diff --git a/Architecture/IO_ARCHITECTURE.md b/Architecture/IO_ARCHITECTURE.md new file mode 100644 index 0000000..53448f8 --- /dev/null +++ b/Architecture/IO_ARCHITECTURE.md @@ -0,0 +1,291 @@ +# NeoECU V1 Initial Functional I/O Architecture + +## Purpose + +This document records the initial functional I/O architecture for NeoECU V1. +It builds on [the power architecture](POWER_ARCHITECTURE.md) and defines the +required interface classes, analogue-channel allocation, and intended signal +conditioning. It is not a schematic or component-selection document; exact +parts, resistor values, pin assignments, connector allocation, and final I/O +quantities remain to be confirmed. + +The initial ECU controls a single-cylinder four-stroke engine with one +injector, one dual-ended dumb ignition coil, crank and cam Hall sensors, +temperature and pressure sensors, and an external starter switch. + +## I/O Summary + +| Interface | V1 allocation | Functional intent | +| --- | ---: | --- | +| Crank trigger input | 1 | 12 V active-low Hall, timer capture | +| Cam trigger input | 1 | 12 V active-low Hall, timer capture | +| Deadman input | 1 | Dedicated 5 V vehicle-logic engine-permit input | +| Thermistor inputs | 4 | Air, oil, water, and one spare temperature input | +| General analogue inputs | 9 | Protected 0-5 V sensor channels | +| ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` | +| Ignition output | 1 | Dedicated coil low-side driver | +| Injector output | 1 | Dedicated injector low-side driver | +| Generic digital inputs | Provisionally 6 | Protected 5 V / 12 V compatible inputs | +| Generic logic outputs | Provisionally 4 | Protected 5 V logic outputs | +| Generic sink outputs | Provisionally 4 | Protected low-side outputs | +| Analogue outputs | Reserve 2 MCU/output paths | Future 0-5 V output capability; not a V1 requirement | + +The provisional generic digital I/O counts are planning values, not a frozen +connector or pin budget. CAN and its physical layer are intentionally outside +the scope of this document. + +## Power-Domain Rules + +- `+5V_MAIN` is the primary internal regulated 5 V rail. It supplies internal + 5 V circuitry and is the upstream rail for `+5V_AUX` and `+5V_SENS`; it is + not connected directly to external harness loads. +- `+5V_SENS` is exclusively for sensor excitation and thermistor pull-ups. + It is never used to power generic peripherals or output loads. +- `+5V_AUX` powers external 5 V logic-level output circuitry. It is separately + protected so an external fault cannot disturb sensor excitation. +- `+12V_SENS` is the regulated buck-boost Hall/12 V sensor supply. It is kept + separate from arbitrary digital output loads. +- `VBAT_PROT` supplies the ignition, injector, and protected low-side output + branches. It is the 12 V-class source for general load-driving interfaces. +- High-current ignition, injector, and load-driver returns remain separate + from the sensor and MCU returns until their deliberate join at the power + entry region. + +## Engine-Position Inputs + +Crank and cam are dedicated inputs, not generic digital inputs. The assumed +sensor type is a three-wire, active-low, open-collector/current-sinking Hall +sensor. + +```text ++12V_SENS -- ECU-side pull-up -- Hall signal harness -- Hall output + | + protection / divider / fast RC + | + 3.3 V Schmitt trigger + | + STM32 timer-capture pin +``` + +The ECU-side pull-up is connected to regulated `+12V_SENS`, not to 3.3 V. +This gives the harness a robust 12 V-class signal while keeping the MCU domain +local and protected. An initial pull-up near 4.7 kohm is a reasonable starting +point, subject to the selected sensor's output-current specification and the +cable capacitance. + +The divider scales the 12 V signal to the Schmitt-buffer input. A deliberately +small, configurable RC filter follows the divider to reject spark-induced +glitches without materially slowing genuine trigger edges. A nominal 1 nF +capacitor footprint, with alternatives such as 470 pF and 2.2 nF, should be +provided and validated with ignition active. The final divider, pull-up, clamp, +filter, and cable requirements depend on the Hall part number and harness. + +## Analogue Inputs + +### ADC allocation + +The STM32H747 provides three ADC peripherals. ADC1 and ADC2 share most of the +external analogue-pin pool, so they increase concurrent conversion capacity +rather than doubling the number of physical sensor pins. The proposed V1 +allocation occupies 16 conditioned ADC channels: + +```text +4 thermistor inputs +9 general 0-5 V inputs +1 VBAT_PROT sense input +1 +5V_SENS sense input +1 +12V_SENS sense input +``` + +This leaves meaningful MCU ADC and pin margin, but the final STM32 package and +pin assignment must reserve all analogue pins alongside timer, CAN, debug, +I2C, and optional DAC requirements. In particular, PA4 and PA5 should remain +available if the two internal DAC outputs are to be retained for future +analogue outputs. + +### Thermistor channels + +Each thermistor channel is excited from `+5V_SENS` using a precision pull-up. +The input is attenuated and filtered before the ADC; this remains required +because an open thermistor drives the node towards 5 V. Firmware calculates the +thermistor resistance from the ratio of its ADC result to the `+5V_SENS` ADC +result, then applies the calibration map for the selected sensor. + +```text ++5V_SENS -- precision pull-up --+-- thermistor -- sensor ground + | + attenuation/filter --> ADC +``` + +The pull-up value is selected from the actual NTC curve and required +temperature range, balancing resolution against self-heating. The attenuation +network should be high impedance enough that it does not materially load the +thermistor divider; the ADC sample time and local input capacitor must then be +chosen to achieve settling. The initial Bosch 2.5 kOhm NTC population is a +3.01 kOhm precision pull-up; 10.0 kOhm and 30.1 kOhm alternatives are reserved +only for confirmed sensor curves. See +[ANALOG_INPUTS.md](IO_MODULES/ANALOG_INPUTS.md) for the detailed architecture. + +### General 0-5 V channels + +General analogue inputs support conventional 0.5-4.5 V and 0-5 V automotive +sensors. Each includes connector protection, attenuation, and an ADC-local +filter capacitor. A nominal attenuation ratio near 0.55 maps a 5.25 V sensor +signal to about 2.9 V at an ADC referenced by `+3V3_ANA`. + +General analogue inputs are passive. Their dividers, filter capacitors, and ADC +acquisition time must be selected together to meet source-impedance and +settling requirements. A genuinely high-impedance or special-purpose sensor +requires a dedicated front end rather than altering the generic channel. + +`+5V_SENS` is measured through an equivalent matched divider/filter path and +sampled near each ratiometric sensor channel. Firmware uses the ratio of the +sensor and supply readings to cancel sensor-supply and ADC-reference variation. + +## Battery and Rail Measurements + +`VBAT_PROT` is measured by a protected, scaled direct ADC channel. This is the +deterministic engine-control measurement used for battery-voltage dwell and +injector compensation. The M7 should receive a DMA-updated, filtered value and +snapshot it immediately before scheduling a dwell event. + +Voltage/current monitor ICs may monitor the regulated rails for telemetry and +diagnostics. They are not the sole engine-control voltage source. In +particular, no whole-ECU current shunt is placed in series with `VBAT_PROT`; +coil and injector pulse currents would waste power and make that measurement +less useful. Upstream protection is provided by the input fuse/e-fuse and +local protection is provided by the ignition and injector driver stages. + +## Generic Digital Inputs + +Generic digital inputs accept externally driven 5 V through `VBAT_PROT` +active-high signals, with software-configurable reported polarity. They are +not intended for crank or cam capture. The detailed interface, including +fail-safe ECU-off behavior, external hysteresis, optional wetting/pull-down +footprints, and harness protection, is defined in +[DIGITAL_INPUTS.md](IO_MODULES/DIGITAL_INPUTS.md). + +The generic input front end uses fail-safe, 40 V-capable open-drain +comparators powered by `+3V3_MAIN`, with thresholds derived from `+5V_MAIN`. +The input is protected at the connector and cannot back-power the ECU when an +external source drives it while the ECU is unpowered. The final transient +protection, threshold, hysteresis, filter, and bias values remain pending the +actual harness and input-function requirements. + +## Deadman Engine-Permit Interlock + +The deadman input is a dedicated 5 V vehicle-logic input, not a generic digital +input. It is conditioned through the normal protected 5 V input interface and +level-shifted to protected 3.3 V logic. A loss of the external deadman signal +is the not-permitted state. + +The resulting `DEADMAN_OK` signal has two independent destinations: + +- It enters an MCU digital input so firmware can observe whether the deadman is + locked or unlocked, disable scheduling, and report the state. +- It is combined in hardware with the MCU's `MCU_RUN_PERMIT` output to produce + `ENGINE_PERMIT`. + +```text +5 V deadman input --> protection / level shift --> DEADMAN_OK --+--> MCU input + | +MCU_RUN_PERMIT --------------------------------------------------AND--> ENGINE_PERMIT + | + driver enable pins, or + command-signal gating +``` + +`ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers +where those inputs are provided. If a selected driver has no suitable enable +input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using +logic that defaults to the disabled state on power-up or loss of power. + +This hardware path ensures that releasing the deadman stops injector and +ignition commands even if firmware or a timer output fails to respond. Firmware +must also clear/disable pending injection and dwell schedules whenever +`DEADMAN_OK` becomes invalid. A firmware test mode may assert +`MCU_RUN_PERMIT`, but it does not override the physical deadman input; bench +operation requires a deliberate external test arrangement that presents a valid +deadman signal. + +## Outputs + +### Ignition and injector + +The ignition coil is supplied from `VBAT_PROT` and switched with a dedicated +automotive ignition driver or smart ignition IGBT. It requires controlled +primary flyback clamping, over-current and thermal protection, and fault +reporting. Firmware applies battery-voltage dwell compensation using the direct +`VBAT_PROT` ADC measurement; driver current limiting remains the safety +backstop. + +The injector is supplied from `VBAT_PROT` and switched by a dedicated +automotive smart low-side driver. It requires inductive-load capability, +controlled turn-off clamping, current/thermal protection, and MCU-readable +open-load and short-circuit diagnostics. This assumes a conventional +high-impedance/saturated injector; a low-impedance injector requires a +peak-and-hold architecture. + +### Generic digital outputs + +All non-engine digital output connector functions are labelled generically and +assigned their vehicle role in firmware. For example, the starter-enable +function is mapped to a compatible generic output rather than having a +dedicated connector-only electrical architecture. + +Two hardware classes remain necessary. Their selected architecture, default +state, diagnostic intent, connector protection, and remaining validation are +defined in [DIGITAL_OUTPUTS.md](IO_MODULES/DIGITAL_OUTPUTS.md). + +- Generic logic outputs use `+5V_AUX`-supplied `TPS4H000-Q1` protected + high-side channels with a local output pull-down. They command external + electronic-control inputs and are limited to 100 mA per channel. +- Generic sink outputs use `VBAT_PROT`-supplied `TLE9104SH` protected low-side + channels. They command relays, solenoids, and external modules that provide + a pull-up. + +Firmware configuration selects the output's vehicle role and active polarity, +but cannot make one electrical driver class behave as the other. A starter +enable can therefore use either a generic logic output or a generic sink output +only when the selected external starter switch accepts that interface. + +### Analogue-output provision + +Analogue output is not a V1 functional requirement. Reserve two MCU pins and +board footprints for future 0-5 V outputs. The intended future path is: + +```text +DAC --> rail-to-rail buffer --> protection / series impedance --> connector +``` + +A true calibrated 0-5 V output may require an external 5 V-referenced DAC or +a suitably characterised buffer stage. A general 0-12 V analogue output is not +included unless a future peripheral explicitly requires it. + +## Layout and Validation Priorities + +- Keep trigger and ADC front ends physically separated from coil, injector, + switching-regulator, and high-current output nodes. +- Route Hall signals with their sensor return; use an appropriate harness and + shielding strategy after cable testing. +- Place protection at the connector, filtering/conditioning near the MCU side, + and avoid dumping input-fault energy into `+3V3_ANA`. +- Validate Hall glitch rejection with ignition active, including worst-case + dwell and spark events. +- Validate ADC noise, ratiometric accuracy, thermistor self-heating, and ADC + settling before freezing resistor networks or deciding whether the optional + analogue LDO is necessary. + +## Open Items Before Schematic Freeze + +1. Select Hall and thermistor part numbers, cable lengths, connectors, and + resulting pull-up/filter values. +2. Confirm ignition-coil and injector electrical data and select their driver + devices. +3. Freeze the generic digital I/O count, per-channel current ratings, and + connector allocation. +4. Select 5 V-tolerant, automotive-suitable comparators and input-protection + components for generic digital inputs. +5. Select the STM32H747 package and complete a pin assignment that preserves + all timer, ADC, optional DAC, debug, and communications resources. +6. Define CAN and other communications interfaces separately. diff --git a/Architecture/IO_MODULES/ANALOG_INPUTS.md b/Architecture/IO_MODULES/ANALOG_INPUTS.md new file mode 100644 index 0000000..6ca918e --- /dev/null +++ b/Architecture/IO_MODULES/ANALOG_INPUTS.md @@ -0,0 +1,79 @@ +# Analogue and Temperature Inputs + +## Scope + +This is the V1 front-end architecture for nine general 0--5 V channels and +four NTC temperature channels. Exact protection parts, ADC timing, and sensor +curves remain schematic-release validation items. All harness analogue signals +use `SENSOR_GND` and are kept separate from ignition/injector return currents. + +## General 0--5 V channels + +```text +connector -- transient clamp -- R_TOP --+-- ADC-local C_HOLD -- ADC + | + R_BOTTOM + | + SENSOR_GND +``` + +`R_TOP` is the divider's upper resistor; do not add a separate series +`R_PROT` in the normal passive channel. It is the element that limits current +from the connector clamp into the ADC-side network, so select an appropriate +pulse/voltage rating for the expected residual transient. `R_TOP`, the clamp, +and `R_BOTTOM` are a system: select standoff, hot leakage, dynamic clamp +voltage, pulse energy, negative-excursion path, and local return from the +actual harness-fault specification. A nominal TVS voltage alone is not a +sufficient selection. Microamp leakage can be a significant offset with a +high-value divider, and neither clamp may feed an unpowered analogue rail or +MCU protection diode. + +For 0.5--4.5 V and 0--5 V active sensors, use a 0.55--0.60 divider with 1% +parts or a matched network. The existing 0.55 target maps 5.25 V to 2.89 V. +Choose impedance low enough that leakage and PCB contamination are negligible, +but high enough not to load the sensor. + +Place `C_HOLD` at the ADC after a small isolation resistor. It is both the +low-pass/anti-alias capacitor and local sample-and-hold charge reservoir. +Validate its value and ADC sample time together against worst-case divider +Thevenin resistance, ADC sampling capacitance, channel-to-channel steps, and +sample rate. A large capacitor does not by itself make arbitrary source +impedance acceptable. + +For ratiometric 5 V sensors, provide a corresponding divider/filter measurement +of `+5V_SENS` and sample it close to the sensor channel. + +## NTC temperature channels + +```text ++5V_SENS -- R_PULLUP --+-- NTC -- SENSOR_GND + | + attenuator / local filter --> ADC +``` + +The attenuator and ADC protection are required even if a normal temperature +range appears below 3.3 V: an open thermistor raises the node to `+5V_SENS`. +Calculate resistance from the thermistor and measured `+5V_SENS` ADC ratio, +then use the selected sensor's R/T calibration rather than a nominal beta +equation. + +Fit one defined pull-up per channel, using 0.1% or better low-TCR resistance; +provide