Salt-lamp meeting reminder — v1 spec, STPA safety analysis, and atopile hardware board - #1
Open
Dementor430 wants to merge 26 commits into
Open
Salt-lamp meeting reminder — v1 spec, STPA safety analysis, and atopile hardware board#1Dementor430 wants to merge 26 commits into
Dementor430 wants to merge 26 commits into
Conversation
Local-processing USB-C salt lamp that pulses a warm-white LED 5 min before a meeting ends. Finalizes hardware (ESP32-C3-MINI-1U + USB-PD 9V + buck CC driver), firmware approach (iCal + Graph), EU compliance path, and the room/desk two-SKU framing. Output of a 7-agent two-round research pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…endar paths day-one - Add SHT4x-class temp/RH sensor (§4.5); replace fixed standing-warmth with a humidity/dew-point closed loop (§4.4) + software over-temp backstop - Build published-.ics and Graph (OAuth) in parallel from day one (was iCal-first) - Update architecture diagram, risks (R6 reframed, R8 added), implementation order Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rmware System-Theoretic Process Analysis of the salt-lamp reminder spec, run as an iterative loop until each scope converged (no new structural failure class): - hardware-personal: converged at iteration 3 - hardware-meetingroom: converged at iteration 3 - firmware: converged at iteration 4 (added the secure-provisioning / supply-chain root-of-trust lifecycle class) Each doc covers losses -> hazards -> constraints -> control structure -> unsafe control actions (4 guidewords) -> loss scenarios -> derived requirements, plus cross-document interaction findings. Load-bearing design decisions surfaced for sign-off (tracked as open gaps): - LED over-temp protection currently owned by neither layer (coupled NTC + autonomous foldback should be mandatory, not optional) - signing-key rotation headroom is a one-way eFuse decision needed pre-unit-1 - silent-failure / heartbeat channel vs the no-backend non-goal - single warm-white channel overloaded across glow/breathe/fault/stale modes Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…y, heartbeat, status LED - #1 LED over-temp now owned by hardware: coupled MCPCB NTC + autonomous comparator latching driver/eFuse EN (MCU-independent); firmware D_max is backup. Cavity SHT4x is ambient/dryness only. Resolves the cross-doc "owned by neither layer" contradiction. - #2 Open/repairable security: no Secure Boot lockdown / no whole-device flash encryption on standard units; signed OTA + HMAC-scheme NVS encryption + scoped/revocable secrets; open-source at EOL; optional locked Secure-Boot+HSM enterprise variant. - #3 Optional webhook heartbeat (reliability, not safety): off by default, fixed-interval health POST, no calendar contents, status reflects real pipeline health + last_sync_ok. - #4 Dedicated RGB status LED on base (dark when healthy); salt light stays warm-white only. Adds goals/non-goals, §4.6, decision log §11, and risk-table updates (R7, R9). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…er-temp comparator, status LED) Delta-STPA scoped to the new failure surface from the four design decisions; converged (high confidence) on all three docs. 60 confirmed-novel findings. Headline new structural class: the MCU-independent over-temp comparator is unannunciated — when it latches the LED rail off, the salt light goes dark (reads as healthy), the RGB stays green, and the heartbeat posts "operational". Fix: a mandatory MCU-readable latch-STATE sense line (default=FAULT). Also: open build has no on-device root of trust (revocation becomes primary secret protection); NTC brine-bridge false-cold pinout/creepage; two-variant governance control; EOL "never bricks" must be variant-scoped; heartbeat token-in-URL log exposure. