Exergie/NeoECU-Hardware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Homogenized labels and added crank and cam sensor inputs

Browse Source
This commit is contained in:
h3cx
2026-09-10 23:26:54 +02:00
parent 0de94168f7
commit 45c0d7f8ec
7 changed files with 266 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Architecture/IO_ARCHITECTURE.md
+34 -51
View File
@@ -19,7 +19,7 @@ temperature and pressure sensors, and an external starter switch.
| --- | ---: | --- |
| Crank trigger input | 1 | 12 V active-low Hall, timer capture |
| Cam trigger input | 1 | 12 V active-low Hall, timer capture |
| Deadman input | 1 | Dedicated 5 V vehicle-logic engine-permit input |
| Deadman inputs | 2 | Dedicated, independent 5 V vehicle-logic engine-permit inputs |
| Thermistor inputs | 4 | Air, oil, water, and one spare temperature input |
| General analogue inputs | 9 | Protected 0-5 V sensor channels |
| ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` |
@@ -53,32 +53,11 @@ the scope of this document.
## Engine-Position Inputs
Crank and cam are dedicated inputs, not generic digital inputs. The assumed
sensor type is a three-wire, active-low, open-collector/current-sinking Hall
sensor.
```text
+12V_SENS -- ECU-side pull-up -- Hall signal harness -- Hall output
|
protection / divider / fast RC
|
3.3 V Schmitt trigger
|
STM32 timer-capture pin
```
The ECU-side pull-up is connected to regulated `+12V_SENS`, not to 3.3 V.
This gives the harness a robust 12 V-class signal while keeping the MCU domain
local and protected. An initial pull-up near 4.7 kohm is a reasonable starting
point, subject to the selected sensor's output-current specification and the
cable capacitance.
The divider scales the 12 V signal to the Schmitt-buffer input. A deliberately
small, configurable RC filter follows the divider to reject spark-induced
glitches without materially slowing genuine trigger edges. A nominal 1 nF
capacitor footprint, with alternatives such as 470 pF and 2.2 nF, should be
provided and validated with ignition active. The final divider, pull-up, clamp,
filter, and cable requirements depend on the Hall part number and harness.
Crank and cam are dedicated timer-capture inputs, not generic digital inputs.
The V1 timing pattern remains two crank pulses per revolution and one cam pulse
per 720-degree cycle. Their interface, harness/shield termination, protection,
conditioning, and hardware/firmware glitch-rejection requirements are defined
in [ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md).
## Analogue Inputs
@@ -174,25 +153,28 @@ actual harness and input-function requirements.
## Deadman Engine-Permit Interlock
The deadman input is a dedicated 5 V vehicle-logic input, not a generic digital
input. It is conditioned through the normal protected 5 V input interface and
level-shifted to protected 3.3 V logic. A loss of the external deadman signal
is the not-permitted state.
The deadman uses two dedicated 5 V vehicle-logic inputs, not generic digital
inputs. The steering-wheel switch provides two electrically independent,
normally-open contacts. Each contact has its own connector pin, protection,
filtering, default-low bias, and conditioned logic path. This makes an open
circuit or a short to the 5 V source on one signal path non-permissive.
The resulting `DEADMAN_OK` signal has two independent destinations:
The resulting 5 V `DEADMAN_OK` signal is high only when channel A reports
held and the independently conditioned, inverted channel B reports not
released. It has two independent destinations:
- It enters an MCU digital input so firmware can observe whether the deadman is
locked or unlocked, disable scheduling, and report the state.
- It is combined in hardware with the MCU's `MCU_RUN_PERMIT` output to produce
`ENGINE_PERMIT`.
- `DEADMAN_A_STATUS` and `DEADMAN_B_STATUS` enter MCU digital inputs so
firmware can observe each contact, detect disagreement, disable scheduling,
and report the state.
- `DEADMAN_OK` is combined in hardware with the MCU's `MCU_RUN_PERMIT` output
to produce `ENGINE_PERMIT`.
