diff --git a/Architecture/IO_ARCHITECTURE.md b/Architecture/IO_ARCHITECTURE.md index 0a50456..4b5c08c 100644 --- a/Architecture/IO_ARCHITECTURE.md +++ b/Architecture/IO_ARCHITECTURE.md @@ -19,7 +19,7 @@ temperature and pressure sensors, and an external starter switch. | --- | ---: | --- | | Crank trigger input | 1 | 12 V active-low Hall, timer capture | | Cam trigger input | 1 | 12 V active-low Hall, timer capture | -| Deadman inputs | 2 | Dedicated, independent 5 V vehicle-logic engine-permit inputs | +| Deadman input | 1 | Shared 5 V signal from parallel steering-wheel switches; dedicated hardware engine-permit path | | Thermistor inputs | 4 | Air, oil, water, and one spare temperature input | | General analogue inputs | 9 | Protected 0-5 V sensor channels | | ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` | @@ -150,41 +150,38 @@ actual harness and input-function requirements. ## Deadman Engine-Permit Interlock -The deadman uses two dedicated 5 V vehicle-logic inputs, not generic digital -inputs. The steering-wheel switch provides two electrically independent, -normally-open contacts. Each contact has its own connector pin, protection, -filtering, default-low bias, and conditioned logic path. This makes an open -circuit or a short to the 5 V source on one signal path non-permissive. +The steering wheel has two normally-open switches connected in parallel. +Holding either switch asserts one shared active-high 5 V `DEADMAN_IN` signal +into the ECU; both must be released to deassert it. The ECU uses one dedicated +signal pin, protection/filter network, default-low bias and conditioning path, +separate from generic digital inputs. -The resulting 5 V `DEADMAN_OK` signal is high only when channel A reports -held and the independently conditioned, inverted channel B reports not -released. It has two independent destinations: +The conditioned 5 V `DEADMAN_OK` signal feeds the hardware permission gate. +One protected 3.3 V `DEADMAN_STATUS` input lets the MCU observe the same combined +state. The MCU cannot identify which switch is held or compare their states. -- `DEADMAN_A_STATUS` and `DEADMAN_B_STATUS` enter MCU digital inputs so - firmware can observe each contact, detect disagreement, disable scheduling, - and report the state. -- `DEADMAN_OK` is combined in hardware with the MCU's `MCU_RUN_PERMIT` output - to produce `ENGINE_PERMIT`. +![Parallel switches and single deadman input](diagrams/deadman-inputs.svg) -![Deadman inputs](diagrams/deadman-inputs.svg) +![Single-input engine permission](diagrams/deadman-permit.svg) -![Deadman permit](diagrams/deadman-permit.svg) +`ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT`. The injector command is +`SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG`; the ignition driver +receives `SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)`. These paths remove +permission in hardware when the shared input goes low, independently of +firmware response. Driver bias networks must establish off/inhibited states +through power loss and MCU reset. -`ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers -where those inputs are provided. If a selected driver has no suitable enable -input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using -logic that defaults to the disabled state on power-up or loss of power. +Both switches released, an open shared signal or loss of switch supply removes +permission through the default-low input. An open individual switch branch +leaves the other switch usable. A stuck-closed switch or a shared signal shorted +to the asserted source can keep permission asserted; this single-input +arrangement cannot detect those faults or per-switch disagreement. -This hardware path ensures that releasing the deadman, an open circuit, or a -single signal-path short to the 5 V source stops injector and ignition commands -even if firmware or a timer output fails to respond. It does not claim to cover -a common-mode