Homogenized labels and added crank and cam sensor inputs

Architecture/IO_ARCHITECTURE.md

@@ -19,7 +19,7 @@ temperature and pressure sensors, and an external starter switch.
 | --- | ---: | --- |
 | Crank trigger input | 1 | 12 V active-low Hall, timer capture |
 | Cam trigger input | 1 | 12 V active-low Hall, timer capture |
-| Deadman input | 1 | Dedicated 5 V vehicle-logic engine-permit input |
+| Deadman inputs | 2 | Dedicated, independent 5 V vehicle-logic engine-permit inputs |
 | Thermistor inputs | 4 | Air, oil, water, and one spare temperature input |
 | General analogue inputs | 9 | Protected 0-5 V sensor channels |
 | ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` |
@@ -53,32 +53,11 @@ the scope of this document.
 
 ## Engine-Position Inputs
 
-Crank and cam are dedicated inputs, not generic digital inputs. The assumed
+Crank and cam are dedicated timer-capture inputs, not generic digital inputs.
-sensor type is a three-wire, active-low, open-collector/current-sinking Hall
+The V1 timing pattern remains two crank pulses per revolution and one cam pulse
-sensor.
+per 720-degree cycle. Their interface, harness/shield termination, protection,
-
+conditioning, and hardware/firmware glitch-rejection requirements are defined
-```text
+in [ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md).
-+12V_SENS -- ECU-side pull-up -- Hall signal harness -- Hall output
-                                                     |
-                                      protection / divider / fast RC
-                                                     |
-                                           3.3 V Schmitt trigger
-                                                     |
-                                              STM32 timer-capture pin
-```
-
-The ECU-side pull-up is connected to regulated `+12V_SENS`, not to 3.3 V.
-This gives the harness a robust 12 V-class signal while keeping the MCU domain
-local and protected. An initial pull-up near 4.7 kohm is a reasonable starting
-point, subject to the selected sensor's output-current specification and the
-cable capacitance.
-
-The divider scales the 12 V signal to the Schmitt-buffer input. A deliberately
-small, configurable RC filter follows the divider to reject spark-induced
-glitches without materially slowing genuine trigger edges. A nominal 1 nF
-capacitor footprint, with alternatives such as 470 pF and 2.2 nF, should be
-provided and validated with ignition active. The final divider, pull-up, clamp,
-filter, and cable requirements depend on the Hall part number and harness.
 
 ## Analogue Inputs
 
@@ -174,25 +153,28 @@ actual harness and input-function requirements.
 
 ## Deadman Engine-Permit Interlock
 
-The deadman input is a dedicated 5 V vehicle-logic input, not a generic digital
+The deadman uses two dedicated 5 V vehicle-logic inputs, not generic digital
-input. It is conditioned through the normal protected 5 V input interface and
+inputs. The steering-wheel switch provides two electrically independent,
-level-shifted to protected 3.3 V logic. A loss of the external deadman signal
+normally-open contacts. Each contact has its own connector pin, protection,
-is the not-permitted state.
+filtering, default-low bias, and conditioned logic path. This makes an open
+circuit or a short to the 5 V source on one signal path non-permissive.
 
-The resulting `DEADMAN_OK` signal has two independent destinations:
+The resulting 5 V `DEADMAN_OK` signal is high only when channel A reports
+held and the independently conditioned, inverted channel B reports not
+released. It has two independent destinations:
 