alternate DNP footprints only where the sensor family is expected. + +| Sensor family / example | Initial `R_PULLUP` | Basis | +| --- | ---: | --- | +| Bosch Motorsport 2.5 kOhm at 20 C NTC | 3.01 kOhm | Bosch states typical ECU pull-ups of 1 or 3 kOhm; 3 kOhm retains useful engine-temperature resolution with less self-heating than 1 kOhm. | +| 10 kOhm at 25 C, beta about 3435--3976 K | 10.0 kOhm | Centres resolution around ordinary ambient/medium temperatures. | +| 30 kOhm at 25 C | 30.1 kOhm | Only for a confirmed curve; reduces divider current and self-heating. | + +For Bosch's 2.5 kOhm curve, a 3.01 kOhm pull-up produces approximately 4.69 V +at -40 C, 2.27 V at 20 C, and 0.29 V at 100 C. A 0.60 attenuator produces +about 2.81 V, 1.36 V, and 0.18 V at the ADC; the open fault maps to 3.0 V. +Make the attenuator high enough that it adds under 1% loading error at the +coldest required NTC resistance, or include its loading in calibration. Its +high Thevenin resistance is acceptable only with designed `C_HOLD` and +settling/sample time. + +Validate NTC self-heating in the actual mounting medium (worst case is normally +hot), plus open/short detection, supply tolerance, pull-up TCR, cable resistance, +clamp leakage, PCB contamination, and operation alongside ignition switching. diff --git a/Architecture/IO_MODULES/DEAD_MAN.md b/Architecture/IO_MODULES/DEAD_MAN.md new file mode 100644 index 0000000..df375a7 --- /dev/null +++ b/Architecture/IO_MODULES/DEAD_MAN.md @@ -0,0 +1,88 @@ +# Dead-Man Engine-Permit Interlock + +## Purpose + +This module provides the hardware run-permission path for the engine outputs. +The steering-wheel dead-man switch must be held to assert permission. Releasing +the switch, an open circuit, loss of a logic supply, or MCU reset must place +the engine outputs in their non-energising state independently of firmware. + +This document defines the signal relationships and destinations only. Output +driver implementation is documented separately. + +## Logic domains + +| Signal | Domain | Active state | Default/fault state | +| --- | --- | --- | --- | +| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission | +| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission | +| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission | +| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off | +| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off | +| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted | +| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted | + +`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered, +and given a default-low bias before entering the 5 V logic. The conditioning +must tolerate expected connector faults and transients without allowing a +fault to assert engine permission. + +## Signal tree + +The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic +levels. Their outputs are 5 V logic levels. + +```text +protected steering-wheel input + | + +--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU + | + +--> conditioned 5 V DEAD_MAN_SIG --+ + AND --> ENGINE_PERMIT --+ +MCU_RUN_PERMIT --------------------------------+ | + +--> ignition-permission inverter + | --> SAFE_IGNITION_INHIBIT + | +MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG +``` + +The logic equations are: + +```text +ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT +SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG +SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) +``` + +## Output destinations + +| Logic output | Destination | Required behavior | +| --- | --- | --- | +| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. | +| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. | +| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. | +| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. | + +## Fail-safe behavior + +- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its + wire opens, or its source is unavailable. +- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset, + boot, brownout, or an unpowered MCU. External bias components shall provide + these states during power sequencing. +- If `ENGINE_PERMIT` becomes low during an injection command, + `SAFE_INJECTOR_SIG` becomes low and removes the command from the injection + output stage. +- If `ENGINE_PERMIT` becomes low during an ignition dwell, + `SAFE_IGNITION_INHIBIT` becomes high and commands the ignition output stage + into its non-sparking shutdown behavior. +- If the 5 V permission logic loses power, the injection command input must + be externally biased low and the ignition output stage's inhibit input must + default to its inhibited state. + +## Firmware responsibilities + +The hardware path is authoritative; firmware cannot override a released +dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear +pending injection and ignition schedules when it becomes invalid, and keep +`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled. diff --git a/Architecture/IO_MODULES/DIGITAL_INPUTS.md b/Architecture/IO_MODULES/DIGITAL_INPUTS.md new file mode 100644 index 0000000..ad09a77 --- /dev/null +++ b/Architecture/IO_MODULES/DIGITAL_INPUTS.md @@ -0,0 +1,187 @@ +# General-Purpose Digital Input Module + +## Purpose + +This module defines the generic harness-connected digital-input class for +NeoECU V1. It accepts externally driven 5 V, 12 V, and protected +battery-domain signals, plus dry-contact and open-collector sources when the +appropriate ECU bias option is fitted. + +This is not the crank/cam trigger interface and is not the dead-man +engine-permit input. Those functions retain their dedicated conditioning and, +for the dead-man, its independent hardware safety path. + +V1 provisionally allocates six generic digital-input channels. The allocation, +connector pins, input timing requirements, and final input count remain open. + +## Interface and operating assumptions + +- Valid externally driven high inputs extend from 5 V through `VBAT_PROT`. + Firmware configures the reported active polarity; the electrical front end + is active-high. +- An external source may drive an input while the ECU is unpowered. This must + not back-power `+3V3_MAIN`, `+5V_MAIN`, `+5V_AUX`, or `VBAT_PROT`. +- `+5V_AUX` may provide optional low-current wetting for a dry contact or + open-collector output. It is not a general sensor-supply rail and + `+5V_SENS` shall not be used for this purpose. +- Each channel's maximum switching rate and permitted debounce delay are + application-dependent. These requirements shall be assigned before the RC + values are frozen. + +## Comparator architecture + +Use the fail-safe, automotive-qualified TI `TLV186x-Q1` open-drain comparator +family. Its inputs are high impedance up to 40 V even while its supply is +unpowered, so a battery-domain input cannot inject current into the ECU logic +rails during normal operation, power sequencing, or an ECU-off condition. + +The provisional six-channel implementation is one `TLV1864-Q1` quad and one +`TLV1862-Q1` dual. This is an architectural component selection; package, +availability, and final channel count still require schematic-stage +confirmation. + +Each comparator is operated in the inverting hysteresis configuration: + +`DIG_INx` passes through the protected input network and configurable `R_IN` / +`C_FILTER` stage to the comparator's `IN−` input. `IN+` is the `VTH` node: +`R_REF_H` connects it to `+5V_MAIN`, `R_REF_L` connects it to protected ground, +and `R_HYS` connects it to `DIG_IN_LOGIC` for positive feedback. The +open-drain comparator output is pulled up to `+3V3_MAIN` by `R_PULLUP` and +then connects to the MCU GPIO. + +`DIG_IN_LOGIC` is pulled to `+3V3_MAIN` and connects to one STM32 GPIO. The +logic is inverted at this point: a harness voltage above the upper threshold +pulls the comparator output low. Firmware may invert the reported input +polarity, but it does not alter the physical thresholds or protection. + +`R_HYS` feeds a controlled fraction of the 3.3 V output state into `VTH`. +When the output is high, the threshold is higher; the input must cross this +upper threshold to pull the output low. Once low, the feedback contribution is +removed and the input must fall through the lower threshold before the output +releases again. This is true hysteresis, not firmware debounce. + +The reference-divider ratio, `R_HYS`, output pull-up, and their tolerances +shall be calculated together. The design shall establish thresholds