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…se line, NTC pinout) - §4.3: add the latch-STATE sense line (MCU-readable, default=FAULT) so the autonomous over-temp cut is annunciated; NTC pinout/creepage + fail-toward-HOT (brine-bridge false-cold); comparator certified as sole over-temp layer. - §2: scope the "never bricks" promise to standard units; locked units get a separate EOL anti-brick commitment. - §5: heartbeat token-hardening (header over URL, mutual exclusion, jitter, wipe). - §11: record iteration-5 convergence + carried-forward (non-board) items. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
11 tasks: scaffold -> install JLCPCB parts -> PowerInput (USB-C/CH224K PD-9V/eFuse) -> protection -> 3.3V rail -> ESP32-C3-MINI-1U -> AL8860 LED driver -> autonomous over-temp (NTC fail-toward-hot + comparator latch + MCU-readable latch state) -> SHT4x + SK6812 -> top-level integration -> BOM/layout handoff. Per-task loop is ato build (compile/solve/pick + asserts + ERC) then commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…omparator from JLCPCB Parts installed (verified in-stock on LCSC/JLCPCB): C2765186 TYPE-C 16PIN 2MD(073) USB-C 16P receptacle C970725 CH224K USB-PD sink (WCH, 9V resistor-set) C125330 AL8860WT-7 buck CC LED driver (SOT-23-5) C5571272 TPS25961DRVR eFuse 2.7–19V, EN, adj-ILIM (WSON-6) C3013922 ESP32-C3-MINI-1U-H4 MCU module, ext-antenna U.FL C2909890 SHT40-AD1B-R2 temp/humidity I2C (DFN-4) C5378720 SK6812 addressable RGB LED (5×5 mm) C2867795 TLV3011AIDBVT single comparator push-pull (SOT-23-6) All .ato files land in elec/src/; footprints in elec/footprints/. ato build passes (parts present, unwired). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- power.ato: new PowerInput module (USB-C → CH224K 9V PD → TPS25961 eFuse → power_9v) - CH224K: single-resistor mode, 6.8kΩ on CFG1 → 9V request (CFG2/CFG3 NC) - RILIM=33kΩ for ~1.5A limit (datasheet: 25kΩ→2A, proportional scaling) - OVLO divider: 1MΩ/51kΩ → trip ≈10.3V (above 9V, below 12V next PDO) - USB-C orientation-reversible: Dp1~Dp2, Dn1~Dn2; EH→GND - Exported: power_vbus, power_9v (9V±5%), usb_data, pg (CH224K.PG), efuse_en - ground.ato: instantiate PowerInput, tie power_9v.gnd ~ gnd - ato build: green, no errors Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SMAJ12A-13-F (C134947, SMA, 12 V standoff / 19.9 V clamp) across VBUS; TPD4E05U06QDQARQ1 (C81353, USON-10, 0.5 pF/ch) protecting CC1/CC2/D+/D-. Creepage layout comment added per brief. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AP63203WU-7 (LCSC C780769): fixed 3.3V, 2A, 3.8V-32V input, SOT-26. Inductor: CD75-4R7M (LCSC C2826691), 4.7uH, >2A rated. Fed from power_vbus (pre-efuse) so radio never browns out when LED efuse is gated. Decoupling: 10uF in, 22uF out, 100nF BST cap. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
AL8860WT-7 hysteretic step-down CC driver: R_S=120mΩ (0805) between VIN and SET pin sets I_LED = 0.1V/R_S ≈ 833mA (assert PASSED: 793–877 mA within 0.7–1A). Catch diode SS34 C8678 (40V/3A SMA, from generics). Inductor CYH127-47UH C2929503 (47uH/2.5A SMD, per AL8860 datasheet 33–100uH recommendation for 9V input). RC low-pass (10kΩ + 100nF) converts MCU LEDC PWM to smooth analog CTRL voltage. Pigtail JST B4B-XH-A C144395 (4-pin 2.5mm keyed TH): p1=LED+, p2=LED-, p3=NTC_sense, p4=NTC_gnd (NTC pins open here; consumed in Task 8). Only regulated DC exits on pigtail — SW node stays on-board (EMC, STPA).
