PCU/BMS: fix BMS pack voltage/temp on PCU; use IVT for RMS limiting

The BMS never transmitted the accumulator voltage (0x02) or temperature
(0x03) frames, so the PCU read them as 0.0 and the RMS limiter falsely
tripped the low-pack-voltage torque cut. The PCU also hand-parsed those
frames with the wrong endianness/signal.

- BMS: broadcast 0x02 (cell-sum pack voltage, decivolts) and 0x03 (max cell
  temperature, deci-C) from the existing 100ms state publish tick, using the
  generated pack functions.
- PCU: decode 0x02/0x03 with the generated unpack functions for the bms
  console display (cell-sum voltage + max temperature).
- PCU: add a local IVT CAN handler (generated unpack) and route the RMS
  torque/power limiter to measured IVT voltage + current, freshness-gated
  with fallback to the inverter DC bus voltage.

Author: ZacharyBer

BMS/Core/User/Src/FEB_CAN_State.c

@@ -6,9 +6,11 @@
 #include "FEB_CAN_State.h"
 #include "FEB_CAN_DASH.h"
 #include "FEB_SM.h"
+#include "FEB_ADBMS6830B.h"
 #include "feb_can_lib.h"
 #include "feb_can.h"
 #include "stm32f4xx_hal.h"
+#include <math.h>
 #include <stdbool.h>
 #include <string.h>
 
@@ -26,6 +28,12 @@ static volatile BMS_State_t current_state = BMS_STATE_BOOT;
 /* BMS state message data */
 static struct feb_can_bms_state_t bms_state_msg;
 
+/* Accumulator telemetry messages broadcast to the PCU (consumed by FEB_CAN_BMS
+ * on the PCU for the `bms` console display). total_pack_voltage is the cell-sum
+ * pack voltage in decivolts; max_cell_temperature is in deci-degrees C. */
+static struct feb_can_bms_accumulator_voltage_t acc_voltage_msg;
+static struct feb_can_bms_accumulator_temperature_t acc_temp_msg;
+
 /* State name lookup table - must match BMS_State_t enum order */
 static const char *state_names[] = {
     "BOOT",              // 0
@@ -47,6 +55,8 @@ static const char *state_names[] = {
 void FEB_CAN_State_Init(void)
 {
   memset(&bms_state_msg, 0, sizeof(bms_state_msg));
+  memset(&acc_voltage_msg, 0, sizeof(acc_voltage_msg));
+  memset(&acc_temp_msg, 0, sizeof(acc_temp_msg));
   current_state = BMS_STATE_BOOT;
 }
 
@@ -103,6 +113,25 @@ void FEB_CAN_State_Tick(void)
     feb_can_bms_state_pack(tx_data, &bms_state_msg, sizeof(tx_data));
 
     FEB_CAN_TX_Send(FEB_CAN_INSTANCE_1, FEB_CAN_BMS_STATE_FRAME_ID, FEB_CAN_ID_STD, tx_data, FEB_CAN_BMS_STATE_LENGTH);
+
+    /* Accumulator voltage (0x02): total_pack_voltage = cell-sum in decivolts.
+     * The PCU divides by 10 for display and uses it for the `bms` console view. */
+    acc_voltage_msg.total_pack_voltage = (uint16_t)(FEB_ADBMS_Snapshot_Total_Voltage() * 10.0f + 0.5f);
+
+    uint8_t acc_v_data[FEB_CAN_BMS_ACCUMULATOR_VOLTAGE_LENGTH];
+    feb_can_bms_accumulator_voltage_pack(acc_v_data, &acc_voltage_msg, sizeof(acc_v_data));
+    FEB_CAN_TX_Send(FEB_CAN_INSTANCE_1, FEB_CAN_BMS_ACCUMULATOR_VOLTAGE_FRAME_ID, FEB_CAN_ID_STD, acc_v_data,
+                    FEB_CAN_BMS_ACCUMULATOR_VOLTAGE_LENGTH);
+
+    /* Accumulator temperature (0x03): max_cell_temperature in deci-degrees C.
+     * Snapshot is NaN until the first cell-monitor scan completes. */
+    float max_temp_c = FEB_ADBMS_Snapshot_Max_Temp();
+    acc_temp_msg.max_cell_temperature = isnan(max_temp_c) ? 0 : (int16_t)(max_temp_c * 10.0f);
+
+    uint8_t acc_t_data[FEB_CAN_BMS_ACCUMULATOR_TEMPERATURE_LENGTH];
+    feb_can_bms_accumulator_temperature_pack(acc_t_data, &acc_temp_msg, sizeof(acc_t_data));
+    FEB_CAN_TX_Send(FEB_CAN_INSTANCE_1, FEB_CAN_BMS_ACCUMULATOR_TEMPERATURE_FRAME_ID, FEB_CAN_ID_STD, acc_t_data,
+                    FEB_CAN_BMS_ACCUMULATOR_TEMPERATURE_LENGTH);
   }
 }
 

