Drogheda/03-Architecture-Hardware/watchdog-electrical-design-state.md

---
title: Watchdog v3 — Electrical Design State & Assumptions
tags: [project-drogheda, hardware, watchdog, electrical, assumptions, canonical]
project: Project Drogheda
author: Helgen CTO
date: 2026-07-02
status: Active — CANONICAL current electrical state (read this first)
---

# HBOX Watchdog v3 — Electrical Design State & Assumptions

> **Read this to get the electrical context.** It is the single source of truth for the
> *current* state of the watchdog electrical design — power tree, pin map, the decisions made
> and why, the bug fixes, what is in the schematic vs. still pending, the prototype approach,
> and the open items. Supersedes scattered notes. Links: [[watchdog-pcb-v3-design|design doc]] ·
> [[BOM-master|production BOM]] · `kicad/hbox-watchdog-v3.kicad_sch` (schematic).

---

## 0. Status (2026-06-24)

KiCad schematic `03-Architecture-Hardware/kicad/hbox-watchdog-v3.kicad_sch` — **ERC = 0 errors**
(only cosmetic off-grid + one `Q_NPN_BCE` symbol-cache warning). Authored via the KiCad MCP;
renders to PDF/SVG (`kicad-cli` PATH fixed in `claude_desktop_config.json`).

**In the schematic NOW:** MCU (Blackpill J1/J2), MAIN5V/3V3 rails, 24 V reverse-polarity protect
(Q10 + 15 V Zener DzG), RTK-stack load switch (Q1/Q5), three sense dividers, **on-board DFR1015
ignition conditioning**, fan driver + dedicated fan buck (U2), I²C temp sensors (SHT40 0x44 +
TMP102 0x48), status LED, **reset (SW1 on-board + P10 external)**, **4-LED battery gauge**,
output connectors, PWR_FLAGs.

**Designed but NOT yet wired (next pass):** the **battery-backup power section** (LTC4040 block
+ battery connector + NTC + the P2→MAIN5V re-route) and the **power-cutoff switch**. The LTC4040's
detailed switching reference circuit (symbol, inductor, program resistors sized to the real pack)
is a dedicated power-design pass — *not fabricated blind*.

## 0b. Update (2026-07-02) — DEV/PROD split + PCB push

- **File split (2026-06-25):** `kicad/hbox-watchdog-v3.kicad_sch` = **DEV/proto** (module buck,
  no battery; reviewed: ERC 0 err, GNDREF→GND unified, 5V_SENSE re-wired) ·
  `kicad/hbox-watchdog-v3-PROD.kicad_sch` = **PRODUCTION** (Blocks A discrete MP1584 buck /
  C reset / D gauge BUILT, ERC 0 err). Build spec = [[watchdog-production-schematic-delta]].
  **H1 SWD dropped** (USB-C flash/log path; optional DNP 4-pad).
- **Pack Ah confirmed ~12 Ah (2026-06-30)** → LTC4040 pass unblocked. **2026-07-02: Blocks
  B (LTC4040) + E (cutoff) + F (PA4→VEH5V) + new Block H (fail-safe UART2 bypass) being wired
  on PROD; PCB layout kickoff follows.** Sized values live in the delta doc §4.
- **Latest proto-assumptions ledger** = `Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx`
  (sheet *Estado y cambios*) + `Drogheda_Guia-Conexion-Protoboard_ES_v2.1.pdf` (source:
  `Guia-Conexion-Protoboard/`). Wiring diagrams: `circuitikz-wiring/` (sheet + Beamer, v2 2026-07-02).
- **New this pass:** analog **NTC→PB1** hot-spot temperature (block 11 — no SHT40 in hand for
  the proto, so PB1 is the proto's temperature path); **Modo B** NTRIP diagnostic (watchdog
  in-line on the uplink, injects `$PHLG`; RTCM3 downlink stays direct); on the PCB a
  **normally-closed relay bypass** on the Modo-B uplink guarantees a dead/absent MCU never cuts
  corrections (extends invariant #2/#3).
- **CARRIER-BOARD conversion (2026-07-02 PM, Leo's call):** the PROD board hosts **all three
  modules on female headers** — Blackpill (J1/J2), **simpleRTK2B Pro as an Arduino-UNO shield**
  (MOD1, `Module:Arduino_UNO_R3` pattern) and the **4G NTRIP Master on an on-board XBee socket**
  (J7/J8, 2 mm, rows 22.35 mm). Board **120×100 mm**. New Block K: second MP1584 makes
  **3V3_MODEM** (the Pro-class XBee socket is **3.3 V @ 1 A/1.5 A pk — not 5 V**) from **SW_5V**,
  so the stack power-cycle also reboots the modem. Modo B + K1 NC bypass = the permanent uplink
  path; F9P's own XBee socket stays empty (its switch parks on UART1); P3/P13/H3 = DNP harness
  alternatives. Details + MOD1 pin map: delta doc **§5d/§5e**.

