Module 4 — Electrical Schematics & Custom PCB Design

4.1 Scope

This module defines the electrical architecture, power tree, interface circuits, netlist, PCB layout requirements, GPIO maps, EMC/safety considerations, and bring-up test procedure for the Money Roll carrier board. It covers the dual-tier compute architecture (Raspberry Pi CM4 host + STM32F407VGT6 real-time controller) and all safety-critical subsystems: bill validator interface, cassette tamper/dye-pack firing circuit, and tamper sensing. Component designators match hardware/bom.csv; the full net table is in hardware/netlist.md.

4.2 System Block Diagram

                                   +-------------------------------------------+
  24VDC IN (PS1: LRS-150-24)  --> | 24V PROTECTION: F1 5A, RV1 TVS, Q4 ideal-D |
                                   +---------------------+-----------------------+
                                                          |
        +-------------------------+--------------+-------+--------+-----------------+
        v                         v              v                v                 v
  U1 24V->12V buck         J21 24V dist    U24 BQ25792      U5 PFAIL comp     C22 10mF hold-up
  (fans, card dispenser)   (bill validator  (charges BT1     (24V divider)     (bulk cap bank)
        |                   solenoids)       2S 18650)             |
        v                                        |                 v
  U2 12V->5V buck  <----------------------- BATT_SYS_OUT     PFAIL GPIO --> U16 (STM32) + U6 (CM4)
        |
        v
  U3 5V->3.3V buck --> 3V3_RAIL (logic, MCU, sensors, isolators)

  =========================== HOST TIER (Linux) ===========================
  U6 CM4104032 (J2/J3 100-pin B2B)
   |-- USB2.0 --> U7 USB2514B hub --+-- J4 Card dispenser (USB2553 port sw + ESD)
   |                                +-- J5 Hybrid card reader
   |                                +-- J6 Touchscreen controller (internal)
   |                                +-- J7 External ruggedized keypad
   |-- Gigabit Ethernet --> J8 RJ45 w/ integrated magnetics (HanRun HR911105A)
   |-- DSI/HDMI --> J13 FPC --> U14 LCD driver board --> 10.1in touchscreen panel
   |                              U15 GT911 touch controller (I2C, via J6)
   |-- mini-PCIe --> J9 4G LTE modem, J10 SIM, U13 sequenced power, J11/J12 antennas
   |-- UART (3.3V, 115200) <----------------------------------------------+
   |-- GPIO_ARM_ENABLE / GPIO_HANDSHAKE_ACK  <-----------------------+    |
                                                                      |    |
  ========================= REAL-TIME TIER (Bare metal) ==============|====|=====
  U16 STM32F407VGT6                                                   |    |
   |-- UART2 (isolated) --> U17 ADuM1201 --> U19 MAX3232 --> J16 Bill validator
   |-- GPIO open-collector --> Q1 --> J17 ccTalk alt. bus
   |-- SPI --> U26 LSM6DSO IMU (tamper/shock)
   |-- GPIO --> SW2-SW5 chassis tamper switches, SW6 cassette door switch
   |-- GPIO --> U25 EE-SX671 beam-break sensor
   |-- I2C --> U27 TMP1075 temperature, U4 DS3231 RTC (shared bus with CM4 via level match)
   |-- ARM/FIRE chain --> SW1 key switch -> K1 relay -> Q2 P-MOSFET -> J18 dye-pack/squib
   |-- Independent watchdog U23 gates FIRE_EN
   +-- SWD debug J15

