Exergie/NeoECU-Hardware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial function IO and power architecture

Browse Source 
This commit contains the inital functional IO (engine controls and
general digital and analog IO excluding digital IO) and the initial
power architecture for the project
This commit is contained in:
h3cx
2026-08-29 21:18:45 +02:00
parent ebcbdf669d
commit 0de94168f7
11 changed files with 1437 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Architecture/IO_MODULES/ANALOG_INPUTS.md
+79
View File
@@ -0,0 +1,79 @@
# Analogue and Temperature Inputs
## Scope
This is the V1 front-end architecture for nine general 0--5 V channels and
four NTC temperature channels. Exact protection parts, ADC timing, and sensor
curves remain schematic-release validation items. All harness analogue signals
use `SENSOR_GND` and are kept separate from ignition/injector return currents.
## General 0--5 V channels
```text
connector -- transient clamp -- R_TOP --+-- ADC-local C_HOLD -- ADC
|
R_BOTTOM
|
SENSOR_GND
```
`R_TOP` is the divider's upper resistor; do not add a separate series
`R_PROT` in the normal passive channel. It is the element that limits current
from the connector clamp into the ADC-side network, so select an appropriate
pulse/voltage rating for the expected residual transient. `R_TOP`, the clamp,
and `R_BOTTOM` are a system: select standoff, hot leakage, dynamic clamp
voltage, pulse energy, negative-excursion path, and local return from the
actual harness-fault specification. A nominal TVS voltage alone is not a
sufficient selection. Microamp leakage can be a significant offset with a
high-value divider, and neither clamp may feed an unpowered analogue rail or
MCU protection diode.
For 0.5--4.5 V and 0--5 V active sensors, use a 0.55--0.60 divider with 1%
parts or a matched network. The existing 0.55 target maps 5.25 V to 2.89 V.
Choose impedance low enough that leakage and PCB contamination are negligible,
but high enough not to load the sensor.
Place `C_HOLD` at the ADC after a small isolation resistor. It is both the
low-pass/anti-alias capacitor and local sample-and-hold charge reservoir.
Validate its value and ADC sample time together against worst-case divider
Thevenin resistance, ADC sampling capacitance, channel-to-channel steps, and
sample rate. A large capacitor does not by itself make arbitrary source
impedance acceptable.
For ratiometric 5 V sensors, provide a corresponding divider/filter measurement
of `+5V_SENS` and sample it close to the sensor channel.
## NTC temperature channels
```text
+5V_SENS -- R_PULLUP --+-- NTC -- SENSOR_GND
|
attenuator / local filter --> ADC
```
The attenuator and ADC protection are required even if a normal temperature
range appears below 3.3 V: an open thermistor raises the node to `+5V_SENS`.
Calculate resistance from the thermistor and measured `+5V_SENS` ADC ratio,
then use the selected sensor's R/T calibration rather than a nominal beta
equation.
Fit one defined pull-up per channel, using 0.1% or better low-TCR resistance;
provide alternate DNP footprints only where the sensor family is expected.
| Sensor family / example | Initial `R_PULLUP` | Basis |
| --- | ---: | --- |
| Bosch Motorsport 2.5 kOhm at 20 C NTC | 3.01 kOhm | Bosch states typical ECU pull-ups of 1 or 3 kOhm; 3 kOhm retains useful engine-temperature resolution with less self-heating than 1 kOhm. |
| 10 kOhm at 25 C, beta about 3435--3976 K | 10.0 kOhm | Centres resolution around ordinary ambient/medium temperatures. |
| 30 kOhm at 25 C | 30.1 kOhm | Only for a confirmed curve; reduces divider current and self-heating. |
For Bosch's 2.5 kOhm curve, a 3.01 kOhm pull-up produces approximately 4.69 V
at -40 C, 2.27 V at 20 C, and 0.29 V at 100 C. A 0.60 attenuator produces
about 2.81 V, 1.36 V, and 0.18 V at the ADC; the open fault maps to 3.0 V.