---

## 1. Power tree (current intent)

```
Cabinet 24 V ─GX16─► Mean Well SD-15B-05 (24→5 V) ─► MAIN5V (board logic rail)
                                                      ├─► Blackpill 5V (J1/20, J2/18) → 3V3 (on-module LDO)
                                                      ├─► Load switch (Q5 NPN → Q1 P-FET) → SW_5V → RTK stack
                                                      └─► [PLANNED] LTC4040 backup ↔ 1S4P cell; boosts to 5 V on power loss
Cabinet 24 V ─GX16─► Q10 rev-pol P-FET (IRFR5305 + DzG 15 V Zener) ─► U2 fan buck (MP1584; proto = LM2596 module set to 5.0 V) → 5V_FAN → fan
Machine ignition (12–24 V) ─GX16 pin 3─► DFR1015 (ON-BOARD, →5 V) ─► Rig 100 Ω ─► D5 BAT54 clamp→3V3 / C9 ─► PA5
[PLANNED] cutoff switch in series with SYS_5V (downstream of the battery merge) → kills vehicle + battery
```

- **MAIN5V** is the board logic rail. With the LTC4040 inserted, `P2` (vehicle 5 V) feeds the
  LTC4040 input and the LTC4040 output feeds MAIN5V (so MAIN5V is the *backed-up* rail).
- **Corrections ride the 4G modem**, not the GNSS — recover a dead link by power-cycling the stack.
- **Power-off is the safe state**: the RTK stack defaults OFF (gate pull-up) until the MCU asserts.

---

## 2. Pin map — STM32F411 Blackpill (current)

J1 = header P1, J2 = header P2. SWD (PA13/PA14) is **not** on the 2×20 → flash via USB.

| Pin | Net | Function | Notes |
|---|---|---|---|
| PA0 | `BAT_SENSE` | ADC ÷2 from battery+ | also feeds the gauge logic |
| PA1 | `PWR_CTRL` | RTK-stack load-switch enable | HIGH = stack ON |
| PA2 / PA3 | `GNSS_TX/RX` | USART2 ↔ F9P UART | NMEA |
| PA4 | `5V_SENSE` | ADC ÷2, vehicle 5 V present | — |
| PA5 | `IGN_SENSE` | **digital** `INPUT_PULLDOWN` | from DFR1015 via Rig + D5 clamp — **NO ÷2** (Finding 2) |
| PA6 | `FAN_PWM` | 25 kHz fan PWM | TIM3_CH1 |
| PA8 | `CHRG_EN` | LTC4040 charge disable (→ U6 CHGOFF) | **[PROD 2026-07-02]** HIGH = charge OFF; 100 k pull-down = charge enabled if MCU absent (NTC still guards) |
| PA9 / PA10 | `USART1` — Modo B uplink | PA10 ← F9P TX2 (monitor tap) · PA9 → relay NO → 4G DIN | injects `$PHLG`; RTCM3 downlink never passes through the MCU |
| PB0 | `EXT_LED` | status LED (low-side) | **FIXED 2026-06-24** (was disconnected) |
| PB1 | `NTC_TEMP` | **[NEW]** analog hot-spot temp, ADC1_IN9 | 3V3–10k(1 %)–NTC 10k–GND ÷ + 100 nF; Beta≈3950/Steinhart in firmware; proto's temperature path (no SHT40 in hand); can drive the `CHRG_EN` cutoff |
| PB3 | `CHRG_STAT` | **[PROD]** U6 CHRG open-drain | 100 k pull-up to 3V3; LOW = charging (>C/8) |
| PB4 | `CHRG_FAULT` | **[PROD]** U6 FAULT open-drain | 100 k pull-up to 3V3; LOW = temp/bad-battery fault |
| PB5 | `BYP_CTRL` | **[PROD]** Modo-B bypass relay driver | HIGH = energize K1 → MCU in-line; de-energized/absent = NC = corrections direct |
| PB6 / PB7 | `I2C1 SCL/SDA` | SHT40 (0x44) + TMP102 (0x48) | 4.7 k pull-ups |
| PB10 | `FAN_TACH` | *(2-wire fan: tach unused)* | fans are **2-wire 5 V** → **DNP provision**; fan-fault inferred from temp |
| PB12–PB15 | `BATLED1–4` | **[NEW]** battery gauge bar | firmware-driven from `BAT_SENSE`, 330 Ω + LED each |
| PC13 | onboard LED | — | WeAct module |
| NRST | `NRST` | **[NEW]** reset | SW1 (on-board) + P10 (external), both → GND |