BMS/VERSION

@@ -1 +1 @@
-1.8.1
+1.8.2

PCU/Core/User/Inc/FEB_CAN_IVT.h

@@ -0,0 +1,57 @@
+/**
+ * @file FEB_CAN_IVT.h
+ * @brief IVT (Isabellenhutte) Current/Voltage sensor CAN reception for the PCU
+ * @author Formula Electric @ Berkeley
+ *
+ * The ISAscale IVT-MODULAR broadcasts on CAN1 (the vehicle bus the PCU is on):
+ * - 0x521: Current
+ * - 0x522: Voltage 1
+ * - 0x523: Voltage 2 (pack voltage on SN5)
+ * - 0x524: Voltage 3
+ * - 0x525: Temperature
+ *
+ * Frame IDs and byte layout live in the shared CAN library
+ * (common/FEB_CAN_Library_SN4); decoding uses the generated FEB_CAN_IVT_*_FRAME_ID
+ * macros and feb_can_ivt_*_unpack() functions, like every other PCU CAN package.
+ *
+ * The PCU uses the IVT's measured pack voltage and current for RMS torque/power
+ * limiting (see FEB_RMS.c).
+ */
+
+#ifndef INC_FEB_CAN_IVT_H_
+#define INC_FEB_CAN_IVT_H_
+
+#include <stdint.h>
+#include <stdbool.h>
+
+/* IVT voltage channel wired to the pack terminals (1, 2, or 3). SN5 uses 2. */
+#define FEB_CAN_IVT_PACK_VOLTAGE_CHANNEL 2
+
+/* Data is considered stale after this many ms without an IVT frame. */
+#define FEB_CAN_IVT_DATA_TIMEOUT_MS 1000
+
+/**
+ * @brief Register IVT CAN RX callbacks on CAN1
+ */
+void FEB_CAN_IVT_Init(void);
+
+/**
+ * @brief Get pack voltage from the IVT (channel FEB_CAN_IVT_PACK_VOLTAGE_CHANNEL)
+ * @return Pack voltage in volts; 0.0 if data is stale or never received
+ */
+float FEB_CAN_IVT_GetVoltage(void);
+
+/**
+ * @brief Get pack current from the IVT
+ * @return Pack current in amps (may be stale — gate with FEB_CAN_IVT_IsDataFresh)
+ */
+float FEB_CAN_IVT_GetCurrent(void);
+
+/**
+ * @brief Check whether IVT data is fresh
+ * @param timeout_ms Maximum acceptable age in milliseconds
+ * @return true if a frame arrived within timeout_ms, false otherwise
+ */
+bool FEB_CAN_IVT_IsDataFresh(uint32_t timeout_ms);
+
+#endif /* INC_FEB_CAN_IVT_H_ */

PCU/Core/User/Inc/FEB_Main.h

@@ -17,6 +17,7 @@
 #include "FEB_RMS.h"
 #include "FEB_CAN_RMS.h"
 #include "FEB_CAN_BMS.h"
+#include "FEB_CAN_IVT.h"
 #include "FEB_CAN_Diagnostics.h"
 #include "FEB_CAN_TPS.h"
 #include "FEB_PCU_Commands.h"

PCU/Core/User/Inc/FEB_RMS_Config.h

@@ -57,6 +57,20 @@ extern "C"
  */
 #define LOW_PACK_VOLTAGE 4200 /* 420.0V in decivolts */
 
+/**
+ * @brief Low pack voltage threshold in volts (for IVT-measured comparisons)
+ * @note Same threshold as LOW_PACK_VOLTAGE, expressed in volts since the IVT
+ *       getters return volts. Below this, torque is limited to MAX_TORQUE_LOW_V.
+ */
+#define LOW_PACK_VOLTAGE_V 420.0f
+
+/**
+ * @brief IVT-measured pack current limit in Amps for the protective torque derate
+ * @note Backstop to the power cap: above this measured current, torque is scaled
+ *       down proportionally. Bench-tune to avoid oscillation before trusting.
+ */
+#define IVT_CURRENT_LIMIT_A PEAK_CURRENT
+
 /**
  * @brief Initial/nominal pack voltage in decivolts
  * @note Used for startup calculations