Make the attenuator high enough that it adds under 1% loading error at the
coldest required NTC resistance, or include its loading in calibration. Its
high Thevenin resistance is acceptable only with designed `C_HOLD` and
settling/sample time.
Validate NTC self-heating in the actual mounting medium (worst case is normally
hot), plus open/short detection, supply tolerance, pull-up TCR, cable resistance,
clamp leakage, PCB contamination, and operation alongside ignition switching.
Architecture/IO_MODULES/DEAD_MAN.md
+88
View File
@@ -0,0 +1,88 @@
# Dead-Man Engine-Permit Interlock
## Purpose
This module provides the hardware run-permission path for the engine outputs.
The steering-wheel dead-man switch must be held to assert permission. Releasing
the switch, an open circuit, loss of a logic supply, or MCU reset must place
the engine outputs in their non-energising state independently of firmware.
This document defines the signal relationships and destinations only. Output
driver implementation is documented separately.
## Logic domains
| Signal | Domain | Active state | Default/fault state |
| --- | --- | --- | --- |
| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission |
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted |
`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered,
and given a default-low bias before entering the 5 V logic. The conditioning
must tolerate expected connector faults and transients without allowing a
fault to assert engine permission.
## Signal tree
The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
levels. Their outputs are 5 V logic levels.
```text
protected steering-wheel input
|
+--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU
|
+--> conditioned 5 V DEAD_MAN_SIG --+
AND --> ENGINE_PERMIT --+
MCU_RUN_PERMIT --------------------------------+ |
+--> ignition-permission inverter
| --> SAFE_IGNITION_INHIBIT
|
MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG
```
The logic equations are:
```text
ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
## Output destinations
| Logic output | Destination | Required behavior |
| --- | --- | --- |
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. |
## Fail-safe behavior
- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its
wire opens, or its source is unavailable.
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
boot, brownout, or an unpowered MCU. External bias components shall provide
these states during power sequencing.
- If `ENGINE_PERMIT` becomes low during an injection command,
`SAFE_INJECTOR_SIG` becomes low and removes the command from the injection
output stage.
- If `ENGINE_PERMIT` becomes low during an ignition dwell,
`SAFE_IGNITION_INHIBIT` becomes high and commands the ignition output stage
into its non-sparking shutdown behavior.
- If the 5 V permission logic loses power, the injection command input must
be externally biased low and the ignition output stage's inhibit input must
default to its inhibited state.
## Firmware responsibilities
The hardware path is authoritative; firmware cannot override a released
dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear
pending injection and ignition schedules when it becomes invalid, and keep
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.
Architecture/IO_MODULES/DIGITAL_INPUTS.md
+187
View File
@@ -0,0 +1,187 @@
# General-Purpose Digital Input Module
## Purpose
This module defines the generic harness-connected digital-input class for
NeoECU V1. It accepts externally driven 5 V, 12 V, and protected
battery-domain signals, plus dry-contact and open-collector sources when the
appropriate ECU bias option is fitted.
This is not the crank/cam trigger interface and is not the dead-man
engine-permit input. Those functions retain their dedicated conditioning and,
for the dead-man, its independent hardware safety path.
V1 provisionally allocates six generic digital-input channels. The allocation,
connector pins, input timing requirements, and final input count remain open.
## Interface and operating assumptions
- Valid externally driven high inputs extend from 5 V through `VBAT_PROT`.
Firmware configures the reported active polarity; the electrical front end
is active-high.
- An external source may drive an input while the ECU is unpowered. This must
not back-power `+3V3_MAIN`, `+5V_MAIN`, `+5V_AUX`, or `VBAT_PROT`.
- `+5V_AUX` may provide optional low-current wetting for a dry contact or
open-collector output. It is not a general sensor-supply rail and
`+5V_SENS` shall not be used for this purpose.
- Each channel's maximum switching rate and permitted debounce delay are
application-dependent. These requirements shall be assigned before the RC
values are frozen.
## Comparator architecture
Use the fail-safe, automotive-qualified TI `TLV186x-Q1` open-drain comparator
family. Its inputs are high impedance up to 40 V even while its supply is
unpowered, so a battery-domain input cannot inject current into the ECU logic
rails during normal operation, power sequencing, or an ECU-off condition.
