+/**
+ * Get age of last heading update in milliseconds.
+ */
+uint32_t um982_heading_age(const UM982_GPS_t *gps);
+
+/**
+ * Get age of the last valid position fix in milliseconds.
+ */
+uint32_t um982_position_age(const UM982_GPS_t *gps);
+
+/* ========================= Internal (exposed for testing) ============ */
+
+/**
+ * Verify NMEA checksum. Returns true if valid.
+ * Sentence must start with '$' and contain '*XX' before termination.
+ */
+bool um982_verify_checksum(const char *sentence);
+
+/**
+ * Parse a complete NMEA line (with $ prefix and *XX checksum).
+ * Dispatches to GGA/RMC/THS/VTG parsers as appropriate.
+ */
+void um982_parse_sentence(UM982_GPS_t *gps, const char *sentence);
+
+/**
+ * Parse NMEA coordinate string to decimal degrees.
+ * Works for both latitude (ddmm.mmmm) and longitude (dddmm.mmmm)
+ * by detecting the decimal point position.
+ *
+ * @param field     NMEA coordinate field (e.g. "4404.14036" or "12118.85961")
+ * @param hemisphere 'N', 'S', 'E', or 'W'
+ * @return Decimal degrees (negative for S/W), or NAN on parse error
+ */
+double um982_parse_coord(const char *field, char hemisphere);
+
+/**
+ * Send a command to the UM982. Appends \r\n automatically.
+ * @return true if UART transmit succeeded
+ */
+bool um982_send_command(UM982_GPS_t *gps, const char *cmd);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* UM982_GPS_H */
@@ -3,18 +3,38 @@
 *.dSYM/

 # Test binaries (built by Makefile)
+# TESTS_WITH_REAL
 test_bug1_timed_sync_init_ordering
-test_bug2_ad9523_double_setup
 test_bug3_timed_sync_noop
 test_bug4_phase_shift_before_check
 test_bug5_fine_phase_gpio_only
+test_bug9_platform_ops_null
+test_bug10_spi_cs_not_toggled
+test_bug15_htim3_dangling_extern
+
+# TESTS_MOCK_ONLY
+test_bug2_ad9523_double_setup
 test_bug6_timer_variable_collision
 test_bug7_gpio_pin_conflict
 test_bug8_uart_commented_out
-test_bug9_platform_ops_null
-test_bug10_spi_cs_not_toggled
-test_bug11_platform_spi_transmit_only
+test_bug14_diag_section_args
+test_gap3_emergency_stop_rails
+
+# TESTS_STANDALONE
 test_bug12_pa_cal_loop_inverted
 test_bug13_dac2_adc_buffer_mismatch
-test_bug14_diag_section_args
-test_bug15_htim3_dangling_extern
+test_gap3_iwdg_config
+test_gap3_temperature_max
+test_gap3_idq_periodic_reread
+test_gap3_emergency_state_ordering
+test_gap3_overtemp_emergency_stop
+test_gap3_health_watchdog_cold_start
+
+# TESTS_WITH_PLATFORM
+test_bug11_platform_spi_transmit_only
+
+# TESTS_WITH_CXX
+test_agc_outer_loop
+
+# Manual / one-off test builds
+test_um982_gps
@@ -27,6 +27,10 @@ CXX_LIB_DIR := ../9_1_1_C_Cpp_Libraries
 CXX_SRCS    := $(CXX_LIB_DIR)/ADAR1000_AGC.cpp $(CXX_LIB_DIR)/ADAR1000_Manager.cpp
 CXX_OBJS    := ADAR1000_AGC.o ADAR1000_Manager.o

+# GPS driver source
+GPS_SRC := ../9_1_3_C_Cpp_Code/um982_gps.c
+GPS_OBJ := um982_gps.o
+
 # Real source files compiled against mock headers
 REAL_SRC := ../9_1_1_C_Cpp_Libraries/adf4382a_manager.c

@@ -64,7 +68,9 @@ TESTS_STANDALONE := test_bug12_pa_cal_loop_inverted \
                    test_gap3_iwdg_config \
                    test_gap3_temperature_max \
                    test_gap3_idq_periodic_reread \
-                    test_gap3_emergency_state_ordering
+                    test_gap3_emergency_state_ordering \
+                    test_gap3_overtemp_emergency_stop \
+                    test_gap3_health_watchdog_cold_start

 # Tests that need platform_noos_stm32.o + mocks
 TESTS_WITH_PLATFORM := test_bug11_platform_spi_transmit_only
@@ -72,11 +78,15 @@ TESTS_WITH_PLATFORM := test_bug11_platform_spi_transmit_only
 # C++ tests (AGC outer loop)
 TESTS_WITH_CXX := test_agc_outer_loop

-ALL_TESTS := $(TESTS_WITH_REAL) $(TESTS_MOCK_ONLY) $(TESTS_STANDALONE) $(TESTS_WITH_PLATFORM) $(TESTS_WITH_CXX)
+# GPS driver tests (need mocks + GPS source + -lm)
+TESTS_GPS := test_um982_gps
+
+ALL_TESTS := $(TESTS_WITH_REAL) $(TESTS_MOCK_ONLY) $(TESTS_STANDALONE) $(TESTS_WITH_PLATFORM) $(TESTS_WITH_CXX) $(TESTS_GPS)

 .PHONY: all build test clean \
        $(addprefix test_,bug1 bug2 bug3 bug4 bug5 bug6 bug7 bug8 bug9 bug10 bug11 bug12 bug13 bug14 bug15) \
-        test_gap3_estop test_gap3_iwdg test_gap3_temp test_gap3_idq test_gap3_order
+        test_gap3_estop test_gap3_iwdg test_gap3_temp test_gap3_idq test_gap3_order \
+        test_gap3_overtemp test_gap3_wdog

 all: build test

@@ -162,6 +172,12 @@ test_gap3_idq_periodic_reread: test_gap3_idq_periodic_reread.c
 test_gap3_emergency_state_ordering: test_gap3_emergency_state_ordering.c
 	$(CC) $(CFLAGS) $< -o $@

+test_gap3_overtemp_emergency_stop: test_gap3_overtemp_emergency_stop.c
+	$(CC) $(CFLAGS) $< -o $@
+
+test_gap3_health_watchdog_cold_start: test_gap3_health_watchdog_cold_start.c
+	$(CC) $(CFLAGS) $< -o $@
+
 # Tests that need platform_noos_stm32.o + mocks
 $(TESTS_WITH_PLATFORM): %: %.c $(MOCK_OBJS) $(PLATFORM_OBJ)
 	$(CC) $(CFLAGS) $(INCLUDES) $< $(MOCK_OBJS) $(PLATFORM_OBJ) -o $@
@@ -184,6 +200,20 @@ test_agc_outer_loop: test_agc_outer_loop.cpp $(CXX_OBJS) $(MOCK_OBJS)
 test_agc: test_agc_outer_loop
 	./test_agc_outer_loop

+# --- GPS driver rules ---
+
+$(GPS_OBJ): $(GPS_SRC)
+	$(CC) $(CFLAGS) $(INCLUDES) -I../9_1_3_C_Cpp_Code -c $< -o $@
+
+# Note: test includes um982_gps.c directly for white-box testing (static fn access)
+test_um982_gps: test_um982_gps.c $(MOCK_OBJS)
+	$(CC) $(CFLAGS) $(INCLUDES) -I../9_1_3_C_Cpp_Code $< $(MOCK_OBJS) -lm -o $@
+
+# Convenience target
+.PHONY: test_gps
+test_gps: test_um982_gps
+	./test_um982_gps
+
 # --- Individual test targets ---

 test_bug1: test_bug1_timed_sync_init_ordering
@@ -246,6 +276,12 @@ test_gap3_idq: test_gap3_idq_periodic_reread
 test_gap3_order: test_gap3_emergency_state_ordering
 	./test_gap3_emergency_state_ordering

+test_gap3_overtemp: test_gap3_overtemp_emergency_stop
+	./test_gap3_overtemp_emergency_stop
+
+test_gap3_wdog: test_gap3_health_watchdog_cold_start
+	./test_gap3_health_watchdog_cold_start
+
 # --- Clean ---

 clean:
@@ -21,6 +21,7 @@ SPI_HandleTypeDef  hspi4 = { .id = 4 };
 I2C_HandleTypeDef  hi2c1 = { .id = 1 };
 I2C_HandleTypeDef  hi2c2 = { .id = 2 };
 UART_HandleTypeDef huart3 = { .id = 3 };
+UART_HandleTypeDef huart5 = { .id = 5 };  /* GPS UART */
 ADC_HandleTypeDef  hadc3 = { .id = 3 };
 TIM_HandleTypeDef  htim3 = { .id = 3 };

@@ -34,6 +35,26 @@ uint32_t mock_tick = 0;
 /* ========================= Printf control ========================= */
 int mock_printf_enabled = 0;

+/* ========================= Mock UART TX capture =================== */
+uint8_t  mock_uart_tx_buf[MOCK_UART_TX_BUF_SIZE];
+uint16_t mock_uart_tx_len = 0;
+
+/* ========================= Mock UART RX buffer ==================== */
+#define MOCK_UART_RX_SLOTS 8
+
+static struct {
+    uint32_t uart_id;
+    uint8_t  buf[MOCK_UART_RX_BUF_SIZE];
+    uint16_t head;
+    uint16_t tail;
+} mock_uart_rx[MOCK_UART_RX_SLOTS];
+
+void mock_uart_tx_clear(void)
+{
+    mock_uart_tx_len = 0;
+    memset(mock_uart_tx_buf, 0, sizeof(mock_uart_tx_buf));
+}
+
 /* ========================= Mock GPIO read ========================= */
 #define GPIO_READ_TABLE_SIZE 32
 static struct {
@@ -49,6 +70,9 @@ void spy_reset(void)
    mock_tick = 0;
    mock_printf_enabled = 0;
    memset(gpio_read_table, 0, sizeof(gpio_read_table));
+    memset(mock_uart_rx, 0, sizeof(mock_uart_rx));
+    mock_uart_tx_len = 0;
+    memset(mock_uart_tx_buf, 0, sizeof(mock_uart_tx_buf));
 }

 const SpyRecord *spy_get(int index)
@@ -185,6 +209,83 @@ HAL_StatusTypeDef HAL_UART_Transmit(UART_HandleTypeDef *huart, const uint8_t *pD
        .value = Timeout,
        .extra = huart
    });
+    /* Capture TX data for test inspection */
+    for (uint16_t i = 0; i < Size && mock_uart_tx_len < MOCK_UART_TX_BUF_SIZE; i++) {
+        mock_uart_tx_buf[mock_uart_tx_len++] = pData[i];
+    }
+    return HAL_OK;
+}
+
+/* ========================= Mock UART RX helpers ====================== */
+
+/* find_rx_slot, mock_uart_rx_load, etc. use the mock_uart_rx declared above */
+
+static int find_rx_slot(UART_HandleTypeDef *huart)
+{
+    if (huart == NULL) return -1;
+    /* Find existing slot */
+    for (int i = 0; i < MOCK_UART_RX_SLOTS; i++) {
+        if (mock_uart_rx[i].uart_id == huart->id && mock_uart_rx[i].head != mock_uart_rx[i].tail) {
+            return i;
+        }
+        if (mock_uart_rx[i].uart_id == huart->id) {
+            return i;
+        }
+    }
+    /* Find empty slot */
+    for (int i = 0; i < MOCK_UART_RX_SLOTS; i++) {
+        if (mock_uart_rx[i].uart_id == 0) {
+            mock_uart_rx[i].uart_id = huart->id;
+            return i;
+        }
+    }
+    return -1;
+}
+
+void mock_uart_rx_load(UART_HandleTypeDef *huart, const uint8_t *data, uint16_t len)
+{
+    int slot = find_rx_slot(huart);
+    if (slot < 0) return;
+    mock_uart_rx[slot].uart_id = huart->id;
+    for (uint16_t i = 0; i < len; i++) {
+        uint16_t next = (mock_uart_rx[slot].head + 1) % MOCK_UART_RX_BUF_SIZE;
+        if (next == mock_uart_rx[slot].tail) break;  /* Buffer full */
+        mock_uart_rx[slot].buf[mock_uart_rx[slot].head] = data[i];
+        mock_uart_rx[slot].head = next;
+    }
+}
+
+void mock_uart_rx_clear(UART_HandleTypeDef *huart)
+{
+    int slot = find_rx_slot(huart);
+    if (slot < 0) return;
+    mock_uart_rx[slot].head = 0;
+    mock_uart_rx[slot].tail = 0;
+}
+
+HAL_StatusTypeDef HAL_UART_Receive(UART_HandleTypeDef *huart, uint8_t *pData,
+                                    uint16_t Size, uint32_t Timeout)
+{
+    (void)Timeout;
+    int slot = find_rx_slot(huart);
+    if (slot < 0) return HAL_TIMEOUT;
+
+    for (uint16_t i = 0; i < Size; i++) {
+        if (mock_uart_rx[slot].head == mock_uart_rx[slot].tail) {
+            return HAL_TIMEOUT;  /* No more data */
+        }
+        pData[i] = mock_uart_rx[slot].buf[mock_uart_rx[slot].tail];
+        mock_uart_rx[slot].tail = (mock_uart_rx[slot].tail + 1) % MOCK_UART_RX_BUF_SIZE;
+    }
+
+    spy_push((SpyRecord){
+        .type  = SPY_UART_RX,
+        .port  = NULL,
+        .pin   = Size,
+        .value = Timeout,
+        .extra = huart
+    });
+
    return HAL_OK;
 }

