Drogheda/03-Architecture-Hardware/watchdog-electrical-design-state.md

276 lines
20 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

---
title: Watchdog v3 — Electrical Design State & Assumptions
tags: [project-drogheda, hardware, watchdog, electrical, assumptions, canonical]
project: Project Drogheda
author: Helgen CTO
date: 2026-07-02
status: Active — CANONICAL current electrical state (read this first)
---
# HBOX Watchdog v3 — Electrical Design State & Assumptions
> **Read this to get the electrical context.** It is the single source of truth for the
> *current* state of the watchdog electrical design — power tree, pin map, the decisions made
> and why, the bug fixes, what is in the schematic vs. still pending, the prototype approach,
> and the open items. Supersedes scattered notes. Links: [[watchdog-pcb-v3-design|design doc]] ·
> [[BOM-master|production BOM]] · `kicad/hbox-watchdog-v3.kicad_sch` (schematic).
---
## 0. Status (2026-06-24)
KiCad schematic `03-Architecture-Hardware/kicad/hbox-watchdog-v3.kicad_sch` — **ERC = 0 errors**
(only cosmetic off-grid + one `Q_NPN_BCE` symbol-cache warning). Authored via the KiCad MCP;
renders to PDF/SVG (`kicad-cli` PATH fixed in `claude_desktop_config.json`).
**In the schematic NOW:** MCU (Blackpill J1/J2), MAIN5V/3V3 rails, 24 V reverse-polarity protect
(Q10 + 15 V Zener DzG), RTK-stack load switch (Q1/Q5), three sense dividers, **on-board DFR1015
ignition conditioning**, fan driver + dedicated fan buck (U2), I²C temp sensors (SHT40 0x44 +
TMP102 0x48), status LED, **reset (SW1 on-board + P10 external)**, **4-LED battery gauge**,
output connectors, PWR_FLAGs.
**Designed but NOT yet wired (next pass):** the **battery-backup power section** (LTC4040 block
+ battery connector + NTC + the P2→MAIN5V re-route) and the **power-cutoff switch**. The LTC4040's
detailed switching reference circuit (symbol, inductor, program resistors sized to the real pack)
is a dedicated power-design pass — *not fabricated blind*.
## 0b. Update (2026-07-02) — DEV/PROD split + PCB push
- **File split (2026-06-25):** `kicad/hbox-watchdog-v3.kicad_sch` = **DEV/proto** (module buck,
no battery; reviewed: ERC 0 err, GNDREF→GND unified, 5V_SENSE re-wired) ·
`kicad/hbox-watchdog-v3-PROD.kicad_sch` = **PRODUCTION** (Blocks A discrete MP1584 buck /
C reset / D gauge BUILT, ERC 0 err). Build spec = [[watchdog-production-schematic-delta]].
**H1 SWD dropped** (USB-C flash/log path; optional DNP 4-pad).
- **Pack Ah confirmed ~12 Ah (2026-06-30)** → LTC4040 pass unblocked. **2026-07-02: Blocks
B (LTC4040) + E (cutoff) + F (PA4→VEH5V) + new Block H (fail-safe UART2 bypass) being wired
on PROD; PCB layout kickoff follows.** Sized values live in the delta doc §4.
- **Latest proto-assumptions ledger** = `Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx`
(sheet *Estado y cambios*) + `Drogheda_Guia-Conexion-Protoboard_ES_v3.0.pdf` (source:
`Guia-Conexion-Protoboard/`; **v3.0 2026-07-08** adds the visual parts catalog
`modulos-pinout.tex`, the Bloque 9 XBee 2.0 mm→2.54 mm bridge with modem VCC = 3.3 V from
SAL, and the missing IOREF→3V3 rows). Wiring diagrams: `circuitikz-wiring/` (sheet + Beamer,
v2.1 2026-07-03; XBee-socket label fixed 5 V→3.3 V on 2026-07-08). 4G sourcing:
`2026-07-08_Drogheda_4G-Modem-Alternatives_v1.0.md`.
