safer

Author: prathameshnium

.gitignore

@@ -124,4 +124,4 @@ pica/CONTRIBUTING.md
 pica/keysight/data_file_for_ref/
 .claude/settings.json
 pica/novocontrol/data_file_for_ref/
-gpib_lifeline_report_20260710_002203.txt
+gpib_lifeline_report_*.txt

docs/Novocontrol_GPIB_Runbook.md

@@ -51,6 +51,35 @@ card). WinDETA already works there, so the card, driver, and cable are good.
 6. **Restart the GUI after any driver install** — the GPIB backend is
    chosen once per process.
 
+## Safety — instrument and system
+
+Instrument (the Alpha can never be harmed by the bring-up itself):
+
+- The **only traffic any PICA tool sends automatically is `*IDN?`** — a
+  read-only IEEE-488.2 identification query. Scans never write settings.
+- The whole bring-up needs only read-only queries: `*IDN?`, `INTTYP?`.
+- In the lifeline terminal: queries send freely; any state-changing write
+  asks for confirmation; **DCV/DCE (DC bias) are blocked outright** — this
+  mainframe has no bias hardware and `pica/novocontrol` never sends them.
+  `:safe` parks the analyzer with the documented sequence
+  `MBK, ACV=0, ZCONSPL=0`.
+- In the SCPI Console GUI, DCV/DCE/RSTH writes pop a confirmation dialog
+  (default No) before anything reaches the bus.
+- `*RST` is safe on the Alpha: it parks the generator and **preserves** the
+  stored calibration tables (per the Alpha manual and `pica/novocontrol`).
+- Never run WinDETA and Python at the same time — one program on the bus.
+
+System (the PC that WinDETA depends on):
+
+- Python-side fixes (`pip uninstall pygpib`, running the scripts) touch
+  nothing outside Python — the lifeline only *reads* DLLs and files.
+- The one system-level change is the **driver install**. Before it:
+  create a Windows restore point. Prefer adding the NI-488.2 compatibility
+  component of the *same* ines driver version already installed over
+  upgrading the whole driver, so the stack WinDETA uses stays untouched.
+- Acceptance test after any driver change: **start WinDETA and confirm it
+  still talks to the Alpha**, then close it and continue with Python.
+
 ## If it still fails
 
 Run `python pica/utils/GPIB_Lifeline_CLI.py --deep` (walks all of `C:\` for

pica/utils/GPIB_Lifeline_CLI.py

@@ -23,7 +23,12 @@
                exists, this same file runs unmodified on a bare 32-bit
                Python (py -3-32) with no pip and no internet.
 
-               SAFETY: sends nothing but *IDN? probes and what you type.
+               SAFETY: automatically sends nothing but *IDN? (a read-only
+               IEEE-488.2 query). In the terminal, queries pass freely,
+               state-changing writes require an explicit yes, DCV/DCE (DC
+               bias -- no bias hardware on this mainframe) are blocked
+               outright, and ':safe' parks the analyzer with the documented
+               sequence MBK, ACV=0, ZCONSPL=0.
 
  USAGE:        python GPIB_Lifeline_CLI.py
                python GPIB_Lifeline_CLI.py --deep
@@ -75,6 +80,16 @@
 
 DLL_BASENAMES = ("gpib-32.dll", "gpib32.dll", "ni4882.dll")
 
+# --- Instrument safety -------------------------------------------------------
+# DC-bias writes are hard-blocked: the lab's Alpha-AN mainframe has no bias
+# hardware, and pica/novocontrol never transmits DCV/DCE either. Every other
+# state-changing write requires an explicit yes; queries ('?') pass freely.
+BLOCKED_WRITE_PREFIXES = ("DCV", "DCE")
+# Documented Novocontrol Alpha safe idle state, same order as
+# pica/novocontrol safe_state(): abort task, park generator, current input
+# to high impedance.
+SAFE_STATE_SEQUENCE = ("MBK", "ACV=0", "ZCONSPL=0")
+
 