-- It enters an MCU digital input so firmware can observe whether the deadman is
+- `DEADMAN_A_STATUS` and `DEADMAN_B_STATUS` enter MCU digital inputs so
-  locked or unlocked, disable scheduling, and report the state.
+  firmware can observe each contact, detect disagreement, disable scheduling,
-- It is combined in hardware with the MCU's `MCU_RUN_PERMIT` output to produce
+  and report the state.
-  `ENGINE_PERMIT`.
+- `DEADMAN_OK` is combined in hardware with the MCU's `MCU_RUN_PERMIT` output
+  to produce `ENGINE_PERMIT`.
 
 ```text
-5 V deadman input --> protection / level shift --> DEADMAN_OK --+--> MCU input
+deadman contact A --> protected input --> DEADMAN_A_HELD --------+
-                                                                 |
+                                                                  +--> valid-state logic --> DEADMAN_OK --+
-MCU_RUN_PERMIT --------------------------------------------------AND--> ENGINE_PERMIT
+deadman contact B --> protected input --> inverted --> DEADMAN_B_RELEASED -+                              |
-                                                                          |
+                                                                                                            AND --> ENGINE_PERMIT
-                                                        driver enable pins, or
+MCU_RUN_PERMIT ----------------------------------------------------------------------------------------------+
-                                                        command-signal gating
 ```
 
 `ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers
@@ -200,13 +182,16 @@ where those inputs are provided. If a selected driver has no suitable enable
 input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using
 logic that defaults to the disabled state on power-up or loss of power.
 
-This hardware path ensures that releasing the deadman stops injector and
+This hardware path ensures that releasing the deadman, an open circuit, or a
-ignition commands even if firmware or a timer output fails to respond. Firmware
+single signal-path short to the 5 V source stops injector and ignition commands
-must also clear/disable pending injection and dwell schedules whenever
+even if firmware or a timer output fails to respond. It does not claim to cover
-`DEADMAN_OK` becomes invalid. A firmware test mode may assert
+a common-mode fault that energises both paths. Firmware must clear/disable
-`MCU_RUN_PERMIT`, but it does not override the physical deadman input; bench
+pending injection and dwell schedules whenever `DEADMAN_OK` becomes invalid or
-operation requires a deliberate external test arrangement that presents a valid
+the two MCU status inputs disagree. A firmware test mode may assert
-deadman signal.
+`MCU_RUN_PERMIT`, but it does not override the physical deadman inputs; bench
+operation requires a deliberate external test arrangement that presents the
+valid two-channel held state. The detailed signal and fault model is defined in
+[DEAD_MAN.md](IO_MODULES/DEAD_MAN.md).
 
 ## Outputs
 
@@ -266,8 +251,6 @@ included unless a future peripheral explicitly requires it.
 
 - Keep trigger and ADC front ends physically separated from coil, injector,
   switching-regulator, and high-current output nodes.
-- Route Hall signals with their sensor return; use an appropriate harness and
-  shielding strategy after cable testing.
 - Place protection at the connector, filtering/conditioning near the MCU side,
   and avoid dumping input-fault energy into `+3V3_ANA`.
 - Validate Hall glitch rejection with ignition active, including worst-case

Architecture/IO_MODULES/DEAD_MAN.md

@@ -3,9 +3,12 @@
 ## Purpose
 
 This module provides the hardware run-permission path for the engine outputs.
-The steering-wheel dead-man switch must be held to assert permission. Releasing
+The steering-wheel dead-man switch must be held to assert permission. Two
-the switch, an open circuit, loss of a logic supply, or MCU reset must place
+electrically independent, normally-open switch contacts and two independent
-the engine outputs in their non-energising state independently of firmware.
+harness signal paths are required. Releasing the switch, an open circuit,
+one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset
+must place the engine outputs in their non-energising state independently of
+firmware.
 
 This document defines the signal relationships and destinations only. Output
 driver implementation is documented separately.
@@ -14,18 +17,31 @@ driver implementation is documented separately.
 
 | Signal | Domain | Active state | Default/fault state |
 | --- | --- | --- | --- |
-| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission |
+| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault |
+| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held |
+| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault |
 | `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
 | `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
 | `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
 | `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
 | `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
-| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted |
+| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault |
+| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault |
 
-`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered,
+Each deadman contact has its own harness signal, connector pin, connector-side
-and given a default-low bias before entering the 5 V logic. The conditioning
+protection, series/filter network, and default-low bias. The contacts may share
-must tolerate expected connector faults and transients without allowing a
+the protected 5 V source at the switch, but neither signal path may share a
-fault to assert engine permission.
+pull-up, pull-down, connector pin, or post-contact conductor with the other.
+Each contact closes to the protected 5 V source only while the driver holds the
+switch. Thus an open signal path reads low; a short of only one signal path to
+the source cannot create the valid two-channel state.
+
+Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B
+is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary
+encoding makes the sole valid held state `A = high`, `B = low`. Both raw,
+conditioned contact observations also enter protected 3.3 V MCU inputs as
+`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations,
+not the safety-critical shutoff path.
 