The provisional six-channel implementation is one `TLV1864-Q1` quad and one
`TLV1862-Q1` dual. This is an architectural component selection; package,
availability, and final channel count still require schematic-stage
confirmation.
Each comparator is operated in the inverting hysteresis configuration:
`DIG_INx` passes through the protected input network and configurable `R_IN` /
`C_FILTER` stage to the comparator's `IN−` input. `IN+` is the `VTH` node:
`R_REF_H` connects it to `+5V_MAIN`, `R_REF_L` connects it to protected ground,
and `R_HYS` connects it to `DIG_IN_LOGIC` for positive feedback. The
open-drain comparator output is pulled up to `+3V3_MAIN` by `R_PULLUP` and
then connects to the MCU GPIO.
`DIG_IN_LOGIC` is pulled to `+3V3_MAIN` and connects to one STM32 GPIO. The
logic is inverted at this point: a harness voltage above the upper threshold
pulls the comparator output low. Firmware may invert the reported input
polarity, but it does not alter the physical thresholds or protection.
`R_HYS` feeds a controlled fraction of the 3.3 V output state into `VTH`.
When the output is high, the threshold is higher; the input must cross this
upper threshold to pull the output low. Once low, the feedback contribution is
removed and the input must fall through the lower threshold before the output
releases again. This is true hysteresis, not firmware debounce.
The reference-divider ratio, `R_HYS`, output pull-up, and their tolerances
shall be calculated together. The design shall establish thresholds in real
harness volts with sufficient margin for all of the following:
- the lowest valid 5 V external source;
- the lowest `+5V_AUX` voltage and forward drop of the optional wetting diode;
- comparator input offset and leakage over temperature;
- resistor tolerance; and
- expected harness noise.
An initial design objective is an upper threshold in the 2.8--3.2 V range and
a lower threshold in the 1.8--2.2 V range. These are design targets, not
schematic values. They shall be confirmed against the final input definitions
and chosen comparator output-pull-up value.
TI's worked example of this topology is [Inverting Comparator With Hysteresis
Circuit](https://www.ti.com/tool/CIRCUIT060076). The selected comparator's
fail-safe input and output requirements are defined in the [TLV185x-Q1 and
TLV186x-Q1 datasheet](https://www.ti.com/lit/ds/symlink/tlv1861-q1.pdf).
## Optional input biasing
Provide unpopulated per-channel footprints for the following mutually
exclusive options. Through-hole resistor positions are acceptable where
field-level reconfiguration is valuable; DNP SMD positions and solder-jumper
selection are also acceptable when production configuration is known.
At the connector node (`DIG_IN_RAW`), fit the harness TVS before `R_IN`.
`C_FILTER` and the local negative clamp are on the protected `SENSE` side of
`R_IN`. The optional wetting branch is `+5V_AUX` → `R_WET` → `D_WET` →
`DIG_IN_RAW`; the diode cathode faces `DIG_IN_RAW`. `R_PD`, when fitted,
connects `DIG_IN_RAW` to protected ground.
- `R_WET` and `D_WET` form the optional wetting pull-up. `D_WET` has its
anode toward `+5V_AUX` and cathode toward the input. It prevents a 12 V or
battery-domain external source from back-feeding `+5V_AUX`.
- `R_PD` is an optional weak pull-down to the protected logic ground.
- With neither component fitted, the channel is intended for an externally
driven logic signal.
- Do not fit both bias components by default. The required mode is selected
per channel from the connected vehicle function.
The MCU's internal pull resistors are not a substitute for these footprints:
they act only on the post-comparator 3.3 V GPIO and cannot define or wet the
harness-connected input.
## Harness protection and filtering
The comparator's 40 V fail-safe input capability eliminates power-backfeed
through the comparator; it does not replace harness fault protection. Every
channel shall include the following protection functions:
The right-hand side of the figure above shows the required functional
protection arrangement.
