I found ETMY-ISI drive going up to huge numbers with the masterswitch off. Nothing was going out to the DAC since the masterswitch was off, but the Guardian should have turned the ISO loops off to prevent sending a big kick into the ISI when the master switch is turned back on. Jamie is going to provide a fix for this: The ISI will go into the "Offline" state, and turn back on from there, anytime its masterswitch is truned off.
As a side note, we should not turn the ISI off using the masterswitch while it is running. In this situation, the "Offline" state should have been requested from the ISI's Guardian menu.
I tracked down this issue to a couple of problems/inadequecies with how the SEI guardian was handling the masterswitch.
First of all, the "masterswitch_is_on" decorator, which is used in all states to check the masterswitch status, had been disabled. This was probably done during debugging and was forgotten. I re-enabled the check so that the ISIs and HPIs now jump to their MASTERSWITCH_OFF states when the masterswitch is off.
I then fixed the MASTERSWITCH_OFF states so that they immediately shutoff all isolation and damping loops.
I finally added masterswitch status checking in the SEI managers, so that they handle errant masterswitch state changes more cleanly.
This all means that the the guardians should have much cleaner handling of the masterswitch being turned off.
That said, and as Hugo mentioned, don't turn off the masterswitch. This is a rather violent thing to do to the ISIs, as they'll get a large jolt if any DC offsets are suddenly removed. Instead, use the SEI managers to request the OFFLINE state.