 ## Signal tree
 
@@ -33,23 +49,27 @@ The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
 levels. Their outputs are 5 V logic levels.
 
 ```text
-protected steering-wheel input
+protected 5 V --> independent NO contact A --> protected A input
+                                                   +--> 3.3 V --> DEADMAN_A_STATUS --> MCU
+                                                   `--> 5 V --> DEADMAN_A_HELD -----+
                                                                                      |
-          +--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU
+protected 5 V --> independent NO contact B --> protected B input                    +--> AND --> DEADMAN_OK --+
+                                                   +--> 3.3 V --> DEADMAN_B_STATUS --> MCU    ^                 |
+                                                   `--> inverter --> DEADMAN_B_RELEASED -- NOT-+                 |
                                                                                                                   |
-          +--> conditioned 5 V DEAD_MAN_SIG --+
+MCU_RUN_PERMIT ---------------------------------------------------------------------------------------------AND --> ENGINE_PERMIT --+
-                                                AND --> ENGINE_PERMIT --+
-MCU_RUN_PERMIT --------------------------------+                        |
-                                                                         +--> ignition-permission inverter
-                                                                         |       --> SAFE_IGNITION_INHIBIT
                                                                                                                                |
-MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG
+                                                                                                     ignition-permission inverter
+                                                                                                               --> SAFE_IGNITION_INHIBIT
+
+MCU_INJECTOR_SIG -------------------------------------------------------------------------------------------AND --> SAFE_INJECTOR_SIG
 ```
 
 The logic equations are:
 
 ```text
-ENGINE_PERMIT        = DEAD_MAN_SIG AND MCU_RUN_PERMIT
+DEADMAN_OK           = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
+ENGINE_PERMIT        = DEADMAN_OK AND MCU_RUN_PERMIT
 SAFE_INJECTOR_SIG    = ENGINE_PERMIT AND MCU_INJECTOR_SIG
 SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
 ```
@@ -61,12 +81,22 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
 | `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
 | `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
 | `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
-| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. |
+| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. |
 
 ## Fail-safe behavior
 
-- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its
+- With the switch released, the valid relationship is
-  wire opens, or its source is unavailable.
+  `DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low.
+- With the switch held, the only permissive relationship is
+  `DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high.
+- An open circuit, an open contact, or a short to the 5 V source on either one
+  signal path produces a non-permissive relationship. A short to ground on a
+  held path also removes permission.
+- This architecture protects against one fault in one contact or signal path.
+  It does not claim to detect a common-mode fault that energises both input
+  paths, or simultaneous faults in both contacts/paths. Harness routing and
+  connector assignment shall minimise such common-mode faults; any remaining
+  risk requires explicit system-level acceptance.
 - `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
   boot, brownout, or an unpowered MCU. External bias components shall provide
   these states during power sequencing.
@@ -82,7 +112,8 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
 
 ## Firmware responsibilities
 
-The hardware path is authoritative; firmware cannot override a released
+The hardware path is authoritative; firmware cannot override a released or
-dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear
+faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and
-pending injection and ignition schedules when it becomes invalid, and keep
+`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a
+released state or disagreement, report any disagreement, and keep
 `MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.

Architecture/IO_MODULES/DIGITAL_INPUTS.md

@@ -7,9 +7,10 @@ NeoECU V1. It accepts externally driven 5 V, 12 V, and protected
 battery-domain signals, plus dry-contact and open-collector sources when the
 appropriate ECU bias option is fitted.
 