- **Primary positive clamp:** use a connector-side TVS or equivalent
protection element. Its working standoff shall exceed the 16.8 V maximum
normal battery input. Its worst-case dynamic clamp voltage, including
tolerance, temperature, source impedance, and the specified pulse current,
shall remain below the comparator's 40 V input capability with design
margin. A nominal device label such as "20 V" or "24 V" is not sufficient
evidence of this requirement.
- **Negative clamp:** provide a local low-capacitance clamp path that prevents
the comparator input from going below its allowed negative input voltage.
The clamp returns to the protected logic-ground reference, not to a positive
ECU rail.
- **Series resistance:** `R_IN` limits fault and clamp current, isolates the
filter capacitor from fast harness events, and shall have adequate pulse
voltage, power, and surge rating. Split series resistors may be used to
share voltage stress.
- **RC filtering:** `R_IN` and `C_FILTER` suppress short edge noise. Reserve
configurable capacitor footprints so the final time constant can support
both electronic inputs and contact-debounce applications. Hysteresis, not
an excessively slow RC, provides the primary threshold-noise immunity.
- **Component placement:** place the primary transient protection at the
connector entry. Keep the comparator-side clamp, filter, reference network,
and comparator close together and away from ignition, injector, and
regulator hot loops.
The selected protection network must also be verified for an ECU-off,
externally driven input. The `TLV186x-Q1` input itself remains high impedance
in that state; the completed TVS, clamp, bias, and capacitor network must
likewise have no path that back-powers an ECU rail.
## Power sequencing and output behavior
The comparator and GPIO pull-up use `+3V3_MAIN`. `VTH` is derived from
`+5V_MAIN`; both comparator inputs are fail-safe beyond the comparator supply,
so the reference network does not require an input clamp merely because of a
normal rail sequencing difference.
The open-drain output is allowed to be pulled to `+3V3_MAIN`; no output clamp
to `VBAT_PROT` is required. When `+3V3_MAIN` is absent, the input front end is
protected but neither the comparator output nor the MCU can report an input
state. This is the intended ECU-off behavior.
## Fault behavior
| Condition | Required hardware behavior |
| --- | --- |
| Input open, wetting pull-up fitted | Read as high at the electrical front end. |
| Input grounded, wetting pull-up fitted | Read as low; `R_WET` limits current. |
| Input open, pull-down fitted | Read as low. |
| Valid external 5 V, 12 V, or `VBAT_PROT` drive | Cross the upper threshold with specified margin. |
| External drive while ECU off | No comparator-input back-power path; no reported state until ECU logic is powered. |
| Positive harness transient | Primary clamp and `R_IN` keep the comparator input within its validated limit. |
| Negative harness transient | Local negative clamp and `R_IN` keep the comparator input within its validated limit. |
| `+5V_AUX` shorted or absent | Wetting function is unavailable; it shall not damage or force a battery-domain input high. |
## Validation and open items before schematic freeze
1. Confirm the six-channel count, connector allocation, and maximum event
rate/debounce requirement for every generic input.
2. Define the harness source types and fault/transient environment, including
externally powered inputs while the ECU is off.
3. Select and validate the TVS, local negative clamp, `R_IN`, and capacitor
voltage/pulse ratings from that environment. Verify the actual clamp
voltage at the comparator pin, not only the nominal clamp designation.
4. Calculate the upper and lower thresholds with worst-case rail voltages,
diode drop, output levels, resistor tolerance, comparator offset, leakage,
and temperature.
5. Select the final wetting and pull-down resistor values, assembly method,
and per-channel default population.
6. Validate noise immunity, contact bounce, ECU-off drive, ESD, and
ignition/injector switching noise on hardware before freezing values.
Architecture/IO_MODULES/DIGITAL_OUTPUTS.md
+157
View File
@@ -0,0 +1,157 @@
# General-Purpose Digital Output Module
## Purpose
This module defines the generic harness-connected digital-output classes for
NeoECU V1. It does not cover the dedicated ignition and injector power stages.
Connector positions, channel count, and the assignment of vehicle functions
remain open until packaging and connector design.
Two non-interchangeable output classes are provided:
- protected 5 V high-side logic outputs for external electronic-control inputs;
- protected battery-domain low-side outputs for relays, solenoids, and other
inductive loads.
