feat(ARK_G431_CAN): 12S CAN target, factory BL image, DRV8350 sleep

.github/workflows/CICD_build.yml

@@ -8,7 +8,7 @@ name: CI Build Linux
 # FLASH; native SITL on Windows is covered by the SITL workflow.)
 #
 # - Push/PR on ark-release: build + artifact.
-# - Version tags (vMAJOR.MINOR[.PATCH][-suffix]): GitHub Release with obj/*.hex.
+# - Version tags (vMAJOR.MINOR[.PATCH][-suffix]): GitHub Release with obj/*.hex and the G431 *.uavcan.bin.
 # - schedule / optional dispatch: rolling `nightly` prerelease (assets replaced).
 
 on:
@@ -112,6 +112,7 @@ jobs:
           name: ARK32-binaries
           path: |
             obj/*.hex
+            obj/*.uavcan.bin
           retention-days: 60
           if-no-files-found: error
 
@@ -122,7 +123,9 @@ jobs:
           github.repository == 'ARK-Electronics/ARK32'
         uses: softprops/action-gh-release@v2
         with:
-          files: obj/*.hex
+          files: |
+            obj/*.hex
+            obj/*.uavcan.bin
           fail_on_unmatched_files: true
           generate_release_notes: true
         env:
@@ -155,7 +158,9 @@ jobs:
           prerelease: true
           make_latest: false
           target_commitish: ${{ github.sha }}
-          files: obj/*.hex
+          files: |
+            obj/*.hex
+            obj/*.uavcan.bin
           fail_on_unmatched_files: true
           body: |
             Rolling nightly firmware build for the ARK32 configurator and production line.

.github/workflows/static-analysis.yml

@@ -88,10 +88,12 @@ jobs:
       - name: Build ARK + codegen check
         run: make codegen-check-ark -j$(nproc)
 
-  # Production full-flash image (BL + app + factory EEPROM). Fails if the
-  # 32 KiB layout or ARK 4IN1 ship defaults regress. See factory/README.md.
+  # Production full-flash images (BL + app + factory EEPROM). Fails if the
+  # flash layout or ARK ship defaults regress. See factory/README.md.
+  # Covers ARK_4IN1_F051 (32 KiB + committed BL) and ARK_G431_CAN (128 KiB
+  # + committed AM32_G431_BOOTLOADER_ARKG4_CAN under Bootloaders/).
   factory-image:
-    name: factory image (ARK 4IN1 full flash)
+    name: factory image (ARK 4IN1 + G431 CAN)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -101,17 +103,52 @@ jobs:
       - name: Install Arm toolchain
         uses: ./.github/actions/setup-arm-sdk
 
-      - name: Build + verify factory full-flash image
+      - name: Build + verify factory full-flash images
         run: make factory-image-check -j$(nproc)
 
       - name: Upload factory artifacts
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: ark-4in1-factory-image
+          name: ark-factory-images
           path: |
-            obj/ARK32_ARK_4IN1_F051_*.factory.bin
+            obj/ARK32_ARK_4IN1_F051_*.factory.img
             obj/ARK32_ARK_4IN1_F051_*.factory.hex
             obj/ARK32_ARK_4IN1_F051_*.eeprom.bin
+            obj/ARK32_ARK_G431_CAN_*.factory.img
+            obj/ARK32_ARK_G431_CAN_*.factory.hex
+            obj/ARK32_ARK_G431_CAN_*.eeprom.bin
+            obj/*.uavcan.bin
           if-no-files-found: error
           retention-days: 30
+
+  # Keep ARK_G431_CAN building under LTO so shared control-path PRs cannot
+  # silently break the 12S CAN target (no size gate yet — flash is ample).
+  build-ark-g431-can:
+    name: build ARK_G431_CAN
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install Arm toolchain
+        run: |
+          make arm_sdk_install
+          make arm_sdk_check
+
+      - name: Build ARK_G431_CAN
+        run: make ARK_G431_CAN -j$(nproc)
+
+      - name: Upload G431 CAN binary
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ark-g431-can
+          path: |
+            obj/ARK32_ARK_G431_CAN_*.elf
+            obj/ARK32_ARK_G431_CAN_*.bin
+            obj/ARK32_ARK_G431_CAN_*.hex
+            obj/*.uavcan.bin
+          if-no-files-found: ignore
+          retention-days: 14