4.3 Power Tree

4.3.1 Topology

PS1 (LRS-150-24, 24V/6.5A, 156W) --> J1 --> F1(5A) --> RV1(TVS) --> Q4(reverse-polarity ideal diode)
   --24V_PROT-->  U1 LMR33630 (24V->12V, up to 3A)         --> 12V_RAIL: card dispenser, fans (J20), K1 coil
   --24V_PROT-->  U2 TPS54560 (12V-derived path shown separately below for CM4 5V)
   --24V_PROT-->  J21 direct 24V distribution: bill validator solenoids, cassette lock motor (J22)
   --24V_PROT-->  U24 BQ25792 charger --> BT1 (2x 18650, 2S, 7.4V nominal) --> Q2 FIRE circuit supply
12V_RAIL --> U2 TPS54560 (12V->5V @5A) --> 5V_RAIL: CM4 (U6), touchscreen (U14/U15), USB hub (U7)
5V_RAIL  --> U3 TPS62133 (5V->3.3V @3A) --> 3V3_RAIL: STM32 (U16), sensors, isolators logic side
5V_RAIL  --> U18 B0505S isolated DC-DC --> 5V_ISO: bill validator isolated interface (U17, U19)

4.3.2 Per-rail current budget

4.3.3 Protection

4.3.4 RTC and power-loss detection (hold-up for orderly shutdown)

                24V_PROT
                   |
             +-----+-----+          PFAIL_SENSE
             |  R divider |------------+
             +-----+-----+             |
                   |                   v
                  GND            U5 LM393 comparator (Vref from 3V3_RAIL/R2 divider)
                                        |
                                    PFAIL (open-drain, pulled up to 3V3)
                                    /            \
                          U16 STM32 EXTI34    U6 CM4 GPIO39
                                        |
                         C22: 5x 2200uF (10mF) bulk bank on 24V_PROT
                         holds bus above U1/U2 UVLO for >= 500 ms after
                         PS1 removal, giving CM4 time to sync filesystem
                         and cleanly unmount eMMC before 5V collapses.

  U4 DS3231 RTC: VCC=3V3_RTC, VBAT=C21 (0.47F EDLC) charged through internal
  trickle diode. Maintains time-of-day through outages up to ~10 days.
  CM4 also retains its own hardware RTC backup via VBAT header (optional,
  not populated on rev A carrier; DS3231 is primary time source over I2C).

4.4 Interface Circuits

4.4.1 (a) Optoisolated bill validator UART (TTL/RS-232)

STM32 UART2                 U17 ADuM1201 (isolator)              U19 MAX3232          J16 Bill Validator
TX (3V3) --[R6 100R]--> VIA1 >>>isolation barrier>>> VOA1 -----> T1IN --> T1OUT ------> pin3 BV_TXD
RX (3V3) <----------------- VOB1 <<<isolation barrier<<< VIB1 <-- R1OUT <-- R1IN <------ pin4 BV_RXD
3V3_RAIL --> U17 pin1 (VDD1)         5V_ISO (from U18) --> U17 pin8 (VDD2), U19 pin16 (VCC)
GND --> U17 pin5 (GND1)              GND_ISO --> U17 pin5(iso side)/U19 pin15
                                      U18 B0505S: pin1=5V_RAIL in, pin2=GND, pin3=5V_ISO out, pin4=GND_ISO
                                      (creepage >= 2mm maintained across U17/U18 isolation slot, see 4.6)
For ID-003 TTL-only validators: bypass U19, tap UART_BV_TX_ISO_OUT / UART_BV_RX_ISO_IN
directly to J16 pins 3/4 at 3.3V TTL levels (U19 stuffed only for RS-232 variants).

4.4.2 (b) ccTalk single-wire open-collector alternative

                 5V (CCTALK_5V, external pull-up in validator)
                        |
                       [R3 1k]
                        |
STM32 GPIO -->[R3 1k]-- Q1 (BC847, base) 
                        |
   CCTALK_BUS <---------+---- collector (open collector to bus)
                        |
                       GND (emitter)
J17 pin1=CCTALK_5V, pin2=CCTALK_BUS, pin3=CCTALK_GND, pin4=shield
Bus is wire-ORed; STM32 reads bus state on a separate input GPIO (not shown,
shares CCTALK_BUS net) with Schmitt-trigger input enabled.

