Document source: e47887d3a11f; code reference: e47887d3a11f. 中文. Source language: en; requested: en; actual: en; translation: original.

Source documentation does not establish software or physical hardware qualification. See the support and qualification records for their exact scope.

STM32G474RET6 / MB1367 selected peripheral platform

This is a source-reviewed STM32G474RET6 baseline for NUCLEO-G474RE. It implements CPU startup, a fixed clock transaction, TIM2 time, package-valid GPIO on A/B/C/D/F/G, six UART IRQ byte controllers, SPI1/2 finite polling, TIM3/4 CH1 fixed-base PWM, independent IWDG and PA0/PA1 EXTI edge events. A separate silicon software fixture adds ADC1 PA0/IN1, finite TIM6-triggered normal DMA, I2C1 PB8/PB9 and full physical dual-bank Flash. That baseline alone does not establish other G4 peripheral modes. Independent software references now select finite coupled PWM/ADC and CAN FD under their own exact contracts. USB, Ethernet and low-power continuity remain outside these profiles. Unsupported modes fail the resolver; actual PCB inspection and all HIL remain not executed.

Reviewed sources

Source	Revision / pinned identity	Relevant facts
STM32G474xx datasheet	DS12288 Rev6	M4F, 170 MHz, memory and clock limits
STM32G4 reference manual	RM0440 Rev9	RCC/PWR/Flash boost sequence, TIM2, GPIO, LPUART
MB1367 user manual	UM2505 Rev7	X3, VCP bridges and LD2 wiring
CMSIS Device G4	626ee412334a5ed2e5b320af5a8d77d69f03a558	Actual G474 register masks/layout, IRQ102, GCC startup

Source hashes and original SDK licensing belong in the dependency lock and review evidence. Vendor notices and LICENSE.md remain unchanged. The public Nexus interface stays independent of register definitions.

Exact target and memory

The exact target is STM32G474RET6, Cortex-M4F, ARMv7E-M, FPv4-SP-D16 hard ABI, DSP and DWT CYCCNT. External IRQ IDs cover 0..101, including TIM2=28, LPUART1=91 and FMAC=101. Four priority bits are implemented.

Flash is 512 KiB at 0x08000000. Startup checks observed DEV_ID 0x469, Flash density 512 KiB and actual DBANK=1. DEV_ID identifies a silicon category, not the package or order code. DBANK=1 yields 2 KiB pages across two banks; DBANK=0 is rejected by this first geometry profile. Startup never writes option bytes or performs erase or programming. A product must verify the exact order code and option state.

RAM consists of 80 KiB SRAM1 at 0x20000000, 16 KiB SRAM2 at 0x20014000, and 32 KiB CCM with a system-bus alias at 0x20018000. The CCM CPU address 0x10000000 aliases the same physical storage and is not counted again. The default linker layout uses 96 KiB SRAM1/2 region at 0x20000000 and reserves 2048 bytes for MSP. These 96 KiB are DMA-visible. CCM is declared once at 0x10000000; silicon also permits DMA through its 0x20018000 alias (RM0440 p89). The selected software policy excludes both CCM addresses from the default linker region and generated DMA domains. No caller buffer is silently relocated into another memory region.

Reference Board facts and uncertainty

Function	Reviewed default reference	Required physical confirmation
HSE	X3 24 MHz crystal, SB25/SB26 on, SB27 off	Fitted X3 and actual bridge/revision
LED LD2	PA5, active high, SB6 on	LED and bridge population
ST-LINK VCP	LPUART1 PA2 TX / PA3 RX, AF12; SB17/SB23 on, SB18/SB22/SB13/SB19 off	Actual bridge and ST-LINK connection

The alternate ST-LINK MCO 8 MHz clock wiring needs a different reviewed profile and is not accepted here. The VCP route is LPUART1, not USART2. Source review does not prove physical electrical states, UART reception, board power or oscillator frequency. Private PCB data and bridge policy stay outside the platform.

Clock transaction and rollback

Admission requires privileged task context, incoming masks clear, positive phase poll budget, reset-like HSI16 selected, PLL/HSE idle and reserved TIM2/NVIC unused. Unknown active resources are rejected before effects. A poll count bounds work; it is not an elapsed-time deadline while the timebase is unavailable.