.gitignore

@@ -1,4 +1,5 @@
 obj/
+bootloader/obj/
 downloads/
 tools/
 .vscode

Bootloaders/README.md

@@ -1,15 +1,19 @@
 # Bootloader images
 
-Prebuilt **[ARK32-bootloader](https://github.com/ARK-Electronics/ARK32-bootloader)** binaries, committed so the app can embed one and rewrite the bootloader region at boot (see `Src/bootloader_update.c`).
+Prebuilt **[ARK32-bootloader](https://github.com/ARK-Electronics/ARK32-bootloader)** binaries, committed so:
 
-[ARK32-bootloader](https://github.com/ARK-Electronics/ARK32-bootloader) is ARK’s fork of [upstream AM32-bootloader](https://github.com/am32-firmware/AM32-bootloader). For ARK hardware (ARK 4IN1 and related), always take images from **ARK32-bootloader releases**, not from the upstream bootloader repo alone.
+1. **F051 (ARK 4IN1):** the app embeds one and rewrites the bootloader region at boot (see `Src/bootloader_update.c`).
+2. **G431 CAN (ARK 12S CAN):** the app always embeds one (including `HWCI_PERF=1`) and rewrites the on-chip BL if it differs — so a manual or PX4 app-only flash still lands UAVCAN hw 0.71. `make factory-image-g431-can` also places the same image at `0x08000000` for blank-chip programming.
 
-These files are release artifacts converted from the published Intel HEX to a flat binary and checked in. They are stored as `.bin` rather than a C array so the bytes stay comparable against a release asset (a hex dump in a header cannot).
+[ARK32-bootloader](https://github.com/ARK-Electronics/ARK32-bootloader) is ARK’s fork of [upstream AM32-bootloader](https://github.com/am32-firmware/AM32-bootloader). For ARK hardware, always take images from **ARK32-bootloader**, not from the upstream bootloader repo alone.
+
+These files are release (or branch) artifacts as flat binaries. They are stored as `.bin` rather than a C array so the bytes stay comparable against a build or release asset (a hex dump in a header cannot).
 
 | File | Target | Signal pin | Source |
 |---|---|---|---|
 | `AM32_F051_BOOTLOADER_ARK4IN1_V18.bin` | STM32F051, ARK 4IN1 (default embed) | PB4; **PA15 nSLEEP low** | [ARK32-bootloader](https://github.com/ARK-Electronics/ARK32-bootloader) `master` (`cdce0a2`, #4); product `AM32_F051_BOOTLOADER_ARK4IN1` |
 | `AM32_F051_BOOTLOADER_PB4_V18.bin` | STM32F051 generic PB4 (reference only) | PB4 | [ARK32-bootloader v18.0.0](https://github.com/ARK-Electronics/ARK32-bootloader/releases/tag/v18.0.0) (`0d667c5`), asset `AM32_F051_BOOTLOADER_PB4_V18.hex` |
+| `AM32_G431_BOOTLOADER_ARKG4_CAN_V18.bin` | STM32G431/G491, ARK 12S CAN ESC (`ARK_G431_CAN`) | PB4 (also FDCAN TX PB9 / RX PA11); **DRV ENABLE (PC9) held low** | **In-tree** [`bootloader/`](../bootloader/) (`make bootloader-g431-can`). From ARK32-bootloader `feat/ark-g431-can-dual-protocol` (`060c417`, UAVCAN hw **0.71**) plus CAN FD. |
 
 | Resource | URL |
 |---|---|
@@ -19,20 +23,37 @@ These files are release artifacts converted from the published Intel HEX to a fl
 
 `.gitignore` ignores `*.bin` repo-wide; this directory is un-ignored explicitly.
 
-## How the image is used
+## How the images are used
+
+### F051 app-side embed
 
 `Src/bl_image.S` pulls the file in with `.incbin` and pads it to the bootloader region size with `0xFF`. The linker script places it in a dedicated `.bl_image` section and asserts that it is exactly the region size and that it does not live inside the region it will erase.
 
-The image is linked for **all F051 targets by default**, including `HWCI_PERF=1`
-(LTO leaves enough flash for the image and the perf struct). To strip it for a
-size emergency or pure perf A/B:
+**F051** embeds on release builds by default. `HWCI_PERF=1` does **not** embed it (flash goes to the perf struct; the HWCI rig already has a bootloader on-chip).
+
+**G431 CAN** always embeds (16 KiB region, including `HWCI_PERF=1`). First app boot rewrites `0x08000000..0x08003FFF` if the on-chip BL differs.
+
+To strip the embed:
 
 ```bash
 make ARK_4IN1_F051 EMBED_BOOTLOADER=0
-make ARK_4IN1_F051 HWCI_PERF=1 NO_EMBED_BL=1
+make ARK_G431_CAN  NO_EMBED_BL=1
 ```
 