4.4.3 (c) Dye-pack tamper circuit — two-stage arm/fire

STAGE 1 - MECHANICAL ARM (service technician key):
  ARM_KEY_IN --SW1(key switch)--> K1 coil driven by STM32 ARM_LATCH_COIL (GPIO + flyback diode)
  K1 contacts (NO) close only when: key inserted+turned AND STM32 commands latch (software AND)

STAGE 2 - ELECTRONIC FIRE (STM32-gated, watchdog-supervised):
  ARM_LATCH_OUT (from K1 NO contact) --> Q2 (AOD417 P-MOSFET) source
  U20 (TC4427A) gate driver drives Q2 gate from FIRE_GATE, enabled by FIRE_EN (STM32 GPIO)
  U20 driver itself is inhibited by U23 independent watchdog (WDT_OUT_INHIBIT) --
  if STM32 firmware hangs, WDT_OUT_INHIBIT forces FIRE_GATE high (Q2 OFF) within 1.6s.
  Q2 drain --> FIRE_LOAD --> J18 --> squib/solenoid --> FIRE_RETURN --> D6 flyback + RV2 TVS
  For pyrotechnic squib: U21 (LM317 as constant-current) + R4 (1.2R) sets 1.00A firing pulse
  (limited to 200ms via STM32 timer). Continuity checked pre-arm with 1mA test current through
  R6, sensed by U22 comparator/ADC on FIRE_CONT_ADC (STM32 ADC1_IN0) — confirms squib bridge
  wire intact (typically 1-2 ohm) before allowing ARM state.
  Firing supply is BATT_SYS_OUT (from BT1 via U24), NOT the 24V mains-derived rail, so cutting
  building power does not disarm or prevent firing.

Safety interlock table:

| Interlock | Signal | Condition to allow FIRE | Failure mode |
|---|---|---|---|
| Mechanical key | SW1 | Technician key present and turned | Open = cannot arm |
| Software arm | GPIO_ARM_ENABLE (CM4->STM32 handshake) | Host confirms cassette full/removal event | Absent = ARM latch not energized |
| Relay latch | K1 | Both above true simultaneously (hardware AND, not software-only) | De-energized = FIRE_GATE cannot reach Q2 |
| Watchdog | U23 | STM32 main loop kicking IWDG and U23 within window | Timeout = forces Q2 off, logs event |
| Continuity | U22 / FIRE_CONT_ADC | Squib resistance in 0.8-3.0 ohm window | Out of range = ARM refused, alarm raised |
| Door switch | SW6 | Cassette door closed | Open = fire inhibited, treated as extraction in progress (different response path) |
| Battery present | BT1 via U24 PG pin | Battery voltage > 6.0V (2S) | Below threshold = fire inhibited, maintenance alert |

Independent watchdog: U23 TPS3813K33 runs from a separate RC timing network unrelated to the
STM32 core clock; it is not reset by the same code path as the STM32 internal IWDG, providing
two independent watchdog domains for the fire-enable chain.

4.4.4 (d) Tamper sensor inputs

Chassis micro-switches (SW2-SW5, Omron D2F-01L), normally-closed loop:
  3V3_RAIL --[R5 10k pull-up]-- TAMPER_SW_n --SW_n(NC)-- GND
  RC debounce: C5 100nF from TAMPER_SW_n to GND, tau = R5*C5 = 1ms; firmware applies
  additional 20ms majority-vote software debounce (5 samples at 4ms).

Optical beam break (U25, Omron EE-SX671), slotted photointerrupter across cassette slide rail:
  BEAM_BREAK_5V --> U25 emitter anode (through internal 330R), collector output
  BEAM_BREAK_SIG pulled up 10k to 3V3, open when beam is broken (object/tamper present).
  Firmware requires beam state to correlate with expected bill-transport timing window;
  break outside expected window flags tamper.

