Drogheda/03-Architecture-Hardware/watchdog-electrical-design-state.md

title	tags	project	author	date	status
Watchdog v3 — Electrical Design State & Assumptions	project-drogheda hardware watchdog electrical assumptions canonical	Project Drogheda	Helgen CTO	2026-07-02	Active — CANONICAL current electrical state (read this first)

HBOX Watchdog v3 — Electrical Design State & Assumptions

Read this to get the electrical context. It is the single source of truth for the current state of the watchdog electrical design — power tree, pin map, the decisions made and why, the bug fixes, what is in the schematic vs. still pending, the prototype approach, and the open items. Supersedes scattered notes. Links: watchdog-pcb-v3-design · BOM-master · kicad/hbox-watchdog-v3.kicad_sch (schematic).

---

0. Status (2026-06-24)

KiCad schematic 03-Architecture-Hardware/kicad/hbox-watchdog-v3.kicad_sch — ERC = 0 errors (only cosmetic off-grid + one Q_NPN_BCE symbol-cache warning). Authored via the KiCad MCP; renders to PDF/SVG (kicad-cli PATH fixed in claude_desktop_config.json).

In the schematic NOW: MCU (Blackpill J1/J2), MAIN5V/3V3 rails, 24 V reverse-polarity protect (Q10 + 15 V Zener DzG), RTK-stack load switch (Q1/Q5), three sense dividers, on-board DFR1015 ignition conditioning, fan driver + dedicated fan buck (U2), I²C temp sensors (SHT40 0x44 + TMP102 0x48), status LED, reset (SW1 on-board + P10 external), 4-LED battery gauge, output connectors, PWR_FLAGs.

Designed but NOT yet wired (next pass): the battery-backup power section (LTC4040 block

• battery connector + NTC + the P2→MAIN5V re-route) and the power-cutoff switch. The LTC4040's detailed switching reference circuit (symbol, inductor, program resistors sized to the real pack) is a dedicated power-design pass — not fabricated blind.

0b. Update (2026-07-02) — DEV/PROD split + PCB push

• File split (2026-06-25): kicad/hbox-watchdog-v3.kicad_sch = DEV/proto (module buck, no battery; reviewed: ERC 0 err, GNDREF→GND unified, 5V_SENSE re-wired) · kicad/hbox-watchdog-v3-PROD.kicad_sch = PRODUCTION (Blocks A discrete MP1584 buck / C reset / D gauge BUILT, ERC 0 err). Build spec = watchdog-production-schematic-delta. H1 SWD dropped (USB-C flash/log path; optional DNP 4-pad).
• Pack Ah confirmed ~12 Ah (2026-06-30) → LTC4040 pass unblocked. 2026-07-02: Blocks B (LTC4040) + E (cutoff) + F (PA4→VEH5V) + new Block H (fail-safe UART2 bypass) being wired on PROD; PCB layout kickoff follows. Sized values live in the delta doc §4.
• Latest proto-assumptions ledger = Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx (sheet Estado y cambios) + Drogheda_Guia-Conexion-Protoboard_ES_v2.1.pdf (source: Guia-Conexion-Protoboard/). Wiring diagrams: circuitikz-wiring/ (sheet + Beamer, v2 2026-07-02).
• New this pass: analog NTC→PB1 hot-spot temperature (block 11 — no SHT40 in hand for the proto, so PB1 is the proto's temperature path); Modo B NTRIP diagnostic (watchdog in-line on the uplink, injects $PHLG; RTCM3 downlink stays direct); on the PCB a normally-closed relay bypass on the Modo-B uplink guarantees a dead/absent MCU never cuts corrections (extends invariant #2/#3).
• CARRIER-BOARD conversion (2026-07-02 PM, Leo's call): the PROD board hosts all three modules on female headers — Blackpill (J1/J2), simpleRTK2B Pro as an Arduino-UNO shield (MOD1, Module:Arduino_UNO_R3 pattern) and the 4G NTRIP Master on an on-board XBee socket (J7/J8, 2 mm, rows 22.35 mm). Board 120×100 mm. New Block K: second MP1584 makes 3V3_MODEM (the Pro-class XBee socket is 3.3 V @ 1 A/1.5 A pk — not 5 V) from SW_5V, so the stack power-cycle also reboots the modem. Modo B + K1 NC bypass = the permanent uplink path; F9P's own XBee socket stays empty (its switch parks on UART1); P3/P13/H3 = DNP harness alternatives. Details + MOD1 pin map: delta doc §5d/§5e.