-This is not the crank/cam trigger interface and is not the dead-man
+This is not the crank/cam trigger interface and is not either deadman
 engine-permit input. Those functions retain their dedicated conditioning and,
-for the dead-man, its independent hardware safety path.
+for the deadman, its independent two-channel hardware safety path defined in
+[DEAD_MAN.md](DEAD_MAN.md).
 
 V1 provisionally allocates six generic digital-input channels. The allocation,
 connector pins, input timing requirements, and final input count remain open.

Architecture/IO_MODULES/ENGINE_POSITION_INPUTS.md

@@ -0,0 +1,155 @@
+# Engine-Position Inputs
+
+## Purpose
+
+This module defines the dedicated crank and cam position-input class for
+NeoECU V1. It is separate from the generic digital-input module because engine
+timing needs bounded edge delay, jitter, and false-trigger behaviour.
+
+This is an architecture and schematic-design basis, not a released schematic.
+Final component values and qualified fault ratings require the selected sensor,
+harness, connector, and test results.
+
+## V1 timing and signal assumptions
+
+| Signal | V1 arrangement | Function |
+| --- | --- | --- |
+| Crank | Two events per crank revolution | 180-degree position events and speed estimation |
+| Cam | One event per 720-degree cycle | Four-stroke phase identification |
+
+The V1 speed limiter is 5,000 RPM. At that speed the interval between selected
+crank events is 6 ms; a four-event-per-revolution trigger would instead have a
+3 ms interval. V1 retains the two-event pattern. Moving to four events is a
+future trigger-wheel and firmware change, not a reason to alter this input
+class.
+
+The intended interface is a three-wire, active-low Hall sensor: the output is
+normally high and sinks current while active. Capture one defined edge per
+event, normally the falling edge, in an STM32H747 timer channel. Do not use
+both edges as independent position events unless firmware explicitly models
+the Hall-window geometry.
+
+`FEBI BILSTEIN 44421` is the selected cam sensor. It cross-references to EFI
+Automotive 144321 and OE references 1920.6T and 9629684380. It is a three-wire
+12 V Hall sensor with an open-drain output: supply it from `+12V_SENS`, connect
+its return to `SENSOR_GND`, and pull its signal high at the ECU. Confirm the
+physical connector pinout and output sink-current limit from the delivered part
+or its manufacturer documentation before assigning the connector pins and
+freezing `R_PULLUP`. The crank-sensor part number remains to be selected.
+
+## Electrical interface
+
+```text
+                                     ECU
+ +12V_SENS ------------------------+--------------------------> sensor supply
+ SENSOR_GND ---------------------------------------------------> sensor return
+                                    |
+ +12V_SENS -- R_PULLUP -- TRIG_x ---+-- connector -- sensor output
+                           |
+                           +-- connector-side transient protection
+                           +-- R_DIV_TOP --+-- Schmitt buffer --> 3.3 V timer input
+                                           +-- R_DIV_BOTTOM -- SENSOR_GND
+                                           +-- C_FILTER ------ SENSOR_GND
+```
+
+- Supply the sensor from `+12V_SENS`; its rail generation, protection, current
+  limit, and diagnostics belong to `POWER_ARCHITECTURE.md`.
+- Place the signal pull-up at the ECU, to `+12V_SENS`, rather than at the
+  sensor or 3.3 V domain. A 4.7 kOhm footprint is a starting provision only.
+  Select its value from the confirmed sensor sink-current rating, high/low
+  thresholds, cable capacitance, and required edge time.
+- Protect the connector-side signal against the assigned positive and negative
+  harness transients. The completed clamp, series impedance, divider, and
+  Schmitt buffer must keep all intermediate nodes within their validated limits
+  without back-powering the 3.3 V rail while the ECU is off.
+- Scale the high-level signal before the 3.3 V Schmitt buffer. The buffer
+  provides defined logic thresholds and hysteresis; the STM32 pin is never
+  exposed to the sensor-domain voltage.
+- The divider also supplies the resistance for the RC filter. Connect the
+  configurable `C_FILTER` footprint from the divided signal to `SENSOR_GND`,
+  in parallel with `R_DIV_BOTTOM`. Its effective series resistance is
+  `R_DIV_TOP || R_DIV_BOTTOM`, so `tau = (R_DIV_TOP || R_DIV_BOTTOM) *