 Either kill switch disables embed (`EMBED_BOOTLOADER=0` or `NO_EMBED_BL=1`).
+`HWCI_PERF=1` also disables embed automatically on F051 only.
+
+### G431 CAN factory image
+
+`BL_IMAGE_G431_CAN` in the `Makefile` points at `AM32_G431_BOOTLOADER_ARKG4_CAN_V18.bin`. The same file is app-side embedded (above) and consumed by:
+
+```bash
+make factory-image-g431-can
+# or
+make factory-image-check
+```
+
+The factory builder places it at `0x08000000` (16 KiB region) and pads with `0xFF` to the app base at `0x08004000`. See [factory/README.md](../factory/README.md).
 
 ## Risk / recovery
 
@@ -45,6 +66,8 @@ App-side BL rewrite erases flash pages at `0x08000000` (reset vectors and the on
 
 ## Updating
 
+### F051
+
 1. Build or download the ARK 4IN1 product from [ARK32-bootloader](https://github.com/ARK-Electronics/ARK32-bootloader) (`make AM32_F051_BOOTLOADER_ARK4IN1`), or convert a release `.hex` with the pinned toolchain.
 2. Install the flat binary:
 
@@ -59,7 +82,20 @@ App-side BL rewrite erases flash pages at `0x08000000` (reset vectors and the on
 
 3. Point `BL_IMAGE_F051` in the `Makefile` at the new path if the filename changed (default is already the ARK4IN1 blob).
 4. Update the table above with the release tag / source commit.
-5. Rebuild — the `.bin` is an explicit prerequisite of the `.elf`, so the change is picked up.
+5. Rebuild — the `.bin` is an explicit prerequisite of the F051 `.elf`, so the change is picked up.
+
+### G431 CAN
+
+Source of truth is [`bootloader/`](../bootloader/), not a separate checkout:
+
+```sh
+make bootloader-g431-can
+# installs Bootloaders/AM32_G431_BOOTLOADER_ARKG4_CAN_V18.bin
+make ARK_G431_CAN
+make factory-image-g431-can
+```
+
+`make ARK_G431_CAN` rebuilds the image when `bootloader/` sources change. Point `BL_IMAGE_G431_CAN` in the `Makefile` at the new path only if the filename changed.
 
 **Do not embed the generic `…_PB4` image on ARK 4IN1** if the chip has ARK4IN1 BL: first boot would rewrite PA15 nSLEEP-off back to stock.
 