@@ -105,6 +105,7 @@ typedef struct {
 extern SPI_HandleTypeDef  hspi1, hspi4;
 extern I2C_HandleTypeDef  hi2c1, hi2c2;
 extern UART_HandleTypeDef huart3;
+extern UART_HandleTypeDef huart5;  /* GPS UART */
 extern ADC_HandleTypeDef  hadc3;
 extern TIM_HandleTypeDef  htim3;  /* Timer for DELADJ PWM */

@@ -139,6 +140,7 @@ typedef enum {
    SPY_TIM_SET_COMPARE,
    SPY_SPI_TRANSMIT_RECEIVE,
    SPY_SPI_TRANSMIT,
+    SPY_UART_RX,
 } SpyCallType;

 typedef struct {
@@ -187,6 +189,23 @@ void          HAL_GPIO_TogglePin(GPIO_TypeDef *GPIOx, uint16_t GPIO_Pin);
 uint32_t      HAL_GetTick(void);
 void          HAL_Delay(uint32_t Delay);
 HAL_StatusTypeDef HAL_UART_Transmit(UART_HandleTypeDef *huart, const uint8_t *pData, uint16_t Size, uint32_t Timeout);
+HAL_StatusTypeDef HAL_UART_Receive(UART_HandleTypeDef *huart, uint8_t *pData, uint16_t Size, uint32_t Timeout);
+
+/* ========================= Mock UART RX buffer ======================= */
+
+/* Inject bytes into the mock UART RX buffer for a specific UART handle.
+ * HAL_UART_Receive will return these bytes one at a time. */
+#define MOCK_UART_RX_BUF_SIZE 2048
+
+void mock_uart_rx_load(UART_HandleTypeDef *huart, const uint8_t *data, uint16_t len);
+void mock_uart_rx_clear(UART_HandleTypeDef *huart);
+
+/* Capture buffer for UART TX data (to verify commands sent to GPS module) */
+#define MOCK_UART_TX_BUF_SIZE 2048
+
+extern uint8_t  mock_uart_tx_buf[MOCK_UART_TX_BUF_SIZE];
+extern uint16_t mock_uart_tx_len;
+void mock_uart_tx_clear(void);

 /* ========================= SPI stubs ============================== */

@@ -50,7 +50,7 @@ static void test_defaults()
    assert(agc.min_gain == 0);
    assert(agc.max_gain == 127);
    assert(agc.holdoff_frames == 4);
-    assert(agc.enabled == true);
+    assert(agc.enabled == false);  // disabled by default — FPGA DIG_6 is source of truth
    assert(agc.holdoff_counter == 0);
    assert(agc.last_saturated == false);
    assert(agc.saturation_event_count == 0);
@@ -67,6 +67,7 @@ static void test_defaults()
 static void test_saturation_reduces_gain()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    uint8_t initial = agc.agc_base_gain;  // 30

    agc.update(true);  // saturation
@@ -82,6 +83,7 @@ static void test_saturation_reduces_gain()
 static void test_holdoff_prevents_early_gain_up()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    agc.update(true);  // saturate once -> gain = 26
    uint8_t after_sat = agc.agc_base_gain;

@@ -101,6 +103,7 @@ static void test_holdoff_prevents_early_gain_up()
 static void test_recovery_after_holdoff()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    agc.update(true);  // saturate -> gain = 26
    uint8_t after_sat = agc.agc_base_gain;

@@ -119,6 +122,7 @@ static void test_recovery_after_holdoff()
 static void test_min_gain_clamp()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    agc.min_gain = 10;
    agc.agc_base_gain = 12;
    agc.gain_step_down = 4;
@@ -136,6 +140,7 @@ static void test_min_gain_clamp()
 static void test_max_gain_clamp()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    agc.max_gain = 32;
    agc.agc_base_gain = 31;
    agc.gain_step_up = 2;
@@ -226,6 +231,7 @@ static void test_apply_gain_spi()
 static void test_reset_preserves_config()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    agc.agc_base_gain = 42;
    agc.gain_step_down = 8;
    agc.cal_offset[3] = -5;
@@ -255,6 +261,7 @@ static void test_reset_preserves_config()
 static void test_saturation_counter()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test

    for (int i = 0; i < 10; ++i) {
        agc.update(true);
@@ -274,6 +281,7 @@ static void test_saturation_counter()
 static void test_mixed_sequence()
 {
    ADAR1000_AGC agc;
+    agc.enabled = true;  // default is OFF; enable for this test
    agc.agc_base_gain = 30;
    agc.gain_step_down = 4;
    agc.gain_step_up = 1;
@@ -34,22 +34,25 @@ static void Mock_Emergency_Stop(void)
    state_was_true_when_estop_called = system_emergency_state;
 }

-/* Error codes (subset matching main.cpp) */
+/* Error codes (subset matching main.cpp SystemError_t) */
 typedef enum {
    ERROR_NONE = 0,
    ERROR_RF_PA_OVERCURRENT = 9,
    ERROR_RF_PA_BIAS = 10,
-    ERROR_STEPPER_FAULT = 11,
+    ERROR_STEPPER_MOTOR = 11,
    ERROR_FPGA_COMM = 12,
    ERROR_POWER_SUPPLY = 13,
    ERROR_TEMPERATURE_HIGH = 14,
+    ERROR_MEMORY_ALLOC = 15,
+    ERROR_WATCHDOG_TIMEOUT = 16,
 } SystemError_t;

-/* Extracted critical-error handling logic (post-fix ordering) */
+/* Extracted critical-error handling logic (matches post-fix main.cpp predicate) */
 static void simulate_handleSystemError_critical(SystemError_t error)
 {
-    /* Only critical errors (PA overcurrent through power supply) trigger e-stop */
-    if (error >= ERROR_RF_PA_OVERCURRENT && error <= ERROR_POWER_SUPPLY) {
+    if ((error >= ERROR_RF_PA_OVERCURRENT && error <= ERROR_POWER_SUPPLY) ||
+        error == ERROR_TEMPERATURE_HIGH ||
+        error == ERROR_WATCHDOG_TIMEOUT) {
        /* FIX 5: set flag BEFORE calling Emergency_Stop */
        system_emergency_state = true;
        Mock_Emergency_Stop();
@@ -93,17 +96,39 @@ int main(void)
    assert(state_was_true_when_estop_called == true);
    printf("PASS\n");

-    /* Test 4: Non-critical error → no e-stop, flag stays false */
-    printf("  Test 4: Non-critical error (no e-stop)... ");
+    /* Test 4: Overtemp → MUST trigger e-stop (was incorrectly non-critical before fix) */
+    printf("  Test 4: Overtemp triggers e-stop... ");
    system_emergency_state = false;
    emergency_stop_called = false;
+    state_was_true_when_estop_called = false;
    simulate_handleSystemError_critical(ERROR_TEMPERATURE_HIGH);
+    assert(emergency_stop_called == true);
+    assert(system_emergency_state == true);
+    assert(state_was_true_when_estop_called == true);
+    printf("PASS\n");
+
+    /* Test 5: Watchdog timeout → MUST trigger e-stop */
+    printf("  Test 5: Watchdog timeout triggers e-stop... ");
+    system_emergency_state = false;
+    emergency_stop_called = false;
+    state_was_true_when_estop_called = false;
+    simulate_handleSystemError_critical(ERROR_WATCHDOG_TIMEOUT);
+    assert(emergency_stop_called == true);
+    assert(system_emergency_state == true);
+    assert(state_was_true_when_estop_called == true);
+    printf("PASS\n");
+
+    /* Test 6: Non-critical error (memory alloc) → no e-stop */
+    printf("  Test 6: Non-critical error (no e-stop)... ");
+    system_emergency_state = false;
+    emergency_stop_called = false;
+    simulate_handleSystemError_critical(ERROR_MEMORY_ALLOC);
    assert(emergency_stop_called == false);
    assert(system_emergency_state == false);
    printf("PASS\n");

-    /* Test 5: ERROR_NONE → no e-stop */
-    printf("  Test 5: ERROR_NONE (no action)... ");
+    /* Test 7: ERROR_NONE → no e-stop */
+    printf("  Test 7: ERROR_NONE (no action)... ");
    system_emergency_state = false;
    emergency_stop_called = false;
    simulate_handleSystemError_critical(ERROR_NONE);
@@ -111,6 +136,6 @@ int main(void)
    assert(system_emergency_state == false);
    printf("PASS\n");

