Initial function IO and power architecture
This commit contains the inital functional IO (engine controls and general digital and analog IO excluding digital IO) and the initial power architecture for the project
This commit is contained in:
@@ -0,0 +1,291 @@
|
|||||||
|
# NeoECU V1 Initial Functional I/O Architecture
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This document records the initial functional I/O architecture for NeoECU V1.
|
||||||
|
It builds on [the power architecture](POWER_ARCHITECTURE.md) and defines the
|
||||||
|
required interface classes, analogue-channel allocation, and intended signal
|
||||||
|
conditioning. It is not a schematic or component-selection document; exact
|
||||||
|
parts, resistor values, pin assignments, connector allocation, and final I/O
|
||||||
|
quantities remain to be confirmed.
|
||||||
|
|
||||||
|
The initial ECU controls a single-cylinder four-stroke engine with one
|
||||||
|
injector, one dual-ended dumb ignition coil, crank and cam Hall sensors,
|
||||||
|
temperature and pressure sensors, and an external starter switch.
|
||||||
|
|
||||||
|
## I/O Summary
|
||||||
|
|
||||||
|
| Interface | V1 allocation | Functional intent |
|
||||||
|
| --- | ---: | --- |
|
||||||
|
| Crank trigger input | 1 | 12 V active-low Hall, timer capture |
|
||||||
|
| Cam trigger input | 1 | 12 V active-low Hall, timer capture |
|
||||||
|
| Deadman input | 1 | Dedicated 5 V vehicle-logic engine-permit input |
|
||||||
|
| Thermistor inputs | 4 | Air, oil, water, and one spare temperature input |
|
||||||
|
| General analogue inputs | 9 | Protected 0-5 V sensor channels |
|
||||||
|
| ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` |
|
||||||
|
| Ignition output | 1 | Dedicated coil low-side driver |
|
||||||
|
| Injector output | 1 | Dedicated injector low-side driver |
|
||||||
|
| Generic digital inputs | Provisionally 6 | Protected 5 V / 12 V compatible inputs |
|
||||||
|
| Generic logic outputs | Provisionally 4 | Protected 5 V logic outputs |
|
||||||
|
| Generic sink outputs | Provisionally 4 | Protected low-side outputs |
|
||||||
|
| Analogue outputs | Reserve 2 MCU/output paths | Future 0-5 V output capability; not a V1 requirement |
|
||||||
|
|
||||||
|
The provisional generic digital I/O counts are planning values, not a frozen
|
||||||
|
connector or pin budget. CAN and its physical layer are intentionally outside
|
||||||
|
the scope of this document.
|
||||||
|
|
||||||
|
## Power-Domain Rules
|
||||||
|
|
||||||
|
- `+5V_MAIN` is the primary internal regulated 5 V rail. It supplies internal
|
||||||
|
5 V circuitry and is the upstream rail for `+5V_AUX` and `+5V_SENS`; it is
|
||||||
|
not connected directly to external harness loads.
|
||||||
|
- `+5V_SENS` is exclusively for sensor excitation and thermistor pull-ups.
|
||||||
|
It is never used to power generic peripherals or output loads.
|
||||||
|
- `+5V_AUX` powers external 5 V logic-level output circuitry. It is separately
|
||||||
|
protected so an external fault cannot disturb sensor excitation.
|
||||||
|
- `+12V_SENS` is the regulated buck-boost Hall/12 V sensor supply. It is kept
|
||||||
|
separate from arbitrary digital output loads.
|
||||||
|
- `VBAT_PROT` supplies the ignition, injector, and protected low-side output
|
||||||
|
branches. It is the 12 V-class source for general load-driving interfaces.
|
||||||
|
- High-current ignition, injector, and load-driver returns remain separate
|
||||||
|
from the sensor and MCU returns until their deliberate join at the power
|
||||||
|
entry region.
|
||||||
|
|
||||||
|
## Engine-Position Inputs
|
||||||
|
|
||||||
|
Crank and cam are dedicated inputs, not generic digital inputs. The assumed
|
||||||
|
sensor type is a three-wire, active-low, open-collector/current-sinking Hall
|
||||||
|
sensor.
|
||||||
|
|
||||||
|
```text
|
||||||
|
+12V_SENS -- ECU-side pull-up -- Hall signal harness -- Hall output
|
||||||
|
|
|
||||||
|
protection / divider / fast RC
|
||||||
|
|
|
||||||
|
3.3 V Schmitt trigger
|
||||||
|
|
|
||||||
|
STM32 timer-capture pin
|
||||||
|
```
|
||||||
|
|
||||||
|
The ECU-side pull-up is connected to regulated `+12V_SENS`, not to 3.3 V.
|
||||||
|
This gives the harness a robust 12 V-class signal while keeping the MCU domain
|
||||||
|
local and protected. An initial pull-up near 4.7 kohm is a reasonable starting
|
||||||
|
point, subject to the selected sensor's output-current specification and the
|
||||||
|
cable capacitance.
|
||||||
|
|
||||||
|
The divider scales the 12 V signal to the Schmitt-buffer input. A deliberately
|
||||||
|
small, configurable RC filter follows the divider to reject spark-induced
|
||||||
|
glitches without materially slowing genuine trigger edges. A nominal 1 nF
|
||||||
|
capacitor footprint, with alternatives such as 470 pF and 2.2 nF, should be
|
||||||
|
provided and validated with ignition active. The final divider, pull-up, clamp,
|
||||||
|
filter, and cable requirements depend on the Hall part number and harness.
|
||||||
|
|
||||||
|
## Analogue Inputs
|
||||||
|
|
||||||
|
### ADC allocation
|
||||||
|
|
||||||
|
The STM32H747 provides three ADC peripherals. ADC1 and ADC2 share most of the
|
||||||
|
external analogue-pin pool, so they increase concurrent conversion capacity
|
||||||
|
rather than doubling the number of physical sensor pins. The proposed V1
|
||||||
|
allocation occupies 16 conditioned ADC channels:
|
||||||
|
|
||||||
|
```text
|
||||||
|
4 thermistor inputs
|
||||||
|
9 general 0-5 V inputs
|
||||||
|
1 VBAT_PROT sense input
|
||||||
|
1 +5V_SENS sense input
|
||||||
|
1 +12V_SENS sense input
|
||||||
|
```
|
||||||
|
|
||||||
|
This leaves meaningful MCU ADC and pin margin, but the final STM32 package and
|
||||||
|
pin assignment must reserve all analogue pins alongside timer, CAN, debug,
|
||||||
|
I2C, and optional DAC requirements. In particular, PA4 and PA5 should remain
|
||||||
|
available if the two internal DAC outputs are to be retained for future
|
||||||
|
analogue outputs.
|
||||||
|
|
||||||
|
### Thermistor channels
|
||||||
|
|
||||||
|
Each thermistor channel is excited from `+5V_SENS` using a precision pull-up.
|
||||||
|
The input is attenuated and filtered before the ADC; this remains required
|
||||||
|
because an open thermistor drives the node towards 5 V. Firmware calculates the
|
||||||
|
thermistor resistance from the ratio of its ADC result to the `+5V_SENS` ADC
|
||||||
|
result, then applies the calibration map for the selected sensor.
|
||||||
|
|
||||||
|
```text
|
||||||
|
+5V_SENS -- precision pull-up --+-- thermistor -- sensor ground
|
||||||
|
|
|
||||||
|
attenuation/filter --> ADC
|
||||||
|
```
|
||||||
|
|
||||||
|
The pull-up value is selected from the actual NTC curve and required
|
||||||
|
temperature range, balancing resolution against self-heating. The attenuation
|
||||||
|
network should be high impedance enough that it does not materially load the
|
||||||
|
thermistor divider; the ADC sample time and local input capacitor must then be
|
||||||
|
chosen to achieve settling. The initial Bosch 2.5 kOhm NTC population is a
|
||||||
|
3.01 kOhm precision pull-up; 10.0 kOhm and 30.1 kOhm alternatives are reserved
|
||||||
|
only for confirmed sensor curves. See
|
||||||
|
[ANALOG_INPUTS.md](IO_MODULES/ANALOG_INPUTS.md) for the detailed architecture.
|
||||||
|
|
||||||
|
### General 0-5 V channels
|
||||||
|
|
||||||
|
General analogue inputs support conventional 0.5-4.5 V and 0-5 V automotive
|
||||||
|
sensors. Each includes connector protection, attenuation, and an ADC-local
|
||||||
|
filter capacitor. A nominal attenuation ratio near 0.55 maps a 5.25 V sensor
|
||||||
|
signal to about 2.9 V at an ADC referenced by `+3V3_ANA`.
|
||||||
|
|
||||||
|
General analogue inputs are passive. Their dividers, filter capacitors, and ADC
|
||||||
|
acquisition time must be selected together to meet source-impedance and
|
||||||
|
settling requirements. A genuinely high-impedance or special-purpose sensor
|
||||||
|
requires a dedicated front end rather than altering the generic channel.
|
||||||
|
|
||||||
|
`+5V_SENS` is measured through an equivalent matched divider/filter path and
|
||||||
|
sampled near each ratiometric sensor channel. Firmware uses the ratio of the
|
||||||
|
sensor and supply readings to cancel sensor-supply and ADC-reference variation.
|
||||||
|
|
||||||
|
## Battery and Rail Measurements
|
||||||
|
|
||||||
|
`VBAT_PROT` is measured by a protected, scaled direct ADC channel. This is the
|
||||||
|
deterministic engine-control measurement used for battery-voltage dwell and
|
||||||
|
injector compensation. The M7 should receive a DMA-updated, filtered value and
|
||||||
|
snapshot it immediately before scheduling a dwell event.
|
||||||
|
|
||||||
|
Voltage/current monitor ICs may monitor the regulated rails for telemetry and
|
||||||
|
diagnostics. They are not the sole engine-control voltage source. In
|
||||||
|
particular, no whole-ECU current shunt is placed in series with `VBAT_PROT`;
|
||||||
|
coil and injector pulse currents would waste power and make that measurement
|
||||||
|
less useful. Upstream protection is provided by the input fuse/e-fuse and
|
||||||
|
local protection is provided by the ignition and injector driver stages.
|
||||||
|
|
||||||
|
## Generic Digital Inputs
|
||||||
|
|
||||||
|
Generic digital inputs accept externally driven 5 V through `VBAT_PROT`
|
||||||
|
active-high signals, with software-configurable reported polarity. They are
|
||||||
|
not intended for crank or cam capture. The detailed interface, including
|
||||||
|
fail-safe ECU-off behavior, external hysteresis, optional wetting/pull-down
|
||||||
|
footprints, and harness protection, is defined in
|
||||||
|
[DIGITAL_INPUTS.md](IO_MODULES/DIGITAL_INPUTS.md).