Firmware assigns a compatible vehicle role and reported polarity to a channel;
it cannot turn one electrical class into the other. A starter-enable function
may use either class only when the external starter interface accepts it.
## Protected 5 V logic outputs
Use the automotive-qualified TI `TPS4H000-Q1` quad smart high-side switch.
It is supplied from `+5V_AUX`, not directly from `+5V_MAIN`.
```text
+5V_MAIN --> +5V_AUX eFuse / load switch --> TPS4H000-Q1 VBB
|
MCU GPIO --> TPS4H000-Q1 INx OUTx --> LOGIC_OUTx --> connector
| |
R_IN_PD R_OUT_PD
| |
GND GND
```
- `+5V_AUX` isolates an external logic-output fault from `+5V_MAIN`, the MCU,
and the sensor-excitation rail.
- Each channel is active high: when commanded on, it sources `+5V_AUX`.
`R_OUT_PD` holds the connector output low when the channel is off or the ECU
is unpowered. This is a protected high-side output with a passive low state,
not a true push-pull stage.
- `R_IN_PD` is an external pull-down at the IC input. It holds the output off
while the MCU is reset, booting, unpowered, or has not deliberately taken
control. MCU internal pulls are not a substitute.
- Set each channel's current limit to the TPS4H000-Q1 minimum configured value
of 100 mA. This is the intended maximum output current for this logic-output
class; the `+5V_AUX` eFuse limit must be selected consistently with the
populated channel count and simultaneous-fault policy.
- Use the IC's diagnostic/current-sense variant as appropriate for the MCU
interface. Per-channel fault reporting is useful but open-load reporting is
optional for generic logic commands.
### Logic-output connector protection
Place `TVS_LOGIC_OUTx` at the connector side of each output, with a short,
low-inductance return to the protected output-ground reference. Select its
working standoff above the maximum `+5V_AUX` voltage and its worst-case dynamic
clamp below the TPS4H000-Q1 output-pin limit with margin.
The TVS absorbs transient events. It is not sized to dissipate a sustained
misconnection to `VBAT_PROT`; the TPS4H000-Q1's off-state short-to-battery
detection and fault behaviour must handle that case. Confirm its unpowered
output behaviour and the completed TVS network against the actual connector
fault and transient specification before schematic freeze.
## Protected low-side outputs
Use the automotive-qualified Infineon `TLE9104SH` smart quad low-side switch.
It drives battery-domain loads supplied from `VBAT_PROT`.
```text
VBAT_PROT --> external load --> SINK_OUTx --> TLE9104SH OUTx
|
internal low-side MOSFET
|
OUT_PGND --> power-entry ground star
VBAT_PROT --> TLE9104SH VS +5V_MAIN --> TLE9104SH VDD
+3V3_MAIN --> TLE9104SH VIO
MCU GPIO --> TLE9104SH INx MCU SPI <--> TLE9104SH SPI
| |
R_IN_PD diagnostics
|
TLE9104SH local ground reference
MCU enable --> TLE9104SH EN
|
R_EN_PD
|
TLE9104SH local ground reference
```
- The TLE9104SH supplies active inductive-load clamping, configurable
overcurrent protection, short-circuit and thermal protection, direct channel
inputs, and SPI diagnostics.
- `VS` is supplied from `VBAT_PROT`; use the documented logic supplies so the
MCU-facing interface is referenced to `+3V3_MAIN` while the driver itself is
supplied from the internal 5 V rail. Decouple both supply domains locally at
the IC.
- `R_EN_PD` holds `EN` inactive through power-up and MCU reset. `R_IN_PD` on
every direct input holds its channel off. Firmware may enable outputs only
after the required reset, SPI configuration, and diagnostic checks have
completed.
- Use the diagnostic interface to identify overcurrent, overtemperature,
short-to-battery, short-to-ground, and—where useful—open-load faults. The
final retry, latching, reporting, and output-inhibit policy is firmware work
and remains open.
- Define `OUT_PGND` as a high-current return domain. It must remain separate
from `DGND`, sensor return, injector return, and ignition return until the
deliberate power-entry star connection.