 def iberr_text(code):
     if code is None:
@@ -399,8 +414,12 @@ def scan_bus(gpib, boards, probe_timeout_code):
 def repl(gpib, handle, resource_label):
     print(f"\n== Interactive terminal on {resource_label} ==")
     print("   Command ending in '?' -> write + read; otherwise write only.")
-    print("   ':read' forces a read, ':quit' exits. (Novocontrol Alpha: try "
-          "*IDN? then INTTYP?)")
+    print("   SAFETY: queries send freely; state-changing writes ask for "
+          "confirmation; DCV/DCE (DC bias) writes are blocked outright.")
+    print("   ':safe' parks a Novocontrol Alpha (MBK, ACV=0, ZCONSPL=0), "
+          "':read' forces a read, ':quit' exits.")
+    print("   (Novocontrol Alpha bring-up: *IDN? then INTTYP? -- both are "
+          "read-only.)")
     while True:
         try:
             command = input(f"{resource_label} > ").strip()
@@ -415,6 +434,31 @@ def repl(gpib, handle, resource_label):
         if command.lower() in (":quit", ":q", "quit", "exit"):
             break
 
+        if command.lower() == ":safe":
+            for step in SAFE_STATE_SEQUENCE:
+                sta = gpib.write(handle, step)
+                verdict = ("ok" if not (sta & ERR)
+                           else f"FAILED {sta_text(sta)}; "
+                                f"{iberr_text(gpib.error_code())}")
+                print(f"  {step:<10} -> {verdict}")
+            continue
+
+        if command.lower() != ":read" and not command.endswith("?"):
+            if command.upper().startswith(BLOCKED_WRITE_PREFIXES):
+                print("  BLOCKED: DCV/DCE set the DC bias; this mainframe "
+                      "has no bias hardware and PICA never sends them.")
+                continue
+            try:
+                answer = input(
+                    f"  '{command}' changes instrument state. Send? [y/N] ")
+            except (EOFError, KeyboardInterrupt):
+                print()
+                break
+            sys.stdout.file.write(answer + "\n")
+            if answer.strip().lower() not in ("y", "yes"):
+                print("  not sent")
+                continue
+
         started = time.perf_counter()
         if command.lower() == ":read":
             data, sta = gpib.read(handle)

pica/utils/SCPI_Console_GUI.py

@@ -88,6 +88,12 @@
 # Commands that perturb instrument state -- highlighted in the library panel.
 SCPI_WARN_COMMANDS = {"*RST", "*SAV 0", "*RCL 0", "ABOR"}
 
+# Writes that can drive hardware into a damaging state get a confirmation
+# dialog before anything reaches the bus. On a Novocontrol Alpha, DCV/DCE
+# set the DC bias (the lab mainframe has no bias hardware and PICA never
+# sends them) and RSTH is a hard reset.
+RISKY_WRITE_PREFIXES = ("DCV", "DCE", "RSTH")
+
 # Label separator used to render "address  ->  IDN" in the instrument combobox.
 ADDR_SEP = "  ->  "
 
@@ -893,7 +899,25 @@ def read_only(self):
             return
         self._dispatch('read', None)
 
+    def _confirm_if_risky(self, command):
+        """True when the command may be sent. Pure queries pass freely;
+        bias / hard-reset writes need an explicit yes."""
+        if command.endswith('?'):
+            return True
+        if not command.upper().lstrip().startswith(RISKY_WRITE_PREFIXES):
+            return True
+        return messagebox.askyesno(
+            "Confirm instrument write",
+            f"'{command}' can change the instrument's output or bias "
+            "state.\n\nOn a Novocontrol Alpha, DCV/DCE drive the DC bias "
+            "(this mainframe has no bias hardware) and RSTH is a hard "
+            "reset.\n\nSend it anyway?",
+            icon='warning', default='no')
+
     def _dispatch(self, mode, command):
+        if command is not None and not self._confirm_if_risky(command):
+            self.log("info", f"Cancelled: '{command}' was not sent.")
+            return
         if command is not None:
             self._remember(command)
             self.command_entry.delete(0, tk.END)