|
||||||
|
|
||||||
|
The generic input front end uses fail-safe, 40 V-capable open-drain
|
||||||
|
comparators powered by `+3V3_MAIN`, with thresholds derived from `+5V_MAIN`.
|
||||||
|
The input is protected at the connector and cannot back-power the ECU when an
|
||||||
|
external source drives it while the ECU is unpowered. The final transient
|
||||||
|
protection, threshold, hysteresis, filter, and bias values remain pending the
|
||||||
|
actual harness and input-function requirements.
|
||||||
|
|
||||||
|
## Deadman Engine-Permit Interlock
|
||||||
|
|
||||||
|
The deadman input is a dedicated 5 V vehicle-logic input, not a generic digital
|
||||||
|
input. It is conditioned through the normal protected 5 V input interface and
|
||||||
|
level-shifted to protected 3.3 V logic. A loss of the external deadman signal
|
||||||
|
is the not-permitted state.
|
||||||
|
|
||||||
|
The resulting `DEADMAN_OK` signal has two independent destinations:
|
||||||
|
|
||||||
|
- It enters an MCU digital input so firmware can observe whether the deadman is
|
||||||
|
locked or unlocked, disable scheduling, and report the state.
|
||||||
|
- It is combined in hardware with the MCU's `MCU_RUN_PERMIT` output to produce
|
||||||
|
`ENGINE_PERMIT`.
|
||||||
|
|
||||||
|
```text
|
||||||
|
5 V deadman input --> protection / level shift --> DEADMAN_OK --+--> MCU input
|
||||||
|
|
|
||||||
|
MCU_RUN_PERMIT --------------------------------------------------AND--> ENGINE_PERMIT
|
||||||
|
|
|
||||||
|
driver enable pins, or
|
||||||
|
command-signal gating
|
||||||
|
```
|
||||||
|
|
||||||
|
`ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers
|
||||||
|
where those inputs are provided. If a selected driver has no suitable enable
|
||||||
|
input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using
|
||||||
|
logic that defaults to the disabled state on power-up or loss of power.
|
||||||
|
|
||||||
|
This hardware path ensures that releasing the deadman stops injector and
|
||||||
|
ignition commands even if firmware or a timer output fails to respond. Firmware
|
||||||
|
must also clear/disable pending injection and dwell schedules whenever
|
||||||
|
`DEADMAN_OK` becomes invalid. A firmware test mode may assert
|
||||||
|
`MCU_RUN_PERMIT`, but it does not override the physical deadman input; bench
|
||||||
|
operation requires a deliberate external test arrangement that presents a valid
|
||||||
|
deadman signal.
|
||||||
|
|
||||||
|
## Outputs
|
||||||
|
|
||||||
|
### Ignition and injector
|
||||||
|
|
||||||
|
The ignition coil is supplied from `VBAT_PROT` and switched with a dedicated
|
||||||
|
automotive ignition driver or smart ignition IGBT. It requires controlled
|
||||||
|
primary flyback clamping, over-current and thermal protection, and fault
|
||||||
|
reporting. Firmware applies battery-voltage dwell compensation using the direct
|
||||||
|
`VBAT_PROT` ADC measurement; driver current limiting remains the safety
|
||||||
|
backstop.
|
||||||
|
|
||||||
|
The injector is supplied from `VBAT_PROT` and switched by a dedicated
|
||||||
|
automotive smart low-side driver. It requires inductive-load capability,
|
||||||
|
controlled turn-off clamping, current/thermal protection, and MCU-readable
|
||||||
|
open-load and short-circuit diagnostics. This assumes a conventional
|
||||||
|
high-impedance/saturated injector; a low-impedance injector requires a
|
||||||
|
peak-and-hold architecture.
|
||||||
|
|
||||||
|
### Generic digital outputs
|
||||||
|
|
||||||
|
All non-engine digital output connector functions are labelled generically and
|
||||||
|
assigned their vehicle role in firmware. For example, the starter-enable
|
||||||
|
function is mapped to a compatible generic output rather than having a
|
||||||
|
dedicated connector-only electrical architecture.
|
||||||
|
|
||||||
|
Two hardware classes remain necessary. Their selected architecture, default
|
||||||
|
state, diagnostic intent, connector protection, and remaining validation are
|
||||||
|
defined in [DIGITAL_OUTPUTS.md](IO_MODULES/DIGITAL_OUTPUTS.md).
|
||||||
|
|
||||||
|
- Generic logic outputs use `+5V_AUX`-supplied `TPS4H000-Q1` protected
|
||||||
|
high-side channels with a local output pull-down. They command external
|
||||||
|
electronic-control inputs and are limited to 100 mA per channel.
|
||||||
|
- Generic sink outputs use `VBAT_PROT`-supplied `TLE9104SH` protected low-side
|
||||||
|
channels. They command relays, solenoids, and external modules that provide
|
||||||
|
a pull-up.
|
||||||
|
|
||||||
|
Firmware configuration selects the output's vehicle role and active polarity,
|
||||||
|
but cannot make one electrical driver class behave as the other. A starter
|
||||||
|
enable can therefore use either a generic logic output or a generic sink output
|
||||||
|
only when the selected external starter switch accepts that interface.
|
||||||
|
|
||||||
|
### Analogue-output provision
|
||||||
|
|
||||||
|
Analogue output is not a V1 functional requirement. Reserve two MCU pins and
|
||||||
|
board footprints for future 0-5 V outputs. The intended future path is:
|
||||||
|
|
||||||
|
```text
|
||||||
|
DAC --> rail-to-rail buffer --> protection / series impedance --> connector
|
||||||
|
```
|
||||||
|
|
||||||
|
A true calibrated 0-5 V output may require an external 5 V-referenced DAC or
|
||||||
|
a suitably characterised buffer stage. A general 0-12 V analogue output is not
|
||||||
|
included unless a future peripheral explicitly requires it.
|
||||||
|
|
||||||
|
## Layout and Validation Priorities
|
||||||
|
|
||||||
|
- Keep trigger and ADC front ends physically separated from coil, injector,
|
||||||
|
switching-regulator, and high-current output nodes.
|
||||||
|
- Route Hall signals with their sensor return; use an appropriate harness and
|
||||||
|
shielding strategy after cable testing.
|
||||||
|
- Place protection at the connector, filtering/conditioning near the MCU side,
|
||||||
|
and avoid dumping input-fault energy into `+3V3_ANA`.
|
||||||
|
- Validate Hall glitch rejection with ignition active, including worst-case
|
||||||
|
dwell and spark events.
|
||||||
|
- Validate ADC noise, ratiometric accuracy, thermistor self-heating, and ADC
|
||||||
|
settling before freezing resistor networks or deciding whether the optional
|
||||||
|
analogue LDO is necessary.
|
||||||
|
|
||||||
|
## Open Items Before Schematic Freeze
|
||||||
|
|
||||||
|
1. Select Hall and thermistor part numbers, cable lengths, connectors, and
|
||||||
|
resulting pull-up/filter values.
|
||||||
|
2. Confirm ignition-coil and injector electrical data and select their driver
|
||||||
|
devices.
|
||||||
|
3. Freeze the generic digital I/O count, per-channel current ratings, and
|
||||||
|
connector allocation.
|
||||||
|
4. Select 5 V-tolerant, automotive-suitable comparators and input-protection
|
||||||
|
components for generic digital inputs.
|
||||||
|
5. Select the STM32H747 package and complete a pin assignment that preserves
|
||||||
|
all timer, ADC, optional DAC, debug, and communications resources.
|
||||||
|
6. Define CAN and other communications interfaces separately.
|
||||||
@@ -0,0 +1,79 @@
|
|||||||
|
# Analogue and Temperature Inputs
|
||||||
|
|
||||||
|
## Scope
|
||||||
|
|
||||||
|
This is the V1 front-end architecture for nine general 0--5 V channels and
|
||||||
|
four NTC temperature channels. Exact protection parts, ADC timing, and sensor
|
||||||
|
curves remain schematic-release validation items. All harness analogue signals
|
||||||
|
use `SENSOR_GND` and are kept separate from ignition/injector return currents.
|
||||||
|
|
||||||
|
## General 0--5 V channels
|
||||||
|
|
||||||
|
```text
|
||||||
|
connector -- transient clamp -- R_TOP --+-- ADC-local C_HOLD -- ADC
|
||||||
|
|
|
||||||
|
R_BOTTOM
|
||||||
|
|
|
||||||
|
SENSOR_GND
|
||||||
|
```
|
||||||
|
|
||||||
|
`R_TOP` is the divider's upper resistor; do not add a separate series
|
||||||
|
`R_PROT` in the normal passive channel. It is the element that limits current
|
||||||
|
from the connector clamp into the ADC-side network, so select an appropriate
|
||||||
|
pulse/voltage rating for the expected residual transient. `R_TOP`, the clamp,
|
||||||
|
and `R_BOTTOM` are a system: select standoff, hot leakage, dynamic clamp
|
||||||
|
voltage, pulse energy, negative-excursion path, and local return from the
|
||||||
|
actual harness-fault specification. A nominal TVS voltage alone is not a
|
||||||
|
sufficient selection. Microamp leakage can be a significant offset with a
|
||||||
|
high-value divider, and neither clamp may feed an unpowered analogue rail or
|
||||||
|
MCU protection diode.
|
||||||
|
|
||||||
|
For 0.5--4.5 V and 0--5 V active sensors, use a 0.55--0.60 divider with 1%
|
||||||
|
parts or a matched network. The existing 0.55 target maps 5.25 V to 2.89 V.
|
||||||
|
Choose impedance low enough that leakage and PCB contamination are negligible,
|
||||||
|
but high enough not to load the sensor.
|
||||||
|
|
||||||
|
Place `C_HOLD` at the ADC after a small isolation resistor. It is both the
|
||||||
|
low-pass/anti-alias capacitor and local sample-and-hold charge reservoir.
|
||||||
|
Validate its value and ADC sample time together against worst-case divider
|
||||||
|
Thevenin resistance, ADC sampling capacitance, channel-to-channel steps, and
|
||||||
|
sample rate. A large capacitor does not by itself make arbitrary source
|
||||||
|
impedance acceptable.
|
||||||
|
|
||||||
|
For ratiometric 5 V sensors, provide a corresponding divider/filter measurement
|
||||||
|
of `+5V_SENS` and sample it close to the sensor channel.
|
||||||
|
|
||||||
|
## NTC temperature channels
|
||||||
|
|
||||||
|
```text
|
||||||
|
+5V_SENS -- R_PULLUP --+-- NTC -- SENSOR_GND
|
||||||
|
|
|
||||||
|
attenuator / local filter --> ADC
|
||||||
|
```
|
||||||
|
|
||||||
|
The attenuator and ADC protection are required even if a normal temperature
|
||||||
|
range appears below 3.3 V: an open thermistor raises the node to `+5V_SENS`.
