NeoECU-Hardware/Architecture/IO_MODULES/CAN_PHYSICAL_LAYER.md

CAN Physical Layer

Purpose

This module defines the NeoECU V1 physical interface to the vehicle CAN FD network. It covers the MCU interface, transceiver, harness topology, termination, protection, grounding, layout, and required fault behaviour. It does not define CAN identifiers, payloads, or firmware scheduling.

CAN is a telemetry and auxiliary-communications interface. It is not part of the hardware engine-permit path: loss, overload, or bus-off of CAN shall never remove or assert engine permission.

This is a schematic-design basis, not a released schematic. Final connector part numbers, MCU pins, protection component values, and validated harness details remain to be confirmed.

V1 network definition

Item	V1 decision
Protocol	ISO 11898-2 high-speed CAN FD, with Classical CAN frames also supported
Nominal/arbitration bit rate	500 kbit/s
CAN FD data-phase bit rate	2 Mbit/s
External buses implemented	One vehicle CAN bus
Expected nodes	ECU plus one or two vehicle nodes; a debug tool may join through a service connector
Harness extent	Approximately 2--2.5 m end-to-end
ECU position	Mid-bus node, not a physical endpoint
Harness	120 ohm nominal twisted pair for CAN_H and CAN_L
Shield	Not required initially; assess only if the final route must run near ignition or other demonstrated high-noise wiring

All V1 nodes connected to this bus shall support CAN FD at the configured rates. A Classical-CAN-only node cannot join a CAN FD network that transmits FD frames.

STM32H747 interface and ownership

The STM32H747 provides two independent CAN FD controllers, FDCAN1 and FDCAN2, with shared message RAM. V1 implements only the one external vehicle bus on FDCAN1. FDCAN2 remains available for a future separate network; it does not imply a second physical bus or a second transceiver in V1.

The Cortex-M4 is the intended owner of CAN telemetry and auxiliary communications. The Cortex-M7 retains deterministic engine control. Firmware shall define the inter-core message and fault-reporting boundary before either core accesses FDCAN resources; neither core may independently initialise or reconfigure a live controller.

PA11 and PA12 are reserved for the USB-C USB-FS D-/D+ path used by the STM32 system-memory DFU recovery route. They shall not be assigned to FDCAN1_RX or FDCAN1_TX. The final FDCAN1 pin pair shall be selected as part of the complete STM32 package and pin allocation, preserving timer, ADC, debug, and required serial interfaces. Candidate pairs include PB8/PB9 and PD0/PD1 where available in the selected package.

The board shall retain accessible BOOT0, NRST, and SWD/J-Link provisions. USB DFU is a recovery path, not a replacement for normal SWD debugging.

Transceiver and local interface

Use the automotive-qualified TI TCAN1044AV-Q1 CAN FD transceiver family. Select the exact package and orderable suffix at PCB-layout and procurement time; the electrical requirements in this module apply to the selected member.

Transceiver connection	Required implementation
VCC	Supply from the protected 5 V logic rail, with the local decoupling specified by the selected-device datasheet.
VIO	Supply from +3V3_MAIN so TXD, RXD, and mode logic interface directly to STM32 GPIO.
TXD / RXD	Connect to the selected FDCAN1_TX / FDCAN1_RX GPIO alternate functions. The ECU shall drive recessive when it is not intentionally transmitting.
STB	Connect to an MCU GPIO and pull externally high to +3V3_MAIN. The transceiver therefore defaults to standby while the MCU is reset, booting, or unpowered; firmware drives it low only after it is healthy and has configured FDCAN.
CAN wake capability	Retain the STB/RXD hardware capability, but V1 has no requirement for an incoming CAN frame to wake a sleeping ECU.
CANH / CANL	Route only through the defined protection/EMC network to the vehicle-I/O/CAN connector.

The TCAN1044AV-Q1 uses the 5 V rail for its bus driver and VIO for its 3.3 V logic interface. Its high-impedance unpowered behaviour is required so an unpowered ECU does not load a live vehicle bus. Galvanic isolation is not part of V1: all vehicle nodes require a defined common circuit reference.

Topology, termination, and service access

The vehicle wiring shall be one continuous linear trunk, with a physical bus endpoint at the rear and another at the front:

Editable diagram · PNG preview

The two segments shown above are trunk segments, not long stubs. The ECU transceiver joins the trunk locally on the PCB. Do not make the ECU a 0.5--1 m branch from a separate harness junction.