### Sink-output connector protection
The TLE9104SH's internal active clamp is the primary turn-off path for
inductive loads. Provide a connector-side transient-protection footprint for
each sink output, but select and place any external TVS only after calculating
the load energy, harness transient environment, and desired release time. An
incorrect low-voltage clamp can bypass the driver's intended inductive clamp,
increase TVS dissipation, or slow a relay/solenoid release.
The final protection network shall keep the output pin within its validated
limit for connector transients and for an externally powered load while the
ECU is off. It shall not back-power the TLE9104SH logic supply, `+3V3_MAIN`,
or `+5V_AUX`.
## Default state and fault behaviour
| Condition | Logic output (`TPS4H000-Q1`) | Sink output (`TLE9104SH`) |
| --- | --- | --- |
| MCU reset or boot | `R_IN_PD` holds the channel off; `R_OUT_PD` holds the connector low. | `R_EN_PD` and `R_IN_PD` keep every channel open. |
| ECU unpowered | Output is not actively driven; connector protection and the IC must tolerate the assigned external-fault case without rail back-power. | Output is open; externally powered loads and connector faults must not back-power ECU logic. |
| Output short/overload | Per-channel current limit and thermal protection act; `+5V_AUX` eFuse limits the aggregate branch. | Per-channel overcurrent/thermal protection acts and status is reported through SPI. |
| Inductive turn-off | Not an intended load class. | Internal active clamp controls load-current decay; any external TVS is coordinated with it. |
## Validation and open items before schematic freeze
1. Confirm the output connector transient/ESD and sustained miswiring cases,
including externally applied battery voltage while the ECU is off.
2. Select `TVS_LOGIC_OUTx` by worst-case dynamic clamp and pulse rating, not
nominal voltage marking. Confirm it does not conduct at the maximum
`+5V_AUX` voltage.
3. Select `R_OUT_PD` from the external logic-input leakage, required low level,
and permitted static current when the output is high.
4. Select the `+5V_AUX` eFuse threshold and TPS4H000-Q1 channel-limit setting
together; 100 mA per active channel is the maximum intended logic-output
current.
5. For each sink load, establish steady current, inrush, inductance, stored
energy, required release time, PWM requirement, and thermal/copper limits.
6. Calculate whether an external sink-output TVS is required and verify that it
complements rather than overrides the TLE9104SH active clamp.
7. Define the firmware diagnostic and recovery policy, and identify any output
assignment that needs an additional hardware permit gate.
## References
- [TPS4H000-Q1 product page and datasheet](https://www.ti.com/product/TPS4H000-Q1)
- [TLE9104SH product page and datasheet](https://www.infineon.com/cms/de/product/power/smart-power-switches/multichannel-spi-switches-controller/flex-multichannel-spi-low-side-power-switch/tle9104sh/)
Architecture/IO_MODULES/IGNITION.md
+135
View File
@@ -0,0 +1,135 @@
# Ignition Output Module
## Purpose
This module drives the existing dual-ended, two-pin dumb ignition coil. The
coil primary is battery-fed and switched on its low side by an STMicroelectronics
VBG08H-E smart ignition IGBT (`VBG08HTR-E` for tape-and-reel assembly).
The VBG08H-E integrates the ignition IGBT, high-voltage clamp, coil-current
limit, thermal protection, soft shutdown, and a coil-current threshold flag.
Its 8 A maximum operative coil-current rating is compatible with V1 only after
the final coil's primary characteristics and required dwell current are
confirmed.
## Power path
```text
VBAT_PROT --> coil primary --> VBG08H HVC
|
internal IGBT
|
PGND1 + PGND2 --> IGN_PGND --> power-entry ground
```
- `HVC` connects to one coil-primary terminal; the other terminal connects to
`VBAT_PROT`.
- `VS` is supplied from `VBAT_PROT`. Place a 100 nF ceramic and 10 µF local
capacitor at `VS`, following the VBG08H-E reference circuit.
- `VBAT_PROT` protection must maintain the VBG08H-E within its 5.4-28 V
operating supply range during normal operation and expected local transients.