|
||||||
|
Calculate resistance from the thermistor and measured `+5V_SENS` ADC ratio,
|
||||||
|
then use the selected sensor's R/T calibration rather than a nominal beta
|
||||||
|
equation.
|
||||||
|
|
||||||
|
Fit one defined pull-up per channel, using 0.1% or better low-TCR resistance;
|
||||||
|
provide alternate DNP footprints only where the sensor family is expected.
|
||||||
|
|
||||||
|
| Sensor family / example | Initial `R_PULLUP` | Basis |
|
||||||
|
| --- | ---: | --- |
|
||||||
|
| Bosch Motorsport 2.5 kOhm at 20 C NTC | 3.01 kOhm | Bosch states typical ECU pull-ups of 1 or 3 kOhm; 3 kOhm retains useful engine-temperature resolution with less self-heating than 1 kOhm. |
|
||||||
|
| 10 kOhm at 25 C, beta about 3435--3976 K | 10.0 kOhm | Centres resolution around ordinary ambient/medium temperatures. |
|
||||||
|
| 30 kOhm at 25 C | 30.1 kOhm | Only for a confirmed curve; reduces divider current and self-heating. |
|
||||||
|
|
||||||
|
For Bosch's 2.5 kOhm curve, a 3.01 kOhm pull-up produces approximately 4.69 V
|
||||||
|
at -40 C, 2.27 V at 20 C, and 0.29 V at 100 C. A 0.60 attenuator produces
|
||||||
|
about 2.81 V, 1.36 V, and 0.18 V at the ADC; the open fault maps to 3.0 V.
|
||||||
|
Make the attenuator high enough that it adds under 1% loading error at the
|
||||||
|
coldest required NTC resistance, or include its loading in calibration. Its
|
||||||
|
high Thevenin resistance is acceptable only with designed `C_HOLD` and
|
||||||
|
settling/sample time.
|
||||||
|
|
||||||
|
Validate NTC self-heating in the actual mounting medium (worst case is normally
|
||||||
|
hot), plus open/short detection, supply tolerance, pull-up TCR, cable resistance,
|
||||||
|
clamp leakage, PCB contamination, and operation alongside ignition switching.
|
||||||
@@ -0,0 +1,88 @@
|
|||||||
|
# Dead-Man Engine-Permit Interlock
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This module provides the hardware run-permission path for the engine outputs.
|
||||||
|
The steering-wheel dead-man switch must be held to assert permission. Releasing
|
||||||
|
the switch, an open circuit, loss of a logic supply, or MCU reset must place
|
||||||
|
the engine outputs in their non-energising state independently of firmware.
|
||||||
|
|
||||||
|
This document defines the signal relationships and destinations only. Output
|
||||||
|
driver implementation is documented separately.
|
||||||
|
|
||||||
|
## Logic domains
|
||||||
|
|
||||||
|
| Signal | Domain | Active state | Default/fault state |
|
||||||
|
| --- | --- | --- | --- |
|
||||||
|
| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission |
|
||||||
|
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
|
||||||
|
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
|
||||||
|
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
|
||||||
|
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
|
||||||
|
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
|
||||||
|
| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted |
|
||||||
|
|
||||||
|
`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered,
|
||||||
|
and given a default-low bias before entering the 5 V logic. The conditioning
|
||||||
|
must tolerate expected connector faults and transients without allowing a
|
||||||
|
fault to assert engine permission.
|
||||||
|
|
||||||
|
## Signal tree
|
||||||
|
|
||||||
|
The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
|
||||||
|
levels. Their outputs are 5 V logic levels.
|
||||||
|
|
||||||
|
```text
|
||||||
|
protected steering-wheel input
|
||||||
|
|
|
||||||
|
+--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU
|
||||||
|
|
|
||||||
|
+--> conditioned 5 V DEAD_MAN_SIG --+
|
||||||
|
AND --> ENGINE_PERMIT --+
|
||||||
|
MCU_RUN_PERMIT --------------------------------+ |
|
||||||
|
+--> ignition-permission inverter
|
||||||
|
| --> SAFE_IGNITION_INHIBIT
|
||||||
|
|
|
||||||
|
MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG
|
||||||
|
```
|
||||||
|
|
||||||
|
The logic equations are:
|
||||||
|
|
||||||
|
```text
|
||||||
|
ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT
|
||||||
|
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
|
||||||
|
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Output destinations
|
||||||
|
|
||||||
|
| Logic output | Destination | Required behavior |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
|
||||||
|
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
|
||||||
|
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
|
||||||
|
| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. |
|
||||||
|
|
||||||
|
## Fail-safe behavior
|
||||||
|
|
||||||
|
- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its
|
||||||
|
wire opens, or its source is unavailable.
|
||||||
|
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
|
||||||
|
boot, brownout, or an unpowered MCU. External bias components shall provide
|
||||||
|
these states during power sequencing.
|
||||||
|
- If `ENGINE_PERMIT` becomes low during an injection command,
|
||||||
|
`SAFE_INJECTOR_SIG` becomes low and removes the command from the injection
|
||||||
|
output stage.
|
||||||
|
- If `ENGINE_PERMIT` becomes low during an ignition dwell,
|
||||||
|
`SAFE_IGNITION_INHIBIT` becomes high and commands the ignition output stage
|
||||||
|
into its non-sparking shutdown behavior.
|
||||||
|
- If the 5 V permission logic loses power, the injection command input must
|
||||||
|
be externally biased low and the ignition output stage's inhibit input must
|
||||||
|
default to its inhibited state.
|
||||||
|
|
||||||
|
## Firmware responsibilities
|
||||||
|
|
||||||
|
The hardware path is authoritative; firmware cannot override a released
|
||||||
|
dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear
|
||||||
|
pending injection and ignition schedules when it becomes invalid, and keep
|
||||||
|
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.
|
||||||
@@ -0,0 +1,187 @@
|
|||||||
|
# General-Purpose Digital Input Module
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This module defines the generic harness-connected digital-input class for
|
||||||
|
NeoECU V1. It accepts externally driven 5 V, 12 V, and protected
|
||||||
|
battery-domain signals, plus dry-contact and open-collector sources when the
|
||||||
|
appropriate ECU bias option is fitted.
|
||||||
|
|
||||||
|
This is not the crank/cam trigger interface and is not the dead-man
|
||||||
|
engine-permit input. Those functions retain their dedicated conditioning and,
|
||||||
|
for the dead-man, its independent hardware safety path.
|
||||||
|
|
||||||
|
V1 provisionally allocates six generic digital-input channels. The allocation,
|
||||||
|
connector pins, input timing requirements, and final input count remain open.
|
||||||
|
|
||||||
|
## Interface and operating assumptions
|
||||||
|
|
||||||
|
- Valid externally driven high inputs extend from 5 V through `VBAT_PROT`.
|
||||||
|
Firmware configures the reported active polarity; the electrical front end
|
||||||
|
is active-high.
|
||||||
|
- An external source may drive an input while the ECU is unpowered. This must
|
||||||
|
not back-power `+3V3_MAIN`, `+5V_MAIN`, `+5V_AUX`, or `VBAT_PROT`.
|
||||||
|
- `+5V_AUX` may provide optional low-current wetting for a dry contact or
|
||||||
|
open-collector output. It is not a general sensor-supply rail and
|
||||||
|
`+5V_SENS` shall not be used for this purpose.
|
||||||
|
- Each channel's maximum switching rate and permitted debounce delay are
|
||||||
|
application-dependent. These requirements shall be assigned before the RC
|
||||||
|
values are frozen.
|
||||||
|
|
||||||
|
## Comparator architecture
|
||||||
|
|
||||||
|
Use the fail-safe, automotive-qualified TI `TLV186x-Q1` open-drain comparator
|
||||||
|
family. Its inputs are high impedance up to 40 V even while its supply is
|
||||||
|
unpowered, so a battery-domain input cannot inject current into the ECU logic
|
||||||
|
rails during normal operation, power sequencing, or an ECU-off condition.
|
||||||
|
|
||||||
|
The provisional six-channel implementation is one `TLV1864-Q1` quad and one
|
||||||
|
`TLV1862-Q1` dual. This is an architectural component selection; package,
|
||||||
|
availability, and final channel count still require schematic-stage
|
||||||
|
confirmation.
|
||||||
|
|
||||||
|
Each comparator is operated in the inverting hysteresis configuration:
|
||||||
|
|
||||||
|
`DIG_INx` passes through the protected input network and configurable `R_IN` /
|
||||||
|
`C_FILTER` stage to the comparator's `IN−` input. `IN+` is the `VTH` node:
|
||||||
|
`R_REF_H` connects it to `+5V_MAIN`, `R_REF_L` connects it to protected ground,
|
||||||
|
and `R_HYS` connects it to `DIG_IN_LOGIC` for positive feedback. The
|
||||||
|
open-drain comparator output is pulled up to `+3V3_MAIN` by `R_PULLUP` and
|
||||||
|
then connects to the MCU GPIO.
|
||||||
|
|
||||||
|
`DIG_IN_LOGIC` is pulled to `+3V3_MAIN` and connects to one STM32 GPIO. The
|
||||||
|
logic is inverted at this point: a harness voltage above the upper threshold
|
||||||
|
pulls the comparator output low. Firmware may invert the reported input
|
||||||
|
polarity, but it does not alter the physical thresholds or protection.
|
||||||
|
|
||||||
|
`R_HYS` feeds a controlled fraction of the 3.3 V output state into `VTH`.
|
||||||
|
When the output is high, the threshold is higher; the input must cross this
|
||||||
|
upper threshold to pull the output low. Once low, the feedback contribution is
|
||||||
|
removed and the input must fall through the lower threshold before the output
|
||||||
|
releases again. This is true hysteresis, not firmware debounce.
|
||||||
|
|
||||||
|
The reference-divider ratio, `R_HYS`, output pull-up, and their tolerances
|
||||||
|
shall be calculated together. The design shall establish thresholds in real
|
||||||
|
harness volts with sufficient margin for all of the following:
|
||||||
|
|
||||||
|
- the lowest valid 5 V external source;
|
||||||
|
- the lowest `+5V_AUX` voltage and forward drop of the optional wetting diode;
|
||||||
|
- comparator input offset and leakage over temperature;
|
||||||
|
- resistor tolerance; and
|
||||||
|
- expected harness noise.
|
||||||
|
|
||||||
|
An initial design objective is an upper threshold in the 2.8--3.2 V range and
|
||||||
|
a lower threshold in the 1.8--2.2 V range. These are design targets, not
|
||||||
|
schematic values. They shall be confirmed against the final input definitions
|
||||||
|
and chosen comparator output-pull-up value.
