20261020-2336-key-wiring-box-external-buttons Key Box 36: control box with 36 DI / 72 DO for external pushbuttons

• status: completed
• createdAt: 2026-10-20 23:36
• approvedAt: 2026-10-21 01:43
• relatedTask: 20261020-2336-key-wiring-box-external-buttons

Context

• Key base unit rev A (/srv/ybo/switch/key, tools/gen_key.py, PCB tools/gen_key_pcb.py): 70 x 140 mm panel board, 8 tact switches and RGB LEDs on L1, keys on ESP32-C6 GPIOs (22 of 22 used), LP5036 LED driver, I2C and internal-CAN expansion ports. The eight-key limit comes from the GPIO count and the panel size; the panel needs IP67 front tooling (keycaps, light guides, legends, seal).
• Owner decisions 2026-10-20/21 (conversation): external marine pushbuttons (C / NO / NC, latching or momentary, about 15 CNY each) with a 12-24 V bicolour common-anode lamp; the buttons of a group are mounted together, so their commons are jumpered at the buttons; a central control box with low-side lamp outputs; C tied to the lamp common (one COM+ wire per group, active-high inputs); NC not used; COM+ voltage sensed; 36 buttons per box (Key Box 18 is the same board half populated); power and both CAN ports inside the harness connectors; the second CAN is NMEA 2000 capable; DO configurable as lamp or general output; TE AMPSEAL 35-way harness connectors (genuine TE first, a compatible part only as a qualified second source).
• TE AMPSEAL 35 vertical header 776231 (drawing 2010, sheet 2): 3 rows (12 / 11 / 12) at 4 mm pitch, 35 x 1.75 mm plated holes, 4 x 2 mm locating holes (63.4 mm top pair, 66.4 mm bottom pair, 18.1 mm apart), panel cut-out 60.5 x 24.7 mm with 4 x 3.3 mm screw holes (panel <= 5 mm), flange gasket about 77 x 32 mm, about 19 mm from the PCB to the panel. Housing colours are keyed: 776231-1 black, -2 natural, -4 gray, -5 blue only mate with plugs of the same colour (776164-1/-2/-4/-5). Terminals 770520 (reel) / 770854 (loose). Header about 9 USD at 100 pcs, plug about 8.6 USD at 500 pcs.
• TI TIC12400 (SCPS269): 24 inputs, but only IN0-IN9 have the configurable current sink needed for switch-to-supply inputs (IN10-IN23 are switch-to-ground with a current source); VS recommended 6.5-24 V at TA <= 85 C (18 V at 105 C), inputs 0-35 V (40 V abs. max) whatever VS is; comparator thresholds 2 / 2.7 / 3 / 4 V, ADC 0-6 V; SPI <= 4 MHz, no daisy chain; HTSSOP-38 (DCP) with thermal pad.
• onsemi NCV7240B: 8 low-side channels, 0.6 A, Rds 1.5 ohm typ / 3 ohm max, overload latch-off 0.6-1.3 A after 3-50 ms, thermal shutdown per channel, open-load diagnostics, 16-bit SPI <= 5 MHz, daisy-chain capable, VDDA 5 V, VDD 3.3 / 5 V, OUT 36 V DC / 44 V transient, SSOP-24 NB (3.9 x 8.65 mm, 0.65 mm pitch, fused leads).
• TI ISO1042 (DW, SOIC-16W): isolated CAN FD transceiver, VCC1 1.71-5.5 V, VCC2 4.5-5.5 V.
• Cost estimate 2026-10-21 (CNY at 1000 units, USD 7.1; script /srv/ybo/switch/.tmp/cost/key_cost.py): Key 8 about 245, Key 4 about 230, I2C unit about 100, CAN unit about 110. 36-key system with Key Box 36, TE AMPSEAL 35 x 4 (headers, plugs, terminals about 600 per box), 36 buttons and harness: about 1615 (45 per key); with qualified compatible connectors about 1100 (31 per key). The panel route (Key 8 + I2C units) is about 18 per key plus 100-200k front tooling.

