diff --git a/Architecture/IO_ARCHITECTURE.md b/Architecture/IO_ARCHITECTURE.md index 53448f8..feffb04 100644 --- a/Architecture/IO_ARCHITECTURE.md +++ b/Architecture/IO_ARCHITECTURE.md @@ -19,7 +19,7 @@ temperature and pressure sensors, and an external starter switch. | --- | ---: | --- | | Crank trigger input | 1 | 12 V active-low Hall, timer capture | | Cam trigger input | 1 | 12 V active-low Hall, timer capture | -| Deadman input | 1 | Dedicated 5 V vehicle-logic engine-permit input | +| Deadman inputs | 2 | Dedicated, independent 5 V vehicle-logic engine-permit inputs | | Thermistor inputs | 4 | Air, oil, water, and one spare temperature input | | General analogue inputs | 9 | Protected 0-5 V sensor channels | | ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` | @@ -53,32 +53,11 @@ the scope of this document. ## Engine-Position Inputs -Crank and cam are dedicated inputs, not generic digital inputs. The assumed -sensor type is a three-wire, active-low, open-collector/current-sinking Hall -sensor. - -```text -+12V_SENS -- ECU-side pull-up -- Hall signal harness -- Hall output - | - protection / divider / fast RC - | - 3.3 V Schmitt trigger - | - STM32 timer-capture pin -``` - -The ECU-side pull-up is connected to regulated `+12V_SENS`, not to 3.3 V. -This gives the harness a robust 12 V-class signal while keeping the MCU domain -local and protected. An initial pull-up near 4.7 kohm is a reasonable starting -point, subject to the selected sensor's output-current specification and the -cable capacitance. - -The divider scales the 12 V signal to the Schmitt-buffer input. A deliberately -small, configurable RC filter follows the divider to reject spark-induced -glitches without materially slowing genuine trigger edges. A nominal 1 nF -capacitor footprint, with alternatives such as 470 pF and 2.2 nF, should be -provided and validated with ignition active. The final divider, pull-up, clamp, -filter, and cable requirements depend on the Hall part number and harness. +Crank and cam are dedicated timer-capture inputs, not generic digital inputs. +The V1 timing pattern remains two crank pulses per revolution and one cam pulse +per 720-degree cycle. Their interface, harness/shield termination, protection, +conditioning, and hardware/firmware glitch-rejection requirements are defined +in [ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md). ## Analogue Inputs @@ -174,25 +153,28 @@ actual harness and input-function requirements. ## Deadman Engine-Permit Interlock -The deadman input is a dedicated 5 V vehicle-logic input, not a generic digital -input. It is conditioned through the normal protected 5 V input interface and -level-shifted to protected 3.3 V logic. A loss of the external deadman signal -is the not-permitted state. +The deadman uses two dedicated 5 V vehicle-logic inputs, not generic digital +inputs. The steering-wheel switch provides two electrically independent, +normally-open contacts. Each contact has its own connector pin, protection, +filtering, default-low bias, and conditioned logic path. This makes an open +circuit or a short to the 5 V source on one signal path non-permissive. -The resulting `DEADMAN_OK` signal has two independent destinations: +The resulting 5 V `DEADMAN_OK` signal is high only when channel A reports +held and the independently conditioned, inverted channel B reports not +released. It has two independent destinations: -- It enters an MCU digital input so firmware can observe whether the deadman is - locked or unlocked, disable scheduling, and report the state. -- It is combined in hardware with the MCU's `MCU_RUN_PERMIT` output to produce - `ENGINE_PERMIT`. +- `DEADMAN_A_STATUS` and `DEADMAN_B_STATUS` enter MCU digital inputs so + firmware can observe each contact, detect disagreement, disable scheduling, + and report the state. +- `DEADMAN_OK` is combined in hardware with the MCU's `MCU_RUN_PERMIT` output + to produce `ENGINE_PERMIT`. ```text -5 V deadman input --> protection / level shift --> DEADMAN_OK --+--> MCU input - | -MCU_RUN_PERMIT --------------------------------------------------AND--> ENGINE_PERMIT - | - driver enable pins, or - command-signal gating +deadman contact A --> protected input --> DEADMAN_A_HELD --------+ + +--> valid-state logic --> DEADMAN_OK --+ +deadman contact B --> protected input --> inverted --> DEADMAN_B_RELEASED -+ | + AND --> ENGINE_PERMIT +MCU_RUN_PERMIT ----------------------------------------------------------------------------------------------+ ``` `ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers @@ -200,13 +182,16 @@ where those inputs are provided. If a selected driver has no suitable enable input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using logic that defaults to the disabled state on power-up or loss of power. -This hardware path ensures that releasing the deadman stops injector and -ignition commands even if firmware or a timer output fails to respond. Firmware -must also clear/disable pending injection and dwell schedules whenever -`DEADMAN_OK` becomes invalid. A firmware test mode may assert -`MCU_RUN_PERMIT`, but it does not override the physical deadman input; bench -operation requires a deliberate external test