---

1. Power tree (current intent)

Cabinet 24 V ─GX16─► Mean Well SD-15B-05 (24→5 V) ─► MAIN5V (board logic rail)
                                                      ├─► Blackpill 5V (J1/20, J2/18) → 3V3 (on-module LDO)
                                                      ├─► Load switch (Q5 NPN → Q1 P-FET) → SW_5V → RTK stack
                                                      └─► [PLANNED] LTC4040 backup ↔ 1S4P cell; boosts to 5 V on power loss
Cabinet 24 V ─GX16─► Q10 rev-pol P-FET (IRFR5305 + DzG 15 V Zener) ─► U2 fan buck (MP1584; proto = LM2596 module set to 5.0 V) → 5V_FAN → fan
Machine ignition (12–24 V) ─GX16 pin 3─► DFR1015 (ON-BOARD, →5 V) ─► Rig 100 Ω ─► D5 BAT54 clamp→3V3 / C9 ─► PA5
[PLANNED] cutoff switch in series with SYS_5V (downstream of the battery merge) → kills vehicle + battery

• MAIN5V is the board logic rail. With the LTC4040 inserted, P2 (vehicle 5 V) feeds the LTC4040 input and the LTC4040 output feeds MAIN5V (so MAIN5V is the backed-up rail).
• Corrections ride the 4G modem, not the GNSS — recover a dead link by power-cycling the stack.
• Power-off is the safe state: the RTK stack defaults OFF (gate pull-up) until the MCU asserts.

---

2. Pin map — STM32F411 Blackpill (current)

J1 = header P1, J2 = header P2. SWD (PA13/PA14) is not on the 2×20 → flash via USB.

Pin	Net	Function	Notes
PA0	BAT_SENSE	ADC ÷2 from battery+	also feeds the gauge logic
PA1	PWR_CTRL	RTK-stack load-switch enable	HIGH = stack ON
PA2 / PA3	GNSS_TX/RX	USART2 ↔ F9P UART	NMEA
PA4	5V_SENSE	ADC ÷2, vehicle 5 V present	—
PA5	IGN_SENSE	digital INPUT_PULLDOWN	from DFR1015 via Rig + D5 clamp — NO ÷2 (Finding 2)
PA6	FAN_PWM	25 kHz fan PWM	TIM3_CH1
PA8	CHRG_EN	LTC4040 charge disable (→ U6 CHGOFF)	[PROD 2026-07-02] HIGH = charge OFF; 100 k pull-down = charge enabled if MCU absent (NTC still guards)
PA9 / PA10	USART1 — Modo B uplink	PA10 ← F9P TX2 (monitor tap) · PA9 → relay NO → 4G DIN	injects $PHLG; RTCM3 downlink never passes through the MCU
PB0	EXT_LED	status LED (low-side)	FIXED 2026-06-24 (was disconnected)
PB1	NTC_TEMP	[NEW] analog hot-spot temp, ADC1_IN9	3V3–10k(1 %)–NTC 10k–GND ÷ + 100 nF; Beta≈3950/Steinhart in firmware; proto's temperature path (no SHT40 in hand); can drive the CHRG_EN cutoff
PB3	CHRG_STAT	[PROD] U6 CHRG open-drain	100 k pull-up to 3V3; LOW = charging (>C/8)
PB4	CHRG_FAULT	[PROD] U6 FAULT open-drain	100 k pull-up to 3V3; LOW = temp/bad-battery fault
PB5	BYP_CTRL	[PROD] Modo-B bypass relay driver	HIGH = energize K1 → MCU in-line; de-energized/absent = NC = corrections direct
PB6 / PB7	I2C1 SCL/SDA	SHT40 (0x44) + TMP102 (0x48)	4.7 k pull-ups
PB10	FAN_TACH	(2-wire fan: tach unused)	fans are 2-wire 5 V → DNP provision; fan-fault inferred from temp
PB12–PB15	BATLED1–4	[NEW] battery gauge bar	firmware-driven from BAT_SENSE, 330 Ω + LED each
PC13	onboard LED	—	WeAct module
NRST	NRST	[NEW] reset	SW1 (on-board) + P10 (external), both → GND