…, MCU-readable latch state MCU-independent over-temp cut (STPA decision #1 / spec 4.3): - Window comparator (2x TLV3011) on the off-board MCPCB NTC: trips on HOT (R_ntc low ~100C), SHORT/brine bridge (sense->3V3), and OPEN/disconnected (sense->0V) -- fail-toward-hot for every named failure mode. - Self-holding NPN+PFET regenerative latch (power-on-clear): holds the trip until power cycle, no auto-recovery while the LED may still be hot. - SN74LVC1G08 AND gate: efuse_en = fw_en AND not_overtemp. Either firmware disable OR an over-temp trip pulls power.efuse_en low, cutting power_9v to the AL8860 (no enable pin) via the eFuse EN. - latch_state -> mcu.overtemp_sense via isolation R; r_latch default-pulls it LOW = FAULT so a dead/unpowered latch never reads healthy. - Fail-safe pulldowns on efuse_en and not_overtemp: every passive default is LED-OFF / FAULT. Resolves previously-dangling power.efuse_en, mcu.efuse_en_out, mcu.overtemp_sense. Adds C7666 (AND), C20526 (NPN), C85202 (PFET), C118873 (signal diode). ato build green; 3 threshold asserts pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…latch, correct polarity Redesign of the non-functional over-temp protection (was commit 5ed0f1a): - C1: replace open-drain TLV3011 with push-pull TLV3012 (C2863635) so the diode-OR overtemp_fault node is actively driven HIGH on a fault. - C2: latch output is now the D-FF Qbar -> tripped drives not_overtemp LOW -> AND(fw_en, not_overtemp) LOW -> eFuse EN LOW -> LED OFF, latched. - I1/I2: replace the fragile discrete MMBT3904/BSS84 regenerative latch with a dedicated set-dominant SN74LVC1G74 D-FF (C70285) wired as an async SR latch with a POR RC async-clear; add SN74LVC1G04 inverter (C7827) so an already-present-at-power-on fault still latches (level/async set via PRE#). - M1: comments corrected to TLV3012 push-pull, 1.242 V internal REF. Build green (default + ci), all 4 asserts pass. Netlist pin-verified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SK6812 powered from 3.3 V rail (datasheet min 3.5 V; no 3.3 V-native addressable RGB exists on LCSC in this protocol family). Firmware must keep brightness ≤ 50 % to stay within safe operating margin. VBUS (5 V / 9 V PD) explicitly excluded. I2C pull-ups via I2CPullup (10 kΩ); 100 nF decoupling on both SHT40 and SK6812 VDD. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… clean ERC - ground.ato: add ButtonSKRPACE010 (LCSC C139797) for config/boot button wired to mcu.button.io (IO9) and GND; 10k pull-up already in mcu.ato (r_boot). - ground.ato: add ProgramHeader4Pin (LCSC C492405, 1x4 2.54mm TH) for EN/IO9(BOOT)/GND/3V3 pogo-pin jig access (DNP on production). - ground.ato: finalize ground stitching — rail3v3, driver, overtemp all tied to single top-level gnd net. - mcu.ato: export en and boot signals (additive) to expose ESP32-C3 EN and IO9 nets at the module boundary for the TP header. - Build: exit 0, zero ERC errors; only pre-existing No-MPN warning on driver.d1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix SS34_C8678 (U12) missing mpn field: LCSC showed '?' pre-fix; add `mpn = "C8678"` to generics/elec/src/SS34_C8678.ato. All 39 BOM groups now resolve to a real LCSC ID (64 component instances total). - Commit atopile generics dependency (elec/src/generics/, 85 files) which was installed but previously untracked. - Build verified reproducible: `ato build -b ci` produces bit-identical BOM (build/ci.csv) and netlist (build/ci.net) vs default build. (`--frozen` flag not available in ato 0.2.69; manual diff confirms.) - Netlist handoff: build/default.net has 64 components / 55 nets; elec/layout/default/ground.kicad_pcb has board outline ready for KiCad plugin to populate footprints. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…OM-lock 1. Reproducibility: document that `ato build` is self-contained, and the machine-local easyeda2kicad CloudFront/User-Agent + lceda.cn fallback workaround needed only for future `ato install --jlcpcb` of new parts (docs/DEVELOPMENT.md + README pointer). No venv file committed. 