Exergie/NeoECU-Hardware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Homogenized labels and added crank and cam sensor inputs

Browse Source
This commit is contained in:
h3cx
2026-09-10 23:26:54 +02:00
parent 0de94168f7
commit 45c0d7f8ec
7 changed files with 266 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Architecture/IO_MODULES/DEAD_MAN.md
+58 -27
View File
@@ -3,9 +3,12 @@
## Purpose
This module provides the hardware run-permission path for the engine outputs.
The steering-wheel dead-man switch must be held to assert permission. Releasing
the switch, an open circuit, loss of a logic supply, or MCU reset must place
the engine outputs in their non-energising state independently of firmware.
The steering-wheel dead-man switch must be held to assert permission. Two
electrically independent, normally-open switch contacts and two independent
harness signal paths are required. Releasing the switch, an open circuit,
one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset
must place the engine outputs in their non-energising state independently of
firmware.
This document defines the signal relationships and destinations only. Output
driver implementation is documented separately.
@@ -14,18 +17,31 @@ driver implementation is documented separately.
| Signal | Domain | Active state | Default/fault state |
| --- | --- | --- | --- |
| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission |
| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault |
| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held |
| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault |
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted |
| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault |
| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault |
`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered,
and given a default-low bias before entering the 5 V logic. The conditioning
must tolerate expected connector faults and transients without allowing a
fault to assert engine permission.
Each deadman contact has its own harness signal, connector pin, connector-side
protection, series/filter network, and default-low bias. The contacts may share
the protected 5 V source at the switch, but neither signal path may share a
pull-up, pull-down, connector pin, or post-contact conductor with the other.
Each contact closes to the protected 5 V source only while the driver holds the
switch. Thus an open signal path reads low; a short of only one signal path to
the source cannot create the valid two-channel state.
Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B
is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary
encoding makes the sole valid held state `A = high`, `B = low`. Both raw,
conditioned contact observations also enter protected 3.3 V MCU inputs as
`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations,
not the safety-critical shutoff path.
## Signal tree
@@ -33,23 +49,27 @@ The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
levels. Their outputs are 5 V logic levels.
```text
protected steering-wheel input
|
+--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU
|
+--> conditioned 5 V DEAD_MAN_SIG --+
AND --> ENGINE_PERMIT --+
MCU_RUN_PERMIT --------------------------------+ |
+--> ignition-permission inverter
| --> SAFE_IGNITION_INHIBIT
|
MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG
protected 5 V --> independent NO contact A --> protected A input
+--> 3.3 V --> DEADMAN_A_STATUS --> MCU
`--> 5 V --> DEADMAN_A_HELD -----+
|
protected 5 V --> independent NO contact B --> protected B input +--> AND --> DEADMAN_OK --+
+--> 3.3 V --> DEADMAN_B_STATUS --> MCU ^ |
`--> inverter --> DEADMAN_B_RELEASED -- NOT-+ |
|
MCU_RUN_PERMIT ---------------------------------------------------------------------------------------------AND --> ENGINE_PERMIT --+
|
ignition-permission inverter
--> SAFE_IGNITION_INHIBIT
MCU_INJECTOR_SIG -------------------------------------------------------------------------------------------AND --> SAFE_INJECTOR_SIG
```
The logic equations are:
```text
ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT
DEADMAN_OK = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
@@ -61,12 +81,22 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. |
| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. |
## Fail-safe behavior
- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its
wire opens, or its source is unavailable.
- With the switch released, the valid relationship is
`DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low.
- With the switch held, the only permissive relationship is
`DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high.
- An open circuit, an open contact, or a short to the 5 V source on either one
signal path produces a non-permissive relationship. A short to ground on a
held path also removes permission.
- This architecture protects against one fault in one contact or signal path.
It does not claim to detect a common-mode fault that energises both input
paths, or simultaneous faults in both contacts/paths. Harness routing and
connector assignment shall minimise such common-mode faults; any remaining
risk requires explicit system-level acceptance.
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
boot, brownout, or an unpowered MCU. External bias components shall provide
these states during power sequencing.
@@ -82,7 +112,8 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
## Firmware responsibilities
The hardware path is authoritative; firmware cannot override a released
dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear
pending injection and ignition schedules when it becomes invalid, and keep
The hardware path is authoritative; firmware cannot override a released or
faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and
`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a
released state or disagreement, report any disagreement, and keep
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.
Architecture/IO_MODULES/DIGITAL_INPUTS.md
+3 -2
View File
@@ -7,9 +7,10 @@ NeoECU V1. It accepts externally driven 5 V, 12 V, and protected
battery-domain signals, plus dry-contact and open-collector sources when the
appropriate ECU bias option is fitted.