-    printf("\n=== Gap-3 Fix 5: ALL TESTS PASSED ===\n\n");
+    printf("\n=== Gap-3 Fix 5: ALL 7 TESTS PASSED ===\n\n");
    return 0;
 }
@@ -0,0 +1,132 @@
+/*******************************************************************************
+ * test_gap3_health_watchdog_cold_start.c
+ *
+ * Safety bug: checkSystemHealth()'s internal watchdog (step 9, pre-fix) had two
+ * linked defects that, once ERROR_WATCHDOG_TIMEOUT was escalated to
+ * Emergency_Stop() by the overtemp/watchdog PR, would false-latch the radar:
+ *
+ *   (1) Cold-start false trip:
+ *         static uint32_t last_health_check = 0;
+ *         if (HAL_GetTick() - last_health_check > 60000) { ... }
+ *       On the very first call, last_health_check == 0, so once the MCU has
+ *       been up >60 s (which is typical after the ADAR1000 / AD9523 / ADF4382
+ *       init sequence) the subtraction `now - 0` exceeds 60 000 ms and the
+ *       watchdog trips spuriously.
+ *
+ *   (2) Stale-timestamp after early returns:
+ *         last_health_check = HAL_GetTick();   // at END of function
+ *       Every earlier sub-check (IMU, BMP180, GPS, PA Idq, temperature) has an
+ *       `if (fault) return current_error;` path that skips the update. After a
+ *       cumulative 60 s of transient faults, the next clean call compares
+ *       `now` against the long-stale `last_health_check` and trips.
+ *
+ * After fix:  Watchdog logic moved to function ENTRY. A dedicated cold-start
+ *             branch seeds the timestamp on the first call without checking.
+ *             On every subsequent call, the elapsed delta is captured FIRST
+ *             and last_health_check is updated BEFORE any sub-check runs, so
+ *             early returns no longer leave a stale value.
+ *
+ * Test strategy:
+ *   Extract the post-fix watchdog predicate into a standalone function that
+ *   takes a simulated HAL_GetTick() value and returns whether the watchdog
+ *   should trip. Walk through boot + fault sequences that would have tripped
+ *   the pre-fix code and assert the post-fix code does NOT trip.
+ ******************************************************************************/
+#include <assert.h>
+#include <stdint.h>
+#include <stdio.h>
+
+/* --- Post-fix watchdog state + predicate, extracted verbatim --- */
+static uint32_t last_health_check = 0;
+
+/* Returns 1 iff this call should raise ERROR_WATCHDOG_TIMEOUT.
+   Updates last_health_check BEFORE returning (matches post-fix behaviour). */
+static int health_watchdog_step(uint32_t now_tick)
+{
+    if (last_health_check == 0) {
+        last_health_check = now_tick;   /* cold start: seed only, never trip */
+        return 0;
+    }
+    uint32_t elapsed = now_tick - last_health_check;
+    last_health_check = now_tick;       /* update BEFORE any early return */
+    return (elapsed > 60000) ? 1 : 0;
+}
+
+/* Test helper: reset the static state between scenarios. */
+static void reset_state(void) { last_health_check = 0; }
+
+int main(void)
+{
+    printf("=== Safety fix: checkSystemHealth() watchdog cold-start + stale-ts ===\n");
+
+    /* ---------- Scenario 1: cold-start after 60 s of init must NOT trip ---- */
+    printf("  Test 1: first call at t=75000 ms (post-init) does not trip... ");
+    reset_state();
+    assert(health_watchdog_step(75000) == 0);
+    printf("PASS\n");
+
+    /* ---------- Scenario 2: first call far beyond 60 s (PRE-FIX BUG) ------- */
+    printf("  Test 2: first call at t=600000 ms still does not trip... ");
+    reset_state();
+    assert(health_watchdog_step(600000) == 0);
+    printf("PASS\n");
+
+    /* ---------- Scenario 3: healthy main-loop pacing (10 ms period) -------- */
+    printf("  Test 3: 1000 calls at 10 ms intervals never trip... ");
+    reset_state();
+    (void)health_watchdog_step(1000);  /* seed */
+    for (int i = 1; i <= 1000; i++) {
+        assert(health_watchdog_step(1000 + i * 10) == 0);
+    }
+    printf("PASS\n");
+
+    /* ---------- Scenario 4: stale-timestamp after a burst of early returns -
+       Pre-fix bug: many early returns skipped the timestamp update, so a
+       later clean call would compare `now` against a 60+ s old value. Post-fix,
+       every call (including ones that would have early-returned in the real
+       function) updates the timestamp at the top, so this scenario is modelled
+       by calling health_watchdog_step() on every iteration of the main loop. */
+    printf("  Test 4: 70 s of 100 ms-spaced calls after seed do not trip... ");
+    reset_state();
+    (void)health_watchdog_step(50000);   /* seed mid-run */
+    for (int i = 1; i <= 700; i++) {     /* 70 s @ 100 ms */
+        int tripped = health_watchdog_step(50000 + i * 100);
+        assert(tripped == 0);
+    }
+    printf("PASS\n");
+
+    /* ---------- Scenario 5: genuine stall MUST trip ------------------------ */
+    printf("  Test 5: real 60+ s gap between calls does trip... ");
+    reset_state();
+    (void)health_watchdog_step(10000);              /* seed */
+    assert(health_watchdog_step(10000 + 60001) == 1);
+    printf("PASS\n");
+
+    /* ---------- Scenario 6: exactly 60 s gap is the boundary -- do NOT trip
+       Post-fix predicate uses strict >60000, matching the pre-fix comparator. */
+    printf("  Test 6: exactly 60000 ms gap does not trip (boundary)... ");
+    reset_state();
+    (void)health_watchdog_step(10000);
+    assert(health_watchdog_step(10000 + 60000) == 0);
+    printf("PASS\n");
+
+    /* ---------- Scenario 7: trip, then recover on next paced call ---------- */
+    printf("  Test 7: after a genuine stall+trip, next paced call does not re-trip... ");
+    reset_state();
+    (void)health_watchdog_step(5000);                      /* seed */
+    assert(health_watchdog_step(5000 + 70000) == 1);       /* stall -> trip */
+    assert(health_watchdog_step(5000 + 70000 + 10) == 0);  /* resume paced */
+    printf("PASS\n");
+
+    /* ---------- Scenario 8: HAL_GetTick() 32-bit wrap (~49.7 days) ---------
+       Because we subtract unsigned 32-bit values, wrap is handled correctly as
+       long as the true elapsed time is < 2^32 ms. */
+    printf("  Test 8: tick wrap from 0xFFFFFF00 -> 0x00000064 (200 ms span) does not trip... ");
+    reset_state();
+    (void)health_watchdog_step(0xFFFFFF00u);
+    assert(health_watchdog_step(0x00000064u) == 0);  /* elapsed = 0x164 = 356 ms */
+    printf("PASS\n");
+
+    printf("\n=== Safety fix: ALL TESTS PASSED ===\n\n");
+    return 0;
+}
@@ -0,0 +1,119 @@
+/*******************************************************************************
+ * test_gap3_overtemp_emergency_stop.c
+ *
+ * Safety bug: handleSystemError() did not escalate ERROR_TEMPERATURE_HIGH
+ * (or ERROR_WATCHDOG_TIMEOUT) to Emergency_Stop().
+ *
+ * Before fix:  The critical-error gate was
+ *                if (error >= ERROR_RF_PA_OVERCURRENT &&
+ *                    error <= ERROR_POWER_SUPPLY) { Emergency_Stop(); }
+ *              So overtemp (code 14) and watchdog timeout (code 16) fell
+ *              through to attemptErrorRecovery()'s default branch (log and
+ *              continue), leaving the 10 W GaN PAs biased at >75 °C.
+ *
+ * After fix:   The gate also matches ERROR_TEMPERATURE_HIGH and
+ *              ERROR_WATCHDOG_TIMEOUT, so thermal and watchdog faults
+ *              latch Emergency_Stop() exactly like PA overcurrent.
+ *
+ * Test strategy:
+ *   Replicate the critical-error predicate and assert that every error
+ *   enum value which threatens RF/power safety is accepted, and that the
+ *   non-critical ones (comm, sensor, memory) are not.
+ ******************************************************************************/
+#include <assert.h>
+#include <stdio.h>
+
+/* Mirror of SystemError_t from main.cpp (keep in lockstep). */
+typedef enum {
+    ERROR_NONE = 0,
+    ERROR_AD9523_CLOCK,
+    ERROR_ADF4382_TX_UNLOCK,
+    ERROR_ADF4382_RX_UNLOCK,
+    ERROR_ADAR1000_COMM,
+    ERROR_ADAR1000_TEMP,
+    ERROR_IMU_COMM,
+    ERROR_BMP180_COMM,
+    ERROR_GPS_COMM,
+    ERROR_RF_PA_OVERCURRENT,
+    ERROR_RF_PA_BIAS,
+    ERROR_STEPPER_MOTOR,
+    ERROR_FPGA_COMM,
+    ERROR_POWER_SUPPLY,
+    ERROR_TEMPERATURE_HIGH,
+    ERROR_MEMORY_ALLOC,
+    ERROR_WATCHDOG_TIMEOUT
+} SystemError_t;
+
+/* Extracted post-fix predicate: returns 1 when Emergency_Stop() must fire. */
+static int triggers_emergency_stop(SystemError_t e)
+{
+    return ((e >= ERROR_RF_PA_OVERCURRENT && e <= ERROR_POWER_SUPPLY) ||
+            e == ERROR_TEMPERATURE_HIGH ||
+            e == ERROR_WATCHDOG_TIMEOUT);
+}
+
+int main(void)
+{
+    printf("=== Safety fix: overtemp / watchdog -> Emergency_Stop() ===\n");
+
+    /* --- Errors that MUST latch Emergency_Stop --- */
+    printf("  Test 1: ERROR_RF_PA_OVERCURRENT triggers... ");
+    assert(triggers_emergency_stop(ERROR_RF_PA_OVERCURRENT));
+    printf("PASS\n");
+
+    printf("  Test 2: ERROR_RF_PA_BIAS triggers... ");
+    assert(triggers_emergency_stop(ERROR_RF_PA_BIAS));
+    printf("PASS\n");
+
+    printf("  Test 3: ERROR_STEPPER_MOTOR triggers... ");
+    assert(triggers_emergency_stop(ERROR_STEPPER_MOTOR));
+    printf("PASS\n");
+
+    printf("  Test 4: ERROR_FPGA_COMM triggers... ");
+    assert(triggers_emergency_stop(ERROR_FPGA_COMM));
+    printf("PASS\n");
+
+    printf("  Test 5: ERROR_POWER_SUPPLY triggers... ");
+    assert(triggers_emergency_stop(ERROR_POWER_SUPPLY));
+    printf("PASS\n");
+
+    printf("  Test 6: ERROR_TEMPERATURE_HIGH triggers (regression)... ");
+    assert(triggers_emergency_stop(ERROR_TEMPERATURE_HIGH));
+    printf("PASS\n");
+
+    printf("  Test 7: ERROR_WATCHDOG_TIMEOUT triggers (regression)... ");
+    assert(triggers_emergency_stop(ERROR_WATCHDOG_TIMEOUT));
+    printf("PASS\n");
+
+    /* --- Errors that MUST NOT escalate (recoverable / informational) --- */
+    printf("  Test 8: ERROR_NONE does not trigger... ");
+    assert(!triggers_emergency_stop(ERROR_NONE));
+    printf("PASS\n");
+
+    printf("  Test 9: ERROR_AD9523_CLOCK does not trigger... ");
+    assert(!triggers_emergency_stop(ERROR_AD9523_CLOCK));
+    printf("PASS\n");
+
+    printf("  Test 10: ERROR_ADF4382_TX_UNLOCK does not trigger (recoverable)... ");
+    assert(!triggers_emergency_stop(ERROR_ADF4382_TX_UNLOCK));
+    printf("PASS\n");
+
+    printf("  Test 11: ERROR_ADAR1000_COMM does not trigger... ");
+    assert(!triggers_emergency_stop(ERROR_ADAR1000_COMM));
+    printf("PASS\n");
+
+    printf("  Test 12: ERROR_IMU_COMM does not trigger... ");
+    assert(!triggers_emergency_stop(ERROR_IMU_COMM));
+    printf("PASS\n");
+
+    printf("  Test 13: ERROR_GPS_COMM does not trigger... ");
+    assert(!triggers_emergency_stop(ERROR_GPS_COMM));
+    printf("PASS\n");
+
+    printf("  Test 14: ERROR_MEMORY_ALLOC does not trigger... ");
+    assert(!triggers_emergency_stop(ERROR_MEMORY_ALLOC));
+    printf("PASS\n");
+
+    printf("\n=== Safety fix: ALL TESTS PASSED ===\n\n");
+    return 0;
+}
@@ -0,0 +1,853 @@
+/*******************************************************************************
+ * test_um982_gps.c -- Unit tests for UM982 GPS driver
+ *
+ * Tests NMEA parsing, checksum validation, coordinate parsing, init sequence,
+ * and validity tracking. Uses the mock HAL infrastructure for UART.
+ *
+ * Build: see Makefile target test_um982_gps
+ * Run:   ./test_um982_gps
+ ******************************************************************************/
+#include "stm32_hal_mock.h"
+#include "../9_1_3_C_Cpp_Code/um982_gps.h"
+#include "../9_1_3_C_Cpp_Code/um982_gps.c"  /* Include .c directly for white-box testing */
+
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include <math.h>
+
+/* ========================= Test helpers ============================== */
+
+static int tests_passed = 0;
+static int tests_failed = 0;
+
+#define TEST(name) \
+    do { printf("  [TEST] %-55s ", name); } while(0)
+
+#define PASS() \
+    do { printf("PASS\n"); tests_passed++; } while(0)
+
+#define FAIL(msg) \
+    do { printf("FAIL: %s\n", msg); tests_failed++; } while(0)
+
+#define ASSERT_TRUE(expr, msg) \
+    do { if (!(expr)) { FAIL(msg); return; } } while(0)
+
+#define ASSERT_FALSE(expr, msg) \
+    do { if (expr) { FAIL(msg); return; } } while(0)
+
+#define ASSERT_EQ_INT(a, b, msg) \
+    do { if ((a) != (b)) { \
+        char _buf[256]; \
+        snprintf(_buf, sizeof(_buf), "%s (got %d, expected %d)", msg, (int)(a), (int)(b)); \
+        FAIL(_buf); return; \
+    } } while(0)
+