- Do not place a conventional flyback diode across the coil primary. The
VBG08H-E's internal high-voltage clamp provides the rapid primary-current
collapse required to generate a spark.
## Command and inhibit path
`INP` is active high: a rising edge begins coil dwell and a falling edge
causes the normal spark event.
```text
STM32 ignition timing output
--> 3.3 V-to-5 V non-inverting buffer --> 1 kOhm --> INP
|
low-capacitance
Zener clamp
|
VBG local Kelvin-ground reference
SAFE_IGNITION_INHIBIT
--> 1 kOhm --> EN
|
low-capacitance
Zener clamp
|
VBG local Kelvin-ground reference
```
The VBG08H-E input-high requirement is 3 V. A 5 V buffer is used rather than
direct STM32 drive to preserve high-level margin across MCU output tolerance,
temperature, and ignition noise.
`EN` is active low:
```text
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a
dwell is active, this invokes the VBG08H-E soft shutdown so coil current is
removed without intentionally generating a spark. The 1 kOhm resistors on
`INP` and `EN` follow the manufacturer's reference circuit and limit transient
current into the device's control pins.
The command traces shall be short, have a continuous quiet reference, and be
routed away from the `HVC` switching node and coil connector. The VBG08H-E
already includes input filtering; no external RC filter shall be added until
its timing effect has been analysed.
Fit a low-capacitance Zener clamp directly at each `INP` and `EN` power-IC pin,
on the VBG side of its 1 kOhm series resistor. Each clamp returns to the VBG
local Kelvin-ground reference at the `IGN_PGND` joining point, not to remote
`DGND`. The clamp voltage shall tolerate the valid 5 V logic high while
limiting positive transients before the VBG08H-E input-overvoltage threshold.
On `EN`, the protection network must preserve the fail-safe high/inhibit state
and must not create a path that can pull `EN` low during a fault.
## Current-flag diagnostic
`C.F.` is an open-drain output. It is low while coil current is below its
internal threshold and releases when the current reaches the nominal 6.5 A
threshold. The threshold is not externally programmable.
```text
VBG08H C.F. --> reference-style R/C filter and 3.3 V pull-up --> STM32 GPIO
```
The pull-up voltage must not exceed 5.5 V; `+3V3_MAIN` is suitable. The signal
is a diagnostic confirmation of primary-current buildup and is not part of the
hardware ignition shutoff path. Firmware shall use it to detect and report an
under-current/late-current condition while retaining a separately defined
maximum dwell time.
## Ground and layout
Define `IGN_PGND` as the ignition module's high-current return domain.
```text
PGND1 -- matched heavy copper --+
+--> IGN_PGND local joining point --> power-entry ground
PGND2 -- matched heavy copper --+
|
VBG08H GND -- short, separate Kelvin reference trace --+
```
- `PGND1` and `PGND2` must use equal-length, equal-width, and similarly
shaped copper paths to the `IGN_PGND` joining point. The VBG08H-E uses these
paths in its internal current-sensing scheme; imbalance shifts its current
limit and current-flag threshold.
- The VBG08H-E `GND` pin connects locally to that same joining point through a
short, separate Kelvin/reference trace. It does not carry coil current.
- Do not separately connect the VBG08H-E `GND` pin to the remote `DGND` plane.
`IGN_PGND` and `DGND` meet only at the deliberate power-entry ground star,
preventing parallel ground-return paths.
- Keep the coil-current loop compact and isolate its routing from MCU, ADC,
trigger-input, and communication traces.
## Remaining validation before schematic freeze
1. Identify the coil and measure/obtain its primary resistance, inductance,
operating current, and permitted dwell characteristics.
2. Confirm that worst-case stored energy and current remain within the
VBG08H-E repetitive operating limits at the 16.8 V battery maximum.
3. Verify thermal performance with the selected PCB copper area and enclosure.
4. Validate spark noise, `C.F.` behavior, input margins, and the effective
engine-permit shutdown behavior on hardware.