- **New this pass:** analog **NTC→PB1** hot-spot temperature (block 11 — no SHT40 in hand for
the proto, so PB1 is the proto's temperature path); **Modo B** NTRIP diagnostic (watchdog
in-line on the uplink, injects `$PHLG`; RTCM3 downlink stays direct); on the PCB a
**normally-closed relay bypass** on the Modo-B uplink guarantees a dead/absent MCU never cuts
corrections (extends invariant #2/#3).
- **Proto sensor suite realigned to parts in hand (2026-07-03).** No SHT40 (long lead) →
**AHT10** (0x38 fixed, 3V3 **only**, must be **alone** on I²C1 — Aosong restriction) takes
Block 6; **LM35 → PA7** (ADC1_IN7, the last free ADC channel; 5 V supply) joins NTC→PB1 in
Block 11 → **triple temperature** (I²C + 2 ADC, three technologies), humidity = AHT10 only.
SHT40 + TMP102 stay **PCB-only** (PROD schematic untouched). The kit's TP4056 module **does
not expose the TEMP pin** → its NTC is unused on proto; instead **PA8 (`CHRG_RUN`) gates the
TP4056 IN+** via 2N3904 + IRF9540N (10 k pull-up): **PA8 HIGH = charge, MCU absent = NO
charge** — *inverted vs PROD `CHRG_EN`* (flag in firmware), and the safe default given the
proto has no hardware NTC guard. **Cutoff switch finally wired:** nodo SYS (OR-diode merge)
→ SPST switch → MAIN5V rail (= PROD Block E / P11; kills vehicle **and** battery). Caps on
hand: 100 nF cer + 10 µF/100 µF elec. Fan confirmed 2-wire (PB10 DNP unchanged). Docs:
ledger xlsx (new *Estado* rows) · Guía **v2.2** · circuitikz **v2.1** · both proto BOMs.
- **CARRIER-BOARD conversion (2026-07-02 PM, Leo's call):** the PROD board hosts **all three
modules on female headers** — Blackpill (J1/J2), **simpleRTK2B Pro as an Arduino-UNO shield**
(MOD1, `Module:Arduino_UNO_R3` pattern) and the **4G NTRIP Master on an on-board XBee socket**
(J7/J8, 2 mm, rows 22.35 mm). Board **120×100 mm**. New Block K: second MP1584 makes
**3V3_MODEM** (the Pro-class XBee socket is **3.3 V @ 1 A/1.5 A pk — not 5 V**) from **SW_5V**,
so the stack power-cycle also reboots the modem. Modo B + K1 NC bypass = the permanent uplink
path; F9P's own XBee socket stays empty (its switch parks on UART1); P3/P13/H3 = DNP harness
alternatives. Details + MOD1 pin map: delta doc **§5d/§5e**.
---
## 1. Power tree (current intent)
```
Cabinet 24 V ─GX16─► Mean Well SD-15B-05 (24→5 V) ─► MAIN5V (board logic rail)
├─► Blackpill 5V (J1/20, J2/18) → 3V3 (on-module LDO)
├─► Load switch (Q5 NPN → Q1 P-FET) → SW_5V → RTK stack
└─► [PLANNED] LTC4040 backup ↔ 1S4P cell; boosts to 5 V on power loss
Cabinet 24 V ─GX16─► Q10 rev-pol P-FET (IRFR5305 + DzG 15 V Zener) ─► U2 fan buck (MP1584; proto = LM2596 module set to 5.0 V) → 5V_FAN → fan
Machine ignition (12–24 V) ─GX16 pin 3─► DFR1015 (ON-BOARD, →5 V) ─► Rig 100 Ω ─► D5 BAT54 clamp→3V3 / C9 ─► PA5
[PLANNED] cutoff switch in series with SYS_5V (downstream of the battery merge) → kills vehicle + battery
```
- **MAIN5V** is the board logic rail. With the LTC4040 inserted, `P2` (vehicle 5 V) feeds the
LTC4040 input and the LTC4040 output feeds MAIN5V (so MAIN5V is the *backed-up* rail).
- **Corrections ride the 4G modem**, not the GNSS — recover a dead link by power-cycling the stack.
- **Power-off is the safe state**: the RTK stack defaults OFF (gate pull-up) until the MCU asserts.