2. Repo hygiene: add .superpowers/ (and board.json) to .gitignore; untrack .superpowers/sdd/task-9-report.md (accidentally committed in 6feb2f8), keeping the local file. 3. MCU/antenna (spec §4.1, R4): correct mcu.ato docstring — the -1U module has an on-MODULE U.FL/IPEX (MHF III) connector (no board-side u.FL part), ships without antenna, so a cert-matched <=2.33 dBi external antenna + pigtail is a required BOM-locked sub-assembly for RED cert inheritance. -1U-H4 (C3013922) is NRND; recommended -1U-H4X has no JLCPCB code yet and the only -H4X part (C41349510) is the wrong PCB-antenna -1 variant, so keep H4 with a BOM-LOCK swap note at the import, in mcu.ato, and in spec §4.1. Build remains green (zero ERC errors; pre-existing implicit-decl warnings only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Important Review skippedToo many files! This PR contains 180 files, which is 30 over the limit of 150. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (37)
📒 Files selected for processing (180)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
… build green) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Establishes the 0.15 idiom pattern: 'from x.ato import X', pathless stdlib imports (ElectricPower/ElectricLogic/Resistor/Capacitor), atomic-part imports 'from parts/.../X.ato import X_package', ElectricPower .hv/.lv, ~> for shunt caps + series resistors, .resistance/.capacitance/.package. CH224K 9V (CFG1 6.8k), eFuse ILIM 33k + OVLO 1M/51k, TVS+ESD, USB D+/D- passthrough. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
All 6 modules (power, regulator, mcu, led_driver, overtemp, sensing) + ground.ato translated v0.2 -> 0.15: ElectricPower/ElectricLogic/ElectricSignal, ~> bridges, pathless stdlib imports, atomic-part imports, named pins on anonymous-pin parts. 28 atomic parts. ato build green (only a cosmetic non-PDF datasheet note). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
USB-C powered salt lamp that slowly pulses a warm-white LED ~5 min before a meeting ends — an ambient nudge synced to an Outlook calendar, processed on-device (no hosted backend). Two SKUs, one board: a conference-room unit and a desk unit.
This PR lands the full v1 arc: design spec → STPA safety analysis → hardware implementation plan → the complete atopile board (built across 11 reviewed tasks). Firmware and calendar integration are separate future cycles.
What's here
docs/superpowers/specs/…-salt-lamp-reminder-design.md— v1 design spec (finalized hardware + 4 locked decisions).docs/stpa/— 5-iteration System-Theoretic Process Analysis (hardware-personal, hardware-meetingroom, firmware), run to convergence.docs/superpowers/plans/…-salt-lamp-hardware.md— 11-task implementation plan.elec/src/— the atopile board (v0.2.x):ground.atotop-level +power,regulator,mcu,led_driver,overtemp,sensingmodules, real JLCPCB parts, and the vendoredgenericsdependency.Architecture
USB-C → USB-PD 9V (CH224K) → eFuse (TPS25961) → 9V → {AL8860 buck CC → warm-white LED on pigtail; AP63203 buck → always-on 3.3V → ESP32-C3-MINI-1U}; SHT40 temp/humidity (I²C); SK6812 RGB status; autonomous over-temp safety cut (TLV3012 window comparator + SN74LVC1G74 latch + AND gate → eFuse EN, MCU-independent).Key decisions
Quality gates
ato buildgreen (default+ci), zero ERC errors, all asserts pass; reproducible (ci vs default bit-identical).Track-for-fab (not blocking the design; flagged in-code / in-spec)
ESP32-C3-MINI-1U-H4(NRND); BOM-lock to pin-identical-1U-H4Xonce a JLCPCB code exists. Cert-matched ≤2.33 dBi external antenna is a required BOM-locked sub-assembly (RED).OVLO/RILIMset-points vs datasheet; SK6812 at 3.3V (~5% below min VDD) — validate at 0/40 °C; over-temp POR-vs-ramp timing.docs/DEVELOPMENT.md—ato buildis self-contained, but futureato installneeds the documented easyeda2kicad workaround.🤖 Generated with Claude Code