The reviewed profile is HSE 24 / PLLM 6 / PLLN 85 / PLLR 2 = 170 MHz. PLL input is 4 MHz and VCO 340 MHz, inside the datasheet limits. HCLK/APB1/APB2 and the TIM2 kernel clock are 170 MHz. G4 uses SW_HSI=1 and SW_PLL=3; F4 clock encodings are not reused.

Startup acquires PWREN with readback and a barrier before reading PWR state. It selects voltage range 1, waits for VOSF clear, uses boost mode and four Flash wait states, starts and observes HSE/PLL, switches through AHB/2 (85 MHz), waits at least the required transition interval, then selects AHB/1. The actual M4 object contains 85 dependent SUBS/BNE iterations at verified 85 MHz. At least 170 instructions/core cycles gives a conservative 2 microsecond lower bound; IRQs can extend it. Physical timing remains unmeasured. Volatile accesses, readback and ordering barriers cannot be optimized away.

Failure records the primary result, cleanup result and still-owned effects. Rollback restores observed HSI before disabling PLL/HSE or reducing Flash/voltage settings. TIM2 source withdrawal and NVIC proof precede removing its ownership. Failed rollback retains the resource bits for explicit retry; it never reports successful cleanup or publishes usable I/O. Stop requires every external peripheral/task consumer already joined; no hidden coordinator guesses this.

Time, GPIO and serial contracts

TIM2 is reserved: 32-bit count, prescaler 169, ARR 0xffffffff, 1 MHz, overflow IRQ priority0 with no OS API. Snapshot saves/restores interrupt state and corrects one pending overflow; IRQ must run at least once per 2^32 microseconds. NMI, HardFault, dynamic reclocking and deep sleep are outside this time contract.

GPIO initialization preloads BSRR and observes ODR before exposing a mode. It observes push/pull and pull configuration, then the selected MODER bits. Partial failure retains the instance for an explicit inactive-level rollback. Hot writes use BSRR directly. Toggle requires the single-owner serialization contract.

The RE package inventory has 52 pads across A/B/C/D/F/G; missing pads and GPIOE are rejected. Inventory does not establish a Board connector or electrical route. PF0/PF1 remain reserved by the fixed HSE profile and PG10 by the unchanged NRST option. GPIO admission cannot silently repurpose those pads.

LPUART1 supports caller-owned byte rings and one borrowed TX request. Its actual 20-bit BRR is round(256PCLK/(16baud)), range0x300..0xfffff; 115200 at 170 MHz uses PRESC=16 (register7), BRR 23611. Initialization observes TEACK/REACK before publishing the face. IRQ is bounded to one TX byte and one RX byte, reports aggregate corruption/overflow loss and preserves older ring contents. It does not reuse F4’s USART divisor, register offsets or error-clear sequences.

USART1/2/3 and UART4/5 use the same IRQ-byte ownership contract through separate static contexts and exact gates, IRQs and pin routes. They use PRESC=1 and OVER16 with their own BRR calculation; LPUART’s 20-bit divisor and PRESC=16 are not reused. The configured 170 MHz bus/kernel profile is observed before admission. Chip-valid routes do not imply that those signals reach the default NUCLEO VCP or any populated connector.

TXE proves a register can accept a byte; TC proves the final wire byte completed. Request metadata/payload/ring/private registers/wake target cannot overlap. Cancel and timeout disable new sends, then wait for actual wire completion. Failed drain retains QUARANTINED storage; later hardware proof can settle it. The provider detaches its active pointer and interrupt sources before SETTLED, which is its final request access. Cold stop closes admission, joins captured callbacks, observes UE and TEACK/REACK off, disables/clears/readbacks NVIC, then withdraws ring/wake ownership. FreeRTOS-capable sinks require actual priority and priority-group validation; waking does not start a scheduler.