---
## 2. Pin map — STM32F411 Blackpill (current)
J1 = header P1, J2 = header P2. SWD (PA13/PA14) is **not** on the 2×20 → flash via USB.
| Pin | Net | Function | Notes |
|---|---|---|---|
| PA0 | `BAT_SENSE` | ADC ÷2 from battery+ | also feeds the gauge logic |
| PA1 | `PWR_CTRL` | RTK-stack load-switch enable | HIGH = stack ON |
| PA2 / PA3 | `GNSS_TX/RX` | USART2 ↔ F9P UART | NMEA |
| PA4 | `5V_SENSE` | ADC ÷2, vehicle 5 V present | — |
| PA5 | `IGN_SENSE` | **digital** `INPUT_PULLDOWN` | from DFR1015 via Rig + D5 clamp — **NO ÷2** (Finding 2) |
| PA6 | `FAN_PWM` | 25 kHz fan PWM | TIM3_CH1 |
| PA7 | `LM35_TEMP` | **[PROTO 2026-07-03]** analog temp #2, ADC1_IN7 | LM35 @5 V, 10 mV/°C (≤1.5 V) — air/board; last free ADC channel |
| PA8 | `CHRG_EN` / `CHRG_RUN` | PROD: LTC4040 charge disable (→ U6 CHGOFF) · PROTO: gates TP4056 IN+ (Q via 2N3904+IRF9540N) | **PROD:** HIGH = charge OFF; 100 k pull-down = charge enabled if MCU absent (NTC still guards). **PROTO (2026-07-03): INVERTED** — HIGH = charge ON; MCU absent = no charge (module has no TEMP pin → no hardware guard). Firmware flag |
| PA9 / PA10 | `USART1` — Modo B uplink | PA10 ← F9P TX2 (monitor tap) · PA9 → relay NO → 4G DIN | injects `$PHLG`; RTCM3 downlink never passes through the MCU |
| PB0 | `EXT_LED` | status LED (low-side) | **FIXED 2026-06-24** (was disconnected) |
| PB1 | `NTC_TEMP` | analog hot-spot temp, ADC1_IN9 | 3V3–10k(1 %)–NTC 10k–GND ÷ + 100 nF; Beta≈3950/Steinhart in firmware; contact sensor at the hot spot — one of the proto's **three** temp paths (with AHT10 + LM35); can drive the charge cutoff |
| PB3 | `CHRG_STAT` | **[PROD]** U6 CHRG open-drain | 100 k pull-up to 3V3; LOW = charging (>C/8) |
| PB4 | `CHRG_FAULT` | **[PROD]** U6 FAULT open-drain | 100 k pull-up to 3V3; LOW = temp/bad-battery fault |
| PB5 | `BYP_CTRL` | **[PROD]** Modo-B bypass relay driver | HIGH = energize K1 → MCU in-line; de-energized/absent = NC = corrections direct |
| PB6 / PB7 | `I2C1 SCL/SDA` | PCB: SHT40 (0x44) + TMP102 (0x48) · **PROTO: AHT10 (0x38, T+RH) ALONE on the bus** (Aosong restriction; 3V3 only) | 4.7 k pull-ups |
| PB10 | `FAN_TACH` | *(2-wire fan: tach unused)* | fans are **2-wire 5 V** → **DNP provision**; fan-fault inferred from temp |
| PB12–PB15 | `BATLED1–4` | **[NEW]** battery gauge bar | firmware-driven from `BAT_SENSE`, 330 Ω + LED each |
| PC13 | onboard LED | — | WeAct module |
| NRST | `NRST` | **[NEW]** reset | SW1 (on-board) + P10 (external), both → GND |
---
## 3. Decisions made this session (2026-06-24) + rationale
1. **DFR1015 folded ON-BOARD** (was an external module). **GX16 pin 3 now carries RAW machine
ignition (12–24 V), not pre-conditioned 5 V.** The on-board DFR1015 (7.5–30 V in, 5 V out)
auto-handles 12 V *and* 24 V machines, drops the external-module dependency, and removes the
risk of 24 V reaching the 5 V-rated clamp. Nets: `IGN_24V` (P1/3 → U5 VIN), `IGN_5V`
(U5 VOUT → Rig). **Harness implication: feed raw ignition to GX16 pin 3 — not 5 V.**
2. **Ignition sense topology (confirmed, Finding 2):** PA5 is a *digital* input. Path =
DFR1015 5 V → `Rig 100 Ω` series → `IGN_SENSE` → `D5 BAT54` clamp to 3V3 + `C9 100 nF` → PA5.