+#define ASSERT_NEAR(a, b, tol, msg) \
+    do { if (fabs((double)(a) - (double)(b)) > (tol)) { \
+        char _buf[256]; \
+        snprintf(_buf, sizeof(_buf), "%s (got %.8f, expected %.8f)", msg, (double)(a), (double)(b)); \
+        FAIL(_buf); return; \
+    } } while(0)
+
+#define ASSERT_NAN(val, msg) \
+    do { if (!isnan(val)) { FAIL(msg); return; } } while(0)
+
+static UM982_GPS_t gps;
+
+static void reset_gps(void)
+{
+    spy_reset();
+    memset(&gps, 0, sizeof(gps));
+    gps.huart = &huart5;
+    gps.heading = NAN;
+    gps.heading_mode = 'V';
+    gps.rmc_status = 'V';
+}
+
+/* ========================= Checksum tests ============================ */
+
+static void test_checksum_valid(void)
+{
+    TEST("checksum: valid GGA");
+    ASSERT_TRUE(um982_verify_checksum(
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47"),
+        "should be valid");
+    PASS();
+}
+
+static void test_checksum_valid_ths(void)
+{
+    TEST("checksum: valid THS");
+    ASSERT_TRUE(um982_verify_checksum("$GNTHS,341.3344,A*1F"),
+        "should be valid");
+    PASS();
+}
+
+static void test_checksum_invalid(void)
+{
+    TEST("checksum: invalid (wrong value)");
+    ASSERT_FALSE(um982_verify_checksum("$GNTHS,341.3344,A*FF"),
+        "should be invalid");
+    PASS();
+}
+
+static void test_checksum_missing_star(void)
+{
+    TEST("checksum: missing * marker");
+    ASSERT_FALSE(um982_verify_checksum("$GNTHS,341.3344,A"),
+        "should be invalid");
+    PASS();
+}
+
+static void test_checksum_null(void)
+{
+    TEST("checksum: NULL input");
+    ASSERT_FALSE(um982_verify_checksum(NULL), "should be false");
+    PASS();
+}
+
+static void test_checksum_no_dollar(void)
+{
+    TEST("checksum: missing $ prefix");
+    ASSERT_FALSE(um982_verify_checksum("GNTHS,341.3344,A*1F"),
+        "should be invalid without $");
+    PASS();
+}
+
+/* ========================= Coordinate parsing tests ================== */
+
+static void test_coord_latitude_north(void)
+{
+    TEST("coord: latitude 4404.14036 N");
+    double lat = um982_parse_coord("4404.14036", 'N');
+    /* 44 + 04.14036/60 = 44.069006 */
+    ASSERT_NEAR(lat, 44.069006, 0.000001, "latitude");
+    PASS();
+}
+
+static void test_coord_latitude_south(void)
+{
+    TEST("coord: latitude 3358.92500 S (negative)");
+    double lat = um982_parse_coord("3358.92500", 'S');
+    ASSERT_TRUE(lat < 0.0, "should be negative for S");
+    ASSERT_NEAR(lat, -(33.0 + 58.925/60.0), 0.000001, "latitude");
+    PASS();
+}
+
+static void test_coord_longitude_3digit(void)
+{
+    TEST("coord: longitude 12118.85961 W (3-digit degrees)");
+    double lon = um982_parse_coord("12118.85961", 'W');
+    /* 121 + 18.85961/60 = 121.314327 */
+    ASSERT_TRUE(lon < 0.0, "should be negative for W");
+    ASSERT_NEAR(lon, -(121.0 + 18.85961/60.0), 0.000001, "longitude");
+    PASS();
+}
+
+static void test_coord_longitude_east(void)
+{
+    TEST("coord: longitude 11614.19729 E");
+    double lon = um982_parse_coord("11614.19729", 'E');
+    ASSERT_TRUE(lon > 0.0, "should be positive for E");
+    ASSERT_NEAR(lon, 116.0 + 14.19729/60.0, 0.000001, "longitude");
+    PASS();
+}
+
+static void test_coord_empty(void)
+{
+    TEST("coord: empty string returns NAN");
+    ASSERT_NAN(um982_parse_coord("", 'N'), "should be NAN");
+    PASS();
+}
+
+static void test_coord_null(void)
+{
+    TEST("coord: NULL returns NAN");
+    ASSERT_NAN(um982_parse_coord(NULL, 'N'), "should be NAN");
+    PASS();
+}
+
+static void test_coord_no_dot(void)
+{
+    TEST("coord: no decimal point returns NAN");
+    ASSERT_NAN(um982_parse_coord("440414036", 'N'), "should be NAN");
+    PASS();
+}
+
+/* ========================= GGA parsing tests ========================= */
+
+static void test_parse_gga_full(void)
+{
+    TEST("GGA: full sentence with all fields");
+    reset_gps();
+    mock_set_tick(1000);
+
+    um982_parse_sentence(&gps,
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47");
+
+    ASSERT_NEAR(gps.latitude, 44.069006, 0.0001, "latitude");
+    ASSERT_NEAR(gps.longitude, -(121.0 + 18.85961/60.0), 0.0001, "longitude");
+    ASSERT_EQ_INT(gps.fix_quality, 1, "fix quality");
+    ASSERT_EQ_INT(gps.num_satellites, 12, "num sats");
+    ASSERT_NEAR(gps.hdop, 0.98, 0.01, "hdop");
+    ASSERT_NEAR(gps.altitude, 1113.0, 0.1, "altitude");
+    ASSERT_NEAR(gps.geoid_sep, -21.3, 0.1, "geoid sep");
+    PASS();
+}
+
+static void test_parse_gga_rtk_fixed(void)
+{
+    TEST("GGA: RTK fixed (quality=4)");
+    reset_gps();
+
+    um982_parse_sentence(&gps,
+        "$GNGGA,023634.00,4004.73871635,N,11614.19729418,E,4,28,0.7,61.0988,M,-8.4923,M,,*5D");
+
+    ASSERT_EQ_INT(gps.fix_quality, 4, "RTK fixed");
+    ASSERT_EQ_INT(gps.num_satellites, 28, "num sats");
+    ASSERT_NEAR(gps.latitude, 40.0 + 4.73871635/60.0, 0.0000001, "latitude");
+    ASSERT_NEAR(gps.longitude, 116.0 + 14.19729418/60.0, 0.0000001, "longitude");
+    PASS();
+}
+
+static void test_parse_gga_no_fix(void)
+{
+    TEST("GGA: no fix (quality=0)");
+    reset_gps();
+
+    /* Compute checksum for this sentence */
+    um982_parse_sentence(&gps,
+        "$GNGGA,235959.00,,,,,0,00,99.99,,,,,,*79");
+
+    ASSERT_EQ_INT(gps.fix_quality, 0, "no fix");
+    PASS();
+}
+
+/* ========================= RMC parsing tests ========================= */
+
+static void test_parse_rmc_valid(void)
+{
+    TEST("RMC: valid position and speed");
+    reset_gps();
+    mock_set_tick(2000);
+
+    um982_parse_sentence(&gps,
+        "$GNRMC,001031.00,A,4404.13993,N,12118.86023,W,0.146,,100117,,,A*7B");
+
+    ASSERT_EQ_INT(gps.rmc_status, 'A', "status");
+    ASSERT_NEAR(gps.latitude, 44.0 + 4.13993/60.0, 0.0001, "latitude");
+    ASSERT_NEAR(gps.longitude, -(121.0 + 18.86023/60.0), 0.0001, "longitude");
+    ASSERT_NEAR(gps.speed_knots, 0.146, 0.001, "speed");
+    PASS();
+}
+
+static void test_parse_rmc_void(void)
+{
+    TEST("RMC: void status (no valid fix)");
+    reset_gps();
+    gps.latitude = 12.34;  /* Pre-set to check it doesn't get overwritten */
+
+    um982_parse_sentence(&gps,
+        "$GNRMC,235959.00,V,,,,,,,100117,,,N*64");
+
+    ASSERT_EQ_INT(gps.rmc_status, 'V', "void status");
+    ASSERT_NEAR(gps.latitude, 12.34, 0.001, "lat should not change on void");
+    PASS();
+}
+
+/* ========================= THS parsing tests ========================= */
+
+static void test_parse_ths_autonomous(void)
+{
+    TEST("THS: autonomous heading 341.3344");
+    reset_gps();
+    mock_set_tick(3000);
+
+    um982_parse_sentence(&gps, "$GNTHS,341.3344,A*1F");
+
+    ASSERT_NEAR(gps.heading, 341.3344, 0.001, "heading");
+    ASSERT_EQ_INT(gps.heading_mode, 'A', "mode");
+    PASS();
+}
+
+static void test_parse_ths_not_valid(void)
+{
+    TEST("THS: not valid mode");
+    reset_gps();
+
+    um982_parse_sentence(&gps, "$GNTHS,,V*10");
+
+    ASSERT_NAN(gps.heading, "heading should be NAN when empty");
+    ASSERT_EQ_INT(gps.heading_mode, 'V', "mode V");
+    PASS();
+}
+
+static void test_parse_ths_zero(void)
+{
+    TEST("THS: heading exactly 0.0000");
+    reset_gps();
+
+    um982_parse_sentence(&gps, "$GNTHS,0.0000,A*19");
+
+    ASSERT_NEAR(gps.heading, 0.0, 0.001, "heading zero");
+    ASSERT_EQ_INT(gps.heading_mode, 'A', "mode A");
+    PASS();
+}
+
+static void test_parse_ths_360_boundary(void)
+{
+    TEST("THS: heading near 360");
+    reset_gps();
+
+    um982_parse_sentence(&gps, "$GNTHS,359.9999,D*13");
+
+    ASSERT_NEAR(gps.heading, 359.9999, 0.001, "heading near 360");
+    ASSERT_EQ_INT(gps.heading_mode, 'D', "mode D");
+    PASS();
+}
+
+/* ========================= VTG parsing tests ========================= */
+
+static void test_parse_vtg(void)
+{
+    TEST("VTG: course and speed");
+    reset_gps();
+
+    um982_parse_sentence(&gps,
+        "$GPVTG,220.86,T,,M,2.550,N,4.724,K,A*34");
+
+    ASSERT_NEAR(gps.course_true, 220.86, 0.01, "course");
+    ASSERT_NEAR(gps.speed_knots, 2.550, 0.001, "speed knots");
+    ASSERT_NEAR(gps.speed_kmh, 4.724, 0.001, "speed kmh");
+    PASS();
+}
+
+/* ========================= Talker ID tests =========================== */
+
+static void test_talker_gp(void)
+{
+    TEST("talker: GP prefix parses correctly");
+    reset_gps();
+
+    um982_parse_sentence(&gps, "$GPTHS,123.4567,A*07");
+
+    ASSERT_NEAR(gps.heading, 123.4567, 0.001, "heading with GP");
+    PASS();
+}
+
+static void test_talker_gl(void)
+{
+    TEST("talker: GL prefix parses correctly");
+    reset_gps();
+
+    um982_parse_sentence(&gps, "$GLTHS,123.4567,A*1B");
+
+    ASSERT_NEAR(gps.heading, 123.4567, 0.001, "heading with GL");
+    PASS();
+}
+
+/* ========================= Feed / line assembly tests ================ */
+
+static void test_feed_single_sentence(void)
+{
+    TEST("feed: single complete sentence with CRLF");
+    reset_gps();
+    mock_set_tick(5000);
+
+    const char *data = "$GNTHS,341.3344,A*1F\r\n";
+    um982_feed(&gps, (const uint8_t *)data, (uint16_t)strlen(data));
+
+    ASSERT_NEAR(gps.heading, 341.3344, 0.001, "heading");
+    PASS();
+}
+
+static void test_feed_multiple_sentences(void)
+{
+    TEST("feed: multiple sentences in one chunk");
+    reset_gps();
+    mock_set_tick(5000);
+
+    const char *data =
+        "$GNTHS,100.0000,A*18\r\n"
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47\r\n";
+    um982_feed(&gps, (const uint8_t *)data, (uint16_t)strlen(data));
+
+    ASSERT_NEAR(gps.heading, 100.0, 0.01, "heading from THS");
+    ASSERT_EQ_INT(gps.fix_quality, 1, "fix from GGA");
+    PASS();
+}
+
+static void test_feed_partial_then_complete(void)
+{
+    TEST("feed: partial bytes then complete");
+    reset_gps();
+    mock_set_tick(5000);
+
+    const char *part1 = "$GNTHS,200.";
+    const char *part2 = "5000,A*1E\r\n";
+    um982_feed(&gps, (const uint8_t *)part1, (uint16_t)strlen(part1));
+    /* Heading should not be set yet */
+    ASSERT_NAN(gps.heading, "should be NAN before complete");
+
+    um982_feed(&gps, (const uint8_t *)part2, (uint16_t)strlen(part2));
+    ASSERT_NEAR(gps.heading, 200.5, 0.01, "heading after complete");
+    PASS();
+}
+
+static void test_feed_bad_checksum_rejected(void)
+{
+    TEST("feed: bad checksum sentence is rejected");
+    reset_gps();
+    mock_set_tick(5000);
+
+    const char *data = "$GNTHS,999.0000,A*FF\r\n";
+    um982_feed(&gps, (const uint8_t *)data, (uint16_t)strlen(data));
+
+    ASSERT_NAN(gps.heading, "heading should remain NAN");
+    PASS();
+}
+
+static void test_feed_versiona_response(void)
+{
+    TEST("feed: VERSIONA response sets flag");
+    reset_gps();
+
+    const char *data = "#VERSIONA,79,GPS,FINE,2326,378237000,15434,0,18,889;\"UM982\"\r\n";
+    um982_feed(&gps, (const uint8_t *)data, (uint16_t)strlen(data));
+
+    ASSERT_TRUE(gps.version_received, "version_received should be true");
+    ASSERT_TRUE(gps.initialized, "VERSIONA should mark communication alive");
+    PASS();
+}
+
+/* ========================= Validity / age tests ====================== */
+
+static void test_heading_valid_within_timeout(void)
+{
+    TEST("validity: heading valid within timeout");
+    reset_gps();
+    mock_set_tick(10000);
+
+    um982_parse_sentence(&gps, "$GNTHS,341.3344,A*1F");
+
+    /* Still at tick 10000 */
+    ASSERT_TRUE(um982_is_heading_valid(&gps), "should be valid");
+    PASS();
+}
+
+static void test_heading_invalid_after_timeout(void)
+{
+    TEST("validity: heading invalid after 2s timeout");
+    reset_gps();
+    mock_set_tick(10000);
+
+    um982_parse_sentence(&gps, "$GNTHS,341.3344,A*1F");
+
+    /* Advance past timeout */
+    mock_set_tick(12500);
+    ASSERT_FALSE(um982_is_heading_valid(&gps), "should be invalid after 2.5s");
+    PASS();
+}
+
+static void test_heading_invalid_mode_v(void)
+{
+    TEST("validity: heading invalid with mode V");
+    reset_gps();
+    mock_set_tick(10000);
+
+    um982_parse_sentence(&gps, "$GNTHS,,V*10");
+
+    ASSERT_FALSE(um982_is_heading_valid(&gps), "mode V is invalid");
+    PASS();
+}
+
+static void test_position_valid(void)
+{
+    TEST("validity: position valid with fix quality 1");
+    reset_gps();
+    mock_set_tick(10000);
+
+    um982_parse_sentence(&gps,
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47");
+
+    ASSERT_TRUE(um982_is_position_valid(&gps), "should be valid");
+    PASS();
+}
+
+static void test_position_invalid_no_fix(void)
+{
+    TEST("validity: position invalid with no fix");
+    reset_gps();
+    mock_set_tick(10000);
+
+    um982_parse_sentence(&gps,