arrangement that presents a valid -deadman signal. +This hardware path ensures that releasing the deadman, an open circuit, or a +single signal-path short to the 5 V source stops injector and ignition commands +even if firmware or a timer output fails to respond. It does not claim to cover +a common-mode fault that energises both paths. Firmware must clear/disable +pending injection and dwell schedules whenever `DEADMAN_OK` becomes invalid or +the two MCU status inputs disagree. A firmware test mode may assert +`MCU_RUN_PERMIT`, but it does not override the physical deadman inputs; bench +operation requires a deliberate external test arrangement that presents the +valid two-channel held state. The detailed signal and fault model is defined in +[DEAD_MAN.md](IO_MODULES/DEAD_MAN.md). ## Outputs @@ -266,8 +251,6 @@ included unless a future peripheral explicitly requires it. - Keep trigger and ADC front ends physically separated from coil, injector, switching-regulator, and high-current output nodes. -- Route Hall signals with their sensor return; use an appropriate harness and - shielding strategy after cable testing. - Place protection at the connector, filtering/conditioning near the MCU side, and avoid dumping input-fault energy into `+3V3_ANA`. - Validate Hall glitch rejection with ignition active, including worst-case diff --git a/Architecture/IO_MODULES/DEAD_MAN.md b/Architecture/IO_MODULES/DEAD_MAN.md index df375a7..da2dd1b 100644 --- a/Architecture/IO_MODULES/DEAD_MAN.md +++ b/Architecture/IO_MODULES/DEAD_MAN.md @@ -3,9 +3,12 @@ ## Purpose This module provides the hardware run-permission path for the engine outputs. -The steering-wheel dead-man switch must be held to assert permission. Releasing -the switch, an open circuit, loss of a logic supply, or MCU reset must place -the engine outputs in their non-energising state independently of firmware. +The steering-wheel dead-man switch must be held to assert permission. Two +electrically independent, normally-open switch contacts and two independent +harness signal paths are required. Releasing the switch, an open circuit, +one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset +must place the engine outputs in their non-energising state independently of +firmware. This document defines the signal relationships and destinations only. Output driver implementation is documented separately. @@ -14,18 +17,31 @@ driver implementation is documented separately. | Signal | Domain | Active state | Default/fault state | | --- | --- | --- | --- | -| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission | +| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault | +| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held | +| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault | | `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission | | `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission | | `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off | | `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off | | `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted | -| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted | +| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault | +| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault | -`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered, -and given a default-low bias before entering the 5 V logic. The conditioning -must tolerate expected connector faults and transients without allowing a -fault to assert engine permission. +Each deadman contact has its own harness signal, connector pin, connector-side +protection, series/filter network, and default-low bias. The contacts may share +the protected 5 V source at the switch, but neither signal path may share a +pull-up, pull-down, connector pin, or post-contact conductor with the other. +Each contact closes to the protected 5 V source only while the driver holds the +switch. Thus an open signal path reads low; a short of only one signal path to +the source cannot create the valid two-channel state. + +Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B +is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary +encoding makes the sole valid held state `A = high`, `B = low`. Both raw, +conditioned contact observations also enter protected 3.3 V MCU inputs as +`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations, +not the safety-critical shutoff path. ## Signal tree @@ -33,23 +49,27 @@ The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic levels. Their outputs are 5 V logic levels. ```text -protected steering-wheel input - | - +--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU - | - +--> conditioned 5 V DEAD_MAN_SIG --+ - AND --> ENGINE_PERMIT --+ -MCU_RUN_PERMIT --------------------------------+ | - +--> ignition-permission inverter - | --> SAFE_IGNITION_INHIBIT - | -MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG +protected 5 V --> independent NO contact A --> protected A input + +--> 3.3 V --> DEADMAN_A_STATUS --> MCU + `--> 5 V --> DEADMAN_A_HELD -----+ + | +protected 5 V --> independent NO contact B --> protected B input +--> AND --> DEADMAN_OK --+ + +--> 3.3 V --> DEADMAN_B_STATUS --> MCU ^ | + `--> inverter --> DEADMAN_B_RELEASED -- NOT-+ | + | +MCU_RUN_PERMIT ---------------------------------------------------------------------------------------------AND --> ENGINE_PERMIT --+ + | + ignition-permission inverter + --> SAFE_IGNITION_INHIBIT + +MCU_INJECTOR_SIG -------------------------------------------------------------------------------------------AND --> SAFE_INJECTOR_SIG ``` The logic equations are: ```text -ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT +DEADMAN_OK = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED) +ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) ``` @@ -61,12 +81,22 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) | `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. | | `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. | | `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. | -| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. | +| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. | ## Fail-safe behavior -- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its - wire opens, or its source is unavailable. +- With the switch released, the valid relationship is + `DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low. +- With the switch held, the only permissive relationship is + `DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high. +- An open circuit, an open contact, or a short to the 5 V source on either one + signal path produces a non-permissive relationship. A short to ground on a + held path also removes permission. +- This architecture protects against one fault in one contact or signal path. + It does not claim to detect a common-mode fault that energises both input + paths, or simultaneous faults in both contacts/paths. Harness routing and + connector assignment shall minimise such common-mode faults; any remaining + risk requires explicit system-level acceptance. - `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset, boot, brownout, or an unpowered MCU. External bias components shall provide these states during power sequencing. @@ -82,7 +112,8 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) ## Firmware responsibilities -The hardware path is authoritative; firmware cannot override a released -dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear -pending injection and ignition schedules when it becomes invalid, and keep +The hardware path is authoritative; firmware cannot override a released or +faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and +`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a +released state or disagreement, report any disagreement, and keep `MCU_RUN_PERMIT` low except while engine operation is intentionally enabled. diff --git a/Architecture/IO_MODULES/DIGITAL_INPUTS.md b/Architecture/IO_MODULES/DIGITAL_INPUTS.md index ad09a77..2dd7daf 100644 --- a/Architecture/IO_MODULES/DIGITAL_INPUTS.md +++ b/Architecture/IO_MODULES/DIGITAL_INPUTS.md @@ -7,9 +7,10 @@ NeoECU V1. It accepts externally driven 5 V, 12 V, and protected battery-domain signals, plus dry-contact and open-collector sources when the appropriate ECU bias option is fitted. -This is not the crank/cam trigger interface and is not the dead-man +This is not the crank/cam trigger interface and is not either deadman engine-permit input. Those functions retain their dedicated conditioning and, -for the dead-man, its independent hardware safety path. +for the deadman, its independent two-channel hardware safety path defined in +[DEAD_MAN.md](DEAD_MAN.md). V1 provisionally allocates six generic digital-input channels. The allocation, connector pins, input timing requirements, and final input count remain open. diff --git a/Architecture/IO_MODULES/ENGINE_POSITION_INPUTS.md b/Architecture/IO_MODULES/ENGINE_POSITION_INPUTS.md new file mode 100644 index 0000000..6b9578e --- /dev/null +++ b/Architecture/IO_MODULES/ENGINE_POSITION_INPUTS.md @@ -0,0 +1,155 @@ +# Engine-Position Inputs + +## Purpose + +This module defines the dedicated crank and cam position-input class for +NeoECU V1. It is separate from the generic digital-input module because engine +timing needs bounded edge delay, jitter, and false-trigger behaviour. + +This is an architecture and schematic-design basis, not a released schematic. +Final component values and qualified fault ratings require the selected sensor, +harness, connector, and test results. + +## V1 timing and signal assumptions + +| Signal | V1 arrangement | Function | +| --- | --- | --- | +| Crank | Two events per crank revolution | 180-degree position events and speed estimation | +| Cam | One event per 720-degree cycle | Four-stroke phase identification | + +The V1 speed limiter is 5,000 RPM. At that speed the interval between selected +crank events is 6 ms; a four-event-per-revolution trigger would instead have a +3 ms interval. V1 retains the two-event pattern. Moving to four events is a +future trigger-wheel and firmware change, not a reason to alter this input +class. + +The intended interface is a three-wire, active-low Hall sensor: the output is +normally high and sinks current while active. Capture one defined edge per +event, normally the falling edge, in an STM32H747 timer channel. Do not use +both