**No ÷2 divider** (a divider drops the logic-high below V_IH).
3. **Battery backup RE-ADDED** — reverses the old "battery dropped / vehicle-only" (Finding 3).
Real trackers carry a cell; we want runtime on a parked machine. Pack = **18650 1S4P**
(Hyvel FG-0889, 3.6 V). Charger = **LTC4040** (1S Li-ion/LiFePO4 *battery-backup manager*:
switching reverse-buck charger + power-path + 2.5 A boost to 5 V backup + **NTC**). **Safety
lever:** NTC on the cell **+** the Blackpill gates charge (`CHRG_EN`) off when TMP102 reads the
cell hot — this directly answers the RCA's #1 failure (hot Li-ion swelling/ignition). The
charge voltage jumper-selects Li-ion *or* LiFePO4, so a future chemistry change is config, not
redesign. **LTC4040 is 1S-only → sufficient for 1S4P.** (Rejected: supercap = last-gasp only;
BQ24074 + boost = cheap/available but no LiFePO4 path, linear charge heat.)
4. **Reset** — on-board button **SW1** + external connector **P10**, both pull `NRST` → GND.
5. **Battery gauge** — 4 LEDs (D_BAT1–4 = 25/50/75/100 %) on PB12–PB15 via 330 Ω, firmware-driven
from `BAT_SENSE` (no gauge IC; reuses spare GPIOs).
6. **Power cutoff** *(planned)* — external switch in series with the **system 5 V** (downstream of
the battery merge) so it kills vehicle **and** battery power.
## 3b. Decisions 2026-07-01/02 + rationale
7. **Block 11 — analog NTC→PB1 hot-spot temperature.** Divider 3V3 – 10 k (1 %) – NTC 10 k – GND
→ PB1 (ADC1_IN9) + 100 nF. ≈1.65 V @25 °C, ≈165 µA (no self-heating). Firmware: Beta (≈3950) /
Steinhart; may trigger the `CHRG_EN` charge cutoff. **Place the NTC at the hot spot
(battery/modem), not in the air.** No SHT40 in hand for the proto → this is the proto's
temperature path; the PCB keeps U3/U4 (I²C) *and* the PB1 channel.
8. **Battery NTC goes to the charger's TEMP/NTC pin** (TP4056 on proto / LTC4040 on PCB),
**not to the MCU** — hardware-qualified charging stays alive even with the MCU dead. The MCU's
view of cell temperature is the TMP102 (I²C) + PB1.
9. **Modo B — NTRIP diagnostic (relé + `$PHLG`).** 4G on a breakout (BOB-08276), F9P switch → UART1;
uplink F9P TX2 → PA10 (monitor) and PA9 → 4G DIN (MCU in-line, injects `$PHLG`); **RTCM3
downlink 4G DOUT → F9P RX2 stays direct** (never through the MCU). IOREF = 3.3 V.
10. **Block H — fail-safe uplink bypass (PROD).** SPDT **signal relay K1, normally-closed**
contacts route F9P TX2 → 4G DIN with the coil de-energized; the MCU must actively energize
(PB5 `BYP_CTRL` → Q6) to insert itself. Chosen over an analog mux because a mux dies with the
3V3 rail — a *relay* keeps corrections flowing even with the Blackpill physically absent.
Extends invariants #2/#3 to the diagnostic path.
11. **Charge voltage = 4.00 V Li-ion** (F2=1, F1=0, F0=1 via solder jumpers). Backup duty means the
cell sits full most of its life; 4.00 V ≈ 3× cycle life vs 4.2 V (datasheet Fig. 1) and is
kinder to hot cells — directly serves the RCA #1 failure mode. LiFePO4 future = re-strap F2.
12. **OVP module skipped** — VIN is the SD-15B-05's regulated 5 V inside the same cabinet;
`OVSNS` shorts to VIN per datasheet. The 24 V side already carries SPD + reverse protection.