This is not the crank/cam trigger interface and is not the dead-man
This is not the crank/cam trigger interface and is not either deadman
engine-permit input. Those functions retain their dedicated conditioning and,
for the dead-man, its independent hardware safety path.
for the deadman, its independent two-channel hardware safety path defined in
[DEAD_MAN.md](DEAD_MAN.md).
V1 provisionally allocates six generic digital-input channels. The allocation,
connector pins, input timing requirements, and final input count remain open.
Architecture/IO_MODULES/ENGINE_POSITION_INPUTS.md
+155
View File
@@ -0,0 +1,155 @@
# Engine-Position Inputs
## Purpose
This module defines the dedicated crank and cam position-input class for
NeoECU V1. It is separate from the generic digital-input module because engine
timing needs bounded edge delay, jitter, and false-trigger behaviour.
This is an architecture and schematic-design basis, not a released schematic.
Final component values and qualified fault ratings require the selected sensor,
harness, connector, and test results.
## V1 timing and signal assumptions
| Signal | V1 arrangement | Function |
| --- | --- | --- |
| Crank | Two events per crank revolution | 180-degree position events and speed estimation |
| Cam | One event per 720-degree cycle | Four-stroke phase identification |
The V1 speed limiter is 5,000 RPM. At that speed the interval between selected
crank events is 6 ms; a four-event-per-revolution trigger would instead have a
3 ms interval. V1 retains the two-event pattern. Moving to four events is a
future trigger-wheel and firmware change, not a reason to alter this input
class.
The intended interface is a three-wire, active-low Hall sensor: the output is
normally high and sinks current while active. Capture one defined edge per
event, normally the falling edge, in an STM32H747 timer channel. Do not use
both edges as independent position events unless firmware explicitly models
the Hall-window geometry.
`FEBI BILSTEIN 44421` is the selected cam sensor. It cross-references to EFI
Automotive 144321 and OE references 1920.6T and 9629684380. It is a three-wire
12 V Hall sensor with an open-drain output: supply it from `+12V_SENS`, connect
its return to `SENSOR_GND`, and pull its signal high at the ECU. Confirm the
physical connector pinout and output sink-current limit from the delivered part
or its manufacturer documentation before assigning the connector pins and
freezing `R_PULLUP`. The crank-sensor part number remains to be selected.
## Electrical interface
```text
ECU
+12V_SENS ------------------------+--------------------------> sensor supply
SENSOR_GND ---------------------------------------------------> sensor return
|
+12V_SENS -- R_PULLUP -- TRIG_x ---+-- connector -- sensor output
|
+-- connector-side transient protection
+-- R_DIV_TOP --+-- Schmitt buffer --> 3.3 V timer input
+-- R_DIV_BOTTOM -- SENSOR_GND
+-- C_FILTER ------ SENSOR_GND
```
- Supply the sensor from `+12V_SENS`; its rail generation, protection, current
limit, and diagnostics belong to `POWER_ARCHITECTURE.md`.
- Place the signal pull-up at the ECU, to `+12V_SENS`, rather than at the
sensor or 3.3 V domain. A 4.7 kOhm footprint is a starting provision only.
Select its value from the confirmed sensor sink-current rating, high/low
thresholds, cable capacitance, and required edge time.
- Protect the connector-side signal against the assigned positive and negative
harness transients. The completed clamp, series impedance, divider, and
Schmitt buffer must keep all intermediate nodes within their validated limits
without back-powering the 3.3 V rail while the ECU is off.
- Scale the high-level signal before the 3.3 V Schmitt buffer. The buffer
provides defined logic thresholds and hysteresis; the STM32 pin is never
exposed to the sensor-domain voltage.
- The divider also supplies the resistance for the RC filter. Connect the
configurable `C_FILTER` footprint from the divided signal to `SENSOR_GND`,
in parallel with `R_DIV_BOTTOM`. Its effective series resistance is
`R_DIV_TOP || R_DIV_BOTTOM`, so `tau = (R_DIV_TOP || R_DIV_BOTTOM) *
C_FILTER`. Do not add a separate RC series resistor by default. Add one only
if it has a separately demonstrated purpose, such as limiting residual-clamp
current.
- Populate 1 nF initially, with 470 pF and 2.2 nF alternatives available.
Validate the selected value with the final harness and ignition operating; it
must reject short interference without eroding legitimate-edge timing margin.
- Use the automotive-qualified `SN74LVC2G17QDCKRQ1`, powered from
`+3V3_MAIN`, as the two-channel non-inverting Schmitt buffer for crank and
cam. Its inputs must only receive the protected, divided signal, never the
raw 12 V harness node.