in real +harness volts with sufficient margin for all of the following: + +- the lowest valid 5 V external source; +- the lowest `+5V_AUX` voltage and forward drop of the optional wetting diode; +- comparator input offset and leakage over temperature; +- resistor tolerance; and +- expected harness noise. + +An initial design objective is an upper threshold in the 2.8--3.2 V range and +a lower threshold in the 1.8--2.2 V range. These are design targets, not +schematic values. They shall be confirmed against the final input definitions +and chosen comparator output-pull-up value. + +TI's worked example of this topology is [Inverting Comparator With Hysteresis +Circuit](https://www.ti.com/tool/CIRCUIT060076). The selected comparator's +fail-safe input and output requirements are defined in the [TLV185x-Q1 and +TLV186x-Q1 datasheet](https://www.ti.com/lit/ds/symlink/tlv1861-q1.pdf). + +## Optional input biasing + +Provide unpopulated per-channel footprints for the following mutually +exclusive options. Through-hole resistor positions are acceptable where +field-level reconfiguration is valuable; DNP SMD positions and solder-jumper +selection are also acceptable when production configuration is known. + +At the connector node (`DIG_IN_RAW`), fit the harness TVS before `R_IN`. +`C_FILTER` and the local negative clamp are on the protected `SENSE` side of +`R_IN`. The optional wetting branch is `+5V_AUX` → `R_WET` → `D_WET` → +`DIG_IN_RAW`; the diode cathode faces `DIG_IN_RAW`. `R_PD`, when fitted, +connects `DIG_IN_RAW` to protected ground. + +- `R_WET` and `D_WET` form the optional wetting pull-up. `D_WET` has its + anode toward `+5V_AUX` and cathode toward the input. It prevents a 12 V or + battery-domain external source from back-feeding `+5V_AUX`. +- `R_PD` is an optional weak pull-down to the protected logic ground. +- With neither component fitted, the channel is intended for an externally + driven logic signal. +- Do not fit both bias components by default. The required mode is selected + per channel from the connected vehicle function. + +The MCU's internal pull resistors are not a substitute for these footprints: +they act only on the post-comparator 3.3 V GPIO and cannot define or wet the +harness-connected input. + +## Harness protection and filtering + +The comparator's 40 V fail-safe input capability eliminates power-backfeed +through the comparator; it does not replace harness fault protection. Every +channel shall include the following protection functions: + +The right-hand side of the figure above shows the required functional +protection arrangement. + +- **Primary positive clamp:** use a connector-side TVS or equivalent + protection element. Its working standoff shall exceed the 16.8 V maximum + normal battery input. Its worst-case dynamic clamp voltage, including + tolerance, temperature, source impedance, and the specified pulse current, + shall remain below the comparator's 40 V input capability with design + margin. A nominal device label such as "20 V" or "24 V" is not sufficient + evidence of this requirement. +- **Negative clamp:** provide a local low-capacitance clamp path that prevents + the comparator input from going below its allowed negative input voltage. + The clamp returns to the protected logic-ground reference, not to a positive + ECU rail. +- **Series resistance:** `R_IN` limits fault and clamp current, isolates the + filter capacitor from fast harness events, and shall have adequate pulse + voltage, power, and surge rating. Split series resistors may be used to + share voltage stress. +- **RC filtering:** `R_IN` and `C_FILTER` suppress short edge noise. Reserve + configurable capacitor footprints so the final time constant can support + both electronic inputs and contact-debounce applications. Hysteresis, not + an excessively slow RC, provides the primary threshold-noise immunity. +- **Component placement:** place the primary transient protection at the + connector entry. Keep the comparator-side clamp, filter, reference network, + and comparator close together and away from ignition, injector, and + regulator hot loops. + +The selected protection network must also be verified for an ECU-off, +externally driven input. The `TLV186x-Q1` input itself remains high impedance +in that state; the completed TVS, clamp, bias, and capacitor network must +likewise have no path that back-powers an ECU rail. + +## Power sequencing and output behavior + +The comparator and GPIO pull-up use `+3V3_MAIN`. `VTH` is derived from +`+5V_MAIN`; both comparator inputs are fail-safe beyond the comparator supply, +so the reference network does not require an input clamp merely because of a +normal rail sequencing difference. + +The open-drain output is allowed to be pulled to `+3V3_MAIN`; no output clamp +to `VBAT_PROT` is required. When `+3V3_MAIN` is absent, the input front end is +protected but neither the comparator output nor the MCU can report an input +state. This is the intended ECU-off behavior. + +## Fault behavior + +| Condition | Required hardware behavior | +| --- | --- | +| Input open, wetting pull-up fitted | Read as high at the electrical front end. | +| Input grounded, wetting pull-up fitted | Read as low; `R_WET` limits current. | +| Input open, pull-down fitted | Read as low. | +| Valid external 5 V, 12 V, or `VBAT_PROT` drive | Cross the upper threshold with specified margin. | +| External drive while ECU off | No comparator-input back-power path; no reported state until ECU logic is powered. | +| Positive harness transient | Primary clamp and `R_IN` keep the comparator input within its validated limit. | +| Negative harness transient | Local negative clamp and `R_IN` keep the comparator input within its validated limit. | +| `+5V_AUX` shorted or absent | Wetting function is unavailable; it shall not damage or force a battery-domain input high. | + +## Validation and open items before schematic freeze + +1. Confirm the six-channel count, connector allocation, and maximum event + rate/debounce requirement for every generic input. +2. Define the harness source types and fault/transient environment, including + externally powered inputs while the ECU is off. +3. Select and validate the TVS, local negative clamp, `R_IN`, and capacitor + voltage/pulse ratings from that environment. Verify the actual clamp + voltage at the comparator pin, not only the nominal clamp designation. +4. Calculate the upper and lower thresholds with worst-case rail voltages, + diode drop, output levels, resistor tolerance, comparator offset, leakage, + and temperature. +5. Select the final wetting and pull-down resistor values, assembly method, + and per-channel default population. +6. Validate noise immunity, contact bounce, ECU-off drive, ESD, and + ignition/injector switching noise on hardware before freezing values. diff --git a/Architecture/IO_MODULES/DIGITAL_OUTPUTS.md b/Architecture/IO_MODULES/DIGITAL_OUTPUTS.md new file mode 100644 index 0000000..3266651 --- /dev/null +++ b/Architecture/IO_MODULES/DIGITAL_OUTPUTS.md @@ -0,0 +1,157 @@ +# General-Purpose Digital Output Module + +## Purpose + +This module defines the generic harness-connected digital-output classes for +NeoECU V1. It does not cover the dedicated ignition and injector power stages. +Connector positions, channel count, and the assignment of vehicle functions +remain open until packaging and connector design. + +Two non-interchangeable output classes are provided: + +- protected 5 V high-side logic outputs for external electronic-control inputs; +- protected battery-domain low-side outputs for relays, solenoids, and other + inductive loads. + +Firmware assigns a compatible vehicle role and reported polarity to a channel; +it cannot turn one electrical class into the other. A starter-enable function +may use either class only when the external starter interface accepts it. + +## Protected 5 V logic outputs + +Use the automotive-qualified TI `TPS4H000-Q1` quad smart high-side switch. +It is supplied from `+5V_AUX`, not directly from `+5V_MAIN`. + +```text ++5V_MAIN --> +5V_AUX eFuse / load switch --> TPS4H000-Q1 VBB + | +MCU GPIO --> TPS4H000-Q1 INx OUTx --> LOGIC_OUTx --> connector + | | + R_IN_PD R_OUT_PD + | | + GND GND +``` + +- `+5V_AUX` isolates an external logic-output fault from `+5V_MAIN`, the MCU, + and the sensor-excitation rail. +- Each channel is active high: when commanded on, it sources `+5V_AUX`. + `R_OUT_PD` holds the connector output low when