```text
5 V deadman input --> protection / level shift --> DEADMAN_OK --+--> MCU input
|
MCU_RUN_PERMIT --------------------------------------------------AND--> ENGINE_PERMIT
|
driver enable pins, or
command-signal gating
deadman contact A --> protected input --> DEADMAN_A_HELD --------+
+--> valid-state logic --> DEADMAN_OK --+
deadman contact B --> protected input --> inverted --> DEADMAN_B_RELEASED -+ |
AND --> ENGINE_PERMIT
MCU_RUN_PERMIT ----------------------------------------------------------------------------------------------+
```
`ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers
@@ -200,13 +182,16 @@ where those inputs are provided. If a selected driver has no suitable enable
input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using
logic that defaults to the disabled state on power-up or loss of power.
This hardware path ensures that releasing the deadman stops injector and
ignition commands even if firmware or a timer output fails to respond. Firmware
must also clear/disable pending injection and dwell schedules whenever
`DEADMAN_OK` becomes invalid. A firmware test mode may assert
`MCU_RUN_PERMIT`, but it does not override the physical deadman input; bench
operation requires a deliberate external test arrangement that presents a valid
deadman signal.
This hardware path ensures that releasing the deadman, an open circuit, or a
single signal-path short to the 5 V source stops injector and ignition commands
even if firmware or a timer output fails to respond. It does not claim to cover
a common-mode fault that energises both paths. Firmware must clear/disable
pending injection and dwell schedules whenever `DEADMAN_OK` becomes invalid or
the two MCU status inputs disagree. A firmware test mode may assert
`MCU_RUN_PERMIT`, but it does not override the physical deadman inputs; bench
operation requires a deliberate external test arrangement that presents the
valid two-channel held state. The detailed signal and fault model is defined in
[DEAD_MAN.md](IO_MODULES/DEAD_MAN.md).
## Outputs
@@ -266,8 +251,6 @@ included unless a future peripheral explicitly requires it.
- Keep trigger and ADC front ends physically separated from coil, injector,
switching-regulator, and high-current output nodes.
- Route Hall signals with their sensor return; use an appropriate harness and
shielding strategy after cable testing.
- Place protection at the connector, filtering/conditioning near the MCU side,
and avoid dumping input-fault energy into `+3V3_ANA`.
- Validate Hall glitch rejection with ignition active, including worst-case
Architecture/IO_MODULES/DEAD_MAN.md
+58 -27
View File
@@ -3,9 +3,12 @@
## Purpose
This module provides the hardware run-permission path for the engine outputs.
The steering-wheel dead-man switch must be held to assert permission. Releasing
the switch, an open circuit, loss of a logic supply, or MCU reset must place
the engine outputs in their non-energising state independently of firmware.
The steering-wheel dead-man switch must be held to assert permission. Two
electrically independent, normally-open switch contacts and two independent
harness signal paths are required. Releasing the switch, an open circuit,
one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset
must place the engine outputs in their non-energising state independently of
firmware.
This document defines the signal relationships and destinations only. Output
driver implementation is documented separately.
@@ -14,18 +17,31 @@ driver implementation is documented separately.
| Signal | Domain | Active state | Default/fault state |
| --- | --- | --- | --- |
| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission |
| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault |
| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held |
| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault |
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted |
| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault |
| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault |
`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered,
and given a default-low bias before entering the 5 V logic. The conditioning
must tolerate expected connector faults and transients without allowing a
fault to assert engine permission.
Each deadman contact has its own harness signal, connector pin, connector-side
protection, series/filter network, and default-low bias. The contacts may share
the protected 5 V source at the switch, but neither signal path may share a
pull-up, pull-down, connector pin, or post-contact conductor with the other.
Each contact closes to the protected 5 V source only while the driver holds the
switch. Thus an open signal path reads low; a short of only one signal path to
the source cannot create the valid two-channel state.
Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B
is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary
encoding makes the sole valid held state `A = high`, `B = low`. Both raw,
conditioned contact observations also enter protected 3.3 V MCU inputs as
`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations,
not the safety-critical shutoff path.
## Signal tree
@@ -33,23 +49,27 @@ The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
levels. Their outputs are 5 V logic levels.