Fit one 120 ohm, 1 %, normally-open termination option across the ECU CAN_H and CAN_L pins, controlled by a clearly labelled solder jumper. It is populated only when the ECU is a physical endpoint. The two actual endpoints of the installed bus each require one 120 ohm terminator; the intended effective resistance measured across a de-energised, correctly terminated bus is approximately 60 ohm.

The debug/service connector joins the same bus and shall expose CAN_H, CAN_L, and CAN_0V. It shall not fit termination. Keep the on-board service branch very short and avoid a permanently attached, long unterminated service cable. A connected debug tool counts as a CAN node and must support the V1 CAN FD rates.

Harness reference and shielding

CAN_H and CAN_L shall be one dedicated twisted pair. A shared vehicle circuit return must provide a controlled common-mode reference between every node. Expose this return as CAN_0V at the ECU and service connectors. It may be the defined low-current vehicle power-return conductor where that conductor is continuous and sized for the connected nodes; it shall not be an ignition/injector/starter current-return path.

CAN_0V is an electrical reference, not a termination conductor and not a cable screen. No shield is required by the V1 2--2.5 m harness definition. Route the twisted pair away from ignition-primary/high-voltage wiring, injector switching loops, and high-current power pairs. If a long parallel route next to one of those sources becomes unavoidable, reassess the shield and common-mode filtering from measured EMC results rather than treating a screen as a substitute for a twisted pair or a reference conductor.

Connector protection and EMC provisions

Place a dual-channel, automotive-qualified, low-capacitance CAN/CAN-FD TVS device directly behind the vehicle-I/O/CAN connector. It protects CAN_H and CAN_L against connector ESD and assigned cable transients before they reach the transceiver. The final part shall be selected after the connector, enclosure, and transient environment are known. A suitable class of candidate is Nexperia PESD2CANFD24L-U; its final standoff, dynamic-clamp, capacitance, temperature, and qualification figures shall be checked against the completed system rather than inferred from the part label.

The primary TVS return shall have a short, low-inductance path to the defined connector-side CAN_0V/vehicle-reference return. It shall not dump cable transient current through the +3V3_MAIN or analogue-ground paths. The final PCB stack-up, connector shell, enclosure, and any frame bond must establish the actual high-frequency return path before this routing is frozen.

Provide an assembly-selectable common-mode-choke option between the connector-side protection network and the transceiver. The default V1 population is a direct/bypassed path, because the selected transceiver has strong EMC performance and an unnecessary choke can reduce signal margin. The PCB shall support a choke or its defined bypass arrangement without changing the differential-pair geometry. Fit and select a choke only if hardware EMC testing demonstrates a need.

Do not add arbitrary series resistance, split termination, or bus capacitance without a timing and EMC reason. Any such option must be evaluated against the 500 kbit/s / 2 Mbit/s bit timing and the final cable capacitance.

Layout requirements

1. Place the connector-side TVS at the connector entry and keep its return loop short and wide.
2. Route CAN_H and CAN_L as a symmetric differential pair through the protection/EMC network to the transceiver. Avoid stubs, unmatched component placements, and large asymmetry between the two paths.
3. Place the transceiver's 5 V and 3.3 V decoupling capacitors immediately at their respective supply pins, using the datasheet-recommended values and return paths.
4. Keep the transceiver and MCU-side logic traces clear of ignition, injector, switching-regulator, and high-current return loops.
5. Keep the termination jumper and resistor close to the local bus interface; label the assembly state and endpoint condition on the schematic and PCB.

Fault behaviour and validation

Firmware shall report CAN controller error state, error-passive state, bus-off, and transceiver standby state to diagnostics. Bus-off recovery and retry timing shall be deliberate and rate-limited; it must not cause a reset storm or repeatedly disturb the other MCU core. A lost CAN network is a telemetry/auxiliary-service failure, not an engine-permit event.

Before schematic freeze, validate the completed interface with the intended CAN FD configuration and installed harness:

1. Confirm CAN_H, CAN_L, and CAN_0V connector pins, endpoint locations, cable type, and real end-to-end length.
2. Confirm the selected STM32H747 package and FDCAN1 pin pair without conflicting with USB FS DFU, timers, ADC, debug, or required serial I/O.
3. Select and validate the final TVS against the connector ESD and transient environment, including its clamp at the transceiver pins and its return path.
4. Verify normal communication, ECU reset/boot standby behaviour, an unpowered ECU on a live bus, debug-tool connection, and correct 60 ohm termination measurement.
5. Test error handling and controlled bus-off recovery with a missing endpoint, open/shorted bus wires, and a deliberately disturbed node.
6. Test CAN operation and emissions/immunity with ignition and injector switching active. Populate and evaluate the common-mode choke only if the baseline routing/protection does not meet the assigned EMC target.