Finite SPI, fixed PWM and irreversible watchdog

SPI1 and SPI2 implement eight-bit full-duplex polling with modes 0..3, explicit active-low GPIO CS, finite absolute deadlines and at most 256 bytes per call. The G4 FIFO uses DS=7, FRXTH and byte accesses to DR. At the fixed 170 MHz kernel clock, requested SCK is limited to 42.5 MHz: the divide-by-two rate of 85 MHz exceeds DS12288 Table89. The divider rounds toward a rate no faster than the endpoint request. SPI/PWM alternate outputs select OSPEEDR=11, matching the SPI table’s stated output-speed condition; UART keeps its separate policy. DMA and asynchronous SPI are unsupported.

Transfer completion observes the receive path and empty/idle shifter state. Timeout or hardware error faults the port and attempts bounded reset. Both reset edges and idle state require readback. An accepted polling call cannot return before wire drain and inactive CS are proved. Failed reset or CS proof retains the executor, caller buffers and all controller/CS owners, masks IRQs and invokes the fault observer; it parks if that observer returns. Product terminal recovery remains external. Idle stop/recovery failures retain their separate retryable private leases. Output buffers and transfer counts cannot alias owned state or MMIO, including the RCC reset register. Generated cleanup retains clocks and pin leases until the port and its CS endpoints have stopped.

The independent IWDG is optional and is not enabled by Platform startup. A successful nominal timeout configuration uses the DS12288 Table45 LSI envelope of 29.5..34 kHz under its stated conditions. The provider rejects a windowed configuration and busy shadow updates before activation, observes hardware option activation, and returns unknown bounds while automatic shadow updates remain busy. It reports actual debug freeze state. A failed preactivation LSI or debug rollback retains a retryable stop lease. Once CCCC is issued, activation is irreversible even if programming fails; a running watchdog keeps Platform stop from claiming complete withdrawal.

The ordinary fixed-pwm mode uses TIM3 CH1 PA6 AF2 or TIM4 CH1 PB6 AF2 with independent, exclusive whole-controller PWM. The reviewed base is edge-aligned upcounting and active-high, with tick clock 170 MHz divided by an integer 1..65536, period 1..65535 and duty 0..period. Duty uses CCR preload; a call does not imply an immediate electrical change. Zero and full duty are explicit constant levels. Runtime period/base changes, other channels, complementary outputs, capture, break, IRQ and DMA are unsupported. Start establishes a quiet UG epoch before exposing AF/output/CEN. Stop observes channel/counter withdrawal and the Board inactive GPIO level; failed close retains clocks, pin state and cleanup duty.

The separate shared-fixed-pwm software reference selects exactly TIM3 CH1/PA6 and CH2/PA7 AF2. Two existing PWM factory faces and readonly channel references share one physical owner and one fixed tick/period configuration. The complete pair must agree on the base; another whole-TIM3 owner or PA6/PA7 user conflicts. Cold construction initializes both disabled channels once. Set stages only the selected CCR; a channel joining its running peer adopts the current phase without UG or counter restart. Neither coherent group start nor a full first pulse is promised. Channel stop withdraws its own enable and drives its own Board inactive GPIO; only the last lane stops the counter. The lifecycle caller quiesces both channel users before final Platform stop. One physical close may use exclusive reset before Platform restores both pin snapshots and releases added clocks. Failed close or outer restoration retains cleanup responsibility. The canonical input uses a 1 MHz tick, 1000-tick period and Board-declared PA6-low/PA7-high inactive latches, with no timer IRQ or DMA. It does not establish PCB wiring, measured phase/pulse timing, electrical safety or HIL.

These count limits describe the timer’s logical capability. For example, 170 MHz tick and period two generate an 85 MHz logical waveform; they do not prove that an attached pad/load can reproduce it. DS12288 Table56 gives the following conditional limits for OSPEEDR=11 and 30 pF load:

GPIO supply condition	Datasheet maximum pad toggling frequency
VDD 1.62..2.7 V	50 MHz
VDD 2.7..3.6 V	120 MHz

The fixed clock profile does not establish actual GPIO supply or load. A Board must qualify its voltage, capacitance, pulse width and electrical path before using the corresponding rate. No unconditional 85 MHz pad performance or electrical safety is claimed by the software counter range.

The mainstream adaptation contract describes cross-family differences, source identities and the separate software/HIL acceptance boundary. No G4 extension inherits F407 or another G4 part’s physical qualification.