Proposal

Product

New Key model Key Box 36: a control box (no keys on board) with 36 key inputs, 4 auxiliary inputs and 72 low-side outputs (DO), YBO CAN plus an NMEA 2000-ready isolated CAN, all on four AMPSEAL 35 harness connectors. Each button uses one input and two DO (bicolour lamp). A DO that is not used by a lamp can drive another load (relay coil, indicator, buzzer) of up to 250 mA, connected to +V. Key Box 18 is the same board with J3 / J4, their TIC12400 and NCV7240B not fitted (blanking caps on the lid). The panel Key 4 / Key 8 and its expansion units stay as they are; the box has no expansion ports, more buttons means another box.

Harness: four TE AMPSEAL 35 (one colour each)

Pins 1-28 are identical on all four connectors (group n = keys 9n-8 ... 9n). The colour keying stops a group plug from landing on the wrong header; power and CAN only exist on #1 and #2.

Pin	#1 black 776231-1	#2 natural 776231-2	#3 gray 776231-4	#4 blue 776231-5
1-9	DI keys 1-9 (NO, active high)	DI keys 10-18	DI keys 19-27	DI keys 28-36
10-18	DO green, keys 1-9	green 10-18	green 19-27	green 28-36
19-27	DO red, keys 1-9	red 10-18	red 19-27	red 28-36
28	COM1+	COM2+	COM3+	COM4+
29	V+ (12 / 24 V)	NET-H (CAN2)	AUX3	AUX4
30	GND	NET-L	spare	spare
31	CAN1 H (YBO CAN)	CAN2 TERM	spare	spare
32	CAN1 L	CAN2 shield	spare	spare
33	CAN1 TERM	AUX2	spare	spare
34	CAN1 shield	NET-S (N2K 12 V)	spare	spare
35	AUX1	NET-C (N2K 0 V)	spare	spare

• Each button: C and lamp common to COMn+ (jumpered at the buttons), NO, lamp green, lamp red; NC unconnected. AUXn is a spare active-high input of the same type.
• CAN termination by harness jumper: the box carries 120 ohm between TERM and CAN-H; a harness that ends a bus shorts TERM to CAN-L inside the plug (sdcr-200 practice). Shields go to GND (CAN1) and NET-C (CAN2) through 1 Mohm || 4.7 nF.
• V+ / GND / CAN1 branch out of the #1 bundle to the YBO bus drop; CAN2 / NET-S / NET-C out of #2 to an NMEA 2000 drop cable (Micro-C adapter in the harness).
• Unused cavities get sealing plugs; Key Box 18 gets blanking caps on J3 / J4.

Circuit (key/key_box, generator tools/gen_key_box.py)