@@ -76,4 +112,11 @@ cmp -n "$(wc -c < Bootloaders/AM32_F051_BOOTLOADER_ARK4IN1_V18.bin)" \
   /tmp/embedded.bin Bootloaders/AM32_F051_BOOTLOADER_ARK4IN1_V18.bin
 ```
 
-The compare is limited to the source file's length because `.bl_image` is padded out to the full 4096-byte region with `0xFF`.
+The compare is limited to the source file's length because `.bl_image` is padded out to the full region (F051 4096, G431 CAN 16384) with `0xFF`. For G431:
+
+```sh
+arm-none-eabi-objcopy -O binary --only-section=.bl_image \
+  obj/AM32_ARK_G431_CAN_*.elf /tmp/embedded.bin
+cmp -n "$(wc -c < Bootloaders/AM32_G431_BOOTLOADER_ARKG4_CAN_V18.bin)" \
+  /tmp/embedded.bin Bootloaders/AM32_G431_BOOTLOADER_ARKG4_CAN_V18.bin
+```

Inc/bootloader_update.h

@@ -3,7 +3,8 @@
 /*
  * Optionally rewrite the AM32 bootloader from an image embedded in the app.
  * No-op when EMBED_BOOTLOADER is not defined (e.g. EMBED_BOOTLOADER=0 /
- * NO_EMBED_BL=1 kill switches).
+ * NO_EMBED_BL=1 kill switches, or F051 HWCI_PERF=1). G431 CAN embeds
+ * by default including HWCI so a field app flash still refreshes the BL.
  *
  * Call once early after clocks/flash are usable and before motors run.
  * Arms IWDG only when an update is about to run. Calls NVIC_SystemReset()

Inc/common.h

@@ -79,7 +79,12 @@ typedef struct fastPID {
 } fastPID;
 
 /*
-  input signal types
+ * input signal types (eeprom input_type / DroneCAN INPUT_SIGNAL_TYPE)
+ *
+ * AUTO_IN: detect first wire protocol (DShot or PWM). DroneCAN may run in
+ * parallel; while a RawCommand stream is live it owns throttle, otherwise
+ * the detected wire input is used.
+ * DRONECAN_IN: exclusive CAN — DShot/PWM capture IRQs disabled at init.
  */
 enum inputType {
 	AUTO_IN = 0,

Inc/debug_uart.h

@@ -0,0 +1,62 @@
+/*
+ * debug_uart.h — ARK 12S CAN debug console (USART2 TX on PB3 AF7 @ 115200)
+ *
+ * Same pinout as AM32-bootloader#60 / ARK bootloader USE_DEBUG_UART.
+ * App uses polled TX (not DMA1 CH1 — that is the DShot capture channel).
+ *
+ * Opt in with USE_DEBUG_UART on the target (ARK_G431_CAN).
+ *
+ * ISR-safe path: debugUartLog*() queues events; debugUartService() drains
+ * them from the main loop with blocking UART writes.
+ */
+#ifndef DEBUG_UART_H_
+#define DEBUG_UART_H_
+
+#include <stdint.h>
+#include "targets.h"
+
+/* Event codes for debugUartLogEvent() — always defined so call sites compile
+ * on targets without USE_DEBUG_UART (stubs are no-ops). */
+enum {
+	DBG_EVT_BOOT = 1,
+	DBG_EVT_NFAULT,	     /* gate-driver nFAULT, unclassified (GDF etc.) */
+	DBG_EVT_NFAULT_UVLO, /* nFAULT + low bus → undervoltage class */
+	DBG_EVT_NFAULT_OCP,  /* nFAULT + high current/drive → overcurrent class */
+	DBG_EVT_NFAULT_OTW,  /* nFAULT + high temp → overtemperature class */
+	DBG_EVT_STUCK,
+	DBG_EVT_LVC,
+	DBG_EVT_SIGNAL,
+	DBG_EVT_DESYNC,
+	DBG_EVT_ACQ_DESYNC,
+	DBG_EVT_STALL,
+	DBG_EVT_GD_WAKE,
+	DBG_EVT_GD_SLEEP,
+};
+
+#ifdef USE_DEBUG_UART
+
+void debugUartInit(void);
+/* Blocking print (main / init only — not from ISRs). */
+void debugUartPrint(const char *msg);
+void debugUartPrintf(const char *fmt, ...);
+/* Queue a state transition (ISR-safe). */
+void debugUartLogState(uint8_t from, uint8_t to);
+/* Queue a named event (ISR-safe). */
+void debugUartLogEvent(uint8_t event);
+/* Drain the queue — call once per main-loop tick. */
+void debugUartService(void);
+
+#else /* !USE_DEBUG_UART */
+
+/* Macros (not empty inlines): format-string args are not evaluated and
+ * do not land in F051 .rodata when the target has no debug UART. */
+#	define debugUartInit() ((void)0)
+#	define debugUartPrint(msg) ((void)0)
+#	define debugUartPrintf(...) ((void)0)
+#	define debugUartLogState(from, to) ((void)0)
+#	define debugUartLogEvent(event) ((void)0)
+#	define debugUartService() ((void)0)
+
+#endif /* USE_DEBUG_UART */
+
+#endif /* DEBUG_UART_H_ */

Inc/eeprom.h

@@ -82,7 +82,17 @@ typedef union EEprom_u {
 			uint8_t filter_hz;	       // 181
 			uint8_t debug_rate;	       // 182
 			uint8_t term_enable;	       // 183
-			uint8_t reserved[8];	       // 184-191
+			/* Width in C of the thermal foldback ramp below full
+			 * derate; the onset is limits.temperature. Lives in the
+			 * can block because that is where the free bytes are -
+			 * the limiter itself is target-agnostic, and 0xFF on a
+			 * board that never wrote this page is coerced in
+			 * settings.c. */
+			uint8_t temp_derate_band; // 184
+			/* CAN FD data-phase bitrate in Mbps: 0 = auto-match
+			 * the host (1/2/4/5), 1/2/4/5 = pinned. Byte 185. */
+			uint8_t fd_mbps;     // 185
+			uint8_t reserved[6]; // 186-191
 		} can;
 	};
 	uint8_t buffer[192];

Inc/esc_state.h

@@ -36,7 +36,9 @@ extern volatile esc_state_t esc_state;
 /* Saturating count of named transitions that violated the edge table. */
 extern volatile uint16_t esc_illegal_edge_count;
 
+#ifdef USE_DEBUG_UART
 const char *escStateName(esc_state_t s);
+#endif
 esc_state_t escGetState(void);
 
 /* --- predicates (flag-backed; ISR may update flags before reconcile) --- */