263 lines
13 KiB
Markdown
263 lines
13 KiB
Markdown
# NeoECU V1 Initial Functional I/O Architecture
|
||
|
||
## Purpose
|
||
|
||
This document records the initial functional I/O architecture for NeoECU V1.
|
||
It builds on [the power architecture](POWER_ARCHITECTURE.md) and defines the
|
||
required interface classes, analogue-channel allocation, and intended signal
|
||
conditioning. It is not a schematic or component-selection document; exact
|
||
parts, resistor values, pin assignments, connector allocation, and final I/O
|
||
quantities remain to be confirmed.
|
||
|
||
The initial ECU controls a single-cylinder four-stroke engine with one
|
||
injector, one dual-ended dumb ignition coil, crank and cam Hall sensors,
|
||
temperature and pressure sensors, and an external starter switch.
|
||
|
||
## I/O Summary
|
||
|
||
| Interface | V1 allocation | Functional intent |
|
||
| --- | ---: | --- |
|
||
| Crank trigger input | 1 | 12 V active-low Hall, timer capture |
|
||
| Cam trigger input | 1 | 12 V active-low Hall, timer capture |
|
||
| Deadman input | 1 | Shared 5 V signal from parallel steering-wheel switches; dedicated hardware engine-permit path |
|
||
| Thermistor inputs | 4 | Air, oil, water, and one spare temperature input |
|
||
| General analogue inputs | 9 | Protected 0-5 V sensor channels |
|
||
| ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` |
|
||
| Ignition output | 1 | Dedicated coil low-side driver |
|
||
| Injector output | 1 | Dedicated injector low-side driver |
|
||
| Generic digital inputs | Provisionally 6 | Protected 5 V / 12 V compatible inputs |
|
||
| Generic logic outputs | Provisionally 4 | Protected 5 V logic outputs |
|
||
| Generic sink outputs | Provisionally 4 | Protected low-side outputs |
|
||
| Analogue outputs | Reserve 2 MCU/output paths | Future 0-5 V output capability; not a V1 requirement |
|
||
|
||
The provisional generic digital I/O counts are planning values, not a frozen
|
||
connector or pin budget. CAN and its physical layer are intentionally outside
|
||
the scope of this document.
|
||
|
||
## Power-Domain Rules
|
||
|
||
- `+5V_MAIN` is the primary internal regulated 5 V rail. It supplies internal
|
||
5 V circuitry and is the upstream rail for `+5V_AUX` and `+5V_SENS`; it is
|
||
not connected directly to external harness loads.
|
||
- `+5V_SENS` is exclusively for sensor excitation and thermistor pull-ups.
|
||
It is never used to power generic peripherals or output loads.
|
||
- `+5V_AUX` powers external 5 V logic-level output circuitry. It is separately
|
||
protected so an external fault cannot disturb sensor excitation.
|
||
- `+12V_SENS` is the regulated buck-boost Hall/12 V sensor supply. It is kept
|
||
separate from arbitrary digital output loads.
|
||
- `VBAT_PROT` supplies the ignition, injector, and protected low-side output
|
||
branches. It is the 12 V-class source for general load-driving interfaces.
|
||
- High-current ignition, injector, and load-driver returns remain separate
|
||
from the sensor and MCU returns until their deliberate join at the power
|
||
entry region.
|
||
|
||
## Engine-Position Inputs
|
||
|
||
Crank and cam are dedicated timer-capture inputs, not generic digital inputs.
|
||
The V1 timing pattern remains two crank pulses per revolution and one cam pulse
|
||
per 720-degree cycle. Their interface, harness/shield termination, protection,
|
||
conditioning, and hardware/firmware glitch-rejection requirements are defined
|
||
in [ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md).
|
||
|
||
## Analogue Inputs
|
||
|
||
### ADC allocation
|
||
|
||
The STM32H747 provides three ADC peripherals. ADC1 and ADC2 share most of the
|
||
external analogue-pin pool, so they increase concurrent conversion capacity
|
||
rather than doubling the number of physical sensor pins. The proposed V1
|
||
allocation occupies 16 conditioned ADC channels:
|
||
|
||
| Conditioned ADC input class | Channels |
|
||
| --- | ---: |
|
||
| Thermistors | 4 |
|
||
| General 0–5 V inputs | 9 |
|
||
| `VBAT_PROT` sense | 1 |
|
||
| `+5V_SENS` sense | 1 |
|
||
| `+12V_SENS` sense | 1 |
|
||
| **Total** | **16** |
|
||
|
||
This leaves meaningful MCU ADC and pin margin, but the final STM32 package and
|
||
pin assignment must reserve all analogue pins alongside timer, CAN, debug,
|
||
I2C, and optional DAC requirements. In particular, PA4 and PA5 should remain
|
||
available if the two internal DAC outputs are to be retained for future
|
||
analogue outputs.