|
||||||
|
|
||||||
|
TI's worked example of this topology is [Inverting Comparator With Hysteresis
|
||||||
|
Circuit](https://www.ti.com/tool/CIRCUIT060076). The selected comparator's
|
||||||
|
fail-safe input and output requirements are defined in the [TLV185x-Q1 and
|
||||||
|
TLV186x-Q1 datasheet](https://www.ti.com/lit/ds/symlink/tlv1861-q1.pdf).
|
||||||
|
|
||||||
|
## Optional input biasing
|
||||||
|
|
||||||
|
Provide unpopulated per-channel footprints for the following mutually
|
||||||
|
exclusive options. Through-hole resistor positions are acceptable where
|
||||||
|
field-level reconfiguration is valuable; DNP SMD positions and solder-jumper
|
||||||
|
selection are also acceptable when production configuration is known.
|
||||||
|
|
||||||
|
At the connector node (`DIG_IN_RAW`), fit the harness TVS before `R_IN`.
|
||||||
|
`C_FILTER` and the local negative clamp are on the protected `SENSE` side of
|
||||||
|
`R_IN`. The optional wetting branch is `+5V_AUX` → `R_WET` → `D_WET` →
|
||||||
|
`DIG_IN_RAW`; the diode cathode faces `DIG_IN_RAW`. `R_PD`, when fitted,
|
||||||
|
connects `DIG_IN_RAW` to protected ground.
|
||||||
|
|
||||||
|
- `R_WET` and `D_WET` form the optional wetting pull-up. `D_WET` has its
|
||||||
|
anode toward `+5V_AUX` and cathode toward the input. It prevents a 12 V or
|
||||||
|
battery-domain external source from back-feeding `+5V_AUX`.
|
||||||
|
- `R_PD` is an optional weak pull-down to the protected logic ground.
|
||||||
|
- With neither component fitted, the channel is intended for an externally
|
||||||
|
driven logic signal.
|
||||||
|
- Do not fit both bias components by default. The required mode is selected
|
||||||
|
per channel from the connected vehicle function.
|
||||||
|
|
||||||
|
The MCU's internal pull resistors are not a substitute for these footprints:
|
||||||
|
they act only on the post-comparator 3.3 V GPIO and cannot define or wet the
|
||||||
|
harness-connected input.
|
||||||
|
|
||||||
|
## Harness protection and filtering
|
||||||
|
|
||||||
|
The comparator's 40 V fail-safe input capability eliminates power-backfeed
|
||||||
|
through the comparator; it does not replace harness fault protection. Every
|
||||||
|
channel shall include the following protection functions:
|
||||||
|
|
||||||
|
The right-hand side of the figure above shows the required functional
|
||||||
|
protection arrangement.
|
||||||
|
|
||||||
|
- **Primary positive clamp:** use a connector-side TVS or equivalent
|
||||||
|
protection element. Its working standoff shall exceed the 16.8 V maximum
|
||||||
|
normal battery input. Its worst-case dynamic clamp voltage, including
|
||||||
|
tolerance, temperature, source impedance, and the specified pulse current,
|
||||||
|
shall remain below the comparator's 40 V input capability with design
|
||||||
|
margin. A nominal device label such as "20 V" or "24 V" is not sufficient
|
||||||
|
evidence of this requirement.
|
||||||
|
- **Negative clamp:** provide a local low-capacitance clamp path that prevents
|
||||||
|
the comparator input from going below its allowed negative input voltage.
|
||||||
|
The clamp returns to the protected logic-ground reference, not to a positive
|
||||||
|
ECU rail.
|
||||||
|
- **Series resistance:** `R_IN` limits fault and clamp current, isolates the
|
||||||
|
filter capacitor from fast harness events, and shall have adequate pulse
|
||||||
|
voltage, power, and surge rating. Split series resistors may be used to
|
||||||
|
share voltage stress.
|
||||||
|
- **RC filtering:** `R_IN` and `C_FILTER` suppress short edge noise. Reserve
|
||||||
|
configurable capacitor footprints so the final time constant can support
|
||||||
|
both electronic inputs and contact-debounce applications. Hysteresis, not
|
||||||
|
an excessively slow RC, provides the primary threshold-noise immunity.
|
||||||
|
- **Component placement:** place the primary transient protection at the
|
||||||
|
connector entry. Keep the comparator-side clamp, filter, reference network,
|
||||||
|
and comparator close together and away from ignition, injector, and
|
||||||
|
regulator hot loops.
|
||||||
|
|
||||||
|
The selected protection network must also be verified for an ECU-off,
|
||||||
|
externally driven input. The `TLV186x-Q1` input itself remains high impedance
|
||||||
|
in that state; the completed TVS, clamp, bias, and capacitor network must
|
||||||
|
likewise have no path that back-powers an ECU rail.
|
||||||
|
|
||||||
|
## Power sequencing and output behavior
|
||||||
|
|
||||||
|
The comparator and GPIO pull-up use `+3V3_MAIN`. `VTH` is derived from
|
||||||
|
`+5V_MAIN`; both comparator inputs are fail-safe beyond the comparator supply,
|
||||||
|
so the reference network does not require an input clamp merely because of a
|
||||||
|
normal rail sequencing difference.
|
||||||
|
|
||||||
|
The open-drain output is allowed to be pulled to `+3V3_MAIN`; no output clamp
|
||||||
|
to `VBAT_PROT` is required. When `+3V3_MAIN` is absent, the input front end is
|
||||||
|
protected but neither the comparator output nor the MCU can report an input
|
||||||
|
state. This is the intended ECU-off behavior.
|
||||||
|
|
||||||
|
## Fault behavior
|
||||||
|
|
||||||
|
| Condition | Required hardware behavior |
|
||||||
|
| --- | --- |
|
||||||
|
| Input open, wetting pull-up fitted | Read as high at the electrical front end. |
|
||||||
|
| Input grounded, wetting pull-up fitted | Read as low; `R_WET` limits current. |
|
||||||
|
| Input open, pull-down fitted | Read as low. |
|
||||||
|
| Valid external 5 V, 12 V, or `VBAT_PROT` drive | Cross the upper threshold with specified margin. |
|
||||||
|
| External drive while ECU off | No comparator-input back-power path; no reported state until ECU logic is powered. |
|
||||||
|
| Positive harness transient | Primary clamp and `R_IN` keep the comparator input within its validated limit. |
|
||||||
|
| Negative harness transient | Local negative clamp and `R_IN` keep the comparator input within its validated limit. |
|
||||||
|
| `+5V_AUX` shorted or absent | Wetting function is unavailable; it shall not damage or force a battery-domain input high. |
|
||||||
|
|
||||||
|
## Validation and open items before schematic freeze
|
||||||
|
|
||||||
|
1. Confirm the six-channel count, connector allocation, and maximum event
|
||||||
|
rate/debounce requirement for every generic input.
|
||||||
|
2. Define the harness source types and fault/transient environment, including
|
||||||
|
externally powered inputs while the ECU is off.
|
||||||
|
3. Select and validate the TVS, local negative clamp, `R_IN`, and capacitor
|
||||||
|
voltage/pulse ratings from that environment. Verify the actual clamp
|
||||||
|
voltage at the comparator pin, not only the nominal clamp designation.
|
||||||
|
4. Calculate the upper and lower thresholds with worst-case rail voltages,
|
||||||
|
diode drop, output levels, resistor tolerance, comparator offset, leakage,
|
||||||
|
and temperature.
|
||||||
|
5. Select the final wetting and pull-down resistor values, assembly method,
|
||||||
|
and per-channel default population.
|
||||||
|
6. Validate noise immunity, contact bounce, ECU-off drive, ESD, and
|
||||||
|
ignition/injector switching noise on hardware before freezing values.
|
||||||
@@ -0,0 +1,157 @@
|
|||||||
|
# General-Purpose Digital Output Module
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This module defines the generic harness-connected digital-output classes for
|
||||||
|
NeoECU V1. It does not cover the dedicated ignition and injector power stages.
|
||||||
|
Connector positions, channel count, and the assignment of vehicle functions
|
||||||
|
remain open until packaging and connector design.
|
||||||
|
|
||||||
|
Two non-interchangeable output classes are provided:
|
||||||
|
|
||||||
|
- protected 5 V high-side logic outputs for external electronic-control inputs;
|
||||||
|
- protected battery-domain low-side outputs for relays, solenoids, and other
|
||||||
|
inductive loads.
|
||||||
|
|
||||||
|
Firmware assigns a compatible vehicle role and reported polarity to a channel;
|
||||||
|
it cannot turn one electrical class into the other. A starter-enable function
|
||||||
|
may use either class only when the external starter interface accepts it.
|
||||||
|
|
||||||
|
## Protected 5 V logic outputs
|
||||||
|
|
||||||
|
Use the automotive-qualified TI `TPS4H000-Q1` quad smart high-side switch.
|
||||||
|
It is supplied from `+5V_AUX`, not directly from `+5V_MAIN`.
|
||||||
|
|
||||||
|
```text
|
||||||
|
+5V_MAIN --> +5V_AUX eFuse / load switch --> TPS4H000-Q1 VBB
|
||||||
|
|
|
||||||
|
MCU GPIO --> TPS4H000-Q1 INx OUTx --> LOGIC_OUTx --> connector
|
||||||
|
| |
|
||||||
|
R_IN_PD R_OUT_PD
|
||||||
|
| |
|
||||||
|
GND GND
|
||||||
|
```
|
||||||
|
|
||||||
|
- `+5V_AUX` isolates an external logic-output fault from `+5V_MAIN`, the MCU,
|
||||||
|
and the sensor-excitation rail.
|
||||||
|
- Each channel is active high: when commanded on, it sources `+5V_AUX`.
|
||||||
|
`R_OUT_PD` holds the connector output low when the channel is off or the ECU
|
||||||
|
is unpowered. This is a protected high-side output with a passive low state,
|
||||||
|
not a true push-pull stage.
|
||||||
|
- `R_IN_PD` is an external pull-down at the IC input. It holds the output off
|
||||||
|
while the MCU is reset, booting, unpowered, or has not deliberately taken
|
||||||
|
control. MCU internal pulls are not a substitute.
|
||||||
|
- Set each channel's current limit to the TPS4H000-Q1 minimum configured value
|
||||||
|
of 100 mA. This is the intended maximum output current for this logic-output
|
||||||
|
class; the `+5V_AUX` eFuse limit must be selected consistently with the
|
||||||
|
populated channel count and simultaneous-fault policy.
|
||||||
|
- Use the IC's diagnostic/current-sense variant as appropriate for the MCU
|
||||||
|
interface. Per-channel fault reporting is useful but open-load reporting is
|
||||||
|
optional for generic logic commands.