the channel is off or the ECU + is unpowered. This is a protected high-side output with a passive low state, + not a true push-pull stage. +- `R_IN_PD` is an external pull-down at the IC input. It holds the output off + while the MCU is reset, booting, unpowered, or has not deliberately taken + control. MCU internal pulls are not a substitute. +- Set each channel's current limit to the TPS4H000-Q1 minimum configured value + of 100 mA. This is the intended maximum output current for this logic-output + class; the `+5V_AUX` eFuse limit must be selected consistently with the + populated channel count and simultaneous-fault policy. +- Use the IC's diagnostic/current-sense variant as appropriate for the MCU + interface. Per-channel fault reporting is useful but open-load reporting is + optional for generic logic commands. + +### Logic-output connector protection + +Place `TVS_LOGIC_OUTx` at the connector side of each output, with a short, +low-inductance return to the protected output-ground reference. Select its +working standoff above the maximum `+5V_AUX` voltage and its worst-case dynamic +clamp below the TPS4H000-Q1 output-pin limit with margin. + +The TVS absorbs transient events. It is not sized to dissipate a sustained +misconnection to `VBAT_PROT`; the TPS4H000-Q1's off-state short-to-battery +detection and fault behaviour must handle that case. Confirm its unpowered +output behaviour and the completed TVS network against the actual connector +fault and transient specification before schematic freeze. + +## Protected low-side outputs + +Use the automotive-qualified Infineon `TLE9104SH` smart quad low-side switch. +It drives battery-domain loads supplied from `VBAT_PROT`. + +```text +VBAT_PROT --> external load --> SINK_OUTx --> TLE9104SH OUTx + | + internal low-side MOSFET + | + OUT_PGND --> power-entry ground star + +VBAT_PROT --> TLE9104SH VS +5V_MAIN --> TLE9104SH VDD + +3V3_MAIN --> TLE9104SH VIO + +MCU GPIO --> TLE9104SH INx MCU SPI <--> TLE9104SH SPI + | | + R_IN_PD diagnostics + | + TLE9104SH local ground reference + +MCU enable --> TLE9104SH EN + | + R_EN_PD + | + TLE9104SH local ground reference +``` + +- The TLE9104SH supplies active inductive-load clamping, configurable + overcurrent protection, short-circuit and thermal protection, direct channel + inputs, and SPI diagnostics. +- `VS` is supplied from `VBAT_PROT`; use the documented logic supplies so the + MCU-facing interface is referenced to `+3V3_MAIN` while the driver itself is + supplied from the internal 5 V rail. Decouple both supply domains locally at + the IC. +- `R_EN_PD` holds `EN` inactive through power-up and MCU reset. `R_IN_PD` on + every direct input holds its channel off. Firmware may enable outputs only + after the required reset, SPI configuration, and diagnostic checks have + completed. +- Use the diagnostic interface to identify overcurrent, overtemperature, + short-to-battery, short-to-ground, and—where useful—open-load faults. The + final retry, latching, reporting, and output-inhibit policy is firmware work + and remains open. +- Define `OUT_PGND` as a high-current return domain. It must remain separate + from `DGND`, sensor return, injector return, and ignition return until the + deliberate power-entry star connection. + +### Sink-output connector protection + +The TLE9104SH's internal active clamp is the primary turn-off path for +inductive loads. Provide a connector-side transient-protection footprint for +each sink output, but select and place any external TVS only after calculating +the load energy, harness transient environment, and desired release time. An +incorrect low-voltage clamp can bypass the driver's intended inductive clamp, +increase TVS dissipation, or slow a relay/solenoid release. + +The final protection network shall keep the output pin within its validated +limit for connector transients and for an externally powered load while the +ECU is off. It shall not back-power the TLE9104SH logic supply, `+3V3_MAIN`, +or `+5V_AUX`. + +## Default state and fault behaviour + +| Condition | Logic output (`TPS4H000-Q1`) | Sink output (`TLE9104SH`) | +| --- | --- | --- | +| MCU reset or boot | `R_IN_PD` holds the channel off; `R_OUT_PD` holds the connector low. | `R_EN_PD` and `R_IN_PD` keep every channel open. | +| ECU unpowered | Output is not actively driven; connector protection and the IC must tolerate the assigned external-fault case without rail back-power. | Output is open; externally powered loads and connector faults must not back-power ECU logic. | +| Output short/overload | Per-channel current limit and thermal protection act; `+5V_AUX` eFuse limits the aggregate branch. | Per-channel overcurrent/thermal protection acts and status is reported through SPI. | +| Inductive turn-off | Not an intended load class. | Internal active clamp controls load-current decay; any external TVS is coordinated with it. | + +## Validation and open items before schematic freeze + +1. Confirm the output connector transient/ESD and sustained miswiring cases, + including externally applied battery voltage while the ECU is off. +2. Select `TVS_LOGIC_OUTx` by worst-case dynamic clamp and pulse rating, not + nominal voltage marking. Confirm it does not conduct at the maximum + `+5V_AUX` voltage. +3. Select `R_OUT_PD` from the external logic-input leakage, required low level, + and permitted static current when the output is high. +4. Select the `+5V_AUX` eFuse threshold and TPS4H000-Q1 channel-limit setting + together; 100 mA per active channel is the maximum intended logic-output + current. +5. For each sink load, establish steady current, inrush, inductance, stored + energy, required release time, PWM requirement, and thermal/copper limits. +6. Calculate whether an external sink-output TVS is required and verify that it + complements rather than overrides the TLE9104SH active clamp. +7. Define the firmware diagnostic and recovery policy, and identify any output + assignment that needs an additional hardware permit gate. + +## References + +- [TPS4H000-Q1 product page and datasheet](https://www.ti.com/product/TPS4H000-Q1) +- [TLE9104SH product page and datasheet](https://www.infineon.com/cms/de/product/power/smart-power-switches/multichannel-spi-switches-controller/flex-multichannel-spi-low-side-power-switch/tle9104sh/) diff --git a/Architecture/IO_MODULES/IGNITION.md b/Architecture/IO_MODULES/IGNITION.md new file mode 100644 index 0000000..a354448 --- /dev/null +++ b/Architecture/IO_MODULES/IGNITION.md @@ -0,0 +1,135 @@ +# Ignition Output Module + +## Purpose + +This module drives the existing dual-ended, two-pin dumb ignition coil. The +coil primary is battery-fed and switched on its low side by an STMicroelectronics +VBG08H-E smart ignition IGBT (`VBG08HTR-E` for tape-and-reel assembly). + +The VBG08H-E integrates the ignition IGBT, high-voltage clamp, coil-current +limit, thermal protection, soft shutdown, and a coil-current threshold flag. +Its 8 A maximum operative coil-current rating is compatible with V1 only after +the final coil's primary characteristics and required dwell current are +confirmed. + +## Power path + +```text +VBAT_PROT --> coil primary --> VBG08H HVC + | + internal IGBT + | + PGND1 + PGND2 --> IGN_PGND --> power-entry ground +``` + +- `HVC` connects to one coil-primary terminal; the other terminal connects to + `VBAT_PROT`. +- `VS` is supplied from `VBAT_PROT`. Place a 100 nF ceramic and 10 µF local + capacitor at `VS`, following the VBG08H-E reference circuit. +- `VBAT_PROT` protection must maintain the VBG08H-E within its 5.4-28 V + operating supply range during normal operation and expected local transients. +- Do not place a conventional flyback diode across the coil primary. The + VBG08H-E's internal high-voltage clamp provides the rapid primary-current + collapse required to generate a spark. + +## Command and inhibit path + +`INP` is active high: a rising edge begins coil dwell and a falling edge +causes the normal spark event. + +```text +STM32 ignition timing output + --> 3.3 V-to-5 V non-inverting buffer --> 1 kOhm --> INP + | + low-capacitance + Zener clamp + | + VBG local Kelvin-ground reference + +SAFE_IGNITION_INHIBIT + --> 1 kOhm --> EN + | + low-capacitance + Zener clamp + | + VBG local Kelvin-ground reference +``` + +The VBG08H-E input-high requirement is 3 V. A 5 V buffer is used rather than +direct STM32 drive to preserve high-level margin across MCU output tolerance, +temperature, and ignition