---
## 4. Bug fixes this session
- **EXT_LED disconnect (real):** J1/14 (PB0) was not on the `EXT_LED` net — a wire ran *through*
the pin without terminating, so the MCU couldn't drive the status LED. Fixed →
`EXT_LED` = J1/14 · Rled · Q4 gate.
- **Panel-LED short:** a stray wire bridged `P8` pin 1↔pin 2 (anode↔cathode of the external status
LED). Deleted → `LED_A`/`LED_K` clean.
- **Ground unified:** 4 stray `power:GNDREF` symbols (added during arrangement) → `power:GND`
(left as-is they'd have renamed the whole ground net to `GNDREF`). One `GND` net now.
- Schematic grid-snapped to 1.27 mm; symbol fields (Footprint/Datasheet/Description) hidden so only
Reference + Value show.
---
## 5. Prototype approach (3 boards, easy-to-find parts)
- BOMs: `watchdog-protoboard-BOM-3boards.xlsx` (engineering, ≈ MXN 5,341) and
`watchdog-LISTA-DE-COMPRAS-ES.xlsx` (plain-Spanish shop list for a non-expert buyer).
- **Battery backup on proto = module stand-in:** **TP4056** charger + **MT3608** boost + 2× 1N5819
OR-ing — reproduces charge / power-loss→backup / `BAT_SENSE`. **The PCB uses the LTC4040.**
The kit's TP4056 module **has no TEMP pin** (2026-07-03) → the 10 k charger-NTC is unused on
proto; instead the *temperature-qualified charge cutoff* **is now testable in hardware**:
`CHRG_RUN` (PA8) switches the TP4056 IN+ via 2N3904 + IRF9540N, driven from the triple temp
suite (AHT10 + LM35→PA7 + NTC→PB1). Polarity is **inverted vs the LTC4040's CHGOFF** — firmware flag.
- **GNSS + 4G: one F9P + 4G set, shared** across the three watchdog boards (the watchdog logic,
sensing, fan/temp, gauge, reset, cutoff and backup all test without them).
- **Proto fan rail = LM2596 module** (24→5 V, *adjust to 5.0 V with a meter*) so fan inrush never
sags MAIN5V; the PCB uses the discrete MP1584 (U2). Fans are **2-wire** (no tach).
- **Assembly references:** `Drogheda_Guia-Conexion-Protoboard_ES_v3.0.pdf` (blocks 1–11, source in
`Guia-Conexion-Protoboard/`) · `Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx` (authoritative
connection list) · `circuitikz-wiring/` diagrams v2.1 (sheet + per-block Beamer).
---
## 6. Key assumptions / invariants (electrical)
- Backup pack is **1S4P, 3.6 V nominal, ~12 Ah** (NOT 3S). The "40 Ah" label was a **mistake —
corrected 2026-06-30 to ~12 Ah** (≈3 Ah × 4 cells). Sizes the LTC4040 charge current (2.5 A max ≈ C/5) + safety timer.
- **GX16 pin 3 = raw machine ignition (12–24 V)** into the on-board DFR1015 (changed this session).
- **MAIN5V** = board logic rail (from SD-15B-05; backed up via the LTC4040 path once wired).
- Corrections ride the **4G modem** → recover the link by power-cycling the stack, never a GNSS reset.
- **Power-off is the safe state**; the load switch defaults OFF until the MCU asserts confidence.
- **Enclosure is ASA** (not PLA); the thermal liability is the **power components** (battery/boost/
modem), not the case. v3.0 thermal = **waterproof duct + Blackpill smart fan** (active managed).
- No material softening < ~80 °C in the thermal path.
- **The battery NTC belongs to the charger** (TEMP/NTC pin), never to the MCU — **on the PCB**
(LTC4040). On the **proto** the TP4056 module exposes no TEMP pin, so the MCU does the
qualification via `CHRG_RUN` (PA8), reading **AHT10 (I²C) + LM35→PA7 + NTC→PB1** — triple
temperature, three independent paths; humidity = AHT10 only.
- **Corrections must survive a dead MCU** on every path — in Modo B that means the K1
normally-closed bypass (Block H); the RTCM3 downlink is always direct.
