Robustness
During ASC 2018, the Controller Boards in the car were fairly robust and no significant issues were identified. However in the months after ASC and even during FSGP 2019, we observed multiple failed Controller Boards that had either:
- One or more pin on the MCU stopped working
- Regulator stopped working
- Can't flash or use the MCU
The suspected causes have been identified as:
- ESD/Improper handling
- Controller Boards have not always been kept in ESD protection bags
- Controller Boards are sometimes "hot plugged", which could cause damage if the ground contacts are not established first to make sure everything is at the same potential
- Electrical Overstress
- Potentially when we connect power to both the carrier board and the programmer?
In order to improve robustness, a few potential solutions are as follows
ESD Protection
ESD protection is usually done through either TVS diodes or series resistors + capacitors to limit the current. The downside of implementing these will both be cost and board space. Even with ESD diode arrays, it may be hard to fit everything onto the current Controller Board size.
More information: Protecting MCU I/O Lines from ESD and Other Transients
Power Rail Protection
We can potentially add a zener/TVS diode to clamp the 3V3 rail as well as the VBAT rail to prevent any high voltage transients from damaging any components connected to the rail. The diodes should be sized appropriately to handle a direct short between VBAT and 3V3 if possible.
Remove Ability to Power MCU from Programmer
One thing we can do to avoid potentially powering the Controller Board from two sources is to remove the ability to power the board through the programming header. A special board can be made for the firmware team that provides 3V3 through the mezzanine connector that's powered by a regulator off USB's 5V if needed. Doing this will force the board to be only powered through the mezzanine connector and not from anywhere else. This new "programming" board can also potentially be made to replace our ST-Link V2s to offer more functionalities if needed.
Make Mounting Holes Pads
On some more often removed Controller Boards, the area around where the M2.5 mounting screw heads are can be seen to be damaged from the screw heads. We can change the board to either make them plated pads for GND, or make them pads with all the copper removed so they're exposed FR-4.
Potential Changes
Some potential features that we can add to our controller boards to make life easier in the future include:
Pass CAN through the Mezzanine
Currently, PB6/PB7 which is used for UART is passed through the mezzanine connector. We could potentially remap these to CAN high and CAN low in the future. Doing this will allow us to use M12 or similar connectors on our carrier boards for VBAT/GND and CAN. This can allow us to reduce the number of wires/crimps needed to improve reliability, and shielded cables can also be used to improve EMC performances.
Care should be taken though to ensure backwards compatibility to our old carrier boards or make sure new controller boards aren't used with any boards that use PB6/PB7 as GPIOs.
Add a Common Mode Choke for CAN
To reduce emissions on CAN and improve the EMC performance, a common mode choke + capacitor filters can be added. The downside of this is both the LC can create unwanted resonants, and during a fault on CAN (short to VBAT/GND), the inductance can create larger voltage spikes that can be damaging.
TI Claims that its automotive line of CAN transceivers can meet EMC requirements without a common mode choke, so they may be a viable option for MSXIV. One issue with the majority of AEC-Q CAN transceivers is that they require a 5V supply even if they're designed to work with 3V3 logic.
TI Application Note: Simplify CAN bus implementations with chokeless transceivers
Add Switchable Termination for CAN
Revision 7 of the Controller Boards introduced on-board termination using 2x 62R resistors and a capacitor. If wanted, we can potentially add a MOSFET or photorelay to create switchable termination resistors. The main use case will be during validation and testing, where the firmware can choose to have termination enabled or disabled in the configuration settings.
The downside of switchable termination will mostly be at the amount of board space needed and losing a GPIO pin that could've been used for carrier boards.
TI Reference Design: TIDA-01238: Controller Area Network (CAN) with Selectable Termination Reference Design