```text
protected steering-wheel input
|
+--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU
|
+--> conditioned 5 V DEAD_MAN_SIG --+
AND --> ENGINE_PERMIT --+
MCU_RUN_PERMIT --------------------------------+ |
+--> ignition-permission inverter
| --> SAFE_IGNITION_INHIBIT
|
MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG
protected 5 V --> independent NO contact A --> protected A input
+--> 3.3 V --> DEADMAN_A_STATUS --> MCU
`--> 5 V --> DEADMAN_A_HELD -----+
|
protected 5 V --> independent NO contact B --> protected B input +--> AND --> DEADMAN_OK --+
+--> 3.3 V --> DEADMAN_B_STATUS --> MCU ^ |
`--> inverter --> DEADMAN_B_RELEASED -- NOT-+ |
|
MCU_RUN_PERMIT ---------------------------------------------------------------------------------------------AND --> ENGINE_PERMIT --+
|
ignition-permission inverter
--> SAFE_IGNITION_INHIBIT
MCU_INJECTOR_SIG -------------------------------------------------------------------------------------------AND --> SAFE_INJECTOR_SIG
```
The logic equations are:
```text
ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT
DEADMAN_OK = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
@@ -61,12 +81,22 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. |
| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. |
## Fail-safe behavior
- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its
wire opens, or its source is unavailable.
- With the switch released, the valid relationship is
`DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low.
- With the switch held, the only permissive relationship is
`DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high.
- An open circuit, an open contact, or a short to the 5 V source on either one
signal path produces a non-permissive relationship. A short to ground on a
held path also removes permission.
- This architecture protects against one fault in one contact or signal path.
It does not claim to detect a common-mode fault that energises both input
paths, or simultaneous faults in both contacts/paths. Harness routing and
connector assignment shall minimise such common-mode faults; any remaining
risk requires explicit system-level acceptance.
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
boot, brownout, or an unpowered MCU. External bias components shall provide
these states during power sequencing.
@@ -82,7 +112,8 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
## Firmware responsibilities
The hardware path is authoritative; firmware cannot override a released
dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear
pending injection and ignition schedules when it becomes invalid, and keep
The hardware path is authoritative; firmware cannot override a released or
faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and
`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a
released state or disagreement, report any disagreement, and keep
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.
Architecture/IO_MODULES/DIGITAL_INPUTS.md
+3 -2
View File
@@ -7,9 +7,10 @@ NeoECU V1. It accepts externally driven 5 V, 12 V, and protected
battery-domain signals, plus dry-contact and open-collector sources when the
appropriate ECU bias option is fitted.
This is not the crank/cam trigger interface and is not the dead-man
This is not the crank/cam trigger interface and is not either deadman
engine-permit input. Those functions retain their dedicated conditioning and,
for the dead-man, its independent hardware safety path.
for the deadman, its independent two-channel hardware safety path defined in
[DEAD_MAN.md](DEAD_MAN.md).
V1 provisionally allocates six generic digital-input channels. The allocation,
connector pins, input timing requirements, and final input count remain open.
Architecture/IO_MODULES/ENGINE_POSITION_INPUTS.md
+155
View File
@@ -0,0 +1,155 @@
# Engine-Position Inputs
## Purpose
This module defines the dedicated crank and cam position-input class for
NeoECU V1. It is separate from the generic digital-input module because engine
timing needs bounded edge delay, jitter, and false-trigger behaviour.
This is an architecture and schematic-design basis, not a released schematic.
Final component values and qualified fault ratings require the selected sensor,
harness, connector, and test results.
## V1 timing and signal assumptions
| Signal | V1 arrangement | Function |
| --- | --- | --- |
| Crank | Two events per crank revolution | 180-degree position events and speed estimation |
| Cam | One event per 720-degree cycle | Four-stroke phase identification |
The V1 speed limiter is 5,000 RPM. At that speed the interval between selected
crank events is 6 ms; a four-event-per-revolution trigger would instead have a
3 ms interval. V1 retains the two-event pattern. Moving to four events is a
future trigger-wheel and firmware change, not a reason to alter this input
class.
The intended interface is a three-wire, active-low Hall sensor: the output is
normally high and sinks current while active. Capture one defined edge per
event, normally the falling edge, in an STM32H747 timer channel. Do not use
both edges as independent position events unless firmware explicitly models
the Hall-window geometry.
`FEBI BILSTEIN 44421` is the selected cam sensor. It cross-references to EFI
Automotive 144321 and OE references 1920.6T and 9629684380. It is a three-wire
12 V Hall sensor with an open-drain output: supply it from `+12V_SENS`, connect
its return to `SENSOR_GND`, and pull its signal high at the ECU. Confirm the
physical connector pinout and output sink-current limit from the delivered part
or its manufacturer documentation before assigning the connector pins and
freezing `R_PULLUP`. The crank-sensor part number remains to be selected.
