PCB 2 · Rev A

STM32 Industrial I/O Controller

Reads industrial sensors, switches real DC loads, drives a 0–10 V actuator and talks isolated RS-485 and CAN FD — with every energy output behind a hardware permission gate the firmware cannot bypass.

  • 140 × 100 mm
  • 4-layer
  • STM32G474VET6
  • 9–30 V DC
  • RS-485 + CAN FD
Discuss a board like thisSee the architecture
PCB 2 isolation-domain mapThe 140 by 100 millimetre board divided into domains. Main ground covers the input protection, high-side outputs, MCU, service power and analog front end. Separate islands hold the four digital inputs on the left edge, RS-485 and CAN FD on the right edge behind an 8 millimetre barrier, and the two relay contact sets on the top edge. Only isolators and isolated supplies straddle the barriers.MAIN_GNDeverything outside an islandInput protectionTVS · eFuse · FET4 × high-sideswitch + diodesService powerbuck · mux · ±analogMCU · logicSTM32G474VET6Analog front endADC · protectors · shunts · DACDI ×4DI_COMRS-485RS485_REFCAN FDCAN_REFK1COM·NO·NCK2COM·NO·NCG5Q · K1G5Q · K28 mm barrierisland gapDI barrierISO1410UCC12050ISO1042UCC12050ISO1212ISO1212USB-CSWDVINDO1–4 · RTNAI_V × 2 · AI_I × 2 · RTNAO20 mm · board 140 × 100 mm · simplified zoning, not a layout render
Main ground, and five islands that only an isolator, an isolated supply or a relay may cross.
  • 9–30 VDC operating input, 12/24 V nominal
  • 5isolated domains beyond main ground
  • 16-bitexternal ADC on four analog inputs
  • 12hierarchical schematic sheets
01I/O

What it connects to

  • 4×Digital inputsGroup-isolated on DI_COM. OFF ≤ 5 V, ON ≥ 9 V; DI1 counts a 20 kHz pulse train.2 × ISO1212
  • 2×0–10 V inputsSingle-ended, ≥ 500 kΩ, survive ±30 V miswire powered or not.ADS8684A · TMUX7462F
  • 2×4–20 mA inputs200 Ω Kelvin shunts, read to 25.6 mA so overrange still reports.ADS8684A · 0.05 % shunts
  • 1×0–10 V outputInto ≥ 10 kΩ, default-off disconnect, real headroom at zero volts.DAC80501Z · OPA197
  • 4×High-side outputs0.5 A each, all four at once. Current-limited, short latches off.TPS4H160B-Q1
  • 2×SPDT relaysDry COM / NO / NC contacts, each its own isolated circuit.G5Q-1 DC5
  • 1×RS-485Half-duplex Modbus RTU, 9.6–115.2 kbit/s, switchable 120 Ω termination.ISO1410 · own supply
  • 1×CAN FDClassic CAN at 500 kbit/s; FD at 2 Mbit/s data phase.ISO1042 · own supply
  • 1×USB-C + SWDUSB 2.0 full-speed service port and a keyed 10-pin Cortex debug header.TPS2121 power select
02Architecture

One MCU, five islands, one gate

Field wiring left and right, the STM32 in the middle, power across the top and the hardware permission along the bottom. Trace any path to see what it passes through.

Trace a pathSwipe the diagram sideways →
STM32 Industrial I/O Controller — system architectureA protected 9 to 30 volt input feeds the field rail and a 5 volt buck. Isolated digital inputs and fault-protected analog inputs feed an STM32G474 microcontroller, which drives isolated RS-485 and CAN FD, four high-side outputs, two relays and a 0 to 10 volt output. Every energy output passes a hardware permission gate fed by reset, watchdog and rail supervision.FIELD INFRONT ENDOUTPUT STAGESFIELD OUTTIMSPI5V_SYSI²CUSARTFDCANARMMCUSTM32G474VET6Cortex-M4 · LQFP100FDCAN · USB FS · timers9–30 V DCVIN+ · VIN−Input protectionfuse · TVS · FET · eFuseVFIELDprotected field rail5 V field buckLMR38020 → 5V_FIELDAux rails±analog · iso 5 VDI1–DI4DI_COMIsolated receivers2 × ISO1212AI × 40–10 V · 4–20 mAFault protectionTMUX7462F · filters15V_ANA16-bit ADCADS8684A · 1 kSPS/chADC_AVDDUSB-C · SWDservice · debugLogic power selectTPS2121 → 5V_SYS5V_FIELDConfig memory24LC64 · CRC · 2 copiesIsolated RS-485ISO1410 · Modbus RTU5V_RS485_ISOIsolated CAN FDISO1042 · 2 Mbit/s5V_CAN_ISO4 × high-sideTPS4H160B · 0.5 A eachVFIELD2 × SPDT relayG5Q-1 · dry contacts5V_FIELD0–10 V outputDAC80501Z → OPA197±ANAD+ · D−RS485_REFCAN_H · CAN_LCAN_REFDO1–DO4LOAD_RETURNCOM · NO · NC× 2, separateAO1AO_RETURNSupervisionreset · watchdog · railsOutput permissionall four must be trueisolation barrierhardware AND gaterail feeding the block

Pick a path to light it through the board — power, sensing, outputs, the isolated buses, or the hardware permission that sits in front of every energy output.

03Protection

No permission, no energy

Every terminal is designed for the day it is miswired. And firmware only decides what the outputs should do — hardware decides whether they may do anything at all, so a hung program or a debugger halt cannot drive a load.

  • −30 Vsupply connected backwards — designed to survive it
  • +40 Vovervoltage — clamp, disconnect, disarm the outputs
  • ±30 Von any analog terminal, 60 s, powered or not
  • ≈ 0.7 Aper-channel current limit — a short latches off
  • FIELD_VALIDRail window monitors
  • RESET_OKReset supervisor
  • WATCHDOG_OKTPS3431 external watchdog
  • ARMExplicit arm from the command owner
ANDIN HARDWARE
  • 4 × high-side inputsevery channel's command passes the gate
  • 2 × relay driverscoils stay dead without permission
  • AO disconnectalso needs FIELD_ANALOG_VALID

External pull-downs hold every command pin off through reset and with the MCU unpowered. The switch’s diagnostic-enable pin is deliberately not treated as an output disable — the gate is the only thing allowed to be one.

Back to the workSee PCB 1, the ESP32-S3 plant monitor →
Start a board

Need a controller like this one?

Protected 24 V power, isolated buses, analog that survives a miswire — send a paragraph about yours and get a fixed quote, in writing, within a day.

Send the brief
  1. 01Send the briefWhat the board does, your target fab, and any files you already have — a paragraph is enough to start.
  2. 02Fixed quote in 24hScope, price, and timeline in writing. NDA signed first if your project needs one.
  3. 03Contract, then workA signed contract with the money-back guarantee written in: if delivery misses the agreed scope, you get a refund. Then the board gets built.