Software evidence and outstanding qualification

Exact EXTI extension

EXTI0/PA0 and EXTI1/PA1 use independent IRQ6/7 with explicit priority and caller-selected 1..4096 event slots. RM0440 Rev9 section10.2.3 pp367–368 gives the GPIOA zero encoding of each SYSCFG_EXTICR1 field; sections15.3–15.5 pp441–453 describe interrupt selection and W1C EXTI_PR1. The official CMSIS layout and exact-part package inventory supply the register and pin facts. tests/contracts/g474_assembly/exti_board is only a software fixture; it does not assert an actual NUCLEO button, connector, bias resistor or electrical route.

The common edge-event face has a single task reader and one IRQ producer per line. Each invocation acknowledges one selected pending bit, samples at most one level and records one timebase timestamp. Hardware edges may coalesce; both-edge direction reflects the sampled level. No polling loop reconstructs lost edges. A full ring preserves older events, exposes a separate loss boundary and only then admits later events. CPU exclusion per copied event is bounded; read work scales with the explicit caller capacity.

Platform admission checks line masks, triggers, pending and NVIC before changing global clocks or GPIO. A shared SYSCFG gate has one generated owner and retains a preexisting enable. Each line saves its mux nibble and restores only that field after its own sources and independent vector are observed withdrawn. GPIO cold leases restore the original input/analog state at complete Platform stop. A failed cleanup keeps storage and recovery responsibility. Wake binding checks actual IRQ policy and joins captured callbacks before releasing storage. No public API, dynamic allocation, worker, runtime registry or extra OS layer is introduced.

The two authored EXTI fixtures select baremetal/FreeRTOS and exact three/two event capacities. Native GoogleTest/GoogleMock executes the real provider and generated two-line factory; ARM fixtures retain the selected ops/handlers and actual FreeRTOS graph. Empty and existing GPIO/LPUART fixtures remain separate regressions. Physical HIL remains not_executed: a future admitted station must confirm PA0/PA1 accessibility and bias, inject observed edges, compare instrument counts/waveforms with coalesced/loss semantics, measure IRQ latency and prove source withdrawal before storage reuse. Software success is not that evidence.

ADC1 shots and finite trigger blocks

The acquisition fixture selects PA0/ADC1_IN1, single-ended 12-bit raw counts, SYSCLK/128 = 1.328125 MHz, bulb sampling and sample code0 (2.5 cycles). It owns the ADC12 common clock and explicit SYSCLK mux, rejects other ADC owners, waits 22 us for the regulator and 5 us after calibration. These delays preserve the 20 us and four-ADC-cycle minimums after 1 MHz time quantization. ES0430 2.7.8–10 requires keeping the mux selected and discarding the first conversion after idle or software STOP. Each enable and conversion clears, barriers and reads back its own completion flags; stale ADRDY/EOC cannot become new data. Each shot performs two conversions separated by a 3 us wait and publishes only the second. The masked prime/arm phase has one absolute 100 us deadline. Sampling is disabled before returning or waiting for another block. Failed drain retains the calling frame or producer loan. Declared reference voltage is nominal; raw counts do not establish accuracy.

Finite DMA additionally owns TIM6, DMA1 channel1 and DMAMUX1 channel0 request5. Each block is primed before arming. Exact rates 2.5–50 kHz must divide the 1 MHz timer tick. RM0440 bulb sampling ends on the next trigger, so SMPR alone does not bound its aperture. DS12288 Table66 limits it to 2.5–640.5 ADC cycles: at the selected clock, the 20–400 us periods minus 12.5 conversion cycles give 14.0625–518.75 sampling cycles. After UG, CNT is set to period minus ten; the first trigger follows ten timer ticks after CEN, with the same 100 us deadline checked before and after enabling CEN. The common SYSCLK source fixes these ratios. Host models cannot establish analog timing or physical clock accuracy.

Halfword normal DMA never overwrites a consumer loan. IRQ stops the trigger; task service observes DMA/ADC withdrawal and disabled ADEN before publishing. The next service explicitly rearms an available block; backpressure leaves the sampler disabled. READY/BORROWED blocks still require consumer release. Close restores and reads back all owned timer, DMA and mux configuration before releasing the lease; refused restoration retains it for retry. The mode has trigger gaps and no hardware aperture timestamp. ES0430 2.3.1 requires specific TC/HT/TE acknowledgement, never global GIF clear on an active lane.