## Electrical interface
```text
ECU
+12V_SENS ------------------------+--------------------------> sensor supply
SENSOR_GND ---------------------------------------------------> sensor return
|
+12V_SENS -- R_PULLUP -- TRIG_x ---+-- connector -- sensor output
|
+-- connector-side transient protection
+-- R_DIV_TOP --+-- Schmitt buffer --> 3.3 V timer input
+-- R_DIV_BOTTOM -- SENSOR_GND
+-- C_FILTER ------ SENSOR_GND
```
- Supply the sensor from `+12V_SENS`; its rail generation, protection, current
limit, and diagnostics belong to `POWER_ARCHITECTURE.md`.
- Place the signal pull-up at the ECU, to `+12V_SENS`, rather than at the
sensor or 3.3 V domain. A 4.7 kOhm footprint is a starting provision only.
Select its value from the confirmed sensor sink-current rating, high/low
thresholds, cable capacitance, and required edge time.
- Protect the connector-side signal against the assigned positive and negative
harness transients. The completed clamp, series impedance, divider, and
Schmitt buffer must keep all intermediate nodes within their validated limits
without back-powering the 3.3 V rail while the ECU is off.
- Scale the high-level signal before the 3.3 V Schmitt buffer. The buffer
provides defined logic thresholds and hysteresis; the STM32 pin is never
exposed to the sensor-domain voltage.
- The divider also supplies the resistance for the RC filter. Connect the
configurable `C_FILTER` footprint from the divided signal to `SENSOR_GND`,
in parallel with `R_DIV_BOTTOM`. Its effective series resistance is
`R_DIV_TOP || R_DIV_BOTTOM`, so `tau = (R_DIV_TOP || R_DIV_BOTTOM) *
C_FILTER`. Do not add a separate RC series resistor by default. Add one only
if it has a separately demonstrated purpose, such as limiting residual-clamp
current.
- Populate 1 nF initially, with 470 pF and 2.2 nF alternatives available.
Validate the selected value with the final harness and ignition operating; it
must reject short interference without eroding legitimate-edge timing margin.
- Use the automotive-qualified `SN74LVC2G17QDCKRQ1`, powered from
`+3V3_MAIN`, as the two-channel non-inverting Schmitt buffer for crank and
cam. Its inputs must only receive the protected, divided signal, never the
raw 12 V harness node.
## Connector, harness, shield, and layout
Crank and cam use the dedicated **engine-sensors connector**, not the
power/actuator connector. This preserves physical separation from coil,
injector, starter, and other high-current wiring. The V1 connector plan is:
| Connector group | Carries |
| --- | --- |
| Power/actuators | Battery and power returns, ignition, injector, and high-current outputs |
| Engine sensors | Crank/cam supply, signals, sensor returns, thermistors, and analogue sensors |
| Vehicle I/O/CAN | CAN, deadman, generic digital inputs, and generic 5 V logic outputs |
Use a screened harness for each trigger sensor. Route the trigger signal as a
twisted pair with `SENSOR_GND`; route its `+12V_SENS` supply in the same
screened cable. The screen is an EMC structure, not a sensor return or circuit
ground conductor.
Terminate each screen at the ECU end only, at a dedicated `SHIELD_GND` bond
with a short, broad connection to the enclosure/chassis structure near the
power-entry region. Do not connect the screen to `SENSOR_GND`, `DGND`, or
`+3V3_ANA`, and do not connect it at the sensor end. Final backshell and case
bonding details depend on the selected connector and enclosure.
Place transient protection at the connector. Keep the divider, filter, Schmitt
buffer, and timer route on the quiet MCU side. Keep these paths away from the
ignition high-voltage node, injector switching loop, and regulator hot loops.
## False-trigger handling and validation
Hardware filtering is the first defence. Firmware provides a second,
independent plausibility check; it does not replace the hardware network.
For every selected crank edge, firmware shall:
1. timestamp the edge with the timer;
2. reject an edge whose interval since the previous accepted edge is below a
calibrated physical minimum; and
3. reject an interval that implies an implausible acceleration from the recent
accepted speed estimate.