fault that energises both paths. Firmware must clear/disable -pending injection and dwell schedules whenever `DEADMAN_OK` becomes invalid or -the two MCU status inputs disagree. A firmware test mode may assert -`MCU_RUN_PERMIT`, but it does not override the physical deadman inputs; bench -operation requires a deliberate external test arrangement that presents the -valid two-channel held state. The detailed signal and fault model is defined in -[DEAD_MAN.md](IO_MODULES/DEAD_MAN.md). +Firmware clears pending injection and dwell schedules when `DEADMAN_STATUS` +deasserts. A test mode may assert `MCU_RUN_PERMIT`, but cannot bypass a low +physical deadman input; bench operation requires a deliberate external test +arrangement asserting the single shared signal. The detailed interface and +fault behavior are defined in [DEAD_MAN.md](IO_MODULES/DEAD_MAN.md). ## Outputs diff --git a/Architecture/IO_MODULES/DEAD_MAN.md b/Architecture/IO_MODULES/DEAD_MAN.md index ff3789f..bb43efc 100644 --- a/Architecture/IO_MODULES/DEAD_MAN.md +++ b/Architecture/IO_MODULES/DEAD_MAN.md @@ -3,106 +3,120 @@ ## Purpose This module provides the hardware run-permission path for the engine outputs. -The steering-wheel dead-man switch must be held to assert permission. Two -electrically independent, normally-open switch contacts and two independent -harness signal paths are required. Releasing the switch, an open circuit, -one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset -must place the engine outputs in their non-energising state independently of -firmware. +The steering wheel has two normally-open deadman switches wired in parallel. +Holding either switch closes the circuit; holding both also closes it. Their +outputs are tied together at the steering wheel and form **one shared deadman +signal entering the ECU**, not two independently monitored inputs. -This document defines the signal relationships and destinations only. Output -driver implementation is documented separately. +The existing active-high 5 V interface is retained: either switch connects the +protected 5 V source to `DEADMAN_IN`. Both switches must be released to remove +permission. The ECU conditions this one signal for hardware gating and MCU +observation. Output-driver implementation is documented separately. ## Logic domains -| Signal | Domain | Active state | Default/fault state | -| --- | --- | --- | --- | -| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault | -| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held | -| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault | -| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission | -| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission | -| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off | -| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off | -| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted | -| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault | -| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault | +| Signal | Domain | Meaning | +| --- | --- | --- | +| `DEADMAN_IN` | Harness-connected 5 V input | High when either parallel switch is held; ECU-side bias holds it low when both are released or the shared signal is open. | +| `DEADMAN_OK` | Conditioned 5 V logic | Active-high hardware observation of the single deadman input. It is not proof that a switch or harness fault is absent. | +| `DEADMAN_STATUS` | Protected 3.3 V MCU input | MCU observation of the same combined deadman state; high means asserted. | +| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High permits engine operation; defaults low. | +| `ENGINE_PERMIT` | 5 V logic | High only when deadman and MCU permission are both asserted. | +| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | Requested injector on-time; defaults low. | +| `SAFE_INJECTOR_SIG` | 5 V logic | Permitted injector command; low means off. | +| `SAFE_IGNITION_INHIBIT` | 5 V logic | High inhibits ignition; low permits it. The driver must default to inhibited when permission logic is unpowered. | -Each deadman contact has its own harness signal, connector pin, connector-side -protection, series/filter network, and default-low bias. The contacts may share -the protected 5 V source at the switch, but neither signal path may share a -pull-up, pull-down, connector pin, or post-contact conductor with the other. -Each contact closes to the protected 5 V source only while the driver holds the -switch. Thus an open signal path reads low; a short of only one signal path to -the source cannot create the valid two-channel state. +## Steering-wheel wiring and ECU input -Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B -is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary -encoding makes the sole valid held state `A = high`, `B = low`. Both raw, -conditioned contact observations also enter protected 3.3 V MCU inputs as -`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations, -not the safety-critical shutoff path. +The two switches share the protected 5 V source and the switched return signal. +The parallel connection is made before the ECU: only one `DEADMAN_IN` signal +conductor and one signal connector pin are required at the ECU, in addition to +the supply connection. No separate contact-status wires are provided. -## Signal tree +Use one dedicated connector-side protection, series/filter network, default-low +bias and non-inverting conditioning path. It produces the 5 V `DEADMAN_OK` +signal and a protected 3.3 V `DEADMAN_STATUS` observation for the MCU. Keep the +hardware gating independent of firmware; the MCU status input is observational. +Exact protection, filtering and connector assignments remain implementation +items. The generic digital-input module does not replace this dedicated path. -The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic -levels. Their outputs are 5 V logic levels. +| Left switch held | Right switch held | Shared signal / `DEADMAN_OK` (healthy circuit) | +| --- | --- | --- | +| No | No | Low | +| Yes | No | High | +| No | Yes | High | +| Yes | Yes | High | -![Deadman inputs](../diagrams/deadman-inputs.svg) +## Hardware gating -![Deadman permit](../diagrams/deadman-permit.svg) +The permission gates operate from `+5V_MAIN`, accept 3.3 V MCU logic levels, +and produce 5 V logic outputs. -![Deadman outputs](../diagrams/deadman-outputs.svg) +![Parallel switches and single deadman input](../diagrams/deadman-inputs.svg) -The logic equations are: +![Single-input engine permission](../diagrams/deadman-permit.svg) + +![Permitted injector command and ignition inhibit](../diagrams/deadman-outputs.svg) + +The healthy-switch relationship is a physical parallel connection at the +steering wheel, not an OR gate or two channels inside the ECU: ```text -DEADMAN_OK = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED) +DEADMAN_IN asserted = LEFT_SWITCH_HELD OR RIGHT_SWITCH_HELD +DEADMAN_OK = conditioned active-high DEADMAN_IN ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) ``` +`LEFT_SWITCH_HELD` and `RIGHT_SWITCH_HELD` above describe physical switch +states only; they are not separately available ECU signals. + ## Output destinations | Logic output | Destination | Required behavior | | --- | --- | --- | -| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. | -| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. | -| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. | -| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. | +| `ENGINE_PERMIT` | Injection command gate and ignition-permission inverter | Low removes permission from both engine-output paths. | +| `SAFE_INJECTOR_SIG` | Injector driver command input | The only injector on-command presented to the output stage. | +| `SAFE_IGNITION_INHIBIT` | Ignition driver inhibit input | High inhibits the ignition stage; low permits it. | +| `DEADMAN_STATUS` | One STM32 digital