+        "$GNGGA,235959.00,,,,,0,00,99.99,,,,,,*79");
+
+    ASSERT_FALSE(um982_is_position_valid(&gps), "no fix = invalid");
+    PASS();
+}
+
+static void test_position_age_uses_last_valid_fix(void)
+{
+    TEST("age: position age uses last valid fix, not no-fix GGA");
+    reset_gps();
+
+    mock_set_tick(10000);
+    um982_parse_sentence(&gps,
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47");
+
+    mock_set_tick(12000);
+    um982_parse_sentence(&gps,
+        "$GNGGA,235959.00,,,,,0,00,99.99,,,,,,*79");
+
+    mock_set_tick(12500);
+    ASSERT_EQ_INT(um982_position_age(&gps), 2500, "age should still be from last valid fix");
+    ASSERT_FALSE(um982_is_position_valid(&gps), "latest no-fix GGA should invalidate position");
+    PASS();
+}
+
+static void test_heading_age(void)
+{
+    TEST("age: heading age computed correctly");
+    reset_gps();
+    mock_set_tick(10000);
+
+    um982_parse_sentence(&gps, "$GNTHS,341.3344,A*1F");
+
+    mock_set_tick(10500);
+    uint32_t age = um982_heading_age(&gps);
+    ASSERT_EQ_INT(age, 500, "age should be 500ms");
+    PASS();
+}
+
+/* ========================= Send command tests ======================== */
+
+static void test_send_command_appends_crlf(void)
+{
+    TEST("send_command: appends \\r\\n");
+    reset_gps();
+
+    um982_send_command(&gps, "GPGGA COM2 1");
+
+    /* Check that TX buffer contains "GPGGA COM2 1\r\n" */
+    const char *expected = "GPGGA COM2 1\r\n";
+    ASSERT_TRUE(mock_uart_tx_len == strlen(expected), "TX length");
+    ASSERT_TRUE(memcmp(mock_uart_tx_buf, expected, strlen(expected)) == 0,
+        "TX content should be 'GPGGA COM2 1\\r\\n'");
+    PASS();
+}
+
+static void test_send_command_null_safety(void)
+{
+    TEST("send_command: NULL gps returns false");
+    ASSERT_FALSE(um982_send_command(NULL, "RESET"), "should return false");
+    PASS();
+}
+
+/* ========================= Init sequence tests ======================= */
+
+static void test_init_sends_correct_commands(void)
+{
+    TEST("init: sends correct command sequence");
+    spy_reset();
+    mock_uart_tx_clear();
+
+    /* Pre-load VERSIONA response so init succeeds */
+    const char *ver_resp = "#VERSIONA,79,GPS,FINE,2326,378237000,15434,0,18,889;\"UM982\"\r\n";
+    mock_uart_rx_load(&huart5, (const uint8_t *)ver_resp, (uint16_t)strlen(ver_resp));
+
+    UM982_GPS_t init_gps;
+    bool ok = um982_init(&init_gps, &huart5, 50.0f, 3.0f);
+
+    ASSERT_TRUE(ok, "init should succeed");
+    ASSERT_TRUE(init_gps.initialized, "should be initialized");
+
+    /* Verify TX buffer contains expected commands */
+    const char *tx = (const char *)mock_uart_tx_buf;
+    ASSERT_TRUE(strstr(tx, "UNLOG\r\n") != NULL, "should send UNLOG");
+    ASSERT_TRUE(strstr(tx, "CONFIG HEADING FIXLENGTH\r\n") != NULL, "should send CONFIG HEADING");
+    ASSERT_TRUE(strstr(tx, "CONFIG HEADING LENGTH 50 3\r\n") != NULL, "should send LENGTH");
+    ASSERT_TRUE(strstr(tx, "GPGGA COM2 1\r\n") != NULL, "should enable GGA");
+    ASSERT_TRUE(strstr(tx, "GPRMC COM2 1\r\n") != NULL, "should enable RMC");
+    ASSERT_TRUE(strstr(tx, "GPTHS COM2 0.2\r\n") != NULL, "should enable THS at 5Hz");
+    ASSERT_TRUE(strstr(tx, "SAVECONFIG\r\n") == NULL, "should NOT save config (NVM wear)");
+    ASSERT_TRUE(strstr(tx, "VERSIONA\r\n") != NULL, "should query version");
+
+    /* Verify command order: UNLOG should come before GPGGA */
+    const char *unlog_pos = strstr(tx, "UNLOG\r\n");
+    const char *gpgga_pos = strstr(tx, "GPGGA COM2 1\r\n");
+    ASSERT_TRUE(unlog_pos < gpgga_pos, "UNLOG should precede GPGGA");
+
+    PASS();
+}
+
+static void test_init_no_baseline(void)
+{
+    TEST("init: baseline=0 skips LENGTH command");
+    spy_reset();
+    mock_uart_tx_clear();
+
+    const char *ver_resp = "#VERSIONA,79,GPS,FINE,2326,378237000,15434,0,18,889;\"UM982\"\r\n";
+    mock_uart_rx_load(&huart5, (const uint8_t *)ver_resp, (uint16_t)strlen(ver_resp));
+
+    UM982_GPS_t init_gps;
+    um982_init(&init_gps, &huart5, 0.0f, 0.0f);
+
+    const char *tx = (const char *)mock_uart_tx_buf;
+    ASSERT_TRUE(strstr(tx, "CONFIG HEADING LENGTH") == NULL, "should NOT send LENGTH");
+    PASS();
+}
+
+static void test_init_fails_no_version(void)
+{
+    TEST("init: fails if no VERSIONA response");
+    spy_reset();
+    mock_uart_tx_clear();
+
+    /* Don't load any RX data — init should timeout */
+    UM982_GPS_t init_gps;
+    bool ok = um982_init(&init_gps, &huart5, 50.0f, 3.0f);
+
+    ASSERT_FALSE(ok, "init should fail without version response");
+    ASSERT_FALSE(init_gps.initialized, "should not be initialized");
+    PASS();
+}
+
+static void test_nmea_traffic_sets_initialized_without_versiona(void)
+{
+    TEST("init state: supported NMEA traffic sets initialized");
+    reset_gps();
+
+    ASSERT_FALSE(gps.initialized, "should start uninitialized");
+    um982_parse_sentence(&gps, "$GNTHS,341.3344,A*1F");
+    ASSERT_TRUE(gps.initialized, "supported NMEA should mark communication alive");
+    PASS();
+}
+
+/* ========================= Edge case tests =========================== */
+
+static void test_empty_fields_handled(void)
+{
+    TEST("edge: GGA with empty lat/lon fields");
+    reset_gps();
+    gps.latitude = 99.99;
+    gps.longitude = 99.99;
+
+    /* GGA with empty position fields (no fix) */
+    um982_parse_sentence(&gps,
+        "$GNGGA,235959.00,,,,,0,00,99.99,,,,,,*79");
+
+    ASSERT_EQ_INT(gps.fix_quality, 0, "no fix");
+    /* Latitude/longitude should not be updated (fields are empty) */
+    ASSERT_NEAR(gps.latitude, 99.99, 0.01, "lat unchanged");
+    ASSERT_NEAR(gps.longitude, 99.99, 0.01, "lon unchanged");
+    PASS();
+}
+
+static void test_sentence_too_short(void)
+{
+    TEST("edge: sentence too short to have formatter");
+    reset_gps();
+    /* Should not crash */
+    um982_parse_sentence(&gps, "$GN");
+    um982_parse_sentence(&gps, "$");
+    um982_parse_sentence(&gps, "");
+    um982_parse_sentence(&gps, NULL);
+    PASS();
+}
+
+static void test_line_overflow(void)
+{
+    TEST("edge: oversized line is dropped");
+    reset_gps();
+
+    /* Create a line longer than UM982_LINE_BUF_SIZE */
+    char big[200];
+    memset(big, 'X', sizeof(big));
+    big[0] = '$';
+    big[198] = '\n';
+    big[199] = '\0';
+
+    um982_feed(&gps, (const uint8_t *)big, 199);
+    /* Should not crash, heading should still be NAN */
+    ASSERT_NAN(gps.heading, "no valid data from overflow");
+    PASS();
+}
+
+static void test_process_via_mock_uart(void)
+{
+    TEST("process: reads from mock UART RX buffer");
+    reset_gps();
+    mock_set_tick(5000);
+
+    /* Load data into mock UART RX */
+    const char *data = "$GNTHS,275.1234,D*18\r\n";
+    mock_uart_rx_load(&huart5, (const uint8_t *)data, (uint16_t)strlen(data));
+
+    /* Call process() which reads from UART */
+    um982_process(&gps);
+
+    ASSERT_NEAR(gps.heading, 275.1234, 0.001, "heading via process()");
+    ASSERT_EQ_INT(gps.heading_mode, 'D', "mode D");
+    PASS();
+}
+
+/* ========================= PR #68 bug regression tests =============== */
+
+/* These tests specifically verify the bugs found in the reverted PR #68 */
+
+static void test_regression_sentence_id_with_gn_prefix(void)
+{
+    TEST("regression: GN-prefixed GGA is correctly identified");
+    reset_gps();
+
+    /* PR #68 bug: strncmp(sentence, "GGA", 3) compared "GNG" vs "GGA" — never matched.
+     * Our fix: skip 2-char talker ID, compare at sentence+3. */
+    um982_parse_sentence(&gps,
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47");
+
+    ASSERT_EQ_INT(gps.fix_quality, 1, "GGA should parse with GN prefix");
+    ASSERT_NEAR(gps.latitude, 44.069006, 0.001, "latitude should be parsed");
+    PASS();
+}
+
+static void test_regression_longitude_3digit_degrees(void)
+{
+    TEST("regression: 3-digit longitude degrees parsed correctly");
+    reset_gps();
+
+    /* PR #68 bug: hardcoded 2-digit degrees for longitude.
+     * 12118.85961 should be 121° 18.85961' = 121.314327° */
+    um982_parse_sentence(&gps,
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47");
+
+    ASSERT_NEAR(gps.longitude, -(121.0 + 18.85961/60.0), 0.0001,
+        "longitude 121° should not be parsed as 12°");
+    ASSERT_TRUE(gps.longitude < -100.0, "longitude should be > 100 degrees");
+    PASS();
+}
+
+static void test_regression_hemisphere_no_ptr_corrupt(void)
+{
+    TEST("regression: hemisphere parsing doesn't corrupt field pointer");
+    reset_gps();
+
+    /* PR #68 bug: GGA/RMC hemisphere cases manually advanced ptr,
+     * desynchronizing from field counter. Our parser uses proper tokenizer. */
+    um982_parse_sentence(&gps,
+        "$GNGGA,001043.00,4404.14036,N,12118.85961,W,1,12,0.98,1113.0,M,-21.3,M*47");
+
+    /* After lat/lon, remaining fields should be correct */
+    ASSERT_EQ_INT(gps.num_satellites, 12, "sats after hemisphere");
+    ASSERT_NEAR(gps.hdop, 0.98, 0.01, "hdop after hemisphere");
+    ASSERT_NEAR(gps.altitude, 1113.0, 0.1, "altitude after hemisphere");
+    PASS();
+}
+
+static void test_regression_rmc_also_parsed(void)
+{
+    TEST("regression: RMC sentence is actually parsed (not dead code)");
+    reset_gps();
+
+    /* PR #68 bug: identifySentence never matched GGA/RMC, so position
+     * parsing was dead code. */
+    um982_parse_sentence(&gps,
+        "$GNRMC,001031.00,A,4404.13993,N,12118.86023,W,0.146,,100117,,,A*7B");
+
+    ASSERT_TRUE(gps.latitude > 44.0, "RMC lat should be parsed");
+    ASSERT_TRUE(gps.longitude < -121.0, "RMC lon should be parsed");
+    ASSERT_NEAR(gps.speed_knots, 0.146, 0.001, "RMC speed");
+    PASS();
+}
+
+/* ========================= Main ====================================== */
+
+int main(void)
+{
+    printf("=== UM982 GPS Driver Tests ===\n\n");
+
+    printf("--- Checksum ---\n");
+    test_checksum_valid();
+    test_checksum_valid_ths();
+    test_checksum_invalid();
+    test_checksum_missing_star();
+    test_checksum_null();
+    test_checksum_no_dollar();
+
+    printf("\n--- Coordinate Parsing ---\n");
+    test_coord_latitude_north();
+    test_coord_latitude_south();
+    test_coord_longitude_3digit();
+    test_coord_longitude_east();
+    test_coord_empty();
+    test_coord_null();
+    test_coord_no_dot();
+
+    printf("\n--- GGA Parsing ---\n");
+    test_parse_gga_full();
+    test_parse_gga_rtk_fixed();
+    test_parse_gga_no_fix();
+
+    printf("\n--- RMC Parsing ---\n");
+    test_parse_rmc_valid();
+    test_parse_rmc_void();
+
+    printf("\n--- THS Parsing ---\n");
+    test_parse_ths_autonomous();
+    test_parse_ths_not_valid();
+    test_parse_ths_zero();
+    test_parse_ths_360_boundary();
+
+    printf("\n--- VTG Parsing ---\n");
+    test_parse_vtg();
+
+    printf("\n--- Talker IDs ---\n");
+    test_talker_gp();
+    test_talker_gl();
+
+    printf("\n--- Feed / Line Assembly ---\n");
+    test_feed_single_sentence();
+    test_feed_multiple_sentences();
+    test_feed_partial_then_complete();
+    test_feed_bad_checksum_rejected();
+    test_feed_versiona_response();
+
+    printf("\n--- Validity / Age ---\n");
+    test_heading_valid_within_timeout();
+    test_heading_invalid_after_timeout();
+    test_heading_invalid_mode_v();
+    test_position_valid();
+    test_position_invalid_no_fix();
+    test_position_age_uses_last_valid_fix();
+    test_heading_age();
+
+    printf("\n--- Send Command ---\n");
+    test_send_command_appends_crlf();
+    test_send_command_null_safety();
+
+    printf("\n--- Init Sequence ---\n");
+    test_init_sends_correct_commands();
+    test_init_no_baseline();
+    test_init_fails_no_version();
+    test_nmea_traffic_sets_initialized_without_versiona();
+
+    printf("\n--- Edge Cases ---\n");
+    test_empty_fields_handled();
+    test_sentence_too_short();
+    test_line_overflow();
+    test_process_via_mock_uart();
+
+    printf("\n--- PR #68 Regression ---\n");
+    test_regression_sentence_id_with_gn_prefix();
+    test_regression_longitude_3digit_degrees();
+    test_regression_hemisphere_no_ptr_corrupt();
+    test_regression_rmc_also_parsed();
+
+    printf("\n===============================================\n");
+    printf("  Results: %d passed, %d failed (of %d total)\n",
+           tests_passed, tests_failed, tests_passed + tests_failed);
+    printf("===============================================\n");
+
+    return tests_failed > 0 ? 1 : 0;
+}
@@ -224,7 +224,7 @@ set_property IOSTANDARD LVCMOS33 [get_ports {stm32_mixers_enable}]