IMU (U26, LSM6DSO) over SPI1 (SCK/MISO/MOSI/CS as in netlist section 14):
  Configured for 6.66 kHz accel ODR, +-16g range, high-pass filtered wake-on-motion
  interrupt (IMU_INT1) wired to STM32 EXTI9, used to detect drilling/prying vibration
  signatures independent of door/chassis switches. Firmware runs an RMS-over-window
  vibration classifier; sustained > 2g RMS for > 200ms raises a tamper event.

4.4.5 (e) USB 2.0 hub with per-port power switching and ESD

U6 CM4 USB2.0 host --> U7 USB2514B (4-port hub)
  Port1 --> U8 TPS2553 (ILIM=1.5A) --> D2 USBLC6-2SC6 --> J4 (card dispenser)
  Port2 --> U9 TPS2553                --> D3 USBLC6-2SC6 --> J5 (hybrid card reader)
  Port3 --> U10 TPS2553               --> D4 USBLC6-2SC6 --> J6 (touchscreen controller, internal)
  Port4 --> U11 TPS2553               --> D5 USBLC6-2SC6 --> J7 (external ruggedized keypad)
Each TPS2553: ILIM resistor sets 1.5A current limit, FLT# open-drain fault flag routed to
U7 hub OVERCURRENT pins for per-port fault reporting to the CM4 USB stack.
D2-D5 placed within 5mm of connector shells with short, direct GND return to chassis stitch.

4.4.6 (f) Ethernet magnetics and 4G modem power sequencing

J8 (HanRun HR911105A) integrates 1:1 magnetics + common-mode choke + bob-bias resistors
internally; CM4 RGMII PHY drives TXP/TXN/RXP/RXN differential pairs directly to J8, 100 ohm
differential trace impedance, length-matched to +-5 mils within each pair.

4G modem sequencing (J9 mini-PCIe):
  Power-up sequence: 3V3_RAIL stable -> t=0
    t=0ms    : U13 TPS22919 EN held low (modem unpowered)
    t=50ms   : STM32 asserts MODEM_EN high once 3V3 and 5V rails confirmed good
    t=50-55ms: U13 ramps MODEM_3V8_SW with controlled slew (internal soft-start)
    t=200ms  : modem asserts its own PWRGD; CM4 begins USB enumeration over J9 pins 34/36
    t>=1500ms: modem control interface (AT/QMI) available to CM4 for network registration
  This sequencing avoids inrush on the shared 5V_RAIL when CM4, touchscreen, and modem
  all power up simultaneously at mains-return.

4.5 Netlist Summary

Full text netlist: hardware/netlist.md (121 named nets across 17 functional blocks). Key nets:

KiCad-style excerpt (isolation and firing circuits):

(net (code 100) (name "UART_BV_TX_ISO") (node (ref U16) (pin 45)) (node (ref U17) (pin 2)))
(net (code 101) (name "UART_BV_RX_ISO") (node (ref U16) (pin 46)) (node (ref U17) (pin 3)))
(net (code 103) (name "5V_ISO") (node (ref U18) (pin 3)) (node (ref U17) (pin 8)) (node (ref U19) (pin 16)))
(net (code 122) (name "ARM_LATCH_OUT") (node (ref K1) (pin 3)) (node (ref Q2) (pin 1)))
(net (code 123) (name "FIRE_GATE") (node (ref U20) (pin 6)) (node (ref Q2) (pin 1)))
(net (code 125) (name "FIRE_LOAD") (node (ref Q2) (pin 3)) (node (ref D6) (pin 2)) (node (ref RV2) (pin 1)) (node (ref J18) (pin 1)))

See hardware/netlist.md for the complete, block-organized listing.

4.6 PCB Layout Requirements

4.6.1 Connector placement table

4.7 GPIO Maps

4.7.1 STM32F407VGT6

4.7.2 CM4 (Raspberry Pi Compute Module 4) GPIO map

4.8 EMC and Safety Considerations

4.9 Bring-Up Test Procedure

Test sign-off requires all 18 steps passed and logged with unit serial number before the carrier board is released to final assembly.