• Input protection: same chain as the base unit (fuse, SMBJ150A + SMBJ33CA stack, LM74800-Q1 with 250 V / 60 V FETs, VS limiter), fuse 4 A time-lag (box total <= 3 A), OV clamp lowered to 34.2 V (100k / 3.74k, 33.2-35.1 V) so the TIC12400 inputs (35 V) and the NCV7240B outputs (36 V) stay within rating with COM+ at the clamp.
• Rails: VPROT -> hold-up + pi filter -> VIN -> LMR36510 5 V (NCV7240B VDDA, TJA1463) -> TLV75533 3.3 V (ESP32-C6, logic); VIN -> LM317L -> 10 V for the TIC12400 VS pins (keeps them in rating on 24 V boats); VIN / 18.9 sense on the ESP32 ADC.
• COM+ per group: VPROT -> 0.5 A / 60 V PTC (Littelfuse 1812L050/60MR) -> COMn+ with 100 nF at the pin; a short to ground trips only that group. Nine keys with both colours lit at 20 mA draw 0.36 A.
• Inputs: four TIC12400, one per connector. IN0-IN8 = the nine key inputs, IN9 = AUXn (all switch-to-supply with the current sink, wetting pulsed up to 15 mA in polling mode), IN10 = COMn+ through 47k / 10k (ADC mode, 34 V -> 5.96 V); IN11-IN23 unused. 15 nF at every used input pin (TI ESD note). VDD 3.3 V, RESET tied low, CAP_A / CAP_D 100 nF, CAP_Pre 1 uF. Shared INT (open drain, 10k pull-up), one CS each.
• Outputs: nine NCV7240B in one SPI daisy chain (one CS), global EN from the MCU with a 10k pull-down (outputs stay off until the firmware enables them), LHI and IN1-IN4 tied low, 10 nF at every output pin. The 72 outputs run in connector pin order (J1 pin 10 = output 1 ... J4 pin 27 = 72). Lamp or general load up to 250 mA per channel, 1 A per chip; an overload latches only that channel off and is reported.
• YBO CAN (CAN1): TJA1463 SIC + common-mode choke + NUP3105L, as the base unit, TWAI0.
• CAN2 (NMEA 2000-ready): ISO1042 isolated transceiver on TWAI1; bus side powered from NET-S through a 100 V diode, SMBJ18A and an L78L05 (LEN target 1), NUP3105L + common-mode choke on NET-H / NET-L, all referenced to NET-C. The isolated island has no plane or pour of the box ground. Firmware stack and NMEA certification are not in this task.
• ESP32-C6-MINI-1 GPIO (21 of 22): SPI SCLK IO19 / MOSI IO18 / MISO IO20 (shared, the TIC12400 and NCV7240B outputs are tri-stated while deselected), TIC CS IO0-IO3 (10k pull-ups), TIC INT IO15, DO CS IO21, DO EN IO14, TWAI0 IO4 / IO5, TWAI1 IO22 / IO23, VIN sense IO6, USB IO12 / IO13, UART0 pads, BOOT / SERVICE button IO9, status LED IO7; IO8 pulled up (strapping) and spare.
• Board 180 x 110 mm, 4 layers: J1 / J2 along the top edge, J3 / J4 along the bottom edge (headers on the top side, through the lid), electronics on the bottom side in the middle band, ESP32-C6 antenna at the left short edge (plastic enclosure or an antenna window). Enclosure about 204 x 134 x 38 mm (228 mm over the mounting ears), IP67, 4 cut-outs in the lid, about 80 mm free above the lid for the plugs and the cable bend.

Firmware-visible semantics (written into the spec, not implemented here)

• Key type per channel: momentary or latching; latching in absolute mode (position ON -> ON) or toggle mode (every change toggles). A latching key cannot be bound to a momentary load.
• After power-up or reset the positions are read and reported, no command is sent.
• Lamp shows the Core-confirmed state, not the button position: green steady ON, dark OFF, green blinking waiting, red steady rejected / locked, red slow blink lost / unknown, both (amber) service window.
• Each DO is configured as lamp or general output. General outputs switch only on a Core command over CAN and report their state (X01 CMD / ACK / STATE); the box never switches them from its own inputs. Overload, open load and over-temperature are reported per channel.
• A momentary key held longer than a configured limit is reported as a fault and its hold is no longer renewed. A group with COMn+ below the threshold marks its nine keys unavailable and generates no events.
• 36 keys, 4 aux inputs and 72 outputs on one CAN node: the X01 index ranges are confirmed in the ICD (KEY-O-04).
• Harness length per button <= 5 m; critical circuits are spread over more than one box (KEY-O-11). OEM boats get a fully pre-made harness; retrofit installs get a pre-made AMPSEAL harness with flying leads. A passive 9-button IP67 junction box is a separate follow-up.

Documents (bizplan/product/switch/key/)

• P05-key.md: Key Box 36 / 18 in section 2 (model, 36 DI / 72 DO, harness, CAN1 + N2K-ready CAN2, button requirements: IP67, changeover contact for 12-24 V DC low current, common-anode bicolour lamp 12-24 V, <= 20 mA per colour; DO <= 250 mA), key types, lamp states, harness fault behaviour.
• P05-key-design.md: new section for the control box (pin-out, input and output circuits, protection, budget, GPIO map, cost).
• P05-key-guide.md: verification items for latching / momentary, COM+ open and short, lamp line short, DO overload, harness ESD; quotation lists Key Box 36 / 18 and the harness separately.
• Brief follows; changelog entry.

Workspace (/srv/ybo/switch)

tools/gen_key_box.py (stand-alone; the shared input / CAN blocks are copied, so the base unit generator and netlist stay untouched), tools/gen_key_symbols.py (TIC12400, NCV7240B, ISO1042), tools/gen_key_pcb.py (key_box board entry, AMPSEAL and SSOP-24 NB footprints), tools/run_key_exp.sh / tools/pcb_key.sh reuse for key_box, outputs under key/key_box/, handover README section. Appearance (owner 2026-10-21: schematic, PCB and 3D appearance as one set): tools/gen_key_box_3d.py (CadQuery: colour-keyed AMPSEAL header and mated plug models, enclosure base and lid as STEP), tools/render_key_box.py / tools/render_key_box.sh (header models on the board, assembly boards, ray-traced renders closed / with plugs / open, STEP export).