The threshold shall be derived from the maximum measured engine acceleration,
the 5,000 RPM speed limit, timer resolution, and a conservative margin. It
shall not be a fixed arbitrary debounce time. A rejected edge shall not update
speed, position, dwell, injection scheduling, or the reference interval, so a
spark-induced pulse cannot displace the next accepted timing event.
Cam edges shall be checked against the expected crank phase. A missing or
inconsistent cam event removes phase synchronisation and must lead firmware to
the explicitly defined no-sync behaviour; it must never invent a phase from a
single unexpected edge.
Validate with the installed engine and final harness:
- no false accepted crank/cam events during worst-case dwell and spark;
- no missed genuine events at 5,000 RPM and during the maximum measured
acceleration;
- measured conditioning delay and jitter within the firmware timing budget;
- correct rejection of injected short glitches without corrupting the following
genuine event; and
- sensor unplug, signal open/short, and sensor-supply fault behaviour as
defined by the final selected parts.
## Remaining inputs before schematic freeze
1. Confirm the FEBI 44421 physical connector pinout and output sink-current
limit from the delivered part or manufacturer documentation.
2. Select and obtain the equivalent data for the crank sensor.
3. Confirm connector family, pin assignment, cable length/construction, and
enclosure/backshell method for the engine-sensors connector.
4. Select protection components and final pull-up, divider, and filter values
against the confirmed sensor and harness limits.
5. Measure maximum real engine acceleration and establish the timer-based
interval-plausibility limits in firmware.
Architecture/IO_MODULES/IGNITION.md
+6 -5
View File
@@ -65,11 +65,12 @@ temperature, and ignition noise.
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a
dwell is active, this invokes the VBG08H-E soft shutdown so coil current is
removed without intentionally generating a spark. The 1 kOhm resistors on
`INP` and `EN` follow the manufacturer's reference circuit and limit transient
current into the device's control pins.
When `ENGINE_PERMIT` is removed by the two-channel deadman interlock or the
MCU, `SAFE_IGNITION_INHIBIT` becomes high. If a dwell is active, this invokes
the VBG08H-E soft shutdown so coil current is removed without intentionally
generating a spark. The 1 kOhm resistors on `INP` and `EN` follow the
manufacturer's reference circuit and limit transient current into the device's
control pins.
The command traces shall be short, have a continuous quiet reference, and be
routed away from the `HVC` switching node and coil connector. The VBG08H-E
Architecture/IO_MODULES/INJECTON.md
+3 -2
View File
@@ -35,7 +35,7 @@ VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN
## Command path
`INPUT` is active high. It receives only the hardware-permitted injector
command defined by the dead-man interlock.
command defined by the two-channel deadman interlock.
```text
SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT
@@ -62,7 +62,8 @@ pin.
When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the
injector output off. This is the hardware shutoff path; firmware also clears
pending injection events when it observes a dead-man release.
pending injection events when `DEADMAN_OK` becomes invalid or the two deadman
status inputs disagree.
## Status diagnostic
Architecture/README.md
+7 -9
View File
@@ -47,15 +47,14 @@ The current engine timing arrangement is:
| Crank | Two Hall-effect pulses per crank revolution | 180-degree position events and speed estimation |
| Cam | One Hall-effect pulse per 720-degree cycle | Four-stroke phase identification |
The initial engine speed limiter is 5,000 RPM. A future crank trigger with four
pulses per revolution is being considered to provide 90-degree timing events
and improve interpolation accuracy.
The initial engine speed limiter is 5,000 RPM. V1 retains the two-pulse crank
arrangement. A future four-pulse trigger can provide 90-degree timing events
and improve interpolation accuracy, but is not part of the V1 hardware scope.
Crank and cam sensors currently operate as 12 V, active-low Hall-effect
signals: their output is normally high and pulls low when active. The ECU must
condition these signals to protected 3.3 V timer inputs. The interface must
support the existing open-collector-style arrangement and provide noise
rejection appropriate for an engine environment.
Crank and cam are dedicated timing interfaces. Their intended 12 V active-low
Hall architecture, connector partition, shield treatment, conditioning, and
hardware/firmware glitch rejection are defined in
[ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md).
## Power Architecture
@@ -144,4 +143,3 @@ selection are finalised:
requirements.
5. CAN connector and bus topology.
6. Detailed trigger sensor wiring, connector, and cable-length information.