---

## 3. Decisions made this session (2026-06-24) + rationale

1. **DFR1015 folded ON-BOARD** (was an external module). **GX16 pin 3 now carries RAW machine
   ignition (12–24 V), not pre-conditioned 5 V.** The on-board DFR1015 (7.5–30 V in, 5 V out)
   auto-handles 12 V *and* 24 V machines, drops the external-module dependency, and removes the
   risk of 24 V reaching the 5 V-rated clamp. Nets: `IGN_24V` (P1/3 → U5 VIN), `IGN_5V`
   (U5 VOUT → Rig). **Harness implication: feed raw ignition to GX16 pin 3 — not 5 V.**
2. **Ignition sense topology (confirmed, Finding 2):** PA5 is a *digital* input. Path =
   DFR1015 5 V → `Rig 100 Ω` series → `IGN_SENSE` → `D5 BAT54` clamp to 3V3 + `C9 100 nF` → PA5.
   **No ÷2 divider** (a divider drops the logic-high below V_IH).
3. **Battery backup RE-ADDED** — reverses the old "battery dropped / vehicle-only" (Finding 3).
   Real trackers carry a cell; we want runtime on a parked machine. Pack = **18650 1S4P**
   (Hyvel FG-0889, 3.6 V). Charger = **LTC4040** (1S Li-ion/LiFePO4 *battery-backup manager*:
   switching reverse-buck charger + power-path + 2.5 A boost to 5 V backup + **NTC**). **Safety
   lever:** NTC on the cell **+** the Blackpill gates charge (`CHRG_EN`) off when TMP102 reads the
   cell hot — this directly answers the RCA's #1 failure (hot Li-ion swelling/ignition). The
   charge voltage jumper-selects Li-ion *or* LiFePO4, so a future chemistry change is config, not
   redesign. **LTC4040 is 1S-only → sufficient for 1S4P.** (Rejected: supercap = last-gasp only;
   BQ24074 + boost = cheap/available but no LiFePO4 path, linear charge heat.)
4. **Reset** — on-board button **SW1** + external connector **P10**, both pull `NRST` → GND.
5. **Battery gauge** — 4 LEDs (D_BAT1–4 = 25/50/75/100 %) on PB12–PB15 via 330 Ω, firmware-driven
   from `BAT_SENSE` (no gauge IC; reuses spare GPIOs).
6. **Power cutoff** *(planned)* — external switch in series with the **system 5 V** (downstream of
   the battery merge) so it kills vehicle **and** battery power.

## 3b. Decisions 2026-07-01/02 + rationale

7. **Block 11 — analog NTC→PB1 hot-spot temperature.** Divider 3V3 – 10 k (1 %) – NTC 10 k – GND
   → PB1 (ADC1_IN9) + 100 nF. ≈1.65 V @25 °C, ≈165 µA (no self-heating). Firmware: Beta (≈3950) /
   Steinhart; may trigger the `CHRG_EN` charge cutoff. **Place the NTC at the hot spot
   (battery/modem), not in the air.** No SHT40 in hand for the proto → this is the proto's
   temperature path; the PCB keeps U3/U4 (I²C) *and* the PB1 channel.
8. **Battery NTC goes to the charger's TEMP/NTC pin** (TP4056 on proto / LTC4040 on PCB),
   **not to the MCU** — hardware-qualified charging stays alive even with the MCU dead. The MCU's
   view of cell temperature is the TMP102 (I²C) + PB1.
9. **Modo B — NTRIP diagnostic (relé + `$PHLG`).** 4G on a breakout (BOB-08276), F9P switch → UART1;
   uplink F9P TX2 → PA10 (monitor) and PA9 → 4G DIN (MCU in-line, injects `$PHLG`); **RTCM3
   downlink 4G DOUT → F9P RX2 stays direct** (never through the MCU). IOREF = 3.3 V.
10. **Block H — fail-safe uplink bypass (PROD).** SPDT **signal relay K1, normally-closed**
    contacts route F9P TX2 → 4G DIN with the coil de-energized; the MCU must actively energize
    (PB5 `BYP_CTRL` → Q6) to insert itself. Chosen over an analog mux because a mux dies with the
    3V3 rail — a *relay* keeps corrections flowing even with the Blackpill physically absent.
    Extends invariants #2/#3 to the diagnostic path.
11. **Charge voltage = 4.00 V Li-ion** (F2=1, F1=0, F0=1 via solder jumpers). Backup duty means the
    cell sits full most of its life; 4.00 V ≈ 3× cycle life vs 4.2 V (datasheet Fig. 1) and is
    kinder to hot cells — directly serves the RCA #1 failure mode. LiFePO4 future = re-strap F2.
12. **OVP module skipped** — VIN is the SD-15B-05's regulated 5 V inside the same cabinet;
    `OVSNS` shorts to VIN per datasheet. The 24 V side already carries SPD + reverse protection.