+  C_FILTER`. Do not add a separate RC series resistor by default. Add one only
+  if it has a separately demonstrated purpose, such as limiting residual-clamp
+  current.
+- Populate 1 nF initially, with 470 pF and 2.2 nF alternatives available.
+  Validate the selected value with the final harness and ignition operating; it
+  must reject short interference without eroding legitimate-edge timing margin.
+- Use the automotive-qualified `SN74LVC2G17QDCKRQ1`, powered from
+  `+3V3_MAIN`, as the two-channel non-inverting Schmitt buffer for crank and
+  cam. Its inputs must only receive the protected, divided signal, never the
+  raw 12 V harness node.
+
+## Connector, harness, shield, and layout
+
+Crank and cam use the dedicated **engine-sensors connector**, not the
+power/actuator connector. This preserves physical separation from coil,
+injector, starter, and other high-current wiring. The V1 connector plan is:
+
+| Connector group | Carries |
+| --- | --- |
+| Power/actuators | Battery and power returns, ignition, injector, and high-current outputs |
+| Engine sensors | Crank/cam supply, signals, sensor returns, thermistors, and analogue sensors |
+| Vehicle I/O/CAN | CAN, deadman, generic digital inputs, and generic 5 V logic outputs |
+
+Use a screened harness for each trigger sensor. Route the trigger signal as a
+twisted pair with `SENSOR_GND`; route its `+12V_SENS` supply in the same
+screened cable. The screen is an EMC structure, not a sensor return or circuit
+ground conductor.
+
+Terminate each screen at the ECU end only, at a dedicated `SHIELD_GND` bond
+with a short, broad connection to the enclosure/chassis structure near the
+power-entry region. Do not connect the screen to `SENSOR_GND`, `DGND`, or
+`+3V3_ANA`, and do not connect it at the sensor end. Final backshell and case
+bonding details depend on the selected connector and enclosure.
+
+Place transient protection at the connector. Keep the divider, filter, Schmitt
+buffer, and timer route on the quiet MCU side. Keep these paths away from the
+ignition high-voltage node, injector switching loop, and regulator hot loops.
+
+## False-trigger handling and validation
+
+Hardware filtering is the first defence. Firmware provides a second,
+independent plausibility check; it does not replace the hardware network.
+
+For every selected crank edge, firmware shall:
+
+1. timestamp the edge with the timer;
+2. reject an edge whose interval since the previous accepted edge is below a
+   calibrated physical minimum; and
+3. reject an interval that implies an implausible acceleration from the recent
+   accepted speed estimate.
+
+The threshold shall be derived from the maximum measured engine acceleration,
+the 5,000 RPM speed limit, timer resolution, and a conservative margin. It
+shall not be a fixed arbitrary debounce time. A rejected edge shall not update
+speed, position, dwell, injection scheduling, or the reference interval, so a
+spark-induced pulse cannot displace the next accepted timing event.
+
+Cam edges shall be checked against the expected crank phase. A missing or
+inconsistent cam event removes phase synchronisation and must lead firmware to
+the explicitly defined no-sync behaviour; it must never invent a phase from a
+single unexpected edge.
+
+Validate with the installed engine and final harness:
+
+- no false accepted crank/cam events during worst-case dwell and spark;
+- no missed genuine events at 5,000 RPM and during the maximum measured
+  acceleration;
+- measured conditioning delay and jitter within the firmware timing budget;
+- correct rejection of injected short glitches without corrupting the following
+  genuine event; and
+- sensor unplug, signal open/short, and sensor-supply fault behaviour as
+  defined by the final selected parts.
+
+## Remaining inputs before schematic freeze
+
+1. Confirm the FEBI 44421 physical connector pinout and output sink-current
+   limit from the delivered part or manufacturer documentation.
+2. Select and obtain the equivalent data for the crank sensor.
+3. Confirm connector family, pin assignment, cable length/construction, and
+   enclosure/backshell method for the engine-sensors connector.
+4. Select protection components and final pull-up, divider, and filter values
+   against the confirmed sensor and harness limits.
+5. Measure maximum real engine acceleration and establish the timer-based
+   interval-plausibility limits in firmware.