input | Firmware observes the combined deadman state and clears schedules when it deasserts. It cannot identify which switch is held. | -## Fail-safe behavior +## Release and fault behavior -- With the switch released, the valid relationship is - `DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low. -- With the switch held, the only permissive relationship is - `DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high. -- An open circuit, an open contact, or a short to the 5 V source on either one - signal path produces a non-permissive relationship. A short to ground on a - held path also removes permission. -- This architecture protects against one fault in one contact or signal path. - It does not claim to detect a common-mode fault that energises both input - paths, or simultaneous faults in both contacts/paths. Harness routing and - connector assignment shall minimise such common-mode faults; any remaining - risk requires explicit system-level acceptance. +- Releasing one switch while the other is held leaves permission asserted. + Releasing both switches deasserts `DEADMAN_OK` and removes `ENGINE_PERMIT` + through hardware, without waiting for firmware. +- An open shared signal conductor or loss of the switch supply deasserts the + input through the ECU-side default-low bias. A shared signal short to ground + also deasserts it; the protected source must tolerate the assigned fault. +- An open individual switch branch disables that switch only. The other + parallel switch can still assert the shared signal. +- A stuck-closed switch, a bridged contact or the shared signal shorted to the + asserted 5 V source can hold `DEADMAN_OK` high after both switches are + released. This single-input arrangement cannot distinguish those faults + from a legitimate held state. It provides no per-switch disagreement or + independent-channel fault detection. - `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset, - boot, brownout, or an unpowered MCU. External bias components shall provide - these states during power sequencing. -- If `ENGINE_PERMIT` becomes low during an injection command, - `SAFE_INJECTOR_SIG` becomes low and removes the command from the injection - output stage. -- If `ENGINE_PERMIT` becomes low during an ignition dwell, - `SAFE_IGNITION_INHIBIT` becomes high and commands the ignition output stage - into its non-sparking shutdown behavior. -- If the 5 V permission logic loses power, the injection command input must - be externally biased low and the ignition output stage's inhibit input must - default to its inhibited state. + boot, brownout or an unpowered MCU. External bias components establish these + states through power sequencing. The MCU can withdraw permission even when + the deadman signal is high. +- If `ENGINE_PERMIT` becomes low during injection, `SAFE_INJECTOR_SIG` becomes + low and removes the injector command. +- If `ENGINE_PERMIT` becomes low during ignition dwell, + `SAFE_IGNITION_INHIBIT` becomes high and requests the ignition driver's + documented non-sparking shutdown behavior. +- If the 5 V permission logic loses power, the injector command must be biased + low and the ignition driver must default to inhibited. Verify this behavior + in the completed input, gate and driver implementation. ## Firmware responsibilities -The hardware path is authoritative; firmware cannot override a released or -faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and -`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a -released state or disagreement, report any disagreement, and keep -`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled. +Firmware samples the single `DEADMAN_STATUS` input, clears pending injection +and ignition schedules when it deasserts, and keeps `MCU_RUN_PERMIT` low except +while engine operation is intentionally enabled. It has no individual switch +states to compare and must not claim to detect contact disagreement or a +stuck-high