Safety and Debugging Index

This appendix makes failure evidence discoverable without hiding it behind the final implementation. Each entry links to the week where its physical symptom, diagnosis, and repair belong.

Power and hardware safety

  • Two destructive electrical incidents - two unresolved shorts destroyed two STM32 boards, three TB6612 modules, and one ST-Link in total. The notes separate observed damage from unconfirmed root cause.

  • Raspberry Pi GPIO is not 5 V tolerant; the PS2 receiver uses 3.3 V logic.

  • The TJA1050 module still requires its documented 5 V supply for valid CAN transceiver levels even though the MCP2515 logic side is lower voltage.

  • A separate Raspberry Pi supply branch reduces exposure but is not necessarily galvanically isolated; shared grounds and communication paths still matter.

  • High- and low-voltage harnesses must be physically separated before probing.

  • Continuity checks are only triage. Reintroduce repaired hardware one module at a time with current limiting.

Firmware and transport

  • CAN driver and parser failures - incorrect TXBnCTRL addressing, missing can_frame definitions, CMake regeneration, and Python capture-pattern behavior.

  • CubeMX failed to persist TIM3 ENCODER_MODE_TI12; the .ioc required an explicit text correction or one encoder would have one-quarter resolution.

  • The ST VS Code extension may report a regenerated project as corrupted; opening a clean CubeMX-generated project is the recorded workaround.

  • Raspberry Pi Wi-Fi may reach UP without a DHCP IPv4 address. CAN and GPIO testing remain independent of that failure.

Motion and control

  • Rear encoder harness swap - forward motion was correct while lateral and angular channels exchanged roles.

  • PID positive-feedback runaway - all raw encoder signs opposed commanded forward motion.

  • Heartbeat stop overwritten - normal control restored PWM immediately after the stop call.

  • Missing 45-degree projection - both translation axes measured low while rotation scale remained plausible.

  • REP-103 frame mirror - lateral and angular outputs required an output-frame correction, not retuned encoder signs.

  • STM32 still uses theoretical CPR 2800 for the disabled PID branch while ROS 2 odometry uses calibrated CPR 2779. The mismatch is intentional and should not be “fixed” without revisiting that decision.

  • Open-loop motor mismatch can create physical yaw during nominal translation; ground-truth analysis must separate this behavior from odometry math errors.

Sensing and localization

Documentation rule

Expanded chapters should retain the full evidence chain: symptom -> competing hypotheses -> discriminating test -> root cause -> repair -> regression test. Removing the failed path would make the hardware reproduction less reliable.