I didn't mean to use an address line as a control signal. I was providing that as an example of how thinking slightly outside of a "standard design" can pay dividends.
But using logic (or PALs) to decode bus signals to drive peripherals was last needed in the 1980's. The earliest microcontrollers made that sort of design obsolete by providing the right signals that memory chips used. Or that external registers or shift registers can use.
And in this case, the Chip Select pins on the CPU can (probably, check the detailed timing) be programmed to provide the strobe signals required to read or write the external registers. Without any extra logic at all.
> However, I must take all precautions to decode the port addresses as close as
> possible so that if the software runs off into the weeds, the probability of
> accidentally writing a port is as low as possible.
It doesn't matter if you're decoding a megabyte range or a single byte range, if it goes wrong the CPU may still hit those addresses. A "runaway" that cycles through the whole of memory (like a "stack runaway") is pretty common. If a train derails then "I only decoded one address" isn't going to cut it as a design choice.
I would suggest that you need a design where it takes a number of different operations before one of those ports can be written to. If there's a safety standard involved, it may require external hardware interlocks to guarantee this, if not a system with "multiple redundant voting". But if you only need two operations that are very unlikely to be triggered by a "runaway program", then connecting a chip select directly to the register clock pin makes that very easy.
You simply don't enable the chip-select decoder until you want to write to the register, and then you disable the decoder afterwards. So the "write to the port" sequence is "Write CSMRn with an appropriate mask with the V bit set; write to the port; zero CSMRn". So the port isn't even in the memory map for 99.999% of the time. You could even program the chip-select pin as a GPIO (in PAR_CS) and an Input (PPDR_x) (with the data register set to the inactive value in PODR_x), so you would then have a three-stage lock, requiring the pin to be changed from GPIO to Chip Select before the other two steps. Then you'd have code around the function that performs that sequence to check other software "lock" conditions to try and stop a "wild jump" into that function triggering the sequence.
Neither the 573 or 574 have reset pins. There's a bit of work allowing for safe power on and reset as well. They (or downstream circuitry) can't be enabled until they've had the "inactive" values loaded into them.
There's also the risk that those external registers could be corrupted by external interference flipping the registers. Especially if this is anywhere near locomotive electrical power. That stuff is nasty.
Tom