PCU/Core/User/Src/FEB_CAN_BMS.c

@@ -96,7 +96,6 @@ static void FEB_CAN_BMS_Callback(FEB_CAN_Instance_t instance, uint32_t can_id, F
 {
   (void)instance;
   (void)id_type;
-  (void)length;
   (void)user_data;
 
   /* NOTE: This callback runs in ISR context - avoid logging and blocking operations */
@@ -105,8 +104,11 @@ static void FEB_CAN_BMS_Callback(FEB_CAN_Instance_t instance, uint32_t can_id, F
 
   if (can_id == FEB_CAN_BMS_ACCUMULATOR_TEMPERATURE_FRAME_ID)
   {
-    BMS_MESSAGE.temperature = data[2] << 8 | data[3];
-    BMS_MESSAGE.max_temperature = (float)BMS_MESSAGE.temperature / 10.0f;
+    /* deci-degrees C, max cell temperature (signed) */
+    struct feb_can_bms_accumulator_temperature_t t;
+    feb_can_bms_accumulator_temperature_unpack(&t, data, length);
+    BMS_MESSAGE.temperature = (uint16_t)t.max_cell_temperature;
+    BMS_MESSAGE.max_temperature = (float)t.max_cell_temperature / 10.0f;
   }
   else if (can_id == FEB_CAN_BMS_STATE_FRAME_ID)
   {
@@ -121,8 +123,11 @@ static void FEB_CAN_BMS_Callback(FEB_CAN_Instance_t instance, uint32_t can_id, F
   }
   else if (can_id == FEB_CAN_BMS_ACCUMULATOR_VOLTAGE_FRAME_ID)
   {
-    BMS_MESSAGE.voltage = (data[0] << 8) | (data[1]);
-    BMS_MESSAGE.accumulator_voltage = (float)BMS_MESSAGE.voltage / 10.0f;
+    /* decivolts, cell-sum pack voltage — used for the `bms` console display */
+    struct feb_can_bms_accumulator_voltage_t v;
+    feb_can_bms_accumulator_voltage_unpack(&v, data, length);
+    BMS_MESSAGE.voltage = v.total_pack_voltage;
+    BMS_MESSAGE.accumulator_voltage = (float)v.total_pack_voltage / 10.0f;
   }
 }
 