|
||||||
|
|
||||||
|
### Logic-output connector protection
|
||||||
|
|
||||||
|
Place `TVS_LOGIC_OUTx` at the connector side of each output, with a short,
|
||||||
|
low-inductance return to the protected output-ground reference. Select its
|
||||||
|
working standoff above the maximum `+5V_AUX` voltage and its worst-case dynamic
|
||||||
|
clamp below the TPS4H000-Q1 output-pin limit with margin.
|
||||||
|
|
||||||
|
The TVS absorbs transient events. It is not sized to dissipate a sustained
|
||||||
|
misconnection to `VBAT_PROT`; the TPS4H000-Q1's off-state short-to-battery
|
||||||
|
detection and fault behaviour must handle that case. Confirm its unpowered
|
||||||
|
output behaviour and the completed TVS network against the actual connector
|
||||||
|
fault and transient specification before schematic freeze.
|
||||||
|
|
||||||
|
## Protected low-side outputs
|
||||||
|
|
||||||
|
Use the automotive-qualified Infineon `TLE9104SH` smart quad low-side switch.
|
||||||
|
It drives battery-domain loads supplied from `VBAT_PROT`.
|
||||||
|
|
||||||
|
```text
|
||||||
|
VBAT_PROT --> external load --> SINK_OUTx --> TLE9104SH OUTx
|
||||||
|
|
|
||||||
|
internal low-side MOSFET
|
||||||
|
|
|
||||||
|
OUT_PGND --> power-entry ground star
|
||||||
|
|
||||||
|
VBAT_PROT --> TLE9104SH VS +5V_MAIN --> TLE9104SH VDD
|
||||||
|
+3V3_MAIN --> TLE9104SH VIO
|
||||||
|
|
||||||
|
MCU GPIO --> TLE9104SH INx MCU SPI <--> TLE9104SH SPI
|
||||||
|
| |
|
||||||
|
R_IN_PD diagnostics
|
||||||
|
|
|
||||||
|
TLE9104SH local ground reference
|
||||||
|
|
||||||
|
MCU enable --> TLE9104SH EN
|
||||||
|
|
|
||||||
|
R_EN_PD
|
||||||
|
|
|
||||||
|
TLE9104SH local ground reference
|
||||||
|
```
|
||||||
|
|
||||||
|
- The TLE9104SH supplies active inductive-load clamping, configurable
|
||||||
|
overcurrent protection, short-circuit and thermal protection, direct channel
|
||||||
|
inputs, and SPI diagnostics.
|
||||||
|
- `VS` is supplied from `VBAT_PROT`; use the documented logic supplies so the
|
||||||
|
MCU-facing interface is referenced to `+3V3_MAIN` while the driver itself is
|
||||||
|
supplied from the internal 5 V rail. Decouple both supply domains locally at
|
||||||
|
the IC.
|
||||||
|
- `R_EN_PD` holds `EN` inactive through power-up and MCU reset. `R_IN_PD` on
|
||||||
|
every direct input holds its channel off. Firmware may enable outputs only
|
||||||
|
after the required reset, SPI configuration, and diagnostic checks have
|
||||||
|
completed.
|
||||||
|
- Use the diagnostic interface to identify overcurrent, overtemperature,
|
||||||
|
short-to-battery, short-to-ground, and—where useful—open-load faults. The
|
||||||
|
final retry, latching, reporting, and output-inhibit policy is firmware work
|
||||||
|
and remains open.
|
||||||
|
- Define `OUT_PGND` as a high-current return domain. It must remain separate
|
||||||
|
from `DGND`, sensor return, injector return, and ignition return until the
|
||||||
|
deliberate power-entry star connection.
|
||||||
|
|
||||||
|
### Sink-output connector protection
|
||||||
|
|
||||||
|
The TLE9104SH's internal active clamp is the primary turn-off path for
|
||||||
|
inductive loads. Provide a connector-side transient-protection footprint for
|
||||||
|
each sink output, but select and place any external TVS only after calculating
|
||||||
|
the load energy, harness transient environment, and desired release time. An
|
||||||
|
incorrect low-voltage clamp can bypass the driver's intended inductive clamp,
|
||||||
|
increase TVS dissipation, or slow a relay/solenoid release.
|
||||||
|
|
||||||
|
The final protection network shall keep the output pin within its validated
|
||||||
|
limit for connector transients and for an externally powered load while the
|
||||||
|
ECU is off. It shall not back-power the TLE9104SH logic supply, `+3V3_MAIN`,
|
||||||
|
or `+5V_AUX`.
|
||||||
|
|
||||||
|
## Default state and fault behaviour
|
||||||
|
|
||||||
|
| Condition | Logic output (`TPS4H000-Q1`) | Sink output (`TLE9104SH`) |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| MCU reset or boot | `R_IN_PD` holds the channel off; `R_OUT_PD` holds the connector low. | `R_EN_PD` and `R_IN_PD` keep every channel open. |
|
||||||
|
| ECU unpowered | Output is not actively driven; connector protection and the IC must tolerate the assigned external-fault case without rail back-power. | Output is open; externally powered loads and connector faults must not back-power ECU logic. |
|
||||||
|
| Output short/overload | Per-channel current limit and thermal protection act; `+5V_AUX` eFuse limits the aggregate branch. | Per-channel overcurrent/thermal protection acts and status is reported through SPI. |
|
||||||
|
| Inductive turn-off | Not an intended load class. | Internal active clamp controls load-current decay; any external TVS is coordinated with it. |
|
||||||
|
|
||||||
|
## Validation and open items before schematic freeze
|
||||||
|
|
||||||
|
1. Confirm the output connector transient/ESD and sustained miswiring cases,
|
||||||
|
including externally applied battery voltage while the ECU is off.
|
||||||
|
2. Select `TVS_LOGIC_OUTx` by worst-case dynamic clamp and pulse rating, not
|
||||||
|
nominal voltage marking. Confirm it does not conduct at the maximum
|
||||||
|
`+5V_AUX` voltage.
|
||||||
|
3. Select `R_OUT_PD` from the external logic-input leakage, required low level,
|
||||||
|
and permitted static current when the output is high.
|
||||||
|
4. Select the `+5V_AUX` eFuse threshold and TPS4H000-Q1 channel-limit setting
|
||||||
|
together; 100 mA per active channel is the maximum intended logic-output
|
||||||
|
current.
|
||||||
|
5. For each sink load, establish steady current, inrush, inductance, stored
|
||||||
|
energy, required release time, PWM requirement, and thermal/copper limits.
|
||||||
|
6. Calculate whether an external sink-output TVS is required and verify that it
|
||||||
|
complements rather than overrides the TLE9104SH active clamp.
|
||||||
|
7. Define the firmware diagnostic and recovery policy, and identify any output
|
||||||
|
assignment that needs an additional hardware permit gate.
|
||||||
|
|
||||||
|
## References
|
||||||
|
|
||||||
|
- [TPS4H000-Q1 product page and datasheet](https://www.ti.com/product/TPS4H000-Q1)
|
||||||
|
- [TLE9104SH product page and datasheet](https://www.infineon.com/cms/de/product/power/smart-power-switches/multichannel-spi-switches-controller/flex-multichannel-spi-low-side-power-switch/tle9104sh/)
|
||||||
@@ -0,0 +1,135 @@
|
|||||||
|
# Ignition Output Module
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This module drives the existing dual-ended, two-pin dumb ignition coil. The
|
||||||
|
coil primary is battery-fed and switched on its low side by an STMicroelectronics
|
||||||
|
VBG08H-E smart ignition IGBT (`VBG08HTR-E` for tape-and-reel assembly).
|
||||||
|
|
||||||
|
The VBG08H-E integrates the ignition IGBT, high-voltage clamp, coil-current
|
||||||
|
limit, thermal protection, soft shutdown, and a coil-current threshold flag.
|
||||||
|
Its 8 A maximum operative coil-current rating is compatible with V1 only after
|
||||||
|
the final coil's primary characteristics and required dwell current are
|
||||||
|
confirmed.
|
||||||
|
|
||||||
|
## Power path
|
||||||
|
|
||||||
|
```text
|
||||||
|
VBAT_PROT --> coil primary --> VBG08H HVC
|
||||||
|
|
|
||||||
|
internal IGBT
|
||||||
|
|
|
||||||
|
PGND1 + PGND2 --> IGN_PGND --> power-entry ground
|
||||||
|
```
|
||||||
|
|
||||||
|
- `HVC` connects to one coil-primary terminal; the other terminal connects to
|
||||||
|
`VBAT_PROT`.
|
||||||
|
- `VS` is supplied from `VBAT_PROT`. Place a 100 nF ceramic and 10 µF local
|
||||||
|
capacitor at `VS`, following the VBG08H-E reference circuit.
|
||||||
|
- `VBAT_PROT` protection must maintain the VBG08H-E within its 5.4-28 V
|
||||||
|
operating supply range during normal operation and expected local transients.
|
||||||
|
- Do not place a conventional flyback diode across the coil primary. The
|
||||||
|
VBG08H-E's internal high-voltage clamp provides the rapid primary-current
|
||||||
|
collapse required to generate a spark.
|
||||||
|
|
||||||
|
## Command and inhibit path
|
||||||
|
|
||||||
|
`INP` is active high: a rising edge begins coil dwell and a falling edge
|
||||||
|
causes the normal spark event.
|
||||||
|
|
||||||
|
```text
|
||||||
|
STM32 ignition timing output
|
||||||
|
--> 3.3 V-to-5 V non-inverting buffer --> 1 kOhm --> INP
|
||||||
|
|
|
||||||
|
low-capacitance
|
||||||
|
Zener clamp
|
||||||
|
|
|
||||||
|
VBG local Kelvin-ground reference
|
||||||
|
|
||||||
|
SAFE_IGNITION_INHIBIT
|
||||||
|
--> 1 kOhm --> EN
|
||||||
|
|
|
||||||
|
low-capacitance
|
||||||
|
Zener clamp
|
||||||
|
|
|
||||||
|
VBG local Kelvin-ground reference
|
||||||
|
```
|
||||||
|
|
||||||
|
The VBG08H-E input-high requirement is 3 V. A 5 V buffer is used rather than
|
||||||
|
direct STM32 drive to preserve high-level margin across MCU output tolerance,
|
||||||
|
temperature, and ignition noise.
|
||||||
|
|
||||||
|
`EN` is active low:
|
||||||
|
|
||||||
|
```text
|
||||||
|
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
|
||||||
|
```
|
||||||
|
|
||||||
|
When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a
|
||||||
|
dwell is active, this invokes the VBG08H-E soft shutdown so coil current is
|
||||||
|
removed without intentionally generating a spark. The 1 kOhm resistors on
|
||||||
|
`INP` and `EN` follow the manufacturer's reference circuit and limit transient
|
||||||
|
current into the device's control pins.