---

## 4. Bug fixes this session

- **EXT_LED disconnect (real):** J1/14 (PB0) was not on the `EXT_LED` net — a wire ran *through*
  the pin without terminating, so the MCU couldn't drive the status LED. Fixed →
  `EXT_LED` = J1/14 · Rled · Q4 gate.
- **Panel-LED short:** a stray wire bridged `P8` pin 1↔pin 2 (anode↔cathode of the external status
  LED). Deleted → `LED_A`/`LED_K` clean.
- **Ground unified:** 4 stray `power:GNDREF` symbols (added during arrangement) → `power:GND`
  (left as-is they'd have renamed the whole ground net to `GNDREF`). One `GND` net now.
- Schematic grid-snapped to 1.27 mm; symbol fields (Footprint/Datasheet/Description) hidden so only
  Reference + Value show.

---

## 5. Prototype approach (3 boards, easy-to-find parts)

- BOMs: `watchdog-protoboard-BOM-3boards.xlsx` (engineering, ≈ MXN 5,341) and
  `watchdog-LISTA-DE-COMPRAS-ES.xlsx` (plain-Spanish shop list for a non-expert buyer).
- **Battery backup on proto = module stand-in:** **TP4056** charger + **MT3608** boost + 2× 1N5819
  OR-ing + 10 k NTC — reproduces charge / power-loss→backup / `BAT_SENSE` / cell-temp so the
  firmware is fully testable. **The PCB uses the LTC4040.** The one thing the proto can't test
  exactly is the *temperature-qualified charge cutoff* (LTC4040-only) — validate it in firmware logic.
- **GNSS + 4G: one F9P + 4G set, shared** across the three watchdog boards (the watchdog logic,
  sensing, fan/temp, gauge, reset, cutoff and backup all test without them).
- **Proto fan rail = LM2596 module** (24→5 V, *adjust to 5.0 V with a meter*) so fan inrush never
  sags MAIN5V; the PCB uses the discrete MP1584 (U2). Fans are **2-wire** (no tach).
- **Assembly references:** `Drogheda_Guia-Conexion-Protoboard_ES_v2.1.pdf` (blocks 1–11, source in
  `Guia-Conexion-Protoboard/`) · `Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx` (authoritative
  connection list) · `circuitikz-wiring/` diagrams (sheet + per-block Beamer).

---

## 6. Key assumptions / invariants (electrical)

- Backup pack is **1S4P, 3.6 V nominal, ~12 Ah** (NOT 3S). The "40 Ah" label was a **mistake —
  corrected 2026-06-30 to ~12 Ah** (≈3 Ah × 4 cells). Sizes the LTC4040 charge current (2.5 A max ≈ C/5) + safety timer.
- **GX16 pin 3 = raw machine ignition (12–24 V)** into the on-board DFR1015 (changed this session).
- **MAIN5V** = board logic rail (from SD-15B-05; backed up via the LTC4040 path once wired).
- Corrections ride the **4G modem** → recover the link by power-cycling the stack, never a GNSS reset.
- **Power-off is the safe state**; the load switch defaults OFF until the MCU asserts confidence.
- **Enclosure is ASA** (not PLA); the thermal liability is the **power components** (battery/boost/
  modem), not the case. v3.0 thermal = **waterproof duct + Blackpill smart fan** (active managed).
- No material softening < ~80 °C in the thermal path.
- **The battery NTC belongs to the charger** (TEMP/NTC pin), never to the MCU; MCU temperature
  view = TMP102 (I²C) + NTC→PB1 (ADC, hot spot).
- **Corrections must survive a dead MCU** on every path — in Modo B that means the K1
  normally-closed bypass (Block H); the RTCM3 downlink is always direct.