Architecture/IO_MODULES/IGNITION.md

@@ -65,11 +65,12 @@ temperature, and ignition noise.
 SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
 ```
 
-When `ENGINE_PERMIT` is removed, `SAFE_IGNITION_INHIBIT` becomes high. If a
+When `ENGINE_PERMIT` is removed by the two-channel deadman interlock or the
-dwell is active, this invokes the VBG08H-E soft shutdown so coil current is
+MCU, `SAFE_IGNITION_INHIBIT` becomes high. If a dwell is active, this invokes
-removed without intentionally generating a spark. The 1 kOhm resistors on
+the VBG08H-E soft shutdown so coil current is removed without intentionally
-`INP` and `EN` follow the manufacturer's reference circuit and limit transient
+generating a spark. The 1 kOhm resistors on `INP` and `EN` follow the
-current into the device's control pins.
+manufacturer's reference circuit and limit transient current into the device's
+control pins.
 
 The command traces shall be short, have a continuous quiet reference, and be
 routed away from the `HVC` switching node and coil connector. The VBG08H-E

Architecture/IO_MODULES/INJECTON.md

@@ -35,7 +35,7 @@ VBAT_PROT --> injector positive terminal --> injector coil --> VNL5050 DRAIN
 ## Command path
 
 `INPUT` is active high. It receives only the hardware-permitted injector
-command defined by the dead-man interlock.
+command defined by the two-channel deadman interlock.
 
 ```text
 SAFE_INJECTOR_SIG --> 1 kOhm Rprot --> INPUT
@@ -62,7 +62,8 @@ pin.
 
 When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the
 injector output off. This is the hardware shutoff path; firmware also clears
-pending injection events when it observes a dead-man release.
+pending injection events when `DEADMAN_OK` becomes invalid or the two deadman
+status inputs disagree.
 
 ## Status diagnostic
 

Architecture/README.md

@@ -47,15 +47,14 @@ The current engine timing arrangement is:
 | Crank | Two Hall-effect pulses per crank revolution | 180-degree position events and speed estimation |
 | Cam | One Hall-effect pulse per 720-degree cycle | Four-stroke phase identification |
 
-The initial engine speed limiter is 5,000 RPM. A future crank trigger with four
+The initial engine speed limiter is 5,000 RPM. V1 retains the two-pulse crank
-pulses per revolution is being considered to provide 90-degree timing events
+arrangement. A future four-pulse trigger can provide 90-degree timing events
-and improve interpolation accuracy.
+and improve interpolation accuracy, but is not part of the V1 hardware scope.
 
-Crank and cam sensors currently operate as 12 V, active-low Hall-effect
+Crank and cam are dedicated timing interfaces. Their intended 12 V active-low
-signals: their output is normally high and pulls low when active. The ECU must
+Hall architecture, connector partition, shield treatment, conditioning, and
-condition these signals to protected 3.3 V timer inputs. The interface must
+hardware/firmware glitch rejection are defined in
-support the existing open-collector-style arrangement and provide noise
+[ENGINE_POSITION_INPUTS.md](IO_MODULES/ENGINE_POSITION_INPUTS.md).
-rejection appropriate for an engine environment.
 
 ## Power Architecture
 
@@ -144,4 +143,3 @@ selection are finalised:
    requirements.
 5. CAN connector and bus topology.
 6. Detailed trigger sensor wiring, connector, and cable-length information.
-