edges as independent position events unless firmware explicitly models +the Hall-window geometry. + +`FEBI BILSTEIN 44421` is the selected cam sensor. It cross-references to EFI +Automotive 144321 and OE references 1920.6T and 9629684380. It is a three-wire +12 V Hall sensor with an open-drain output: supply it from `+12V_SENS`, connect +its return to `SENSOR_GND`, and pull its signal high at the ECU. Confirm the +physical connector pinout and output sink-current limit from the delivered part +or its manufacturer documentation before assigning the connector pins and +freezing `R_PULLUP`. The crank-sensor part number remains to be selected. + +## Electrical interface + +```text + ECU + +12V_SENS ------------------------+--------------------------> sensor supply + SENSOR_GND ---------------------------------------------------> sensor return + | + +12V_SENS -- R_PULLUP -- TRIG_x ---+-- connector -- sensor output + | + +-- connector-side transient protection + +-- R_DIV_TOP --+-- Schmitt buffer --> 3.3 V timer input + +-- R_DIV_BOTTOM -- SENSOR_GND + +-- C_FILTER ------ SENSOR_GND +``` + +- Supply the sensor from `+12V_SENS`; its rail generation, protection, current + limit, and diagnostics belong to `POWER_ARCHITECTURE.md`. +- Place the signal pull-up at the ECU, to `+12V_SENS`, rather than at the + sensor or 3.3 V domain. A 4.7 kOhm footprint is a starting provision only. + Select its value from the confirmed sensor sink-current rating, high/low + thresholds, cable capacitance, and required edge time. +- Protect the connector-side signal against the assigned positive and negative + harness transients. The completed clamp, series impedance, divider, and + Schmitt buffer must keep all intermediate nodes within their validated limits + without back-powering the 3.3 V rail while the ECU is off. +- Scale the high-level signal before the 3.3 V Schmitt buffer. The buffer + provides defined logic thresholds and hysteresis; the STM32 pin is never + exposed to the sensor-domain voltage. +- The divider also supplies the resistance for the RC filter. Connect the + configurable `C_FILTER` footprint from the divided signal to `SENSOR_GND`, + in parallel with `R_DIV_BOTTOM`. Its effective series resistance is + `R_DIV_TOP || R_DIV_BOTTOM`, so `tau = (R_DIV_TOP || R_DIV_BOTTOM) * + C_FILTER`. Do not add a separate RC series resistor by default. Add one only + if it has a separately demonstrated purpose, such as limiting residual-clamp + current. +- Populate 1 nF initially, with 470 pF and 2.2 nF alternatives available. + Validate the selected value with the final harness and ignition operating; it + must reject short interference without eroding legitimate-edge timing margin. +- Use the automotive-qualified `SN74LVC2G17QDCKRQ1`, powered from + `+3V3_MAIN`, as the two-channel non-inverting Schmitt buffer for crank and + cam. Its inputs must only receive the protected, divided signal, never the + raw 12 V harness node. + +## Connector, harness, shield, and layout + +Crank and cam use the dedicated **engine-sensors connector**, not the +power/actuator connector. This preserves physical separation from coil, +injector, starter, and other high-current wiring. The V1 connector plan is: + +| Connector group | Carries | +| --- | --- | +| Power/actuators | Battery and power returns, ignition, injector, and high-current outputs | +| Engine sensors | Crank/cam supply, signals, sensor returns, thermistors, and analogue sensors | +| Vehicle I/O/CAN | CAN, deadman, generic digital inputs, and generic 5 V logic outputs | + +Use a screened harness for each trigger sensor. Route the trigger signal as a +twisted pair with `SENSOR_GND`; route its `+12V_SENS` supply in the same +screened cable. The screen is an EMC structure, not a sensor return or circuit +ground conductor. + +Terminate each screen at the ECU end only, at a dedicated `SHIELD_GND` bond +with a short, broad connection to the enclosure/chassis structure near the +power-entry region. Do not connect the screen to `SENSOR_GND`, `DGND`, or +`+3V3_ANA`, and do not connect it at the sensor end. Final backshell and case +bonding details depend on the selected connector and enclosure. + +Place transient protection at the connector. Keep the divider, filter, Schmitt +buffer, and timer route on the quiet MCU side. Keep these paths away from the +ignition high-voltage node, injector switching loop, and regulator hot loops. + +## False-trigger handling and validation + +Hardware filtering is the first defence. Firmware provides a second, +independent plausibility check; it does not replace the hardware network. + +For every selected crank edge, firmware shall: + +1. timestamp the edge with the timer; +2. reject an edge whose interval since the previous accepted edge is below a + calibrated physical minimum; and +3. reject an interval that implies an implausible acceleration from the recent + accepted speed estimate. + +The threshold shall be derived from the maximum measured engine acceleration, +the 5,000 RPM speed limit, timer resolution, and a conservative margin. It +shall not be a fixed arbitrary debounce time. A rejected edge shall not update +speed, position, dwell, injection scheduling, or the reference