shared signal from this observation alone. + +A firmware test mode may assert `MCU_RUN_PERMIT`, but cannot override a low +hardware deadman input. Bench operation requires a deliberate external test +arrangement that asserts the single `DEADMAN_IN` signal. diff --git a/Architecture/IO_MODULES/DIGITAL_INPUTS.md b/Architecture/IO_MODULES/DIGITAL_INPUTS.md index 02e1fb5..e342c09 100644 --- a/Architecture/IO_MODULES/DIGITAL_INPUTS.md +++ b/Architecture/IO_MODULES/DIGITAL_INPUTS.md @@ -7,9 +7,9 @@ NeoECU V1. It accepts externally driven 5 V, 12 V, and protected battery-domain signals, plus dry-contact and open-collector sources when the appropriate ECU bias option is fitted. -This is not the crank/cam trigger interface and is not either deadman +This is not the crank/cam trigger interface and is not the dedicated deadman engine-permit input. Those functions retain their dedicated conditioning and, -for the deadman, its independent two-channel hardware safety path defined in +for the deadman, its single-input hardware permission path defined in [DEAD_MAN.md](DEAD_MAN.md). V1 provisionally allocates six generic digital-input channels. The allocation, diff --git a/Architecture/IO_MODULES/IGNITION.md b/Architecture/IO_MODULES/IGNITION.md index c110740..1a63788 100644 --- a/Architecture/IO_MODULES/IGNITION.md +++ b/Architecture/IO_MODULES/IGNITION.md @@ -43,7 +43,7 @@ temperature, and ignition noise. SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT) ``` -When `ENGINE_PERMIT` is removed by the two-channel deadman interlock or the +When `ENGINE_PERMIT` is removed by the single-input deadman interlock or the MCU, `SAFE_IGNITION_INHIBIT` becomes high. If a dwell is active, this invokes the VBG08H-E soft shutdown so coil current is removed without intentionally generating a spark. The 1 kOhm resistors on `INP` and `EN` follow the diff --git a/Architecture/IO_MODULES/INJECTON.md b/Architecture/IO_MODULES/INJECTON.md index 91824f6..6b2c1b0 100644 --- a/Architecture/IO_MODULES/INJECTON.md +++ b/Architecture/IO_MODULES/INJECTON.md @@ -29,7 +29,7 @@ low-impedance injector requires a different architecture. ## Command path `INPUT` is active high. It receives only the hardware-permitted injector -command defined by the two-channel deadman interlock. +command defined by the single-input deadman interlock. ![Injector command](../diagrams/injector-command.svg) @@ -51,8 +51,7 @@ pin. When `ENGINE_PERMIT` is removed, `SAFE_INJECTOR_SIG` goes low and turns the injector output off. This is the hardware shutoff path; firmware also clears -pending injection events when `DEADMAN_OK` becomes invalid or the two deadman -status inputs disagree. +pending injection events when the single `DEADMAN_STATUS` input deasserts. ## Status diagnostic diff --git a/Architecture/diagrams/README.md b/Architecture/diagrams/README.md index 51ae236..eae5047 100644 --- a/Architecture/diagrams/README.md +++ b/Architecture/diagrams/README.md @@ -66,8 +66,11 @@ Validate each circuit manifest with the installed topology validator: - The Hall-input drawing separates sensor supply, sensor return and signal; the original ASCII alignment could suggest an unintended join. The pull-up, divider and parallel filter follow the existing prose. -- The deadman equations are unchanged. Contact observations, permission gates - and output gates occupy separate figures; shared net names connect them. +- The steering-wheel deadman switches are wired in parallel and present one + shared `DEADMAN_IN` to the ECU. Either switch can assert permission. One + `DEADMAN_STATUS` input reports the combined state; the ECU has no per-switch + observations. The permission and output gates use the single `DEADMAN_OK` + signal. See the module document for release and stuck-high fault behavior. - `VBG_LOCAL_KELVIN` labels the documented local ignition reference at the `IGN_PGND` joining point. `LOCAL_GND` in the sink-command figure denotes the TLE9104SH local ground