Risks

• COMn+ is a single point of failure for nine keys; it is detected (TIC ADC) but not tolerated.
• An open NO wire silently disables one key; a NO wire shorted to COM+ reads as pressed; a short to ground reads released (safe side).
• Lamp voltage follows the boat supply: 24 V lamps see up to 34 V during a load-dump clamp.
• One box loses 36 keys when it fails; the installation guide must split critical loads.
• TIC12400 runs from a 10 V VS rail; the TI datasheet only characterises VINx <= 24 V with VS = 24 V. Inputs above VS (24 V boat, 28.8 V charging) are inside the 35 V input rating but must be confirmed on the bench (leakage, threshold, sink operation).
• LM317L dissipation at 34 V in: (34 - 10) V x about 30 mA = 0.7 W in SOT-89; check the copper.
• General DO blur the line between panel and actuator node; they stay limited to 250 mA and to Core commands.
• NMEA 2000 needs the certified stack and NMEA certification; the hardware is only "N2K-ready". The isolation island needs creepage checked on the real layout.
• AMPSEAL genuine parts dominate the cost (about 600 CNY per box); a compatible source must be qualified as a complete set (header, plug, terminal, seal) with a non-infringement warranty.
• The pin-1 orientation of the 776231 footprint is drawn from the TE drawing and must be checked against a sample before the first PCB order.

Scope

docs repo: 4 files under bizplan/product/switch/key/, changelog, task/plan. switch repo: 1 new generator, 2 changed tools (symbols, PCB), new key/key_box/ outputs (schematic, ERC, netlist, BOM, PDF, PCB, DRC), handover README.

Alternatives

• Superseal 34 + 3 x 26 (32 keys): cheaper, but the 34-way only carries one group plus power and CAN, and no fifth connector fits; replaced by 4 x AMPSEAL 35 (owner).
• Discrete inputs (10k pull-down, divider, 74HC165): about 3 W static at 32 V with all keys on and no pulsed wetting; replaced by TIC12400.
• TPIC6B595 outputs: no current limit or thermal shutdown; replaced by NCV7240B.
• Protected high-side DO with common-cathode lamps: about +160 CNY; rejected (owner).
• Aptiv / Molex CMC 64 x 2: 0.64 mm terminals limit the wire size; kept as a later OEM variant.
• NO + NC supervision, single-colour lamps, C to GND wiring: rejected (owner).
• Shared generator module with the base unit: would touch the released base unit; the box generator copies the blocks instead.

Annotations

• 2026-10-20: external buttons, latching allowed, lamp shows state.
• 2026-10-21: bicolour common-anode lamp, low-side outputs, C on COM+, COM+ sensed, no NC.
• 2026-10-21: power and CAN in the harness; two CAN ports, the second one possibly NMEA 2000.
• 2026-10-21: TIC12400 inputs, NCV7240B outputs, clamp about 34 V, harness TERM pins; 36 keys on 4 x TE AMPSEAL 35 (genuine first); board 180 x 110 mm; owner: build it ("按这个设计来做").
• 2026-10-21: TIC12400 check: only IN0-IN9 sink current and VS <= 24 V, so four chips (one per connector) on a 10 V VS rail, one aux input per connector; NET-S / NET-C take #2 pins 34 / 35.
• 2026-10-21: delivered. Schematic ERC 0 (285 parts, 284 nets); PCB 180 x 110 mm, 4 layers, DRC 0 unconnected / 0 clearance / 0 short after one hand route (U9 DI8 / DI9 through the 0.75 mm channel between the exposed pad and the pins). The DSN export now drops pour-only rule areas, which KiCad otherwise exports as routing keepouts (the CAN2 island stayed unrouted). Appearance renders and STEP (board, assembly) under key/key_box/export/; handover package handover/key-2026-10-14 refreshed with a Key Box section.