Architecture/IO_MODULES/INJECTON.md
+107
View File
@@ -0,0 +1,107 @@
# Injector Output Module
## Purpose
This module drives one conventional high-impedance/saturated fuel injector. It
uses the STMicroelectronics VNL5050S5-E protected low-side switch
(`VNL5050S5TR-E` for tape-and-reel assembly).
The driver provides an integrated power MOSFET, inductive-load clamp, current
and power limiting, thermal protection, off-state open-load detection, and an
open-drain status output. It is not a peak-and-hold injector driver; a
low-impedance injector requires a different architecture.
## Power path
```text
VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN
|
internal low-side MOSFET
|
SOURCE --> INJ_PGND --> power-entry ground
```
- The injector's positive terminal connects to `VBAT_PROT`; its negative
terminal connects to `DRAIN`.
- `SUPPLY` connects to `+5V_MAIN`, the internal logic rail. Place local
decoupling from `SUPPLY` to `SOURCE`, including a nearby 100 nF ceramic
capacitor.
- The VNL5050S5-E provides a 41-52 V drain-source clamp for inductive turn-off.
Injector current-decay/closing time must be verified using the actual
injector inductance and resistance.
- Do not add a conventional flyback diode across the injector; it would slow
its current decay and closing response.
## Command path
`INPUT` is active high. It receives only the hardware-permitted injector
command defined by the dead-man interlock.
```text
SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT
|-- 10 kOhm ---------> INJ_PGND
`-- low-capacitance
Zener clamp ------> INJ_PGND
```
```text
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
```
`SAFE_INJECTOR_SIG` is 5 V logic and therefore provides substantial margin
over the VNL5050S5-E's 2.1 V minimum input-high level. The 1 kOhm `Rprot`
resistor follows the manufacturer's protection approach. The 10 kOhm pull-down
is placed on the driver side of `Rprot`; it holds `INPUT` low if the permission
logic is unpowered, disconnected, or during power sequencing.
Fit the low-capacitance Zener clamp directly at the VNL5050S5-E `INPUT` pin,
on the driver side of `Rprot`. Its return is the local `INJ_PGND`/`SOURCE`
reference, not remote `DGND`. Select its clamp voltage to tolerate the valid
5 V command high while limiting coupled positive transients at the power-IC
pin.
When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the
injector output off. This is the hardware shutoff path; firmware also clears
pending injection events when it observes a dead-man release.
## Status diagnostic
`STATUS` is an open-drain diagnostic output. It is read by the MCU through a
1 kOhm protection resistor and a `+3V3_MAIN` pull-up.
```text
+3V3_MAIN pull-up --> MCU-side status node --> 1 kOhm Rprot --> STATUS
```
The 3.3 V pull-up is within the pin rating and provides a safe MCU logic level.
The diagnostic path supports off-state open-load detection and indicates
over-temperature shutdown. The VNL5050S5-E protects against short circuit and
current overload internally, but its single `STATUS` pin does not provide a
separate, unambiguous MCU-readable short-circuit/current-limit indication.
## Ground and layout
Define `INJ_PGND` as the injector module's high-current return domain.
```text
VNL5050 SOURCE --> short, low-impedance INJ_PGND copper --> power-entry ground star
```
- `INJ_PGND` runs directly to the power-entry ground star, where it joins the
battery return, `IGN_PGND`, `DGND`, and sensor return domains.
- It must not share copper with those other returns before the star point.
- `SOURCE` is both the MOSFET power return and the driver's logic reference;
unlike the ignition driver, this part has no separate Kelvin-sense ground
pin. Keep the `SUPPLY`-to-`SOURCE` decoupling loop compact and the command
and status traces away from the `DRAIN` switching node.
- Provide the drain copper area required by the package thermal guidance.
## Remaining validation before schematic freeze
1. Measure injector coil resistance and obtain its part number/datasheet.
2. Confirm that the injector is high impedance and that its peak current,
stored energy, and turn-off time fit the VNL5050S5-E limits.
3. Verify output-stage temperature using the actual injector duty cycle,
board copper area, and enclosure conditions.
4. Validate injector opening/closing timing, diagnostic behavior, and ignition
noise immunity on hardware.