reference. Neither denotes a new remote ground path. diff --git a/Architecture/diagrams/block-connections.json b/Architecture/diagrams/block-connections.json index 4a50c03..e65d824 100644 --- a/Architecture/diagrams/block-connections.json +++ b/Architecture/diagrams/block-connections.json @@ -658,11 +658,11 @@ ] }, "deadman-inputs": { - "title": "Deadman contacts and observations", - "source": "IO_MODULES/DEAD_MAN.md: Logic domains", + "title": "Parallel switches \u00b7 one ECU deadman input", + "source": "IO_MODULES/DEAD_MAN.md: Steering-wheel wiring and ECU input", "nodes": { "title": { - "label": "Deadman contacts and observations", + "label": "Parallel switches \u00b7 one ECU deadman input", "kind": "note", "bounds": [ 30, @@ -671,131 +671,137 @@ 42 ] }, - "As": { - "label": "Protected 5 V\nIndependent NO contact A", + "supply": { + "label": "Protected 5 V", "kind": "power", "bounds": [ 30, - 100, - 260, - 80 - ] - }, - "Ap": { - "label": "Protected input A\nOwn filter + default-low bias", - "kind": "signal", - "bounds": [ - 370, - 100, - 290, - 80 - ] - }, - "Ah": { - "label": "DEADMAN_A_HELD\n5 V \u00b7 non-inverting", - "kind": "signal", - "bounds": [ - 750, - 100, - 260, - 80 - ] - }, - "Ad": { - "label": "DEADMAN_A_STATUS\n3.3 V \u00b7 held = high \u2192 MCU", - "kind": "device", - "bounds": [ - 370, + 200, 220, - 330, - 75 - ] - }, - "Bs": { - "label": "Protected 5 V\nIndependent NO contact B", - "kind": "power", - "bounds": [ - 30, - 345, - 260, 80 ] }, - "Bp": { - "label": "Protected input B\nOwn filter + default-low bias", - "kind": "signal", - "bounds": [ - 370, - 345, - 290, - 80 - ] - }, - "Bh": { - "label": "DEADMAN_B_RELEASED\n5 V \u00b7 inverting", - "kind": "signal", - "bounds": [ - 750, - 345, - 260, - 80 - ] - }, - "Bd": { - "label": "DEADMAN_B_STATUS\n3.3 V \u00b7 held = high \u2192 MCU", + "left": { + "label": "Left NO switch\nHeld = closed", "kind": "device", "bounds": [ - 370, - 465, - 330, - 75 + 340, + 90, + 230, + 80 ] }, - "note575": { - "label": "Separate harness paths. MCU status observations are diagnostic; the 5 V signals feed the permit gates.", + "right": { + "label": "Right NO switch\nHeld = closed", + "kind": "device", + "bounds": [ + 340, + 300, + 230, + 80 + ] + }, + "shared": { + "label": "DEADMAN_IN\nJoined at steering wheel", + "kind": "signal", + "bounds": [ + 740, + 200, + 270, + 80 + ] + }, + "note390": { + "label": "Switches are physically in parallel. Either held \u2192 asserted; both released \u2192 deasserted.", "kind": "note", "bounds": [ 30, - 575, + 390, 980, 60 ] + }, + "input": { + "label": "DEADMAN_IN\nOne ECU signal pin", + "kind": "signal", + "bounds": [ + 30, + 490, + 240, + 80 + ] + }, + "conditioning": { + "label": "Protection + filter\nDefault-low bias", + "kind": "signal", + "bounds": [ + 340, + 490, + 270, + 80 + ] + }, + "ok": { + "label": "DEADMAN_OK\n5 V \u00b7 hardware gates", + "kind": "signal", + "bounds": [ + 740, + 490, + 270, + 80 + ] + }, + "status": { + "label": "DEADMAN_STATUS\n3.3 V \u2192 one MCU input", + "kind": "device", + "bounds": [ + 340, + 630, + 310, + 80 + ] } }, "connections": [ { - "from": "As", - "to": "Ap", + "from": "supply", + "to": "left", "label": "", "kind": "signal" }, { - "from": "Ap", - "to": "Ah", + "from": "supply", + "to": "right", "label": "", "kind": "signal" }, { - "from": "Ap", - "to": "Ad", + "from": "left", + "to": "shared", "label": "", "kind": "signal" }, { - "from": "Bs", - "to": "Bp", + "from": "right", + "to": "shared", "label": "", "kind": "signal" }, { - "from": "Bp", - "to": "Bh", + "from": "input", + "to": "conditioning", "label": "", "kind": "signal" }, { - "from": "Bp", - "to": "Bd", + "from": "conditioning", + "to": "ok", + "label": "", + "kind": "signal" + }, + { + "from": "conditioning", + "to": "status", "label": "", "kind": "signal" } diff --git a/Architecture/diagrams/build_blocks.py b/Architecture/diagrams/build_blocks.py index fe49cb6..05819d1 100644 --- a/Architecture/diagrams/build_blocks.py +++ b/Architecture/diagrams/build_blocks.py @@ -99,15 +99,23 @@ f.note('Sensor output is the sensor’s signal pin. Both ADC channels use +3V3_A chain('dac-output','Optional analogue-output provision','IO_ARCHITECTURE.md: Analogue-output provision',['MCU DAC','Rail-to-rail buffer','Protection /\nseries impedance','Connector'],'Provision only; final electrical range, load and protection remain to be defined.') -f=Figure('deadman-inputs','Deadman contacts and observations','IO_MODULES/DEAD_MAN.md: Logic domains',1040,650) -for i,c in enumerate('AB'): - y=100+i*245 - f.node(c+'s','Protected 5 V\nIndependent NO contact '+c,30,y,260,80,'power') - f.node(c+'p','Protected input '+c+'\nOwn filter + default-low bias',370,y,290,80,'signal') - f.node(c+'h','DEADMAN_A_HELD\n5 V · non-inverting' if c=='A' else 'DEADMAN_B_RELEASED\n5 V · inverting',750,y,260,80,'signal') - f.node(c+'d','DEADMAN_'+c+'_STATUS\n3.3 V · held = high → MCU',370,y+120,330,75,'device') - f.edge(c+'s',c+'p'); f.edge(c+'p',c+'h'); f.edge(c+'p',c+'d',exit=(.5,1),entry=(.5,0)) -f.note('Separate harness paths. MCU status observations are diagnostic; the 5 V signals feed the permit gates.',575);f.save() +f=Figure('deadman-inputs','Parallel switches · one ECU deadman input','IO_MODULES/DEAD_MAN.md: Steering-wheel wiring and ECU input',1040,750) +f.node('supply','Protected 5 V',30,200,220,80,'power') +f.node('left','Left NO switch\nHeld = closed',340,90,230,80,'device') +f.node('right','Right NO switch\nHeld = closed',340,300,230,80,'device') +f.node('shared','DEADMAN_IN\nJoined at steering wheel',740,200,270,80,'signal') +f.edge('supply','left',points=[(290,240),(290,130)]) +f.edge('supply','right',points=[(290,240),(290,340)]) +f.edge('left','shared',points=[(660,130),(660,240)]) +f.edge('right','shared',points=[(660,340),(660,240)]) +f.note('Switches are physically in parallel. Either held → asserted; both released → deasserted.',390) +f.node('input','DEADMAN_IN\nOne ECU signal pin',30,490,240,80) +f.node('conditioning','Protection + filter\nDefault-low bias',340,490,270,80) +f.node('ok','DEADMAN_OK\n5 V · hardware gates',740,490,270,80) +f.node('status','DEADMAN_STATUS\n3.3 V → one MCU input',340,630,310,80,'device') +f.edge('input','conditioning');f.edge('conditioning','ok') +f.edge('conditioning','status',exit=(.5,1),entry=(.5,0)) +f.save() for name,title,part,pin,load,ground,source in [ ('ignition-power','Ignition power path','VBG08H-E','HVC','Coil primary','IGN_PGND','IGNITION'), diff --git a/Architecture/diagrams/build_circuits.py b/Architecture/diagrams/build_circuits.py index 5809c5a..52d37d1 100644 --- a/Architecture/diagrams/build_circuits.py +++ b/Architecture/diagrams/build_circuits.py @@ -160,11 +160,10 @@ def equation_gate(c,ref,xy,a,b,out,invert_b=False): c.wire(start,(x-1.2,yy));c.wire((x-1.2,yy),(x-1.2,anchor.y));c.wire((x-1.2,anchor.y),anchor) c.wire(gate.out,(x+5,y));c.port(ref+'O',(x+5,y),out,loc='right') -c=Circuit('deadman-permit','Hardware engine-permit equations','IO_MODULES/DEAD_MAN.md: Logic equations') -equation_gate(c,'VALID',(0,0),'DEADMAN_A_HELD','DEADMAN_B_RELEASED','DEADMAN_OK',True) -equation_gate(c,'PERMIT',(0,-6),'DEADMAN_OK','MCU_RUN_PERMIT','ENGINE_PERMIT') -c.label((0,3),'Hardware permission · 5 V gate outputs',size=18) -c.label((0,-9),'Bubble inverts channel B. MCU_RUN_PERMIT is 3.3 V; gates must accept that input level.',size=11);c.save() +c=Circuit('deadman-permit','Single-input hardware engine permission','IO_MODULES/DEAD_MAN.md: Hardware gating') +equation_gate(c,'PERMIT',(0,0),'DEADMAN_OK','MCU_RUN_PERMIT','ENGINE_PERMIT') +c.label((0,3),'Single deadman input · hardware permission',size=18) +c.label((0,-3),'DEADMAN_OK: conditioned shared input. MCU_RUN_PERMIT: 3.3 V. Gate output: 5 V.',size=11);c.save() c=Circuit('deadman-outputs','Hardware permitted output commands','IO_MODULES/DEAD_MAN.md: Logic equations') equation_gate(c,'INJECT',(0,0),'ENGINE_PERMIT','MCU_INJECTOR_SIG','SAFE_INJECTOR_SIG') diff --git a/Architecture/diagrams/deadman-inputs.drawio b/Architecture/diagrams/deadman-inputs.drawio index 5385430..229e3b7 100644 --- a/Architecture/diagrams/deadman-inputs.drawio +++ b/Architecture/diagrams/deadman-inputs.drawio @@ -1,58 +1,81 @@ - - + + - + - - + + - - + + - - + + - - + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - + - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/Architecture/diagrams/deadman-inputs.png b/Architecture/diagrams/deadman-inputs.png index 98221b5..deac14a 100644 Binary files a/Architecture/diagrams/deadman-inputs.png and b/Architecture/diagrams/deadman-inputs.png differ diff --git a/Architecture/diagrams/deadman-inputs.svg b/Architecture/diagrams/deadman-inputs.svg index f5da9eb..e63a304 100644 --- a/Architecture/diagrams/deadman-inputs.svg +++ b/Architecture/diagrams/deadman-inputs.svg @@ -1,2 +1,2 @@ -Deadman contacts and observationsProtected 5 VIndependent NO contact AProtected input AOwn filter + default-low biasDEADMAN_A_HELD5 V · non-invertingDEADMAN_A_STATUS3.3 V · held = high → MCUProtected 5 VIndependent NO contact BProtected input BOwn filter + default-low biasDEADMAN_B_RELEASED5 V · invertingDEADMAN_B_STATUS3.3 V · held = high → MCUSeparate harness paths. MCU status observations are diagnostic; the 5 V signals feed the permit gates. \ No newline at end of file +Parallel switches · one ECU deadman inputProtected 5 VLeft NO switchHeld = closedRight NO switchHeld = closedDEADMAN_INJoined at steering wheelSwitches are physically in parallel. Either held → asserted; both released → deasserted.DEADMAN_INOne ECU signal pinProtection + filterDefault-low biasDEADMAN_OK5 V · hardware gatesDEADMAN_STATUS3.3 V → one MCU input \ No newline at end of file diff --git a/Architecture/diagrams/deadman-permit.png b/Architecture/diagrams/deadman-permit.png index 591fa80..6cef63b 100644 Binary files a/Architecture/diagrams/deadman-permit.png and b/Architecture/diagrams/deadman-permit.png differ diff --git a/Architecture/diagrams/deadman-permit.svg b/Architecture/diagrams/deadman-permit.svg index b113d76..080f1ca 100644 --- a/Architecture/diagrams/deadman-permit.svg +++ b/Architecture/diagrams/deadman-permit.svg @@ -1,2 +1,2 @@ -Hardware permission · 5 V gate outputsBubble inverts channel B. MCU_RUN_PERMIT is 3.3 V; gates must accept that input level.DEADMAN_A_HELDDEADMAN_B_RELEASEDDEADMAN_OKDEADMAN_OKMCU_RUN_PERMITENGINE_PERMIT \ No newline at end of file +Single deadman input · hardware permissionDEADMAN_OK: conditioned shared input. MCU_RUN_PERMIT: 3.3 V. Gate output: 5 V.DEADMAN_OKMCU_RUN_PERMITENGINE_PERMIT \ No newline at end of file diff --git a/Architecture/diagrams/deadman-permit.topology.json b/Architecture/diagrams/deadman-permit.topology.json index f8dc4bf..20dfe27 100644 --- a/Architecture/diagrams/deadman-permit.topology.json +++ b/Architecture/diagrams/deadman-permit.topology.json @@ -1,42 +1,8 @@ { - "title": "Hardware engine-permit equations", - "source": "IO_MODULES/DEAD_MAN.md: Logic equations", + "title": "Single-input hardware engine permission", + "source": "IO_MODULES/DEAD_MAN.md: Hardware gating", "reference_scope": "documentation only", "components": [ - { - "ref": "VALID", - "kind": "and-with-inverted-B", - "pins": [ - "A", - "B", - "Y" - ], - "value": "" - }, - { - "ref": "VALIDP0", - "kind": "port", - "pins": [ - "P" - ], - "value": "DEADMAN_A_HELD" - }, - { - "ref": "VALIDP1", - "kind": "port", - "pins": [ - "P" - ], - "value": "DEADMAN_B_RELEASED" - }, - { - "ref": "VALIDO", - "kind": "port", - "pins": [ - "P" - ], - "value": "DEADMAN_OK" - }, { "ref": "PERMIT", "kind": "and", @@ -73,25 +39,9 @@ } ], "nets": [ - { - "name": "DEADMAN_A_HELD", - "connections": [ - "VALID.A", - "VALIDP0.P" - ] - }, - { - "name": "DEADMAN_B_RELEASED", - "connections": [ - "VALID.B", - "VALIDP1.P" - ] - }, { "name": "DEADMAN_OK", "connections": [ - "VALID.Y", - "VALIDO.P", "PERMIT.A", "PERMITP0.P" ]