Overview
FSAE rule EV 7.1.1.10 requires that we monitor every device on the CAN bus — if any ECU goes silent, the car must detect it as a fault and cut shutdown loop power, opening the AIRs and putting the vehicle in a safe state. The CAN watchdog board is responsible for that detection.
The board centers on a STM32 NUCLEO-F303K8, which listens to the CAN bus via two SN65HVD230 transceivers. For each ECU on the network, the firmware tracks two variables: the timestamp of the last received message, and an error flag. In the main loop, the STM32 compares the current time against each ECU's last-seen timestamp — if any device has been silent for more than 500 ms, its error flag is raised.
When any error flag is active, the on-board LED (LD3) lights up and the fault line is driven LOW, opening the relay and cutting power to the shutdown loop. As long as all ECUs are communicating within the threshold, the fault line stays HIGH and the relay remains closed.
Design decisions
Message detection uses the STM32's hardware CAN interrupt rather than polling. When a frame arrives, the interrupt handler reads the message ID to identify the sender, resets that ECU's error flag, and updates its timestamp — keeping the overhead minimal and the response deterministic.
One subtle constraint: the STM32 cannot receive its own CAN transmissions on the bus. To get around this, we added an ESP32 Dev Module whose sole job is to echo the STM32's heartbeat back onto the line. The STM32 then tracks this echo like any other ECU message, so a fault in the STM32's own transmit path will also trigger a shutdown. As a bonus, the heartbeat — sent every 250 ms — makes it much easier to debug CAN failures in the field: if the echo stops but other ECUs are fine, the issue is with the STM32 itself; if everything stops, the bus is the problem.