|
||
|
||
### Thermistor channels
|
||
|
||
Each thermistor channel is excited from `+5V_SENS` using a precision pull-up.
|
||
The input is attenuated and filtered before the ADC; this remains required
|
||
because an open thermistor drives the node towards 5 V. Firmware calculates the
|
||
thermistor resistance from the ratio of its ADC result to the `+5V_SENS` ADC
|
||
result, then applies the calibration map for the selected sensor.
|
||
|
||
|
||
|
||
The pull-up value is selected from the actual NTC curve and required
|
||
temperature range, balancing resolution against self-heating. The attenuation
|
||
network should be high impedance enough that it does not materially load the
|
||
thermistor divider; the ADC sample time and local input capacitor must then be
|
||
chosen to achieve settling. The initial Bosch 2.5 kOhm NTC population is a
|
||
3.01 kOhm precision pull-up; 10.0 kOhm and 30.1 kOhm alternatives are reserved
|
||
only for confirmed sensor curves. See
|
||
[ANALOG_INPUTS.md](IO_MODULES/ANALOG_INPUTS.md) for the detailed architecture.
|
||
|
||
### General 0-5 V channels
|
||
|
||
General analogue inputs support conventional 0.5-4.5 V and 0-5 V automotive
|
||
sensors. Each includes connector protection, attenuation, and an ADC-local
|
||
filter capacitor. A nominal attenuation ratio near 0.55 maps a 5.25 V sensor
|
||
signal to about 2.9 V at an ADC referenced by `+3V3_ANA`.
|
||
|
||
General analogue inputs are passive. Their dividers, filter capacitors, and ADC
|
||
acquisition time must be selected together to meet source-impedance and
|
||
settling requirements. A genuinely high-impedance or special-purpose sensor
|
||
requires a dedicated front end rather than altering the generic channel.
|
||
|
||
`+5V_SENS` is measured through an equivalent matched divider/filter path and
|
||
sampled near each ratiometric sensor channel. Firmware uses the ratio of the
|
||
sensor and supply readings to cancel sensor-supply and ADC-reference variation.
|
||
|
||
## Battery and Rail Measurements
|
||
|
||
`VBAT_PROT` is measured by a protected, scaled direct ADC channel. This is the
|
||
deterministic engine-control measurement used for battery-voltage dwell and
|
||
injector compensation. The M7 should receive a DMA-updated, filtered value and
|
||
snapshot it immediately before scheduling a dwell event.
|
||
|
||
Voltage/current monitor ICs may monitor the regulated rails for telemetry and
|
||
diagnostics. They are not the sole engine-control voltage source. In
|
||
particular, no whole-ECU current shunt is placed in series with `VBAT_PROT`;
|
||
coil and injector pulse currents would waste power and make that measurement
|
||
less useful. Upstream protection is provided by the input fuse/e-fuse and
|
||
local protection is provided by the ignition and injector driver stages.
|
||
|
||
## Generic Digital Inputs
|
||
|
||
Generic digital inputs accept externally driven 5 V through `VBAT_PROT`
|
||
active-high signals, with software-configurable reported polarity. They are
|
||
not intended for crank or cam capture. The detailed interface, including
|
||
fail-safe ECU-off behavior, external hysteresis, optional wetting/pull-down
|
||
footprints, and harness protection, is defined in
|
||
[DIGITAL_INPUTS.md](IO_MODULES/DIGITAL_INPUTS.md).
|
||
|
||
The generic input front end uses fail-safe, 40 V-capable open-drain
|
||
comparators powered by `+3V3_MAIN`, with thresholds derived from `+5V_MAIN`.
|
||
The input is protected at the connector and cannot back-power the ECU when an
|
||
external source drives it while the ECU is unpowered. The final transient
|
||
protection, threshold, hysteresis, filter, and bias values remain pending the
|
||
actual harness and input-function requirements.
|
||
|
||
## Deadman Engine-Permit Interlock
|
||
|
||
The steering wheel has two normally-open switches connected in parallel.
|
||
Holding either switch asserts one shared active-high 5 V `DEADMAN_IN` signal
|
||
into the ECU; both must be released to deassert it. The ECU uses one dedicated
|
||
signal pin, protection/filter network, default-low bias and conditioning path,
|
||
separate from generic digital inputs.
|
||
|
||
The conditioned 5 V `DEADMAN_OK` signal feeds the hardware permission gate.
|
||
One protected 3.3 V `DEADMAN_STATUS` input lets the MCU observe the same combined
|
||
state. The MCU cannot identify which switch is held or compare their states.
|
||
|
||
|
||
|
||
|
||
|
||
`ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT`. The injector command is
|
||
`SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG`; the ignition driver
|
||
receives `SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)`. These paths remove
|
||
permission in hardware when the shared input goes low, independently of
|
||
firmware response. Driver bias networks must establish off/inhibited states
|
||
through power loss and MCU reset.