 # DIG_5 = H11, DIG_6 = G12, DIG_7 = H12 — FPGA→STM32 status outputs
 # DIG_5: AGC saturation flag (PD13 on STM32)
-# DIG_6: reserved (PD14)
+# DIG_6: AGC enable flag (PD14) — mirrors FPGA host_agc_enable to STM32
 # DIG_7: reserved (PD15)
 set_property PACKAGE_PIN H11 [get_ports {gpio_dig5}]
 set_property PACKAGE_PIN G12 [get_ports {gpio_dig6}]
@@ -11,8 +11,10 @@ module radar_receiver_final (
    input wire adc_dco_n,            // Data Clock Output N (400MHz LVDS)
 	 output wire adc_pwdn,
    
-    // Chirp counter from transmitter (for frame sync and matched filter)
+    // Chirp counter from transmitter (for matched filter indexing)
    input wire [5:0] chirp_counter,
+    // Frame-start pulse from transmitter (CDC-synchronized, 1 clk_100m cycle)
+    input wire tx_frame_start,
    
    output wire [31:0] doppler_output,
    output wire doppler_valid,
@@ -392,32 +394,31 @@ mti_canceller #(
    .mti_first_chirp(mti_first_chirp)
 );

-// ========== FRAME SYNC USING chirp_counter ==========
-reg [5:0] chirp_counter_prev;
+// ========== FRAME SYNC FROM TRANSMITTER ==========
+// [FPGA-001 FIXED] Use the authoritative new_chirp_frame signal from the
+// transmitter (via plfm_chirp_controller_enhanced), CDC-synchronized to
+// clk_100m in radar_system_top.  Previous code tried to derive frame
+// boundaries from chirp_counter == 0, but that counter comes from the
+// transmitter path (plfm_chirp_controller_enhanced) which does NOT wrap
+// at chirps_per_elev — it overflows to N and only wraps at 6-bit rollover
+// (64).  This caused frame pulses at half the expected rate for N=32.
+reg tx_frame_start_prev;
 reg new_frame_pulse;

 always @(posedge clk or negedge reset_n) begin
    if (!reset_n) begin
-        chirp_counter_prev <= 6'd0;
+        tx_frame_start_prev <= 1'b0;
        new_frame_pulse <= 1'b0;
    end else begin
-        // Default: no pulse
        new_frame_pulse <= 1'b0;
        
-        // Dynamic frame detection using host_chirps_per_elev.
-        // Detect frame boundary when chirp_counter changes AND is a
-        // multiple of host_chirps_per_elev (0, N, 2N, 3N, ...).
-        // Uses a modulo counter that resets at host_chirps_per_elev.
-        if (chirp_counter != chirp_counter_prev) begin
-            if (chirp_counter == 6'd0 ||
-                chirp_counter == host_chirps_per_elev ||
-                chirp_counter == {host_chirps_per_elev, 1'b0}) begin
-                new_frame_pulse <= 1'b1;
-            end
+        // Edge detect: tx_frame_start is a toggle-CDC derived pulse that
+        // may be 1 clock wide.  Capture rising edge for clean 1-cycle pulse.
+        if (tx_frame_start && !tx_frame_start_prev) begin
+            new_frame_pulse <= 1'b1;
        end
        
-        // Store previous value
-        chirp_counter_prev <= chirp_counter;
+        tx_frame_start_prev <= tx_frame_start;
    end
 end

@@ -483,14 +484,6 @@ always @(posedge clk or negedge reset_n) begin
            `endif
            chirps_in_current_frame <= 0;
        end
-        
-        // Monitor chirp counter pattern
-        if (chirp_counter != chirp_counter_prev) begin
-            `ifdef SIMULATION
-            $display("[TOP] chirp_counter: %0d ? %0d", 
-                     chirp_counter_prev, chirp_counter);
-            `endif
-        end
    end
 end

@@ -130,7 +130,7 @@ module radar_system_top (
    // FPGA→STM32 GPIO outputs (DIG_5..DIG_7 on 50T board)
    // Used by STM32 outer AGC loop to read saturation state without USB polling.
    output wire gpio_dig5,          // DIG_5 (H11→PD13): AGC saturation flag (1=clipping detected)
-    output wire gpio_dig6,          // DIG_6 (G12→PD14): reserved (tied low)
+    output wire gpio_dig6,          // DIG_6 (G12→PD14): AGC enable flag (mirrors host_agc_enable)
    output wire gpio_dig7           // DIG_7 (H12→PD15): reserved (tied low)
 );

@@ -505,6 +505,8 @@ radar_receiver_final rx_inst (
    
    // Chirp counter from transmitter (CDC-synchronized from 120 MHz domain)
    .chirp_counter(tx_current_chirp_sync),
+    // Frame-start pulse from transmitter (CDC-synchronized toggle→pulse)
+    .tx_frame_start(tx_new_chirp_frame_sync),
    
    // ADC Physical Interface
    .adc_d_p(adc_d_p),
@@ -1035,9 +1037,11 @@ assign system_status = status_reg;
 // ============================================================================
 // DIG_5: AGC saturation flag — high when per-frame saturation_count > 0.
 //        STM32 reads PD13 to detect clipping and adjust ADAR1000 VGA gain.
-// DIG_6, DIG_7: Reserved (tied low for future use).
+// DIG_6: AGC enable flag — mirrors host_agc_enable so STM32 outer-loop AGC
+//        tracks the FPGA register as single source of truth.
+// DIG_7: Reserved (tied low for future use).
 assign gpio_dig5 = (rx_agc_saturation_count != 8'd0);
-assign gpio_dig6 = 1'b0;
+assign gpio_dig6 = host_agc_enable;
 assign gpio_dig7 = 1'b0;

 // ============================================================================
@@ -291,9 +291,12 @@ class Mixer:
        Convert 8-bit unsigned ADC to 18-bit signed.
        RTL: adc_signed_w = {1'b0, adc_data, {9{1'b0}}} -
                            {1'b0, {8{1'b1}}, {9{1'b0}}} / 2
-        = (adc_data << 9) - (0xFF << 9) / 2
-        = (adc_data << 9) - (0xFF << 8)  [integer division]
-        = (adc_data << 9) - 0x7F80
+
+        Verilog '/' binds tighter than '-', so the division applies
+        only to the second concatenation:
+            {1'b0, 8'hFF, 9'b0} = 0x1FE00
+            0x1FE00 / 2 = 0xFF00 = 65280
+        Result: (adc_data << 9) - 0xFF00
        """
        adc_data_8bit = adc_data_8bit & 0xFF
        # {1'b0, adc_data, 9'b0} = adc_data << 9, zero-padded to 18 bits
@@ -290,9 +290,9 @@ def run_ddc(adc_samples):
    for n in range(n_samples):
        # ADC sign conversion: RTL does offset binary → signed 18-bit
        # adc_signed_w = {1'b0, adc_data, 9'b0} - {1'b0, 8'hFF, 9'b0}/2
-        # Simplified: center around zero, scale to 18-bit
+        # Exact: (adc_val << 9) - 0xFF00, where 0xFF00 = {1'b0,8'hFF,9'b0}/2
        adc_val = int(adc_samples[n])
-        adc_signed = (adc_val - 128) << 9  # Approximate RTL sign conversion to 18-bit
+        adc_signed = (adc_val << 9) - 0xFF00  # Exact RTL: {1'b0,adc,9'b0} - {1'b0,8'hFF,9'b0}/2
        adc_signed = saturate(adc_signed, 18)
        
        # NCO lookup (ignoring dithering for golden reference)
@@ -96,15 +96,31 @@ end
 reg [5:0] chirp_counter;
 reg mc_new_chirp_prev;

+// Frame-start pulse: mirrors the real transmitter's new_chirp_frame signal.
+// In the real system this fires on IDLE→LONG_CHIRP transitions in the chirp
+// controller.  Here we derive it from the mode controller's chirp_count
+// wrapping back to 0 (which wraps correctly at cfg_chirps_per_elev).
+reg tx_frame_start;
+reg [5:0] rmc_chirp_prev;
+
 always @(posedge clk_100m or negedge reset_n) begin
    if (!reset_n) begin
        chirp_counter <= 6'd0;
        mc_new_chirp_prev <= 1'b0;
+        tx_frame_start <= 1'b0;
+        rmc_chirp_prev <= 6'd0;
    end else begin
        mc_new_chirp_prev <= dut.mc_new_chirp;
        if (dut.mc_new_chirp != mc_new_chirp_prev) begin
            chirp_counter <= chirp_counter + 1;
        end
+        
+        // Detect when the internal mode controller's chirp_count wraps to 0
+        tx_frame_start <= 1'b0;
+        if (dut.rmc_chirp_count == 6'd0 && rmc_chirp_prev != 6'd0) begin
+            tx_frame_start <= 1'b1;
+        end
+        rmc_chirp_prev <= dut.rmc_chirp_count;
    end
 end