---
## 7. Open items / TODO (electrical)
- [~] **Wire the battery-backup section** (Block B) on PROD: LTC4040 (U6) + battery connector
(BAT+, BAT−, NTC) + the `P2 → VEH5V → LTC4040 → MAIN5V` re-route + `CHRG_EN`/`CHRG_STAT`/
`CHRG_FAULT` to the MCU — **in progress 2026-07-02** (values sized, see delta §4).
- [~] **Power-cutoff switch** (Block E, P11 MAIN5V→SYS5V) — in progress 2026-07-02.
- [~] **Block H bypass relay** (K1 NC + Q6 + P13) — in progress 2026-07-02.
- [x] ~~LTC4040 detailed reference design~~ → **sized 2026-07-02** to the 12 Ah pack: RPROG 825 Ω
(2.42 A ≈ C/5), RS 8 mΩ (3.1 A input limit), PFI 287k/100k (trip 4.60 V), BSTFB=RSTFB
499k/100k (backup 4.79 V, RST −7.5 %), L 2.2 µH ≥8 A, NTC 10 k bias, F=4.00 V Li-ion.
**Bench-validate before fab** (unchanged gate).
- [x] ~~Confirm the real pack capacity~~ → **~12 Ah** (1S4P, ~3 Ah/cell); the "40 Ah" label was wrong (2026-06-30).
- [ ] **Firmware**: gauge-LED driver (PB12–15 from `BAT_SENSE`); cut-charge-when-hot logic —
**proto = `CHRG_RUN` (PA8, HIGH = charge, INVERTED vs PROD `CHRG_EN`) from the triple temp
suite**; **AHT10 driver (0x38, T+RH, replaces SHT40 0x44 on proto)**; **LM35 channel PA7
(10 mV/°C)**; **PB1 NTC Beta/Steinhart channel**; `CHRG_STAT`/`CHRG_FAULT` into the STREAM
log; **deep-discharge note:** full recharge of 12 Ah @2.42 A ≈ 5 h exceeds the LTC4040's
internal safety timer — restart the cycle via `CHRG_EN` toggle while cell is cool and
`BAT_SENSE` low; Modo B `$PHLG` injection + `BYP_CTRL` handling; reset is hardware-only.
- [ ] **Fans are 2-wire 5 V (no tach)** (2026-06-24): drop the PB10 tach health check in firmware
and **infer fan-fault from temperature** (PWM commanded high but temp still climbing → fault);
keep PB10 + the tach pull-up as a **DNP provision** for future 3-wire fans. Optional: a fan
current-sense resistor gives positive stall detection without a tach.
- [ ] Cosmetic: position the new parts on-grid (clears off-grid warnings).
- [ ] **PCB layout** (kickoff 2026-07-02): outline/stackup per [[watchdog-pcb-v3-kicad-guide]],
SW nodes (U2, U6) tiny + away from P3; exposed-pad GND stitching; JLCPCB exports.
---
## 8. Pointers
- **Schematics:** `kicad/hbox-watchdog-v3.kicad_sch` (**DEV/proto**) ·
`kicad/hbox-watchdog-v3-PROD.kicad_sch` (**PRODUCTION**, + `.kicad_pcb`) · `Drogheda-sym.kicad_sym`.
- **Build spec (PROD Δ):** [[watchdog-production-schematic-delta]] — Block B values table lives here.
- **Design doc:** [[watchdog-pcb-v3-design]] (sub-circuits, pin map, findings).
- **Connections:** `Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx` (proto, authoritative) ·
`watchdog-connections.xlsx` (PCB list, H1 rows now DNP) + [[watchdog-connections-rationale]].
- **Assembly guide:** `Guia-Conexion-Protoboard/` (source) → `Drogheda_Guia-Conexion-Protoboard_ES_v3.0.pdf`.
- **Diagrams:** `circuitikz-wiring/` — full sheet + per-block Beamer (v2, 2026-07-02, blocks 1–11).
- **BOMs:** [[BOM-master]] (production) · `watchdog-protoboard-BOM-3boards.xlsx` +
`watchdog-LISTA-DE-COMPRAS-ES.xlsx` (proto) · [[watchdog-protoboard-bringup]] (bench order).
- **Firmware:** `04-Source-Code/firmware/blackpillrtkcode_v2/` (v2.3) + `docs/PINOUT.md`, `docs/LOGGING-SPEC.md`.