---

3. Decisions made this session (2026-06-24) + rationale

1. DFR1015 folded ON-BOARD (was an external module). GX16 pin 3 now carries RAW machine ignition (12–24 V), not pre-conditioned 5 V. The on-board DFR1015 (7.5–30 V in, 5 V out) auto-handles 12 V and 24 V machines, drops the external-module dependency, and removes the risk of 24 V reaching the 5 V-rated clamp. Nets: IGN_24V (P1/3 → U5 VIN), IGN_5V (U5 VOUT → Rig). Harness implication: feed raw ignition to GX16 pin 3 — not 5 V.
2. Ignition sense topology (confirmed, Finding 2): PA5 is a digital input. Path = DFR1015 5 V → Rig 100 Ω series → IGN_SENSE → D5 BAT54 clamp to 3V3 + C9 100 nF → PA5. No ÷2 divider (a divider drops the logic-high below V_IH).
3. Battery backup RE-ADDED — reverses the old "battery dropped / vehicle-only" (Finding 3). Real trackers carry a cell; we want runtime on a parked machine. Pack = 18650 1S4P (Hyvel FG-0889, 3.6 V). Charger = LTC4040 (1S Li-ion/LiFePO4 battery-backup manager: switching reverse-buck charger + power-path + 2.5 A boost to 5 V backup + NTC). Safety lever: NTC on the cell + the Blackpill gates charge (CHRG_EN) off when TMP102 reads the cell hot — this directly answers the RCA's #1 failure (hot Li-ion swelling/ignition). The charge voltage jumper-selects Li-ion or LiFePO4, so a future chemistry change is config, not redesign. LTC4040 is 1S-only → sufficient for 1S4P. (Rejected: supercap = last-gasp only; BQ24074 + boost = cheap/available but no LiFePO4 path, linear charge heat.)
4. Reset — on-board button SW1 + external connector P10, both pull NRST → GND.
5. Battery gauge — 4 LEDs (D_BAT1–4 = 25/50/75/100 %) on PB12–PB15 via 330 Ω, firmware-driven from BAT_SENSE (no gauge IC; reuses spare GPIOs).
6. Power cutoff (planned) — external switch in series with the system 5 V (downstream of the battery merge) so it kills vehicle and battery power.

3b. Decisions 2026-07-01/02 + rationale

7. Block 11 — analog NTC→PB1 hot-spot temperature. Divider 3V3 – 10 k (1 %) – NTC 10 k – GND → PB1 (ADC1_IN9) + 100 nF. ≈1.65 V @25 °C, ≈165 µA (no self-heating). Firmware: Beta (≈3950) / Steinhart; may trigger the CHRG_EN charge cutoff. Place the NTC at the hot spot (battery/modem), not in the air. No SHT40 in hand for the proto → this is the proto's temperature path; the PCB keeps U3/U4 (I²C) and the PB1 channel.
8. Battery NTC goes to the charger's TEMP/NTC pin (TP4056 on proto / LTC4040 on PCB), not to the MCU — hardware-qualified charging stays alive even with the MCU dead. The MCU's view of cell temperature is the TMP102 (I²C) + PB1.
9. Modo B — NTRIP diagnostic (relé + $PHLG). 4G on a breakout (BOB-08276), F9P switch → UART1; uplink F9P TX2 → PA10 (monitor) and PA9 → 4G DIN (MCU in-line, injects $PHLG); RTCM3 downlink 4G DOUT → F9P RX2 stays direct (never through the MCU). IOREF = 3.3 V.
10. Block H — fail-safe uplink bypass (PROD). SPDT signal relay K1, normally-closed contacts route F9P TX2 → 4G DIN with the coil de-energized; the MCU must actively energize (PB5 BYP_CTRL → Q6) to insert itself. Chosen over an analog mux because a mux dies with the 3V3 rail — a relay keeps corrections flowing even with the Blackpill physically absent. Extends invariants #2/#3 to the diagnostic path.
11. Charge voltage = 4.00 V Li-ion (F2=1, F1=0, F0=1 via solder jumpers). Backup duty means the cell sits full most of its life; 4.00 V ≈ 3× cycle life vs 4.2 V (datasheet Fig. 1) and is kinder to hot cells — directly serves the RCA #1 failure mode. LiFePO4 future = re-strap F2.
12. OVP module skipped — VIN is the SD-15B-05's regulated 5 V inside the same cabinet; OVSNS shorts to VIN per datasheet. The 24 V side already carries SPD + reverse protection.