@@ -128,6 +144,7 @@ radar_receiver_final dut (
    .adc_pwdn(),

    .chirp_counter(chirp_counter),
+    .tx_frame_start(tx_frame_start),

    .doppler_output(doppler_output),
    .doppler_valid(doppler_valid),
@@ -497,6 +497,7 @@ def count_concat_bits(concat_expr: str, port_widths: dict[str, int]) -> ConcatWi
            # Unknown width — flag it
            fragments.append((part, -1))
            total = -1  # Can't compute
+            break

    return ConcatWidth(
        total_bits=total,
@@ -27,6 +27,7 @@ layers agree (because both could be wrong).
 from __future__ import annotations

 import os
+import re
 import struct
 import subprocess
 import tempfile
@@ -49,8 +50,8 @@ sys.path.insert(0, str(cp.GUI_DIR))
 # Helpers
 # ===================================================================

-IVERILOG = os.environ.get("IVERILOG", "/opt/homebrew/bin/iverilog")
-VVP = os.environ.get("VVP", "/opt/homebrew/bin/vvp")
+IVERILOG = os.environ.get("IVERILOG", "iverilog")
+VVP = os.environ.get("VVP", "vvp")
 CXX = os.environ.get("CXX", "c++")

 # Check tool availability for conditional skipping
@@ -61,6 +62,20 @@ _has_cxx = subprocess.run(
    [CXX, "--version"], capture_output=True
 ).returncode == 0

+# In CI, missing tools must be a hard failure — never silently skip.
+_in_ci = os.environ.get("GITHUB_ACTIONS") == "true"
+if _in_ci:
+    if not _has_iverilog:
+        raise RuntimeError(
+            "iverilog is required in CI but was not found. "
+            "Ensure 'apt-get install iverilog' ran and IVERILOG/VVP are on PATH."
+        )
+    if not _has_cxx:
+        raise RuntimeError(
+            "C++ compiler is required in CI but was not found. "
+            "Ensure build-essential is installed."
+        )
+

 def _parse_hex_results(text: str) -> list[dict[str, str]]:
    """Parse space-separated hex lines from TB output files."""
@@ -355,6 +370,188 @@ class TestTier1ResetDefaults:
            )