## Connector, harness, shield, and layout
Crank and cam use the dedicated **engine-sensors connector**, not the
power/actuator connector. This preserves physical separation from coil,
injector, starter, and other high-current wiring. The V1 connector plan is:
| Connector group | Carries |
| --- | --- |
| Power/actuators | Battery and power returns, ignition, injector, and high-current outputs |
| Engine sensors | Crank/cam supply, signals, sensor returns, thermistors, and analogue sensors |
| Vehicle I/O/CAN | CAN, deadman, generic digital inputs, and generic 5 V logic outputs |
Use a screened harness for each trigger sensor. Route the trigger signal as a
twisted pair with `SENSOR_GND`; route its `+12V_SENS` supply in the same
screened cable. The screen is an EMC structure, not a sensor return or circuit
ground conductor.
Terminate each screen at the ECU end only, at a dedicated `SHIELD_GND` bond
with a short, broad connection to the enclosure/chassis structure near the
power-entry region. Do not connect the screen to `SENSOR_GND`, `DGND`, or
`+3V3_ANA`, and do not connect it at the sensor end. Final backshell and case
bonding details depend on the selected connector and enclosure.
Place transient protection at the connector. Keep the divider, filter, Schmitt
buffer, and timer route on the quiet MCU side. Keep these paths away from the
ignition high-voltage node, injector switching loop, and regulator hot loops.
## False-trigger handling and validation
Hardware filtering is the first defence. Firmware provides a second,
independent plausibility check; it does not replace the hardware network.
For every selected crank edge, firmware shall:
1. timestamp the edge with the timer;
2. reject an edge whose interval since the previous accepted edge is below a
calibrated physical minimum; and
3. reject an interval that implies an implausible acceleration from the recent
accepted speed estimate.
The threshold shall be derived from the maximum measured engine acceleration,
the 5,000 RPM speed limit, timer resolution, and a conservative margin. It
shall not be a fixed arbitrary debounce time. A rejected edge shall not update
speed, position, dwell, injection scheduling, or the reference interval, so a
spark-induced pulse cannot displace the next accepted timing event.
Cam edges shall be checked against the expected crank phase. A missing or
inconsistent cam event removes phase synchronisation and must lead firmware to
the explicitly defined no-sync behaviour; it must never invent a phase from a
single unexpected edge.
Validate with the installed engine and final harness:
- no false accepted crank/cam events during worst-case dwell and spark;
- no missed genuine events at 5,000 RPM and during the maximum measured
acceleration;
- measured conditioning delay and jitter within the firmware timing budget;
- correct rejection of injected short glitches without corrupting the following
genuine event; and
- sensor unplug, signal open/short, and sensor-supply fault behaviour as
defined by the final selected parts.
## Remaining inputs before schematic freeze
1. Confirm the FEBI 44421 physical connector pinout and output sink-current
limit from the delivered part or manufacturer documentation.
2. Select and obtain the equivalent data for the crank sensor.
3. Confirm connector family, pin assignment, cable length/construction, and
enclosure/backshell method for the engine-sensors connector.
4. Select protection components and final pull-up, divider, and filter values
against the confirmed sensor and harness limits.
5. Measure maximum real engine acceleration and establish the timer-based
interval-plausibility limits in firmware.
Architecture/IO_MODULES/IGNITION.md
+6 -5
View File
@@ -65,11 +65,12 @@ temperature, and ignition noise.
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a
dwell is active, this invokes the VBG08H-E soft shutdown so coil current is
removed without intentionally generating a spark. The 1 kOhm resistors on
`INP` and `EN` follow the manufacturer's reference circuit and limit transient
current into the device's control pins.
When `ENGINE_PERMIT` is removed by the two-channel deadman interlock or the
MCU, `SAFE_IGNITION_INHIBIT` becomes high. If a dwell is active, this invokes
the VBG08H-E soft shutdown so coil current is removed without intentionally
generating a spark. The 1 kOhm resistors on `INP` and `EN` follow the
manufacturer's reference circuit and limit transient current into the device's
control pins.
The command traces shall be short, have a continuous quiet reference, and be
routed away from the `HVC` switching node and coil connector. The VBG08H-E
Architecture/IO_MODULES/INJECTON.md
+3 -2
View File
@@ -35,7 +35,7 @@ VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN
## Command path
`INPUT` is active high. It receives only the hardware-permitted injector
command defined by the dead-man interlock.
command defined by the two-channel deadman interlock.
```text
SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT
@@ -62,7 +62,8 @@ pin.
When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the
injector output off. This is the hardware shutoff path; firmware also clears
pending injection events when it observes a dead-man release.
pending injection events when `DEADMAN_OK` becomes invalid or the two deadman
status inputs disagree.
## Status diagnostic