---

4. Bug fixes this session

• EXT_LED disconnect (real): J1/14 (PB0) was not on the EXT_LED net — a wire ran through the pin without terminating, so the MCU couldn't drive the status LED. Fixed → EXT_LED = J1/14 · Rled · Q4 gate.
• Panel-LED short: a stray wire bridged P8 pin 1↔pin 2 (anode↔cathode of the external status LED). Deleted → LED_A/LED_K clean.
• Ground unified: 4 stray power:GNDREF symbols (added during arrangement) → power:GND (left as-is they'd have renamed the whole ground net to GNDREF). One GND net now.
• Schematic grid-snapped to 1.27 mm; symbol fields (Footprint/Datasheet/Description) hidden so only Reference + Value show.

---

5. Prototype approach (3 boards, easy-to-find parts)

• BOMs: watchdog-protoboard-BOM-3boards.xlsx (engineering, ≈ MXN 5,341) and watchdog-LISTA-DE-COMPRAS-ES.xlsx (plain-Spanish shop list for a non-expert buyer).
• Battery backup on proto = module stand-in: TP4056 charger + MT3608 boost + 2× 1N5819 OR-ing + 10 k NTC — reproduces charge / power-loss→backup / BAT_SENSE / cell-temp so the firmware is fully testable. The PCB uses the LTC4040. The one thing the proto can't test exactly is the temperature-qualified charge cutoff (LTC4040-only) — validate it in firmware logic.
• GNSS + 4G: one F9P + 4G set, shared across the three watchdog boards (the watchdog logic, sensing, fan/temp, gauge, reset, cutoff and backup all test without them).
• Proto fan rail = LM2596 module (24→5 V, adjust to 5.0 V with a meter) so fan inrush never sags MAIN5V; the PCB uses the discrete MP1584 (U2). Fans are 2-wire (no tach).
• Assembly references: Drogheda_Guia-Conexion-Protoboard_ES_v2.1.pdf (blocks 1–11, source in Guia-Conexion-Protoboard/) · Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx (authoritative connection list) · circuitikz-wiring/ diagrams (sheet + per-block Beamer).

---

6. Key assumptions / invariants (electrical)

• Backup pack is 1S4P, 3.6 V nominal, ~12 Ah (NOT 3S). The "40 Ah" label was a mistake — corrected 2026-06-30 to ~12 Ah (≈3 Ah × 4 cells). Sizes the LTC4040 charge current (2.5 A max ≈ C/5) + safety timer.
• GX16 pin 3 = raw machine ignition (12–24 V) into the on-board DFR1015 (changed this session).
• MAIN5V = board logic rail (from SD-15B-05; backed up via the LTC4040 path once wired).
• Corrections ride the 4G modem → recover the link by power-cycling the stack, never a GNSS reset.
• Power-off is the safe state; the load switch defaults OFF until the MCU asserts confidence.
• Enclosure is ASA (not PLA); the thermal liability is the power components (battery/boost/ modem), not the case. v3.0 thermal = waterproof duct + Blackpill smart fan (active managed).
• No material softening < ~80 °C in the thermal path.
• The battery NTC belongs to the charger (TEMP/NTC pin), never to the MCU; MCU temperature view = TMP102 (I²C) + NTC→PB1 (ADC, hot spot).
• Corrections must survive a dead MCU on every path — in Modo B that means the K1 normally-closed bypass (Block H); the RTCM3 downlink is always direct.