|
||||||
|
|
||||||
|
The command traces shall be short, have a continuous quiet reference, and be
|
||||||
|
routed away from the `HVC` switching node and coil connector. The VBG08H-E
|
||||||
|
already includes input filtering; no external RC filter shall be added until
|
||||||
|
its timing effect has been analysed.
|
||||||
|
|
||||||
|
Fit a low-capacitance Zener clamp directly at each `INP` and `EN` power-IC pin,
|
||||||
|
on the VBG side of its 1 kOhm series resistor. Each clamp returns to the VBG
|
||||||
|
local Kelvin-ground reference at the `IGN_PGND` joining point, not to remote
|
||||||
|
`DGND`. The clamp voltage shall tolerate the valid 5 V logic high while
|
||||||
|
limiting positive transients before the VBG08H-E input-overvoltage threshold.
|
||||||
|
On `EN`, the protection network must preserve the fail-safe high/inhibit state
|
||||||
|
and must not create a path that can pull `EN` low during a fault.
|
||||||
|
|
||||||
|
## Current-flag diagnostic
|
||||||
|
|
||||||
|
`C.F.` is an open-drain output. It is low while coil current is below its
|
||||||
|
internal threshold and releases when the current reaches the nominal 6.5 A
|
||||||
|
threshold. The threshold is not externally programmable.
|
||||||
|
|
||||||
|
```text
|
||||||
|
VBG08H C.F. --> reference-style R/C filter and 3.3 V pull-up --> STM32 GPIO
|
||||||
|
```
|
||||||
|
|
||||||
|
The pull-up voltage must not exceed 5.5 V; `+3V3_MAIN` is suitable. The signal
|
||||||
|
is a diagnostic confirmation of primary-current buildup and is not part of the
|
||||||
|
hardware ignition shutoff path. Firmware shall use it to detect and report an
|
||||||
|
under-current/late-current condition while retaining a separately defined
|
||||||
|
maximum dwell time.
|
||||||
|
|
||||||
|
## Ground and layout
|
||||||
|
|
||||||
|
Define `IGN_PGND` as the ignition module's high-current return domain.
|
||||||
|
|
||||||
|
```text
|
||||||
|
PGND1 -- matched heavy copper --+
|
||||||
|
+--> IGN_PGND local joining point --> power-entry ground
|
||||||
|
PGND2 -- matched heavy copper --+
|
||||||
|
|
|
||||||
|
VBG08H GND -- short, separate Kelvin reference trace --+
|
||||||
|
```
|
||||||
|
|
||||||
|
- `PGND1` and `PGND2` must use equal-length, equal-width, and similarly
|
||||||
|
shaped copper paths to the `IGN_PGND` joining point. The VBG08H-E uses these
|
||||||
|
paths in its internal current-sensing scheme; imbalance shifts its current
|
||||||
|
limit and current-flag threshold.
|
||||||
|
- The VBG08H-E `GND` pin connects locally to that same joining point through a
|
||||||
|
short, separate Kelvin/reference trace. It does not carry coil current.
|
||||||
|
- Do not separately connect the VBG08H-E `GND` pin to the remote `DGND` plane.
|
||||||
|
`IGN_PGND` and `DGND` meet only at the deliberate power-entry ground star,
|
||||||
|
preventing parallel ground-return paths.
|
||||||
|
- Keep the coil-current loop compact and isolate its routing from MCU, ADC,
|
||||||
|
trigger-input, and communication traces.
|
||||||
|
|
||||||
|
## Remaining validation before schematic freeze
|
||||||
|
|
||||||
|
1. Identify the coil and measure/obtain its primary resistance, inductance,
|
||||||
|
operating current, and permitted dwell characteristics.
|
||||||
|
2. Confirm that worst-case stored energy and current remain within the
|
||||||
|
VBG08H-E repetitive operating limits at the 16.8 V battery maximum.
|
||||||
|
3. Verify thermal performance with the selected PCB copper area and enclosure.
|
||||||
|
4. Validate spark noise, `C.F.` behavior, input margins, and the effective
|
||||||
|
engine-permit shutdown behavior on hardware.
|
||||||
@@ -0,0 +1,107 @@
|
|||||||
|
# Injector Output Module
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This module drives one conventional high-impedance/saturated fuel injector. It
|
||||||
|
uses the STMicroelectronics VNL5050S5-E protected low-side switch
|
||||||
|
(`VNL5050S5TR-E` for tape-and-reel assembly).
|
||||||
|
|
||||||
|
The driver provides an integrated power MOSFET, inductive-load clamp, current
|
||||||
|
and power limiting, thermal protection, off-state open-load detection, and an
|
||||||
|
open-drain status output. It is not a peak-and-hold injector driver; a
|
||||||
|
low-impedance injector requires a different architecture.
|
||||||
|
|
||||||
|
## Power path
|
||||||
|
|
||||||
|
```text
|
||||||
|
VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN
|
||||||
|
|
|
||||||
|
internal low-side MOSFET
|
||||||
|
|
|
||||||
|
SOURCE --> INJ_PGND --> power-entry ground
|
||||||
|
```
|
||||||
|
|
||||||
|
- The injector's positive terminal connects to `VBAT_PROT`; its negative
|
||||||
|
terminal connects to `DRAIN`.
|
||||||
|
- `SUPPLY` connects to `+5V_MAIN`, the internal logic rail. Place local
|
||||||
|
decoupling from `SUPPLY` to `SOURCE`, including a nearby 100 nF ceramic
|
||||||
|
capacitor.
|
||||||
|
- The VNL5050S5-E provides a 41-52 V drain-source clamp for inductive turn-off.
|
||||||
|
Injector current-decay/closing time must be verified using the actual
|
||||||
|
injector inductance and resistance.
|
||||||
|
- Do not add a conventional flyback diode across the injector; it would slow
|
||||||
|
its current decay and closing response.
|
||||||
|
|
||||||
|
## Command path
|
||||||
|
|
||||||
|
`INPUT` is active high. It receives only the hardware-permitted injector
|
||||||
|
command defined by the dead-man interlock.
|
||||||
|
|
||||||
|
```text
|
||||||
|
SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT
|
||||||
|
|-- 10 kOhm ---------> INJ_PGND
|
||||||
|
`-- low-capacitance
|
||||||
|
Zener clamp ------> INJ_PGND
|
||||||
|
```
|
||||||
|
|
||||||
|
```text
|
||||||
|
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
|
||||||
|
```
|
||||||
|
|
||||||
|
`SAFE_INJECTOR_SIG` is 5 V logic and therefore provides substantial margin
|
||||||
|
over the VNL5050S5-E's 2.1 V minimum input-high level. The 1 kOhm `Rprot`
|
||||||
|
resistor follows the manufacturer's protection approach. The 10 kOhm pull-down
|
||||||
|
is placed on the driver side of `Rprot`; it holds `INPUT` low if the permission
|
||||||
|
logic is unpowered, disconnected, or during power sequencing.
|
||||||
|
|
||||||
|
Fit the low-capacitance Zener clamp directly at the VNL5050S5-E `INPUT` pin,
|
||||||
|
on the driver side of `Rprot`. Its return is the local `INJ_PGND`/`SOURCE`
|
||||||
|
reference, not remote `DGND`. Select its clamp voltage to tolerate the valid
|
||||||
|
5 V command high while limiting coupled positive transients at the power-IC
|
||||||
|
pin.
|
||||||
|
|
||||||
|
When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the
|
||||||
|
injector output off. This is the hardware shutoff path; firmware also clears
|
||||||
|
pending injection events when it observes a dead-man release.
|
||||||
|
|
||||||
|
## Status diagnostic
|
||||||
|
|
||||||
|
`STATUS` is an open-drain diagnostic output. It is read by the MCU through a
|
||||||
|
1 kOhm protection resistor and a `+3V3_MAIN` pull-up.
|
||||||
|
|
||||||
|
```text
|
||||||
|
+3V3_MAIN pull-up --> MCU-side status node --> 1 kOhm Rprot --> STATUS
|
||||||
|
```
|
||||||
|
|
||||||
|
The 3.3 V pull-up is within the pin rating and provides a safe MCU logic level.
|
||||||
|
The diagnostic path supports off-state open-load detection and indicates
|
||||||
|
over-temperature shutdown. The VNL5050S5-E protects against short circuit and
|
||||||
|
current overload internally, but its single `STATUS` pin does not provide a
|
||||||
|
separate, unambiguous MCU-readable short-circuit/current-limit indication.
|
||||||
|
|
||||||
|
## Ground and layout
|
||||||
|
|
||||||
|
Define `INJ_PGND` as the injector module's high-current return domain.
|
||||||
|
|
||||||
|
```text
|
||||||
|
VNL5050 SOURCE --> short, low-impedance INJ_PGND copper --> power-entry ground star
|
||||||
|
```
|
||||||
|
|
||||||
|
- `INJ_PGND` runs directly to the power-entry ground star, where it joins the
|
||||||
|
battery return, `IGN_PGND`, `DGND`, and sensor return domains.
|
||||||
|
- It must not share copper with those other returns before the star point.
|
||||||
|
- `SOURCE` is both the MOSFET power return and the driver's logic reference;
|
||||||
|
unlike the ignition driver, this part has no separate Kelvin-sense ground
|
||||||
|
pin. Keep the `SUPPLY`-to-`SOURCE` decoupling loop compact and the command
|
||||||
|
and status traces away from the `DRAIN` switching node.
|
||||||
|
- Provide the drain copper area required by the package thermal guidance.
|
||||||
|
|
||||||
|
## Remaining validation before schematic freeze
|
||||||
|
|
||||||
|
1. Measure injector coil resistance and obtain its part number/datasheet.
|
||||||
|
2. Confirm that the injector is high impedance and that its peak current,
|
||||||
|
stored energy, and turn-off time fit the VNL5050S5-E limits.
|
||||||
|
3. Verify output-stage temperature using the actual injector duty cycle,
|
||||||
|
board copper area, and enclosure conditions.
|
||||||
|
4. Validate injector opening/closing timing, diagnostic behavior, and ignition
|
||||||
|
noise immunity on hardware.
|
||||||
@@ -0,0 +1,246 @@
|
|||||||
|
# NeoECU V1 Power Architecture
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
This document defines the working power architecture for NeoECU V1. The ECU
|
||||||
|
is powered from a 4S LiPo and controls one injector, one dual-ended dumb
|
||||||
|
ignition coil, engine-position Hall sensors, analogue sensors, CAN, and a
|
||||||
|
starter-enable output.
|
||||||
|
|
||||||
|
This is an architecture decision document, not a component-selection or
|
||||||
|
schematic document. Current limits, exact protection components, and regulator
|
||||||
|
part numbers remain to be selected after the loads and packaging are confirmed.
|
||||||
|
|
||||||
|
## Supply Assumptions
|
||||||
|
|
||||||
|
- Supply: 4S LiPo battery.