I2C1 finite master messages

I2C1 uses PB8/PB9 AF4 open drain, external pull-ups, HSI16 kernel, analog filter, DNF0 and TIMINGR 0x30420f13. Standard-mode rise at most 1000 ns and fall at most 300 ns are Board requirements. One transaction has one to eight 7-bit messages, each one to 256 bytes. A 256-byte message uses 255+1 RELOAD chunks; messages use repeated START and one final STOP. STOPF and cleared BUSY precede return. Errors reset the local controller and require explicit recovery without GPIO pulses or replay. This does not prove a physically stuck bus recovered. The private V2 engine has independently asserted G474 SDK offsets and masks. ES0430 2.15.2 permits clearing master-only spurious BERR and continuing; NACK, arbitration and overrun still abort. Slave, IRQ and DMA modes are excluded.

Full physical Flash

The Flash face exposes all 512 KiB, two banks of 128 pages, 2 KiB erase pages and 8-byte ECC programming units. DBANK=1, BFB2=0 and observed FB_MODE=0 are required; the SYSCFG clock remains owned and observed before reading the live mapping. Remapped banks and foreign Flash control modes are rejected before unlock, data or erase effects. Page128 selects bank2/page0. There is no product reservation. The fixed software reference assumes 3300 mV; the Board must confirm programming voltage. Geometry explicitly advertises fresh-erase provenance: each written ECC line must come from a real erase, which byte readback cannot prove. Each all-ones input unit skips the physical pulse so it does not consume an erased ECC line. Program and erase wait for any live pulse after an elapsed deadline and relock after idle. Each pulse clears and reads back its own W1C status, checks the prepared control mode, and requires a fresh EOP after BSY withdrawal; a preceding page cannot provide its completion. RM0440 Category3 Table16 and FLASH_SR.Bit0 require EOPIE for EOP to latch. EOPIE/ERRIE are explicitly enabled only for the owned pulse while exclusively claimed FLASH_IRQn4 remains disabled in NVIC. Cold/live enabled, pending, active IRQ or ECCIE owners are rejected. Cleanup observes source withdrawal, clears status, then clears NVIC pending and observes disabled, not-pending and not-active before release without changing its priority. Failed cleanup retains a retryable lease. ES0430 2.2.2 requires disabling data cache before pulses and resetting it before restoring the original policy. Products own explicit regions, watchdog, execution stalls and power-loss recovery. Option writes, fast programming and mass erase are excluded.

Failed relock or cache restoration retains a private cleanup lease and rejects further reads/writes. Platform stop retries the actual restoration before releasing that state.

These modes are separate software fixtures in tests/contracts/g474_assembly. The exact official ADC/DMAMUX inline graph is locked to STM32CubeG4 v1.6.3 driver f5929f431f9effe45fbe18f5337e4753ced9ac92; Nexus retains transfer and IRQ ownership. Production register models, generated factories and ARM links have different exits from clean SDK reproduction and physical HIL. Every physical result remains not_executed.

Existing baseline evidence

Actual host models execute the production register algorithm with official SDK layout and masks. They verify bounded timeout, failed rollback, initial-latch failure, source withdrawal, request alias rejection, wire drain, overflow, callback borrow and independent state. They do not establish oscillator, voltage, timing, peripheral errata or physical IRQ behavior.

The earlier baseline ARM C11 build with GCC 14.3 and the pinned official GCC startup links empty, LED, UART and mixed bare-metal ELFs. The selected types occupy System 56, GPIO 12, UART 72 and TX request 32 bytes. The small profile costs are measured from those baseline ELF files and include the 2048-byte MSP reservation; they are not inferred from host sizeof or a size promise for the expanded modes. Current resource and qualification records must bind their exact selected configuration. Unselected GPIO/UART symbols disappear through section GC.

Generated typed factories, both OS backend compositions, clean reproducible builds, exact SDK lock/bundle identities and any later Board HIL have separate qualification exits. Software-only delivery must keep physical status unknown.