noise. + +`EN` is active low: + +```text +SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) +``` + +When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a +dwell is active, this invokes the VBG08H-E soft shutdown so coil current is +removed without intentionally generating a spark. The 1 kOhm resistors on +`INP` and `EN` follow the manufacturer's reference circuit and limit transient +current into the device's control pins. + +The command traces shall be short, have a continuous quiet reference, and be +routed away from the `HVC` switching node and coil connector. The VBG08H-E +already includes input filtering; no external RC filter shall be added until +its timing effect has been analysed. + +Fit a low-capacitance Zener clamp directly at each `INP` and `EN` power-IC pin, +on the VBG side of its 1 kOhm series resistor. Each clamp returns to the VBG +local Kelvin-ground reference at the `IGN_PGND` joining point, not to remote +`DGND`. The clamp voltage shall tolerate the valid 5 V logic high while +limiting positive transients before the VBG08H-E input-overvoltage threshold. +On `EN`, the protection network must preserve the fail-safe high/inhibit state +and must not create a path that can pull `EN` low during a fault. + +## Current-flag diagnostic + +`C.F.` is an open-drain output. It is low while coil current is below its +internal threshold and releases when the current reaches the nominal 6.5 A +threshold. The threshold is not externally programmable. + +```text +VBG08H C.F. --> reference-style R/C filter and 3.3 V pull-up --> STM32 GPIO +``` + +The pull-up voltage must not exceed 5.5 V; `+3V3_MAIN` is suitable. The signal +is a diagnostic confirmation of primary-current buildup and is not part of the +hardware ignition shutoff path. Firmware shall use it to detect and report an +under-current/late-current condition while retaining a separately defined +maximum dwell time. + +## Ground and layout + +Define `IGN_PGND` as the ignition module's high-current return domain. + +```text +PGND1 -- matched heavy copper --+ + +--> IGN_PGND local joining point --> power-entry ground +PGND2 -- matched heavy copper --+ + | +VBG08H GND -- short, separate Kelvin reference trace --+ +``` + +- `PGND1` and `PGND2` must use equal-length, equal-width, and similarly + shaped copper paths to the `IGN_PGND` joining point. The VBG08H-E uses these + paths in its internal current-sensing scheme; imbalance shifts its current + limit and current-flag threshold. +- The VBG08H-E `GND` pin connects locally to that same joining point through a + short, separate Kelvin/reference trace. It does not carry coil current. +- Do not separately connect the VBG08H-E `GND` pin to the remote `DGND` plane. + `IGN_PGND` and `DGND` meet only at the deliberate power-entry ground star, + preventing parallel ground-return paths. +- Keep the coil-current loop compact and isolate its routing from MCU, ADC, + trigger-input, and communication traces. + +## Remaining validation before schematic freeze + +1. Identify the coil and measure/obtain its primary resistance, inductance, + operating current, and permitted dwell characteristics. +2. Confirm that worst-case stored energy and current remain within the + VBG08H-E repetitive operating limits at the 16.8 V battery maximum. +3. Verify thermal performance with the selected PCB copper area and enclosure. +4. Validate spark noise, `C.F.` behavior, input margins, and the effective + engine-permit shutdown behavior on hardware. diff --git a/Architecture/IO_MODULES/INJECTON.md b/Architecture/IO_MODULES/INJECTON.md new file mode 100644 index 0000000..dfad68e --- /dev/null +++ b/Architecture/IO_MODULES/INJECTON.md @@ -0,0 +1,107 @@ +# Injector Output Module + +## Purpose + +This module drives one conventional high-impedance/saturated fuel injector. It +uses the STMicroelectronics VNL5050S5-E protected low-side switch +(`VNL5050S5TR-E` for tape-and-reel assembly). + +The driver provides an integrated power MOSFET, inductive-load clamp, current +and power limiting, thermal protection, off-state open-load detection, and an +open-drain status output. It is not a peak-and-hold injector driver; a +low-impedance injector requires a different architecture. + +## Power path + +```text +VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN + | + internal low-side MOSFET + | + SOURCE --> INJ_PGND --> power-entry ground +``` + +- The injector's positive terminal connects to `VBAT_PROT`; its negative + terminal connects to `DRAIN`. +- `SUPPLY` connects to `+5V_MAIN`, the internal logic rail. Place local + decoupling from `SUPPLY` to `SOURCE`, including a nearby 100 nF ceramic + capacitor. +- The VNL5050S5-E provides a 41-52 V drain-source clamp for inductive turn-off. + Injector current-decay/closing time must be verified using the actual + injector inductance and resistance. +- Do not add a conventional flyback diode across the injector; it would slow + its current decay and closing response. + +## Command path + +`INPUT` is active high. It receives only the hardware-permitted injector +command defined by the dead-man interlock. + +```text +SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT + |-- 10 kOhm ---------> INJ_PGND + `-- low-capacitance + Zener clamp ------> INJ_PGND +``` + +```text +SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG +``` + +`SAFE_INJECTOR_SIG` is 5 V logic and therefore provides substantial margin +over the VNL5050S5-E's 2.1 V minimum input-high level. The 1 kOhm `Rprot` +resistor follows the manufacturer's protection approach. The 10 kOhm pull-down +is placed on the driver side of `Rprot`; it holds `INPUT` low if the permission +logic is unpowered, disconnected, or during power sequencing. + +Fit the low-capacitance Zener clamp directly at the VNL5050S5-E `INPUT` pin, +on the driver side of `Rprot`. Its return is the local `INJ_PGND`/`SOURCE` +reference, not remote `DGND`. Select its clamp voltage to tolerate the valid +5 V command high while limiting coupled positive transients at the power-IC +pin. + +When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the +injector output off. This is the hardware shutoff path; firmware also clears +pending injection events when it observes a dead-man release. + +## Status diagnostic + +`STATUS` is an open-drain diagnostic output. It is read by the MCU through a +1 kOhm protection resistor and a `+3V3_MAIN` pull-up. + +```text ++3V3_MAIN pull-up --> MCU-side status node --> 1 kOhm Rprot --> STATUS +``` + +The 3.3 V pull-up is within the pin rating and provides a safe MCU logic level. +The diagnostic path supports off-state open-load detection and indicates +over-temperature shutdown. The VNL5050S5-E protects against short circuit and +current overload internally, but its single `STATUS` pin does not provide a +separate, unambiguous MCU-readable short-circuit/current-limit indication. + +## Ground and layout + +Define `INJ_PGND` as the injector module's high-current return domain. + +```text +VNL5050 SOURCE --> short, low-impedance INJ_PGND copper --> power-entry ground star +``` + +- `INJ_PGND` runs directly to the power-entry ground star, where it joins the + battery return, `IGN_PGND`, `DGND`, and sensor return domains. +- It must not share copper with those other returns before the star point. +- `SOURCE` is both the MOSFET power return and the driver's logic reference; + unlike the ignition driver, this part has no separate Kelvin-sense ground + pin. Keep the `SUPPLY`-to-`SOURCE` decoupling loop compact and the command + and status traces away from the `DRAIN` switching node. +- Provide the drain copper area required by the package thermal guidance. + +## Remaining validation before schematic freeze + +1. Measure injector coil resistance and obtain its part number/datasheet. +2. Confirm that the injector is high impedance and that its peak current, + stored energy, and turn-off time fit the VNL5050S5-E limits. +3. Verify output-stage temperature using the actual injector duty cycle, + board copper area, and enclosure conditions. +4. Validate injector opening/closing timing, diagnostic behavior, and ignition + noise immunity on hardware. diff --git a/Architecture/POWER_ARCHITECTURE.md b/Architecture/POWER_ARCHITECTURE.md new file mode 100644 index 0000000..93cbc0b --- /dev/null +++ b/Architecture/POWER_ARCHITECTURE.md @@ -0,0 +1,246 @@ +# NeoECU V1 Power Architecture + +## Purpose + +This document defines the working power architecture for NeoECU V1. The ECU +is powered from a 4S LiPo and controls one injector, one dual-ended dumb +ignition coil, engine-position Hall sensors, analogue sensors, CAN, and a +starter-enable output. + +This is an architecture decision document, not a component-selection or +schematic document. Current limits, exact protection components, and regulator +part numbers remain to be selected after the loads and packaging are confirmed. + +## Supply Assumptions + +- Supply: 4S LiPo battery. +- Nominal voltage: 14.8 V. +- Fully charged voltage: 16.8 V. +- The ECU shall tolerate supply sag during vehicle operation and switching + transients from ignition, injector, starter, and harness inductance. +- Unlike a road-car alternator system, V1 is not initially designed around a + conventional automotive load-dump event. Input protection and regulators + should nevertheless have adequate voltage headroom for realistic local + transients. + +## Rail Tree + +```text +4S LiPo + | + +-- input fuse, reverse-polarity protection, TVS/transient protection + | + +-- VBAT_PROT ---------------------------------> ignition branch + | injector branch + | protected low-side outputs + | protected VBAT sense + | + +-- synchronous buck --------------------------> +5V_MAIN + | | internal 5 V circuitry + | | + | +-- eFuse / load switch ------------------> +5V_AUX + | | external logic-level outputs + | | + | +-- eFuse / load switch, ferrite/filter --> +5V_SENS + | protected sensor supply + | + +-- synchronous buck --------------------------> +3V3_MAIN + | | MCU digital supplies + | | 3.3 V logic / communications + | | + | +-- ferrite bead / filtering -------------> +5V_AUX + | MCU analogue domain + | analogue front ends + | ADC reference + | + +-- regulated buck-boost ----------------------> +12V_SENS + 12 V sensor supply + crank/cam Hall sensors + +``` + +## Input and Raw-Battery Domain + +`VBAT_PROT` is the protected raw-battery domain. It is produced after the +input fuse, reverse-polarity stage, and input transient clamp. + +It supplies the loads that must operate from battery voltage: + +- ignition-coil primary supply; +- injector supply; +- a protected, scaled battery-voltage measurement for the MCU. + +Ignition, injector, and low-side-output branches require their own protection +and fault containment. Their high-current returns must not share the sensor or +MCU return path; all return domains join deliberately at the power-entry +region. + +## +5V_MAIN + +`+5V_MAIN` is the ECU's primary regulated 5 V rail. It is generated directly +from `VBAT_PROT` by a synchronous buck converter and powers internal 5 V +circuitry, including automotive ICs that require 5 V logic or supply voltage. + +It is the upstream rail for `+5V_AUX` and `+5V_SENS`. External +harness-connected loads shall not be connected directly to `+5V_MAIN`; they +use their separately protected branch. + +## +5V_SENS + +`+5V_SENS` is derived from `+5V_MAIN` through an eFuse or protected load +switch, followed by a ferrite bead and local filtering. It is not shared +directly with external digital-output loads. + +It provides a controlled, protected 5 V excitation supply for ratiometric +pressure sensors and other sensors that require 5 V. The rail shall include a +sensor-facing protection/current-limit stage so a harness short cannot bring +down `+5V_MAIN` or the ECU logic supply. Its voltage should be monitored by +the MCU. + +The ferrite bead and local filtering isolate sensor excitation from switching +and digital noise on `+5V_MAIN`, while the protected branch keeps a +sensor-harness fault contained to the sensor domain. + +## +5V_AUX + +`+5V_AUX` is derived from `+5V_MAIN` through an eFuse or protected load switch. +It supplies external 5 V digital logic-level output circuits, such as a +starter-enable command to a separate external control module. + +This rail is distinct from `+5V_SENS` so external digital loads and harness +faults cannot disturb sensor excitation. The protection stage shall isolate a +short on `+5V_AUX` without inhibiting `+5V_MAIN` or the rest of the ECU. It +shall include appropriate output protection and current limiting for the +external interface. + +`+5V_AUX` is not an actuator supply. If a starter-enable or other command must +drive a relay or another inductive load, it shall use an appropriate protected +low-side sink output instead of a 5 V logic-level output. + +## +3V3_MAIN + +`+3V3_MAIN` is generated directly from `VBAT_PROT` by a dedicated synchronous +buck converter. It supplies the STM32H747 digital supply pins and the 3.3 V +digital loads, including logic-side communications circuitry. + +The main 3.3 V rail shall not be made by an LDO from either 5 V rail. The H747 +and supporting logic can create a substantial 3.3 V load; an LDO would +dissipate the difference between 5 V and 3.3 V as heat. Generating 3.3 V from +`VBAT_PROT` also avoids placing the MCU's current demand on `+5V_MAIN`. +`+3V3_MAIN` must never be derived from `+5V_SENS`, since that would couple the +logic load to the sensor supply. + +## +3V3_ANA + +`+3V3_ANA` is derived from `+3V3_MAIN` through a ferrite bead and local +filtering. It supplies the MCU analogue supply/reference domain and analogue +front-end circuitry. + +The initial implementation should reserve an optional low-noise LDO footprint +for this rail. An LDO should be fitted only if analogue-noise testing shows it +is necessary; it is not the primary 3.3 V regulator. The analogue rail and its +decoupling must follow the STM32H747 supply and ADC layout guidance. + +## Ratiometric 5 V Sensor Measurements + +The MCU ADC reference is `+3V3_ANA`; it is not expected to be precision-trimmed +to track `+5V_SENS`. Therefore 5 V ratiometric sensor readings are made +ratiometric in measurement and firmware rather than by requiring a fixed +relationship between the rails. + +```text ++5V_SENS ----> sensor excitation + | + +--> sensor output -- matched divider --> ADC sensor channel + | + +--> +5V_SENS sense - matched divider --> ADC 5-V-sense channel +``` + +Firmware shall calculate the sensor signal as a ratio of the two ADC readings: + +```text +sensor fraction = ADC(sensor output) / ADC(+5V_SENS sense) +``` + +Since the two channels use the same ADC reference, the reference-voltage error +and most common gain error cancel. Divider ratio and temperature drift are also +minimised by using matched, low-drift resistor networks for the sensor-output +and 5-V-sense dividers. + +Design requirements: + +- The divider ratio must keep both channels within the ADC input range with + margin for the maximum sensor-supply tolerance. A nominal ratio near 0.55 + maps 5.25 V to approximately 2.9 V. +- Use corresponding filter characteristics on the sensor-output and 5-V-sense + channels and sample them close together. +- Apply normal input protection and anti-alias filtering without defeating the + intended ratiometric measurement. +- A failed or shorted sensor supply must be detectable from the sensed 5 V + reading. + +## Thermistor Measurements + +Thermistor dividers are normally excited from `+5V_SENS`, consistent with a +conventional automotive ECU sensor interface. The thermistor itself is passive +and would operate with a 3.3 V excitation, but using the protected 5 V sensor +rail gives a common, diagnosable excitation supply for external sensors. + +```text ++5V_SENS -- precision pull-up --+-- thermistor -- sensor ground + | + +-- matched divider/filter --> ADC thermistor channel + ++5V_SENS ------ matched divider/filter -----------------> ADC 5-V-sense channel +``` + +Firmware shall use the ratio of the thermistor-channel and 5-V-sense ADC +readings to calculate the thermistor resistance. This cancels variation in +both `+5V_SENS` and the `+3V3_ANA` ADC reference. Pull-up resistance must be +chosen to limit thermistor self-heating while providing sufficient measurement +resolution over the required temperature range. + +## +12V_SENS + +The crank and cam sensors are currently described as 12 V, active-low, +open-collector-style Hall-effect sensors. They are supplied from `+12V_SENS`. + +`+12V_SENS` is a regulated 12 V buck-boost rail generated from `VBAT_PROT`. +It provides a stable supply when the 4S LiPo is above or below 12 V and may be +used by future 12 V sensor circuits in addition to the crank and cam sensors. + +The rail shall include a sensor-facing current-limit or protected high-side +switch, filtering appropriate to the harness, and local decoupling at the +sensor