CO_EM_RPDO_TIME_OUT is a single shared error bit for all RPDO instances.
CO_RPDO_process() called CO_errorReset() for this bit the moment any one
RPDO recovered from timeout, even if other RPDOs were still timed out.
Scenario that exposes the bug:
node-2 and node-3 are RPDO producers with deadline monitoring.
Both go pre-operational -> CO_EM_RPDO_TIME_OUT set -> error register 0x10.
node-2 comes back -> CO_RPDO_process() calls CO_errorReset() ->
CO_EM_RPDO_TIME_OUT cleared -> error register 0x00.
node-3 is still timed out: the error register is now incorrect.
Fix: remove CO_errorReset() from CO_RPDO_process(). Instead, add a
post-loop check in CO_process_RPDO() (CANopen.c) that iterates all RPDO
instances. CO_errorReset() is only called when none of them remains in
timeout (timeoutTimer > timeoutTime_us). CO_process_RPDO() has access
to the full co->RPDO[] array and is therefore the correct place to make
this cross-RPDO decision. CO_errorReset() is a no-op when the error bit
is already clear, so calling it every cycle when no timeout is active is
safe and efficient.
a36ab57e4e