interval, so a +spark-induced pulse cannot displace the next accepted timing event. + +Cam edges shall be checked against the expected crank phase. A missing or +inconsistent cam event removes phase synchronisation and must lead firmware to +the explicitly defined no-sync behaviour; it must never invent a phase from a +single unexpected edge. + +Validate with the installed engine and final harness: + +- no false accepted crank/cam events during worst-case dwell and spark; +- no missed genuine events at 5,000 RPM and during the maximum measured + acceleration; +- measured conditioning delay and jitter within the firmware timing budget; +- correct rejection of injected short glitches without corrupting the following + genuine event; and +- sensor unplug, signal open/short, and sensor-supply fault behaviour as + defined by the final selected parts. + +## Remaining inputs before schematic freeze + +1. Confirm the FEBI 44421 physical connector pinout and output sink-current + limit from the delivered part or manufacturer documentation. +2. Select and obtain the equivalent data for the crank sensor. +3. Confirm connector family, pin assignment, cable length/construction, and + enclosure/backshell method for the engine-sensors connector. +4. Select protection components and final pull-up, divider, and filter values + against the confirmed sensor and harness limits. +5. Measure maximum real engine acceleration and establish the timer-based + interval-plausibility limits in firmware. diff --git a/Architecture/IO_MODULES/IGNITION.md b/Architecture/IO_MODULES/IGNITION.md index a354448..d5b4974 100644 --- a/Architecture/IO_MODULES/IGNITION.md +++ b/Architecture/IO_MODULES/IGNITION.md @@ -65,11 +65,12 @@ temperature, and ignition noise. SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) ``` -When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a -dwell is active, this invokes the VBG08H-E soft shutdown so coil current is -removed without intentionally generating a spark. The 1 kOhm resistors on -`INP` and `EN` follow the manufacturer's reference circuit and limit transient -current into the device's control pins. +When `ENGINE_PERMIT` is removed by the two-channel deadman interlock or the +MCU, `SAFE_IGNITION_INHIBIT` becomes high. If a dwell is active, this invokes +the VBG08H-E soft shutdown so coil current is removed without intentionally +generating a spark. The 1 kOhm resistors on `INP` and `EN` follow the +manufacturer's reference circuit and limit transient current into the device's +control pins. The command traces shall be short, have a continuous quiet reference, and be routed away from the `HVC` switching node and coil connector. The VBG08H-E diff --git a/Architecture/IO_MODULES/INJECTON.md b/Architecture/IO_MODULES/INJECTON.md index dfad68e..787d318 100644 --- a/Architecture/IO_MODULES/INJECTON.md +++ b/Architecture/IO_MODULES/INJECTON.md @@ -35,7 +35,7 @@ VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN ## Command path `INPUT` is active high. It receives only the hardware-permitted injector -command defined by the dead-man interlock. +command defined by the two-channel deadman interlock. ```text SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT @@ -62,7 +62,8 @@ pin. When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the injector output off. This is the hardware shutoff path; firmware also clears -pending injection events when it observes a dead-man release. +pending injection events when `DEADMAN_OK` becomes invalid or the two deadman +status inputs disagree. ## Status diagnostic diff --git a/Architecture/README.md b/Architecture/README.md index 523ea7c..29c792a 100644 --- a/Architecture/README.md +++ b/Architecture/README.md @@ -47,15 +47,14 @@ The current engine timing arrangement is: | Crank | Two Hall-effect pulses per crank revolution | 180-degree position events and speed estimation | | Cam | One Hall-effect pulse per 720-degree cycle | Four-stroke phase identification | -The initial engine speed limiter is 5,000 RPM. A future crank trigger with four -pulses per revolution is being considered to provide 90-degree timing events -and improve interpolation accuracy. +The initial engine speed limiter is 5,000 RPM. V1 retains the two-pulse crank +arrangement. A future four-pulse trigger can provide 90-degree timing events +and improve interpolation accuracy, but is not part of the V1 hardware scope. -Crank and cam sensors currently operate as 12 V, active-low Hall-effect -signals: their output is normally high and pulls low when active. The ECU must -condition these signals to protected 3.3 V timer inputs. The interface must -support the existing open-collector-style arrangement and provide noise -rejection appropriate for an engine environment. +Crank and cam are dedicated timing interfaces. Their intended 12 V active-low +Hall architecture, connector partition, shield treatment, conditioning, and +hardware/firmware glitch rejection are defined in +[ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md). ## Power Architecture @@ -144,4 +143,3 @@ selection are finalised: requirements. 5. CAN connector and bus topology. 6. Detailed trigger sensor wiring, connector, and cable-length information. -