+class TestTier1AgcCrossLayerInvariant:
+    """
+    Verify AGC enable/disable is consistent across FPGA, MCU, and GUI layers.
+
+    System-level invariant: the FPGA register host_agc_enable is the single
+    source of truth for AGC state. It propagates to MCU via DIG_6 GPIO and
+    to GUI via status word 4 bit[11]. At boot, all layers must agree AGC=OFF.
+    At runtime, the MCU must read DIG_6 every frame to sync its outer-loop AGC.
+    """
+
+    def test_fpga_dig6_drives_agc_enable(self):
+        """FPGA must drive gpio_dig6 from host_agc_enable, NOT tied low."""
+        rtl = (cp.FPGA_DIR / "radar_system_top.v").read_text()
+        # Must find: assign gpio_dig6 = host_agc_enable;
+        assert re.search(
+            r'assign\s+gpio_dig6\s*=\s*host_agc_enable\s*;', rtl
+        ), "gpio_dig6 must be driven by host_agc_enable (not tied low)"
+        # Must NOT have the old tied-low pattern
+        assert not re.search(
+            r"assign\s+gpio_dig6\s*=\s*1'b0\s*;", rtl
+        ), "gpio_dig6 must NOT be tied low — it carries AGC enable"
+
+    def test_fpga_agc_enable_boot_default_off(self):
+        """FPGA host_agc_enable must reset to 0 (AGC off at boot)."""
+        v_defaults = cp.parse_verilog_reset_defaults()
+        assert "host_agc_enable" in v_defaults, (
+            "host_agc_enable not found in reset block"
+        )
+        assert v_defaults["host_agc_enable"] == 0, (
+            f"host_agc_enable reset default is {v_defaults['host_agc_enable']}, "
+            "expected 0 (AGC off at boot)"
+        )
+
+    def test_mcu_agc_constructor_default_off(self):
+        """MCU ADAR1000_AGC constructor must default enabled=false."""
+        agc_cpp = (cp.MCU_LIB_DIR / "ADAR1000_AGC.cpp").read_text()
+        # The constructor initializer list must have enabled(false)
+        assert re.search(
+            r'enabled\s*\(\s*false\s*\)', agc_cpp
+        ), "ADAR1000_AGC constructor must initialize enabled(false)"
+        assert not re.search(
+            r'enabled\s*\(\s*true\s*\)', agc_cpp
+        ), "ADAR1000_AGC constructor must NOT initialize enabled(true)"
+
+    def test_mcu_reads_dig6_before_agc_gate(self):
+        """MCU main loop must read DIG_6 GPIO to sync outerAgc.enabled."""
+        main_cpp = (cp.MCU_CODE_DIR / "main.cpp").read_text()
+        # DIG_6 must be read via HAL_GPIO_ReadPin
+        assert re.search(
+            r'HAL_GPIO_ReadPin\s*\(\s*FPGA_DIG6', main_cpp,
+        ), "main.cpp must read DIG_6 GPIO via HAL_GPIO_ReadPin"
+        # outerAgc.enabled must be assigned from the DIG_6 reading
+        # (may be indirect via debounce variable like dig6_now)
+        assert re.search(
+            r'outerAgc\.enabled\s*=', main_cpp,
+        ), "main.cpp must assign outerAgc.enabled from DIG_6 state"
+
+    def test_boot_invariant_all_layers_agc_off(self):
+        """
+        At boot, all three layers must agree: AGC is OFF.
+        - FPGA: host_agc_enable resets to 0 -> DIG_6 low
+        - MCU: ADAR1000_AGC.enabled defaults to false
+        - GUI: reads status word 4 bit[11] = 0 -> reports MANUAL
+        """
+        # FPGA
+        v_defaults = cp.parse_verilog_reset_defaults()
+        assert v_defaults.get("host_agc_enable") == 0
+
+        # MCU
+        agc_cpp = (cp.MCU_LIB_DIR / "ADAR1000_AGC.cpp").read_text()
+        assert re.search(r'enabled\s*\(\s*false\s*\)', agc_cpp)
+
+        # GUI: status word 4 bit[11] is host_agc_enable, which resets to 0.
+        # Verify the GUI parses bit[11] of status word 4 as the AGC flag.
+        gui_py = (cp.GUI_DIR / "radar_protocol.py").read_text()
+        assert re.search(
+            r'words\[4\].*>>\s*11|status_words\[4\].*>>\s*11',
+            gui_py,
+        ), "GUI must parse AGC status from words[4] bit[11]"
+
+    def test_status_word4_agc_bit_matches_dig6_source(self):
+        """
+        Status word 4 bit[11] and DIG_6 must both derive from host_agc_enable.
+        This guarantees the GUI status display can never lie about MCU AGC state.
+        """
+        rtl = (cp.FPGA_DIR / "radar_system_top.v").read_text()
+
+        # DIG_6 driven by host_agc_enable
+        assert re.search(
+            r'assign\s+gpio_dig6\s*=\s*host_agc_enable\s*;', rtl
+        )
+
+        # Status word 4 must contain host_agc_enable (may be named
+        # status_agc_enable at the USB interface port boundary).
+        # Also verify the top-level wiring connects them.
+        usb_ft2232h = (cp.FPGA_DIR / "usb_data_interface_ft2232h.v").read_text()
+        usb_ft601 = (cp.FPGA_DIR / "usb_data_interface.v").read_text()
+
+        # USB interfaces use the port name status_agc_enable
+        found_in_ft2232h = "status_agc_enable" in usb_ft2232h
+        found_in_ft601 = "status_agc_enable" in usb_ft601
+
+        assert found_in_ft2232h or found_in_ft601, (
+            "status_agc_enable must appear in at least one USB interface's "
+            "status word to guarantee GUI status matches DIG_6"
+        )
+
+        # Verify top-level wiring: status_agc_enable port is connected
+        # to host_agc_enable (same signal that drives DIG_6)
+        assert re.search(
+            r'\.status_agc_enable\s*\(\s*host_agc_enable\s*\)', rtl
+        ), (
+            "Top-level must wire .status_agc_enable(host_agc_enable) "
+            "so status word and DIG_6 derive from the same signal"
+        )
+
+    def test_mcu_dig6_debounce_guards_enable_assignment(self):
+        """
+        MCU must apply a 2-frame confirmation debounce before mutating
+        outerAgc.enabled from DIG_6 reads. A naive assignment straight from
+        the latest GPIO sample would let a single-cycle glitch flip the AGC
+        state for one frame.
+        """
+        main_cpp = (cp.MCU_CODE_DIR / "main.cpp").read_text()
+
+        # (1) Current-frame DIG_6 sample must be captured in a local variable
+        # so it can be compared against the previous-frame value.
+        now_match = re.search(
+            r'(bool|int|uint8_t)\s+(\w*dig6\w*)\s*=\s*[^;]*?'
+            r'HAL_GPIO_ReadPin\s*\(\s*FPGA_DIG6[^;]*;',
+            main_cpp,
+            re.DOTALL,
+        )
+        assert now_match, (
+            "DIG_6 read must be stored in a local variable (e.g. `dig6_now`) "
+            "so the current sample can be compared against the previous frame"
+        )
+        now_var = now_match.group(2)
+
+        # (2) Previous-frame state must persist across iterations via static
+        # storage, and must default to false (matches FPGA boot: AGC off).
+        prev_match = re.search(
+            r'static\s+(bool|int|uint8_t)\s+(\w*dig6\w*)\s*=\s*(false|0)\s*;',
+            main_cpp,
+        )
+        assert prev_match, (
+            "A static previous-frame variable (e.g. "
+            "`static bool dig6_prev = false;`) must exist, initialized to "
+            "false so the debounce starts in sync with the FPGA boot default"
+        )
+        prev_var = prev_match.group(2)
+        assert prev_var != now_var, (
+            f"Current and previous DIG_6 variables must be distinct "
+            f"(both are '{now_var}')"
+        )
+
+        # (3) outerAgc.enabled assignment must be gated by now == prev.
+        guarded_assign = re.search(
+            rf'if\s*\(\s*{now_var}\s*==\s*{prev_var}\s*\)\s*\{{[^}}]*?'
+            rf'outerAgc\.enabled\s*=\s*{now_var}\s*;',
+            main_cpp,
+            re.DOTALL,
+        )
+        assert guarded_assign, (
+            f"`outerAgc.enabled = {now_var};` must be inside "
+            f"`if ({now_var} == {prev_var}) {{ ... }}` — the confirmation "
+            "guard that absorbs single-sample GPIO glitches. A naive "
+            "assignment without this guard reintroduces the glitch bug."
+        )
+
+        # (4) Previous-frame variable must advance each frame.
+        prev_update = re.search(
+            rf'{prev_var}\s*=\s*{now_var}\s*;',
+            main_cpp,
+        )
+        assert prev_update, (
+            f"`{prev_var} = {now_var};` must run each frame so the "
+            "debounce window slides forward; without it the guard is "
+            "stuck and enable changes never confirm"
+        )
+
+
 class TestTier1DataPacketLayout:
    """Verify data packet byte layout matches between Python and Verilog."""
Author	SHA1	Message	Date
Jason	7edbd2d3d0	test: add debounce structural invariant test for DIG_6 AGC sync Lock in the four structural invariants of the 2-frame confirmation debounce: local variable captures DIG_6 read, static prev initialized to false (matches FPGA boot), outerAgc.enabled gated by now==prev guard, and prev advances each frame. Prevents a naive refactor from silently removing the glitch protection. Credit: joyshmitz review on PR #93.	2026-04-17 00:28:40 +05:45
Jason	658752abb7	fix: propagate FPGA AGC enable to MCU outer loop via DIG_6 GPIO Resolve cross-layer AGC control mismatch where opcode 0x28 only controlled the FPGA inner-loop AGC but the STM32 outer-loop AGC (ADAR1000_AGC) ran independently with its own enable state. FPGA: Drive gpio_dig6 from host_agc_enable instead of tied low, making the FPGA register the single source of truth for AGC state. MCU: Change ADAR1000_AGC constructor default from enabled(true) to enabled(false) so boot state matches FPGA reset default (AGC off). Read DIG_6 GPIO every frame with 2-frame confirmation debounce to sync outerAgc.enabled — prevents single-sample glitch from causing spurious AGC state transitions. Tests: Update MCU unit tests for new default, add 6 cross-layer contract tests verifying the FPGA-MCU-GUI AGC invariant chain.	2026-04-17 00:04:37 +05:45
Jason	fa5e1dcdf4	Merge pull request #88 from shaun0927/fix/concat-parser-unknown-signal fix(test): break on unknown signal in count_concat_bits	2026-04-16 13:55:12 +03:00
Jason	ade1497457	Merge pull request #79 from NawfalMotii79/feat/um982-gps-driver feat: UM982 GPS driver + deferred fixes (STM32-006, STM32-004, FPGA-001)	2026-04-16 13:54:40 +03:00
Jason	f1d3bff4fe	Merge pull request #85 from shaun0927/fix/ci-iverilog-path fix(ci): use PATH-based iverilog/vvp discovery for cross-layer tests	2026-04-16 11:49:44 +03:00
Jason	791b2e7374	Merge pull request #86 from shaun0927/fix/golden-ref-adc-formula fix(cosim): align golden_reference ADC sign conversion with RTL	2026-04-16 11:49:21 +03:00
copilot-swe-agent[bot]	df875bdf4d	Merge origin/develop into feat/um982-gps-driver Co-authored-by: JJassonn69 <83615043+JJassonn69@users.noreply.github.com>	2026-04-16 06:23:05 +00:00
Jason	15a9cde274	review(cosim): fix stale comment and wrong docstring derivation golden_reference.py: update comment from 'Simplified' to 'Exact' to match shaun0927's corrected formula. fpga_model.py: fix adc_to_signed docstring that incorrectly derived 0x7F80 instead of 0xFF00. Verilog '/' binds tighter than '-', so {1'b0,8'hFF,9'b0}/2 = 0x1FE00/2 = 0xFF00, not 0xFF<<8 = 0x7F80.	2026-04-16 11:07:56 +05:45
Jason	ae7643975d	fix(ci): fail hard when required tools missing in CI Silently skipping Tier 2/3 tests in CI defeats the purpose of running them. Add a GITHUB_ACTIONS guard that raises RuntimeError at module load if iverilog or C++ compiler is not found, preventing false-green CI results from skipped tests.	2026-04-16 10:27:58 +05:45
Jason	8609e455a0	Merge pull request #78 from 3aLaee/fix/overtemp-emergency-stop fix(mcu): harden checkSystemHealth() watchdog against cold-start	2026-04-16 07:25:05 +03:00
JunghwanNA	029df375f5	fix(test): break on unknown signal in count_concat_bits When an unknown signal is encountered, total is set to -1 but the loop continues. Subsequent known signals add their widths to -1, producing incorrect totals (e.g. -1 + 16 = 15 instead of -1). This can mask genuine truncation bugs in status word packing.	2026-04-16 12:27:10 +09:00
JunghwanNA	a9ceb3c851	fix(cosim): align golden_reference ADC sign conversion with RTL The golden reference used (adc_val - 128) << 9 which subtracts 65536, but the Verilog RTL computes {1'b0,adc,9'b0} - {1'b0,8'hFF,9'b0}/2 which subtracts 0xFF00 = 65280. This creates a constant 256-LSB DC offset between the golden reference and RTL for all 256 ADC values. The bit-accurate model in fpga_model.py already uses the correct RTL formula. This aligns golden_reference.py to match. Verified: all 256 ADC input values now produce zero offset against fpga_model.py.	2026-04-16 12:27:02 +09:00
JunghwanNA	425c349184	fix(ci): use PATH-based iverilog/vvp discovery for cross-layer tests The default IVERILOG and VVP paths were hardcoded to macOS Homebrew locations (/opt/homebrew/bin/iverilog). On Ubuntu CI runners, apt installs iverilog to /usr/bin/, so the Path.exists() check returns False and all Tier 2 Verilog cosim tests are silently skipped. Change defaults to bare command names so the existing which-based fallback at line 57-58 discovers the binary via PATH on any platform.	2026-04-16 12:26:50 +09:00
Jason	bcbbfabbdb	harden error_strings[] safety and update .gitignore - Add ERROR_COUNT sentinel to SystemError_t enum - Change error_strings[] to static const char* const - Add static_assert to enforce enum/array sync at compile time - Add runtime bounds check with fallback for invalid error codes - Add all missing test binary names to .gitignore	2026-04-16 02:12:37 +05:45
Jason	b9c36dcca5	fix(ci): remove macOS test binaries from git, update .gitignore The gap3, agc, and gps test binaries (Mach-O executables compiled on macOS) were accidentally tracked. CI runs on Linux and fails with 'Exec format error'. Removed from index and added to .gitignore.	2026-04-16 00:45:52 +05:45
Jason	db4e73577e	fix: use authoritative tx frame signal for frame sync, consistent ad9523 error path FPGA-001: The previous fix derived frame boundaries from chirp_counter==0, but that counter comes from plfm_chirp_controller_enhanced which overflows to N (not wrapping at chirps_per_elev). This caused frame pulses only on 6-bit rollover (every 64 chirps) instead of every N chirps. Now wires the CDC-synchronized tx_new_chirp_frame_sync signal from the transmitter into radar_receiver_final, giving correct per-frame timing for any N. STM32-004: Changed ad9523_init() failure path from Error_Handler() to return -1, matching the pattern used by ad9523_setup() and ad9523_status() in the same function. Both halt the system, but return -1 keeps IRQs enabled for diagnostic output.	2026-04-16 00:33:27 +05:45
3aLaee	35539ea934	fix(mcu): harden checkSystemHealth() watchdog against cold-start + stale-ts checkSystemHealth()'s internal watchdog (pre-fix step 9) had two linked defects that, combined with the previous commit's escalation of ERROR_WATCHDOG_TIMEOUT to Emergency_Stop(), would false-latch AERIS-10: 1. Cold-start false trip: static uint32_t last_health_check = 0; if (HAL_GetTick() - last_health_check > 60000) { trip; } On the first call, last_health_check == 0, so the subtraction against a seeded-zero sentinel exceeds 60 000 ms as soon as the MCU has been up >60 s -- normal after the ADAR1000 / AD9523 / ADF4382 init sequence -- and the watchdog trips spuriously. 2. Stale timestamp after early returns: last_health_check = HAL_GetTick(); // at END of function Every earlier sub-check (IMU, BMP180, GPS, PA Idq, temperature) has an `if (fault) return current_error;` path that skips the update. After ~60 s of transient faults, the next clean call compares against a long-stale last_health_check and trips. With ERROR_WATCHDOG_TIMEOUT now escalating to Emergency_Stop(), either failure mode would cut the RF rails on a perfectly healthy system. Fix: move the watchdog check to function ENTRY. A dedicated cold-start branch seeds the timestamp on the first call without checking. On every subsequent call, the elapsed delta is captured first and last_health_check is updated BEFORE any sub-check runs, so early returns no longer leave a stale value. 32-bit tick-wrap semantics are preserved because the subtraction remains on uint32_t. Add test_gap3_health_watchdog_cold_start.c covering cold-start, paced main-loop, stall detection, boundary (exactly 60 000 ms), recovery after trip, and 32-bit HAL_GetTick() wrap -- wired into tests/Makefile alongside the existing gap-3 safety tests.	2026-04-15 20:36:19 +02:00
Jason	8187771ab0	fix: resolve 3 deferred issues (STM32-006, STM32-004, FPGA-001) STM32-006: Remove blocking do-while loop that waited for legacy GUI start flag — production V7 PyQt GUI never sends it, hanging the MCU at boot. STM32-004: Check ad9523_init() return code and call Error_Handler() on failure, matching the pattern used by all other hardware init calls. FPGA-001: Simplify frame boundary detection to only trigger on chirp_counter wrap-to-zero. Previous conditions checking == N and == 2N were unreachable dead code (counter wraps at N-1). Now correct for any chirps_per_elev value.	2026-04-16 00:13:45 +05:45
Jason	b0e5b298fe	feat(gps): add UM982 GPS driver replacing broken TinyGPS++ Implement a complete UM982 GNSS driver (um982_gps.h/.c) with: - NMEA parser for GGA, RMC, THS, VTG with multi-talker support (GP/GN/GL/GA/GB) - Correct coordinate parsing using decimal-point-based degree detection (fixes PR #68 bug: 3-digit longitude degrees) - Checksum verification on all incoming sentences - Non-blocking line assembler with ring buffer - Init sequence: UNLOG, HEADING FIXLENGTH, baseline config, NMEA enables, VERSIONA handshake (no SAVECONFIG to avoid NVM wear) - Validity/age checks with configurable timeouts Integration into main.cpp: - Replace TinyGPSPlus with UM982_GPS_t, UART5 baud 9600->115200 - Non-blocking um982_process() in main loop (single-byte UART reads) - GPS heading override with magnetometer fallback - Health check using um982_position_age() Test infrastructure: - 49 unit tests covering checksums, coordinate parsing, all sentence types, talker IDs, feed/assembly, validity, init sequence, edge cases - Mock HAL_UART_Receive with per-UART ring buffer for integration tests - All 72 MCU tests passing (23 existing + 49 new) Fixes all 12 bugs identified in PR #68 analysis (5 compile errors + 7 functional).	2026-04-15 17:46:21 +05:45
Jason	f67440ee9a	Merge pull request #74 from NawfalMotii79/revert-68-feature/add-um982-gps-driver Revert "Add UM982 GPS driver (um982_gps.h/.cpp) for NMEA sentence parsing	2026-04-15 12:51:47 +03:00
Jason	513e0b9a69	Merge pull request #69 from 3aLaee/fix/overtemp-emergency-stop Escalate overtemp and watchdog-timeout faults to Emergency_Stop()	2026-04-15 12:51:22 +03:00
Jason	0b25db08b5	fix(test): align emergency_state_ordering test with overtemp/watchdog fix - Rename ERROR_STEPPER_FAULT → ERROR_STEPPER_MOTOR to match main.cpp enum - Update critical-error predicate to include ERROR_TEMPERATURE_HIGH and ERROR_WATCHDOG_TIMEOUT (was testing stale pre-fix logic) - Test 4 now asserts overtemp DOES trigger e-stop (previously asserted opposite) - Add Test 5 (watchdog triggers e-stop) and Test 6 (memory alloc does not) - Add ERROR_MEMORY_ALLOC and ERROR_WATCHDOG_TIMEOUT to local enum - 7 tests, all pass	2026-04-15 13:18:07 +05:45
3aLaee	4900282042	fix(mcu-tests): strip stray literal backslash-r in Makefile continuations The previous commit accidentally introduced the literal 2-byte sequence '\r' at the end of two backslash-continuation lines (TESTS_STANDALONE and the .PHONY list). GNU make on Linux treats that as text rather than a line continuation, which orphans the following line with leading spaces and aborts CI with: Makefile:68: *** missing separator (did you mean TAB instead of 8 spaces?) Strip the extraneous 'r' so each continuation ends with a real backslash + LF.	2026-04-15 09:16:03 +02:00
3aLaee	a2686b7424	fix(mcu): escalate overtemp and watchdog-timeout faults to Emergency_Stop() handleSystemError() only called Emergency_Stop() for error codes in [ERROR_RF_PA_OVERCURRENT .. ERROR_POWER_SUPPLY] (9..13). Two critical faults were left out of the gate and fell through to attemptErrorRecovery()'s default log-and-continue branch: - ERROR_TEMPERATURE_HIGH (14): raised by checkSystemHealth() when the hottest of 8 PA thermal sensors exceeds 75 C. Without cutting bias (DAC CLR) and the PA 5V0/5V5/RFPA_VDD rails, the 10 W GaN QPA2962 stages remain biased in an overtemperature state -- a thermal-runaway path in AERIS-10E. - ERROR_WATCHDOG_TIMEOUT (16): indicates the health-check loop has stalled (>60 s since last pass). Transmitter state is unknown; relying on IWDG to reset the MCU re-runs startup and re-energises the PA rails rather than latching the safe state. Fix: extend the critical-error predicate so these two codes also trigger Emergency_Stop(). Add test_gap3_overtemp_emergency_stop.c covering all 17 SystemError_t values (must-trigger and must-not-trigger), wired into tests/Makefile alongside the existing gap-3 safety tests.	2026-04-14 21:53:39 +02:00