|
||
|
||
Both switches released, an open shared signal or loss of switch supply removes
|
||
permission through the default-low input. An open individual switch branch
|
||
leaves the other switch usable. A stuck-closed switch or a shared signal shorted
|
||
to the asserted source can keep permission asserted; this single-input
|
||
arrangement cannot detect those faults or per-switch disagreement.
|
||
|
||
Firmware clears pending injection and dwell schedules when `DEADMAN_STATUS`
|
||
deasserts. A test mode may assert `MCU_RUN_PERMIT`, but cannot bypass a low
|
||
physical deadman input; bench operation requires a deliberate external test
|
||
arrangement asserting the single shared signal. The detailed interface and
|
||
fault behavior are defined in [DEAD_MAN.md](IO_MODULES/DEAD_MAN.md).
|
||
|
||
## Outputs
|
||
|
||
### Ignition and injector
|
||
|
||
The ignition coil is supplied from `VBAT_PROT` and switched with a dedicated
|
||
automotive ignition driver or smart ignition IGBT. It requires controlled
|
||
primary flyback clamping, over-current and thermal protection, and fault
|
||
reporting. Firmware applies battery-voltage dwell compensation using the direct
|
||
`VBAT_PROT` ADC measurement; driver current limiting remains the safety
|
||
backstop.
|
||
|
||
The injector is supplied from `VBAT_PROT` and switched by a dedicated
|
||
automotive smart low-side driver. It requires inductive-load capability,
|
||
controlled turn-off clamping, current/thermal protection, and MCU-readable
|
||
open-load and short-circuit diagnostics. This assumes a conventional
|
||
high-impedance/saturated injector; a low-impedance injector requires a
|
||
peak-and-hold architecture.
|
||
|
||
### Generic digital outputs
|
||
|
||
All non-engine digital output connector functions are labelled generically and
|
||
assigned their vehicle role in firmware. For example, the starter-enable
|
||
function is mapped to a compatible generic output rather than having a
|
||
dedicated connector-only electrical architecture.
|
||
|
||
Two hardware classes remain necessary. Their selected architecture, default
|
||
state, diagnostic intent, connector protection, and remaining validation are
|
||
defined in [DIGITAL_OUTPUTS.md](IO_MODULES/DIGITAL_OUTPUTS.md).
|
||
|
||
- Generic logic outputs use `+5V_AUX`-supplied `TPS4H000-Q1` protected
|
||
high-side channels with a local output pull-down. They command external
|
||
electronic-control inputs and are limited to 100 mA per channel.
|
||
- Generic sink outputs use `VBAT_PROT`-supplied `TLE9104SH` protected low-side
|
||
channels. They command relays, solenoids, and external modules that provide
|
||
a pull-up.
|
||
|
||
Firmware configuration selects the output's vehicle role and active polarity,
|
||
but cannot make one electrical driver class behave as the other. A starter
|
||
enable can therefore use either a generic logic output or a generic sink output
|
||
only when the selected external starter switch accepts that interface.
|
||
|
||
### Analogue-output provision
|
||
|
||
Analogue output is not a V1 functional requirement. Reserve two MCU pins and
|
||
board footprints for future 0-5 V outputs. The intended future path is:
|
||
|
||
|
||
|
||
A true calibrated 0-5 V output may require an external 5 V-referenced DAC or
|
||
a suitably characterised buffer stage. A general 0-12 V analogue output is not
|
||
included unless a future peripheral explicitly requires it.
|
||
|
||
## Layout and Validation Priorities
|
||
|
||
- Keep trigger and ADC front ends physically separated from coil, injector,
|
||
switching-regulator, and high-current output nodes.
|
||
- Place protection at the connector, filtering/conditioning near the MCU side,
|
||
and avoid dumping input-fault energy into `+3V3_ANA`.
|
||
- Validate Hall glitch rejection with ignition active, including worst-case
|
||
dwell and spark events.
|
||
- Validate ADC noise, ratiometric accuracy, thermistor self-heating, and ADC
|
||
settling before freezing resistor networks or deciding whether the optional
|
||
analogue LDO is necessary.
|
||
|
||
## Open Items Before Schematic Freeze
|
||
|
||
1. Select Hall and thermistor part numbers, cable lengths, connectors, and
|
||
resulting pull-up/filter values.
|
||
2. Confirm ignition-coil and injector electrical data and select their driver
|
||
devices.
|
||
3. Freeze the generic digital I/O count, per-channel current ratings, and
|
||
connector allocation.
|
||
4. Select 5 V-tolerant, automotive-suitable comparators and input-protection
|
||
components for generic digital inputs.
|
||
5. Select the STM32H747 package and complete a pin assignment that preserves
|
||
all timer, ADC, optional DAC, debug, and communications resources.
|
||
6. Define CAN and other communications interfaces separately.
|