|
||||||
|
- Nominal voltage: 14.8 V.
|
||||||
|
- Fully charged voltage: 16.8 V.
|
||||||
|
- The ECU shall tolerate supply sag during vehicle operation and switching
|
||||||
|
transients from ignition, injector, starter, and harness inductance.
|
||||||
|
- Unlike a road-car alternator system, V1 is not initially designed around a
|
||||||
|
conventional automotive load-dump event. Input protection and regulators
|
||||||
|
should nevertheless have adequate voltage headroom for realistic local
|
||||||
|
transients.
|
||||||
|
|
||||||
|
## Rail Tree
|
||||||
|
|
||||||
|
```text
|
||||||
|
4S LiPo
|
||||||
|
|
|
||||||
|
+-- input fuse, reverse-polarity protection, TVS/transient protection
|
||||||
|
|
|
||||||
|
+-- VBAT_PROT ---------------------------------> ignition branch
|
||||||
|
| injector branch
|
||||||
|
| protected low-side outputs
|
||||||
|
| protected VBAT sense
|
||||||
|
|
|
||||||
|
+-- synchronous buck --------------------------> +5V_MAIN
|
||||||
|
| | internal 5 V circuitry
|
||||||
|
| |
|
||||||
|
| +-- eFuse / load switch ------------------> +5V_AUX
|
||||||
|
| | external logic-level outputs
|
||||||
|
| |
|
||||||
|
| +-- eFuse / load switch, ferrite/filter --> +5V_SENS
|
||||||
|
| protected sensor supply
|
||||||
|
|
|
||||||
|
+-- synchronous buck --------------------------> +3V3_MAIN
|
||||||
|
| | MCU digital supplies
|
||||||
|
| | 3.3 V logic / communications
|
||||||
|
| |
|
||||||
|
| +-- ferrite bead / filtering -------------> +5V_AUX
|
||||||
|
| MCU analogue domain
|
||||||
|
| analogue front ends
|
||||||
|
| ADC reference
|
||||||
|
|
|
||||||
|
+-- regulated buck-boost ----------------------> +12V_SENS
|
||||||
|
12 V sensor supply
|
||||||
|
crank/cam Hall sensors
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
## Input and Raw-Battery Domain
|
||||||
|
|
||||||
|
`VBAT_PROT` is the protected raw-battery domain. It is produced after the
|
||||||
|
input fuse, reverse-polarity stage, and input transient clamp.
|
||||||
|
|
||||||
|
It supplies the loads that must operate from battery voltage:
|
||||||
|
|
||||||
|
- ignition-coil primary supply;
|
||||||
|
- injector supply;
|
||||||
|
- a protected, scaled battery-voltage measurement for the MCU.
|
||||||
|
|
||||||
|
Ignition, injector, and low-side-output branches require their own protection
|
||||||
|
and fault containment. Their high-current returns must not share the sensor or
|
||||||
|
MCU return path; all return domains join deliberately at the power-entry
|
||||||
|
region.
|
||||||
|
|
||||||
|
## +5V_MAIN
|
||||||
|
|
||||||
|
`+5V_MAIN` is the ECU's primary regulated 5 V rail. It is generated directly
|
||||||
|
from `VBAT_PROT` by a synchronous buck converter and powers internal 5 V
|
||||||
|
circuitry, including automotive ICs that require 5 V logic or supply voltage.
|
||||||
|
|
||||||
|
It is the upstream rail for `+5V_AUX` and `+5V_SENS`. External
|
||||||
|
harness-connected loads shall not be connected directly to `+5V_MAIN`; they
|
||||||
|
use their separately protected branch.
|
||||||
|
|
||||||
|
## +5V_SENS
|
||||||
|
|
||||||
|
`+5V_SENS` is derived from `+5V_MAIN` through an eFuse or protected load
|
||||||
|
switch, followed by a ferrite bead and local filtering. It is not shared
|
||||||
|
directly with external digital-output loads.
|
||||||
|
|
||||||
|
It provides a controlled, protected 5 V excitation supply for ratiometric
|
||||||
|
pressure sensors and other sensors that require 5 V. The rail shall include a
|
||||||
|
sensor-facing protection/current-limit stage so a harness short cannot bring
|
||||||
|
down `+5V_MAIN` or the ECU logic supply. Its voltage should be monitored by
|
||||||
|
the MCU.
|
||||||
|
|
||||||
|
The ferrite bead and local filtering isolate sensor excitation from switching
|
||||||
|
and digital noise on `+5V_MAIN`, while the protected branch keeps a
|
||||||
|
sensor-harness fault contained to the sensor domain.
|
||||||
|
|
||||||
|
## +5V_AUX
|
||||||
|
|
||||||
|
`+5V_AUX` is derived from `+5V_MAIN` through an eFuse or protected load switch.
|
||||||
|
It supplies external 5 V digital logic-level output circuits, such as a
|
||||||
|
starter-enable command to a separate external control module.
|
||||||
|
|
||||||
|
This rail is distinct from `+5V_SENS` so external digital loads and harness
|
||||||
|
faults cannot disturb sensor excitation. The protection stage shall isolate a
|
||||||
|
short on `+5V_AUX` without inhibiting `+5V_MAIN` or the rest of the ECU. It
|
||||||
|
shall include appropriate output protection and current limiting for the
|
||||||
|
external interface.
|
||||||
|
|
||||||
|
`+5V_AUX` is not an actuator supply. If a starter-enable or other command must
|
||||||
|
drive a relay or another inductive load, it shall use an appropriate protected
|
||||||
|
low-side sink output instead of a 5 V logic-level output.
|
||||||
|
|
||||||
|
## +3V3_MAIN
|
||||||
|
|
||||||
|
`+3V3_MAIN` is generated directly from `VBAT_PROT` by a dedicated synchronous
|
||||||
|
buck converter. It supplies the STM32H747 digital supply pins and the 3.3 V
|
||||||
|
digital loads, including logic-side communications circuitry.
|
||||||
|
|
||||||
|
The main 3.3 V rail shall not be made by an LDO from either 5 V rail. The H747
|
||||||
|
and supporting logic can create a substantial 3.3 V load; an LDO would
|
||||||
|
dissipate the difference between 5 V and 3.3 V as heat. Generating 3.3 V from
|
||||||
|
`VBAT_PROT` also avoids placing the MCU's current demand on `+5V_MAIN`.
|
||||||
|
`+3V3_MAIN` must never be derived from `+5V_SENS`, since that would couple the
|
||||||
|
logic load to the sensor supply.
|
||||||
|
|
||||||
|
## +3V3_ANA
|
||||||
|
|
||||||
|
`+3V3_ANA` is derived from `+3V3_MAIN` through a ferrite bead and local
|
||||||
|
filtering. It supplies the MCU analogue supply/reference domain and analogue
|
||||||
|
front-end circuitry.
|
||||||
|
|
||||||
|
The initial implementation should reserve an optional low-noise LDO footprint
|
||||||
|
for this rail. An LDO should be fitted only if analogue-noise testing shows it
|
||||||
|
is necessary; it is not the primary 3.3 V regulator. The analogue rail and its
|
||||||
|
decoupling must follow the STM32H747 supply and ADC layout guidance.
|
||||||
|
|
||||||
|
## Ratiometric 5 V Sensor Measurements
|
||||||
|
|
||||||
|
The MCU ADC reference is `+3V3_ANA`; it is not expected to be precision-trimmed
|
||||||
|
to track `+5V_SENS`. Therefore 5 V ratiometric sensor readings are made
|
||||||
|
ratiometric in measurement and firmware rather than by requiring a fixed
|
||||||
|
relationship between the rails.
|
||||||
|
|
||||||
|
```text
|
||||||
|
+5V_SENS ----> sensor excitation
|
||||||
|
|
|
||||||
|
+--> sensor output -- matched divider --> ADC sensor channel
|
||||||
|
|
|
||||||
|
+--> +5V_SENS sense - matched divider --> ADC 5-V-sense channel
|
||||||
|
```
|
||||||
|
|
||||||
|
Firmware shall calculate the sensor signal as a ratio of the two ADC readings:
|
||||||
|
|
||||||
|
```text
|
||||||
|
sensor fraction = ADC(sensor output) / ADC(+5V_SENS sense)
|
||||||
|
```
|
||||||
|
|
||||||
|
Since the two channels use the same ADC reference, the reference-voltage error
|
||||||
|
and most common gain error cancel. Divider ratio and temperature drift are also
|
||||||
|
minimised by using matched, low-drift resistor networks for the sensor-output
|
||||||
|
and 5-V-sense dividers.
|
||||||
|
|
||||||
|
Design requirements:
|
||||||
|
|
||||||
|
- The divider ratio must keep both channels within the ADC input range with
|
||||||
|
margin for the maximum sensor-supply tolerance. A nominal ratio near 0.55
|
||||||
|
maps 5.25 V to approximately 2.9 V.
|
||||||
|
- Use corresponding filter characteristics on the sensor-output and 5-V-sense
|
||||||
|
channels and sample them close together.
|
||||||
|
- Apply normal input protection and anti-alias filtering without defeating the
|
||||||
|
intended ratiometric measurement.
|
||||||
|
- A failed or shorted sensor supply must be detectable from the sensed 5 V
|
||||||
|
reading.
|
||||||
|
|
||||||
|
## Thermistor Measurements
|
||||||
|
|
||||||
|
Thermistor dividers are normally excited from `+5V_SENS`, consistent with a
|
||||||
|
conventional automotive ECU sensor interface. The thermistor itself is passive
|
||||||
|
and would operate with a 3.3 V excitation, but using the protected 5 V sensor
|
||||||
|
rail gives a common, diagnosable excitation supply for external sensors.
|
||||||
|
|
||||||
|
```text
|
||||||
|
+5V_SENS -- precision pull-up --+-- thermistor -- sensor ground
|
||||||
|
|
|
||||||
|
+-- matched divider/filter --> ADC thermistor channel
|
||||||
|
|
||||||
|
+5V_SENS ------ matched divider/filter -----------------> ADC 5-V-sense channel
|
||||||
|
```
|
||||||
|
|
||||||
|
Firmware shall use the ratio of the thermistor-channel and 5-V-sense ADC
|
||||||
|
readings to calculate the thermistor resistance. This cancels variation in
|
||||||
|
both `+5V_SENS` and the `+3V3_ANA` ADC reference. Pull-up resistance must be
|
||||||
|
chosen to limit thermistor self-heating while providing sufficient measurement
|
||||||
|
resolution over the required temperature range.
|
||||||
|
|
||||||
|
## +12V_SENS
|
||||||
|
|
||||||
|
The crank and cam sensors are currently described as 12 V, active-low,
|
||||||
|
open-collector-style Hall-effect sensors. They are supplied from `+12V_SENS`.