---

## 7. Open items / TODO (electrical)

- [~] **Wire the battery-backup section** (Block B) on PROD: LTC4040 (U6) + battery connector
      (BAT+, BAT−, NTC) + the `P2 → VEH5V → LTC4040 → MAIN5V` re-route + `CHRG_EN`/`CHRG_STAT`/
      `CHRG_FAULT` to the MCU — **in progress 2026-07-02** (values sized, see delta §4).
- [~] **Power-cutoff switch** (Block E, P11 MAIN5V→SYS5V) — in progress 2026-07-02.
- [~] **Block H bypass relay** (K1 NC + Q6 + P13) — in progress 2026-07-02.
- [x] ~~LTC4040 detailed reference design~~ → **sized 2026-07-02** to the 12 Ah pack: RPROG 825 Ω
      (2.42 A ≈ C/5), RS 8 mΩ (3.1 A input limit), PFI 287k/100k (trip 4.60 V), BSTFB=RSTFB
      499k/100k (backup 4.79 V, RST −7.5 %), L 2.2 µH ≥8 A, NTC 10 k bias, F=4.00 V Li-ion.
      **Bench-validate before fab** (unchanged gate).
- [x] ~~Confirm the real pack capacity~~ → **~12 Ah** (1S4P, ~3 Ah/cell); the "40 Ah" label was wrong (2026-06-30).
- [ ] **Firmware**: gauge-LED driver (PB12–15 from `BAT_SENSE`); `CHRG_EN` cut-charge-when-hot logic
      (TMP102 + PB1); **PB1 NTC Beta/Steinhart channel**; `CHRG_STAT`/`CHRG_FAULT` into the STREAM
      log; **deep-discharge note:** full recharge of 12 Ah @2.42 A ≈ 5 h exceeds the LTC4040's
      internal safety timer — restart the cycle via `CHRG_EN` toggle while cell is cool and
      `BAT_SENSE` low; Modo B `$PHLG` injection + `BYP_CTRL` handling; reset is hardware-only.
- [ ] **Fans are 2-wire 5 V (no tach)** (2026-06-24): drop the PB10 tach health check in firmware
      and **infer fan-fault from temperature** (PWM commanded high but temp still climbing → fault);
      keep PB10 + the tach pull-up as a **DNP provision** for future 3-wire fans. Optional: a fan
      current-sense resistor gives positive stall detection without a tach.
- [ ] Cosmetic: position the new parts on-grid (clears off-grid warnings).
- [ ] **PCB layout** (kickoff 2026-07-02): outline/stackup per [[watchdog-pcb-v3-kicad-guide]],
      SW nodes (U2, U6) tiny + away from P3; exposed-pad GND stitching; JLCPCB exports.

---

## 8. Pointers

- **Schematics:** `kicad/hbox-watchdog-v3.kicad_sch` (**DEV/proto**) ·
  `kicad/hbox-watchdog-v3-PROD.kicad_sch` (**PRODUCTION**, + `.kicad_pcb`) · `Drogheda-sym.kicad_sym`.
- **Build spec (PROD Δ):** [[watchdog-production-schematic-delta]] — Block B values table lives here.
- **Design doc:** [[watchdog-pcb-v3-design]] (sub-circuits, pin map, findings).
- **Connections:** `Drogheda_Conexiones-por-Bloque_Proto_v1.xlsx` (proto, authoritative) ·
  `watchdog-connections.xlsx` (PCB list, H1 rows now DNP) + [[watchdog-connections-rationale]].
- **Assembly guide:** `Guia-Conexion-Protoboard/` (source) → `Drogheda_Guia-Conexion-Protoboard_ES_v2.1.pdf`.
- **Diagrams:** `circuitikz-wiring/` — full sheet + per-block Beamer (v2, 2026-07-02, blocks 1–11).
- **BOMs:** [[BOM-master]] (production) · `watchdog-protoboard-BOM-3boards.xlsx` +
  `watchdog-LISTA-DE-COMPRAS-ES.xlsx` (proto) · [[watchdog-protoboard-bringup]] (bench order).
- **Firmware:** `04-Source-Code/firmware/blackpillrtkcode_v2/` (v2.3) + `docs/PINOUT.md`, `docs/LOGGING-SPEC.md`.