connector. Its voltage accuracy, ripple, current capability, and +current-limit threshold must be specified from the selected Hall sensors and +the future 12 V sensor budget. + +Hall outputs shall not enter the MCU at the sensor supply voltage. Their input +conditioning shall provide protection, noise rejection, and a defined +logic-level conversion to protected 3.3 V timer inputs. Output pull-up and +level-shift details are to be selected with the final sensor wiring and output +type. + +## Grounding and Layout Intent + +- Keep ignition, injector, and starter-switch current returns separate from + sensor and MCU ground returns. +- Join these return domains deliberately near the input/power-entry region. +- Keep switching-regulator hot loops compact and away from trigger and ADC + signal paths. +- Route sensor supply and sensor-return paths as controlled pairs to the + connector where practical. +- Place the analogue front end near its ADC connections and isolate it from + ignition and injector switching nodes. + +## Open Items Before Schematic Freeze + +1. Confirm the current budget for each rail, including all expansion I/O. +2. Confirm the Hall-sensor part numbers, current, output type, cable lengths, + and pull-up requirements; establish the current budget for future + `+12V_SENS` loads. +3. Select the input transient and reverse-polarity ratings after the battery, + wiring, and enclosure arrangement are known. +4. Confirm sensor-supply accuracy, current limit, and diagnostic requirements. +5. Validate ADC noise and ratiometric accuracy on hardware before deciding + whether the optional `+3V3_ANA` LDO is needed. diff --git a/Architecture/README.md b/Architecture/README.md new file mode 100644 index 0000000..523ea7c --- /dev/null +++ b/Architecture/README.md @@ -0,0 +1,147 @@ +# NeoECU V1 Hardware Architecture + +This document records the current working architecture for the NeoECU V1. It is +intended to be refined as the electrical system, engine components, and board +packaging are confirmed. + +## Scope + +NeoECU V1 controls a single-piston, four-stroke Eco Marathon engine. The ECU +provides engine timing, injection, ignition, sensor acquisition, and CAN +telemetry support. + +The immediate hardware scope is: + +- one injector output +- one dual-ended, two-pin dumb ignition coil output +- crank and cam position inputs +- air and coolant/water temperature inputs +- provision for additional pressure, temperature, and digital inputs +- CAN bus +- a low-current starter-enable output for an external high-current switch + +Fuel-pump control is not required because the vehicle fuel system is already +pressurised. + +## Controller + +The target controller is the STM32H747 dual-core microcontroller. + +- The Cortex-M7 owns deterministic engine control, including trigger capture, + synchronisation, and scheduled injection and ignition events. +- The Cortex-M4 is reserved for non-critical work such as telemetry, CAN, and + future auxiliary features. +- Timer capture and output-compare resources are used for time-critical engine + I/O. + +The H747 remains the preferred V1 controller. Its peripheral set provides the +required timer, analogue, digital, and FDCAN support with substantial capacity +for future telemetry and expansion. + +## Engine Timing + +The current engine timing arrangement is: + +| Signal | Current arrangement | Purpose | +| --- | --- | --- | +| Crank | Two Hall-effect pulses per crank revolution | 180-degree position events and speed estimation | +| Cam | One Hall-effect pulse per 720-degree cycle | Four-stroke phase identification | + +The initial engine speed limiter is 5,000 RPM. A future crank trigger with four +pulses per revolution is being considered to provide 90-degree timing events +and improve interpolation accuracy. + +Crank and cam sensors currently operate as 12 V, active-low Hall-effect +signals: their output is normally high and pulls low when active. The ECU must +condition these signals to protected 3.3 V timer inputs. The interface must +support the existing open-collector-style arrangement and provide noise +rejection appropriate for an engine environment. + +## Power Architecture + +The ECU is supplied directly from a 4S LiPo battery. The normal system range +therefore includes a fully charged voltage of 16.8 V. + +The input power stage must provide: + +- input fusing and reverse-polarity protection +- transient protection with voltage ratings suitable for a 16.8 V battery +- protected battery-voltage measurement by the MCU +- a regulated 5 V sensor supply +- a clean regulated 3.3 V rail for the MCU and analogue circuitry +- separate protected power branches for the ignition and injector loads + +Coil, injector, and starter-switch current returns must be routed separately +from sensor and MCU ground returns, with a deliberate ground strategy joining +them at the power-entry region. + +## Ignition Output + +The engine uses a dual-ended, two-pin dumb ignition coil with two spark plugs. +The coil primary is supplied from the protected battery rail and switched on +the low side by the ECU. + +The V1 ignition stage should use an automotive smart ignition IGBT or +ignition-driver IC rather than a generic smart low-side switch or a fully +discrete IGBT driver. It must be designed for the coil's high-voltage primary +flyback and provide active voltage clamping, over-current protection, and +thermal protection. + +Ignition dwell is adjusted in firmware using measured battery voltage. Current +limiting in the ignition driver is required as the safety backstop, particularly +at the 16.8 V fully charged battery voltage. Final dwell calibration and the +driver rating are pending coil identification or primary-current measurement. + +## Injection Output + +The injector is supplied from the protected battery rail and switched on the +low side. Its electrical type has not yet been confirmed, though it is expected +to be a conventional high-impedance/saturated injector. + +V1 should use an automotive smart low-side injector driver with: + +- inductive-load capability and controlled turn-off clamp +- current limit and thermal protection +- open-load and short-circuit diagnostics +- MCU-readable fault reporting + +Injector opening-time compensation is performed in firmware from the measured +battery voltage. The injector is not supplied from a regulated high-current +rail. Its resistance must be measured before the driver and protection values +are finalised; a low-impedance injector would require a peak-and-hold driver +and changes this architecture. + +## Sensor and Auxiliary I/O + +Analogue inputs should support common 5 V ratiometric sensors, particularly +0.5-4.5 V automotive pressure transducers, as well as thermistor channels. +Each input requires protection, filtering, diagnostic-friendly biasing where +appropriate, and conditioning to the MCU ADC voltage range. + +Initial intended I/O categories are: + +| Category | Required V1 capability | +| --- | --- | +| Digital inputs | Crank, cam, and expansion inputs | +| Analogue inputs | Air temperature, coolant/water temperature, pressure sensors, and expansion inputs | +| Engine outputs | One injector and one ignition-coil primary channel | +| Auxiliary outputs | Starter-enable logic output to an external high-current MOSFET or IGBT switch | +| Communications | CAN bus with selectable termination | + +The starter-enable output only commands an external high-current switch. The +ECU does not carry the starter's approximately 40 A current. + +## Decisions Still Required + +The following information is needed before schematic capture and component +selection are finalised: + +1. Injector coil resistance and, if available, its part number or datasheet. +2. Ignition-coil part number, primary resistance/inductance, and acceptable + dwell/current characteristics. +3. Required quantity and exact types of spare analogue and digital I/O. +4. ECU enclosure, board-size, mounting, environmental, and connector + requirements. +5. CAN connector and bus topology. +6. Detailed trigger sensor wiring, connector, and cable-length information. + diff --git a/Datasheets/stm32h747ag.pdf b/Datasheets/stm32h747ag.pdf new file mode 100644 index 0000000..f9f3f66 Binary files /dev/null and b/Datasheets/stm32h747ag.pdf differ diff --git a/Datasheets/vbg08h-e.pdf b/Datasheets/vbg08h-e.pdf new file mode 100644 index 0000000..4a593f4 Binary files /dev/null and b/Datasheets/vbg08h-e.pdf differ