|
||||||
|
|
||||||
|
`+12V_SENS` is a regulated 12 V buck-boost rail generated from `VBAT_PROT`.
|
||||||
|
It provides a stable supply when the 4S LiPo is above or below 12 V and may be
|
||||||
|
used by future 12 V sensor circuits in addition to the crank and cam sensors.
|
||||||
|
|
||||||
|
The rail shall include a sensor-facing current-limit or protected high-side
|
||||||
|
switch, filtering appropriate to the harness, and local decoupling at the
|
||||||
|
sensor connector. Its voltage accuracy, ripple, current capability, and
|
||||||
|
current-limit threshold must be specified from the selected Hall sensors and
|
||||||
|
the future 12 V sensor budget.
|
||||||
|
|
||||||
|
Hall outputs shall not enter the MCU at the sensor supply voltage. Their input
|
||||||
|
conditioning shall provide protection, noise rejection, and a defined
|
||||||
|
logic-level conversion to protected 3.3 V timer inputs. Output pull-up and
|
||||||
|
level-shift details are to be selected with the final sensor wiring and output
|
||||||
|
type.
|
||||||
|
|
||||||
|
## Grounding and Layout Intent
|
||||||
|
|
||||||
|
- Keep ignition, injector, and starter-switch current returns separate from
|
||||||
|
sensor and MCU ground returns.
|
||||||
|
- Join these return domains deliberately near the input/power-entry region.
|
||||||
|
- Keep switching-regulator hot loops compact and away from trigger and ADC
|
||||||
|
signal paths.
|
||||||
|
- Route sensor supply and sensor-return paths as controlled pairs to the
|
||||||
|
connector where practical.
|
||||||
|
- Place the analogue front end near its ADC connections and isolate it from
|
||||||
|
ignition and injector switching nodes.
|
||||||
|
|
||||||
|
## Open Items Before Schematic Freeze
|
||||||
|
|
||||||
|
1. Confirm the current budget for each rail, including all expansion I/O.
|
||||||
|
2. Confirm the Hall-sensor part numbers, current, output type, cable lengths,
|
||||||
|
and pull-up requirements; establish the current budget for future
|
||||||
|
`+12V_SENS` loads.
|
||||||
|
3. Select the input transient and reverse-polarity ratings after the battery,
|
||||||
|
wiring, and enclosure arrangement are known.
|
||||||
|
4. Confirm sensor-supply accuracy, current limit, and diagnostic requirements.
|
||||||
|
5. Validate ADC noise and ratiometric accuracy on hardware before deciding
|
||||||
|
whether the optional `+3V3_ANA` LDO is needed.
|
||||||
@@ -0,0 +1,147 @@
|
|||||||
|
# NeoECU V1 Hardware Architecture
|
||||||
|
|
||||||
|
This document records the current working architecture for the NeoECU V1. It is
|
||||||
|
intended to be refined as the electrical system, engine components, and board
|
||||||
|
packaging are confirmed.
|
||||||
|
|
||||||
|
## Scope
|
||||||
|
|
||||||
|
NeoECU V1 controls a single-piston, four-stroke Eco Marathon engine. The ECU
|
||||||
|
provides engine timing, injection, ignition, sensor acquisition, and CAN
|
||||||
|
telemetry support.
|
||||||
|
|
||||||
|
The immediate hardware scope is:
|
||||||
|
|
||||||
|
- one injector output
|
||||||
|
- one dual-ended, two-pin dumb ignition coil output
|
||||||
|
- crank and cam position inputs
|
||||||
|
- air and coolant/water temperature inputs
|
||||||
|
- provision for additional pressure, temperature, and digital inputs
|
||||||
|
- CAN bus
|
||||||
|
- a low-current starter-enable output for an external high-current switch
|
||||||
|
|
||||||
|
Fuel-pump control is not required because the vehicle fuel system is already
|
||||||
|
pressurised.
|
||||||
|
|
||||||
|
## Controller
|
||||||
|
|
||||||
|
The target controller is the STM32H747 dual-core microcontroller.
|
||||||
|
|
||||||
|
- The Cortex-M7 owns deterministic engine control, including trigger capture,
|
||||||
|
synchronisation, and scheduled injection and ignition events.
|
||||||
|
- The Cortex-M4 is reserved for non-critical work such as telemetry, CAN, and
|
||||||
|
future auxiliary features.
|
||||||
|
- Timer capture and output-compare resources are used for time-critical engine
|
||||||
|
I/O.
|
||||||
|
|
||||||
|
The H747 remains the preferred V1 controller. Its peripheral set provides the
|
||||||
|
required timer, analogue, digital, and FDCAN support with substantial capacity
|
||||||
|
for future telemetry and expansion.
|
||||||
|
|
||||||
|
## Engine Timing
|
||||||
|
|
||||||
|
The current engine timing arrangement is:
|
||||||
|
|
||||||
|
| Signal | Current arrangement | Purpose |
|
||||||
|
| --- | --- | --- |
|
||||||
|
| Crank | Two Hall-effect pulses per crank revolution | 180-degree position events and speed estimation |
|
||||||
|
| Cam | One Hall-effect pulse per 720-degree cycle | Four-stroke phase identification |
|
||||||
|
|
||||||
|
The initial engine speed limiter is 5,000 RPM. A future crank trigger with four
|
||||||
|
pulses per revolution is being considered to provide 90-degree timing events
|
||||||
|
and improve interpolation accuracy.
|
||||||
|
|
||||||
|
Crank and cam sensors currently operate as 12 V, active-low Hall-effect
|
||||||
|
signals: their output is normally high and pulls low when active. The ECU must
|
||||||
|
condition these signals to protected 3.3 V timer inputs. The interface must
|
||||||
|
support the existing open-collector-style arrangement and provide noise
|
||||||
|
rejection appropriate for an engine environment.
|
||||||
|
|
||||||
|
## Power Architecture
|
||||||
|
|
||||||
|
The ECU is supplied directly from a 4S LiPo battery. The normal system range
|
||||||
|
therefore includes a fully charged voltage of 16.8 V.
|
||||||
|
|
||||||
|
The input power stage must provide:
|
||||||
|
|
||||||
|
- input fusing and reverse-polarity protection
|
||||||
|
- transient protection with voltage ratings suitable for a 16.8 V battery
|
||||||
|
- protected battery-voltage measurement by the MCU
|
||||||
|
- a regulated 5 V sensor supply
|
||||||
|
- a clean regulated 3.3 V rail for the MCU and analogue circuitry
|
||||||
|
- separate protected power branches for the ignition and injector loads
|
||||||
|
|
||||||
|
Coil, injector, and starter-switch current returns must be routed separately
|
||||||
|
from sensor and MCU ground returns, with a deliberate ground strategy joining
|
||||||
|
them at the power-entry region.
|
||||||
|
|
||||||
|
## Ignition Output
|
||||||
|
|
||||||
|
The engine uses a dual-ended, two-pin dumb ignition coil with two spark plugs.
|
||||||
|
The coil primary is supplied from the protected battery rail and switched on
|
||||||
|
the low side by the ECU.
|
||||||
|
|
||||||
|
The V1 ignition stage should use an automotive smart ignition IGBT or
|
||||||
|
ignition-driver IC rather than a generic smart low-side switch or a fully
|
||||||
|
discrete IGBT driver. It must be designed for the coil's high-voltage primary
|
||||||
|
flyback and provide active voltage clamping, over-current protection, and
|
||||||
|
thermal protection.
|
||||||
|
|
||||||
|
Ignition dwell is adjusted in firmware using measured battery voltage. Current
|
||||||
|
limiting in the ignition driver is required as the safety backstop, particularly
|
||||||
|
at the 16.8 V fully charged battery voltage. Final dwell calibration and the
|
||||||
|
driver rating are pending coil identification or primary-current measurement.
|
||||||
|
|
||||||
|
## Injection Output
|
||||||
|
|
||||||
|
The injector is supplied from the protected battery rail and switched on the
|
||||||
|
low side. Its electrical type has not yet been confirmed, though it is expected
|
||||||
|
to be a conventional high-impedance/saturated injector.
|
||||||
|
|
||||||
|
V1 should use an automotive smart low-side injector driver with:
|
||||||
|
|
||||||
|
- inductive-load capability and controlled turn-off clamp
|
||||||
|
- current limit and thermal protection
|
||||||
|
- open-load and short-circuit diagnostics
|
||||||
|
- MCU-readable fault reporting
|
||||||
|
|
||||||
|
Injector opening-time compensation is performed in firmware from the measured
|
||||||
|
battery voltage. The injector is not supplied from a regulated high-current
|
||||||
|
rail. Its resistance must be measured before the driver and protection values
|
||||||
|
are finalised; a low-impedance injector would require a peak-and-hold driver
|
||||||
|
and changes this architecture.
|
||||||
|
|
||||||
|
## Sensor and Auxiliary I/O
|
||||||
|
|
||||||
|
Analogue inputs should support common 5 V ratiometric sensors, particularly
|
||||||
|
0.5-4.5 V automotive pressure transducers, as well as thermistor channels.
|
||||||
|
Each input requires protection, filtering, diagnostic-friendly biasing where
|
||||||
|
appropriate, and conditioning to the MCU ADC voltage range.
|
||||||
|
|
||||||
|
Initial intended I/O categories are:
|
||||||
|
|
||||||
|
| Category | Required V1 capability |
|
||||||
|
| --- | --- |
|
||||||
|
| Digital inputs | Crank, cam, and expansion inputs |
|
||||||
|
| Analogue inputs | Air temperature, coolant/water temperature, pressure sensors, and expansion inputs |
|
||||||
|
| Engine outputs | One injector and one ignition-coil primary channel |
|
||||||
|
| Auxiliary outputs | Starter-enable logic output to an external high-current MOSFET or IGBT switch |
|
||||||
|
| Communications | CAN bus with selectable termination |
|
||||||
|
|
||||||
|
The starter-enable output only commands an external high-current switch. The
|
||||||
|
ECU does not carry the starter's approximately 40 A current.
|
||||||
|
|
||||||
|
## Decisions Still Required
|
||||||
|
|
||||||
|
The following information is needed before schematic capture and component
|
||||||
|
selection are finalised:
|
||||||
|
|
||||||
|
1. Injector coil resistance and, if available, its part number or datasheet.
|
||||||
|
2. Ignition-coil part number, primary resistance/inductance, and acceptable
|
||||||
|
dwell/current characteristics.
|
||||||
|
3. Required quantity and exact types of spare analogue and digital I/O.
|
||||||
|
4. ECU enclosure, board-size, mounting, environmental, and connector
|
||||||
|
requirements.
|
||||||
|
5. CAN connector and bus topology.
|
||||||
|
6. Detailed trigger sensor wiring, connector, and cable-length information.
|
||||||
|
|
||||||
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user