PCU/Core/User/Src/FEB_CAN_IVT.c

@@ -0,0 +1,152 @@
+/**
+ * @file FEB_CAN_IVT.c
+ * @brief IVT (Isabellenhutte) Current/Voltage sensor CAN reception for the PCU
+ * @author Formula Electric @ Berkeley
+ *
+ * Decodes the IVT-S broadcast on CAN1 using the generated feb_can_ivt_*_unpack()
+ * functions, exactly like the other PCU CAN packages. The measured pack voltage
+ * and current feed the RMS torque/power limiter (FEB_RMS.c).
+ */
+
+#include "FEB_CAN_IVT.h"
+#include "feb_can_lib.h"
+#include "feb_can.h"
+#include "stm32f4xx_hal.h"
+#include "cmsis_compiler.h"
+#include <stddef.h>
+
+/* Note: float reads are atomic on ARM Cortex-M4, so no critical section needed. */
+
+typedef struct
+{
+  volatile float current_mA;
+  volatile float voltage_1_mV;
+  volatile float voltage_2_mV;
+  volatile float voltage_3_mV;
+  volatile uint32_t last_rx_tick; /* 0 = never received */
+} IVT_Data_t;
+
+static IVT_Data_t ivt_data = {0};
+
+/* ISR-context callback — no logging or blocking work. */
+static void FEB_CAN_IVT_Callback(FEB_CAN_Instance_t instance, uint32_t can_id, FEB_CAN_ID_Type_t id_type,
+                                 const uint8_t *data, uint8_t length, void *user_data)
+{
+  (void)instance;
+  (void)id_type;
+  (void)user_data;
+
+  switch (can_id)
+  {
+  case FEB_CAN_IVT_CURRENT_FRAME_ID:
+  {
+    struct feb_can_ivt_current_t msg;
+    if (feb_can_ivt_current_unpack(&msg, data, length) < 0)
+    {
+      return;
+    }
+    /* Current in mA, negate for reversed direction (matches BMS convention) */
+    ivt_data.current_mA = (float)msg.current * (-0.001f) * 1000.0f;
+    __DMB();
+    ivt_data.last_rx_tick = HAL_GetTick();
+    break;
+  }
+
+  case FEB_CAN_IVT_VOLTAGE1_FRAME_ID:
+  {
+    struct feb_can_ivt_voltage1_t msg;
+    if (feb_can_ivt_voltage1_unpack(&msg, data, length) < 0)
+    {
+      return;
+    }
+    ivt_data.voltage_1_mV = (float)msg.voltage1;
+    __DMB();
+    ivt_data.last_rx_tick = HAL_GetTick();
+    break;
+  }
+
+  case FEB_CAN_IVT_VOLTAGE2_FRAME_ID:
+  {
+    struct feb_can_ivt_voltage2_t msg;
+    if (feb_can_ivt_voltage2_unpack(&msg, data, length) < 0)
+    {
+      return;
+    }
+    ivt_data.voltage_2_mV = (float)msg.voltage2;
+    __DMB();
+    ivt_data.last_rx_tick = HAL_GetTick();
+    break;
+  }
+
+  case FEB_CAN_IVT_VOLTAGE3_FRAME_ID:
+  {
+    struct feb_can_ivt_voltage3_t msg;
+    if (feb_can_ivt_voltage3_unpack(&msg, data, length) < 0)
+    {
+      return;
+    }
+    ivt_data.voltage_3_mV = (float)msg.voltage3;
+    __DMB();
+    ivt_data.last_rx_tick = HAL_GetTick();
+    break;
+  }
+
+  default:
+    break;
+  }
+}
+
+void FEB_CAN_IVT_Init(void)
+{
+  ivt_data.current_mA = 0.0f;
+  ivt_data.voltage_1_mV = 0.0f;
+  ivt_data.voltage_2_mV = 0.0f;
+  ivt_data.voltage_3_mV = 0.0f;
+  ivt_data.last_rx_tick = 0;
+
+  /* Single MASK registration covering 0x520-0x527 (IVT frames are 0x521-0x525).
+   * One hardware filter bank; the callback ignores anything else in range. */
+  FEB_CAN_RX_Params_t rx_params = {
+      .instance = FEB_CAN_INSTANCE_1,
+      .can_id = 0x520,
+      .id_type = FEB_CAN_ID_STD,
+      .filter_type = FEB_CAN_FILTER_MASK,
+      .mask = 0x7F8,
+      .fifo = FEB_CAN_FIFO_0,
+      .callback = FEB_CAN_IVT_Callback,
+      .user_data = NULL,
+  };
+  FEB_CAN_RX_Register(&rx_params);
+}
+
+float FEB_CAN_IVT_GetVoltage(void)
+{
+  if (!FEB_CAN_IVT_IsDataFresh(FEB_CAN_IVT_DATA_TIMEOUT_MS))
+  {
+    return 0.0f;
+  }
+
+#if FEB_CAN_IVT_PACK_VOLTAGE_CHANNEL == 1
+  return ivt_data.voltage_1_mV * 0.001f;
+#elif FEB_CAN_IVT_PACK_VOLTAGE_CHANNEL == 2
+  return ivt_data.voltage_2_mV * 0.001f;
+#elif FEB_CAN_IVT_PACK_VOLTAGE_CHANNEL == 3
+  return ivt_data.voltage_3_mV * 0.001f;
+#else
+#error "FEB_CAN_IVT_PACK_VOLTAGE_CHANNEL must be 1, 2, or 3"
+#endif
+}
+
+float FEB_CAN_IVT_GetCurrent(void)
+{
+  return ivt_data.current_mA * 0.001f;
+}
+
+bool FEB_CAN_IVT_IsDataFresh(uint32_t timeout_ms)
+{
+  if (ivt_data.last_rx_tick == 0)
+  {
+    return false;
+  }
+  return (HAL_GetTick() - ivt_data.last_rx_tick) < timeout_ms;
+}

PCU/Core/User/Src/FEB_Main.c

@@ -120,6 +120,11 @@ void FEB_Main_Setup(void)
     // === CHECKPOINT 6: BMS ready ===
     LOG_I(TAG_MAIN, "[6/8] BMS initialized");
     HAL_Delay(50);
+
+    // IVT current/voltage sensor RX (pack voltage + current for RMS limiting)
+    FEB_CAN_IVT_Init();
+    LOG_I(TAG_MAIN, "[6/8] IVT initialized");
+    HAL_Delay(50);
   }
   else
   {