---

7. Open items / TODO (electrical)

• [~] Wire the battery-backup section (Block B) on PROD: LTC4040 (U6) + battery connector (BAT+, BAT−, NTC) + the P2 → VEH5V → LTC4040 → MAIN5V re-route + CHRG_EN/CHRG_STAT/ CHRG_FAULT to the MCU — in progress 2026-07-02 (values sized, see delta §4).
• [~] Power-cutoff switch (Block E, P11 MAIN5V→SYS5V) — in progress 2026-07-02.
• [~] Block H bypass relay (K1 NC + Q6 + P13) — in progress 2026-07-02.
• LTC4040 detailed reference design → sized 2026-07-02 to the 12 Ah pack: RPROG 825 Ω (2.42 A ≈ C/5), RS 8 mΩ (3.1 A input limit), PFI 287k/100k (trip 4.60 V), BSTFB=RSTFB 499k/100k (backup 4.79 V, RST −7.5 %), L 2.2 µH ≥8 A, NTC 10 k bias, F=4.00 V Li-ion. Bench-validate before fab (unchanged gate).
• Confirm the real pack capacity → ~12 Ah (1S4P, ~3 Ah/cell); the "40 Ah" label was wrong (2026-06-30).
• Firmware: gauge-LED driver (PB12–15 from BAT_SENSE); CHRG_EN cut-charge-when-hot logic (TMP102 + PB1); PB1 NTC Beta/Steinhart channel; CHRG_STAT/CHRG_FAULT into the STREAM log; deep-discharge note: full recharge of 12 Ah @2.42 A ≈ 5 h exceeds the LTC4040's internal safety timer — restart the cycle via CHRG_EN toggle while cell is cool and BAT_SENSE low; Modo B $PHLG injection + BYP_CTRL handling; reset is hardware-only.
• Fans are 2-wire 5 V (no tach) (2026-06-24): drop the PB10 tach health check in firmware and infer fan-fault from temperature (PWM commanded high but temp still climbing → fault); keep PB10 + the tach pull-up as a DNP provision for future 3-wire fans. Optional: a fan current-sense resistor gives positive stall detection without a tach.
• Cosmetic: position the new parts on-grid (clears off-grid warnings).
• PCB layout (kickoff 2026-07-02): outline/stackup per watchdog-pcb-v3-kicad-guide, SW nodes (U2, U6) tiny + away from P3; exposed-pad GND stitching; JLCPCB exports.

---

8. Pointers

• Schematics: kicad/hbox-watchdog-v3.kicad_sch (DEV/proto) · kicad/hbox-watchdog-v3-PROD.kicad_sch (PRODUCTION, + .kicad_pcb) · Drogheda-sym.kicad_sym.
• Build spec (PROD Δ): watchdog-production-schematic-delta — Block B values table lives here.
• Design doc: watchdog-pcb-v3-design (sub-circuits, pin map, findings).
• Connections: Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx (proto, authoritative) · watchdog-connections.xlsx (PCB list, H1 rows now DNP) + watchdog-connections-rationale.
• Assembly guide: Guia-Conexion-Protoboard/ (source) → Drogheda_Guia-Conexion-Protoboard_ES_v2.1.pdf.
• Diagrams: circuitikz-wiring/ — full sheet + per-block Beamer (v2, 2026-07-02, blocks 1–11).
• BOMs: BOM-master (production) · watchdog-protoboard-BOM-3boards.xlsx + watchdog-LISTA-DE-COMPRAS-ES.xlsx (proto) · watchdog-protoboard-bringup (bench order).
• Firmware: 04-Source-Code/firmware/blackpillrtkcode_v2/ (v2.3) + docs/PINOUT.md, docs/LOGGING-SPEC.md.