Exergie/NeoECU-Hardware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reviewd and fixed deadman architecture

Browse Source
This commit is contained in:
h3cx
2026-09-10 23:53:27 +02:00
parent 31b3595ac0
commit f8d111ef5c
15 changed files with 304 additions and 305 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Architecture/IO_ARCHITECTURE.md
+27 -30
View File
@@ -19,7 +19,7 @@ temperature and pressure sensors, and an external starter switch.
| --- | ---: | --- |
| Crank trigger input | 1 | 12 V active-low Hall, timer capture |
| Cam trigger input | 1 | 12 V active-low Hall, timer capture |
| Deadman inputs | 2 | Dedicated, independent 5 V vehicle-logic engine-permit inputs |
| Deadman input | 1 | Shared 5 V signal from parallel steering-wheel switches; dedicated hardware engine-permit path |
| Thermistor inputs | 4 | Air, oil, water, and one spare temperature input |
| General analogue inputs | 9 | Protected 0-5 V sensor channels |
| ADC rail-monitor channels | 3 | `VBAT_PROT`, `+5V_SENS`, and `+12V_SENS` |
@@ -150,41 +150,38 @@ actual harness and input-function requirements.
## Deadman Engine-Permit Interlock
The deadman uses two dedicated 5 V vehicle-logic inputs, not generic digital
inputs. The steering-wheel switch provides two electrically independent,
normally-open contacts. Each contact has its own connector pin, protection,
filtering, default-low bias, and conditioned logic path. This makes an open
circuit or a short to the 5 V source on one signal path non-permissive.
The steering wheel has two normally-open switches connected in parallel.
Holding either switch asserts one shared active-high 5 V `DEADMAN_IN` signal
into the ECU; both must be released to deassert it. The ECU uses one dedicated
signal pin, protection/filter network, default-low bias and conditioning path,
separate from generic digital inputs.
The resulting 5 V `DEADMAN_OK` signal is high only when channel A reports
held and the independently conditioned, inverted channel B reports not
released. It has two independent destinations:
The conditioned 5 V `DEADMAN_OK` signal feeds the hardware permission gate.
One protected 3.3 V `DEADMAN_STATUS` input lets the MCU observe the same combined
state. The MCU cannot identify which switch is held or compare their states.
- `DEADMAN_A_STATUS` and `DEADMAN_B_STATUS` enter MCU digital inputs so
firmware can observe each contact, detect disagreement, disable scheduling,
and report the state.
- `DEADMAN_OK` is combined in hardware with the MCU's `MCU_RUN_PERMIT` output
to produce `ENGINE_PERMIT`.
![Parallel switches and single deadman input](diagrams/deadman-inputs.svg)
![Deadman inputs](diagrams/deadman-inputs.svg)
![Single-input engine permission](diagrams/deadman-permit.svg)
![Deadman permit](diagrams/deadman-permit.svg)
`ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT`. The injector command is
`SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG`; the ignition driver
receives `SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)`. These paths remove
permission in hardware when the shared input goes low, independently of
firmware response. Driver bias networks must establish off/inhibited states
through power loss and MCU reset.
`ENGINE_PERMIT` controls the enable inputs of the injector and ignition drivers
where those inputs are provided. If a selected driver has no suitable enable
input, `ENGINE_PERMIT` is ANDed with that driver's MCU command signal using
logic that defaults to the disabled state on power-up or loss of power.
Both switches released, an open shared signal or loss of switch supply removes
permission through the default-low input. An open individual switch branch
leaves the other switch usable. A stuck-closed switch or a shared signal shorted
to the asserted source can keep permission asserted; this single-input
arrangement cannot detect those faults or per-switch disagreement.
This hardware path ensures that releasing the deadman, an open circuit, or a
single signal-path short to the 5 V source stops injector and ignition commands
even if firmware or a timer output fails to respond. It does not claim to cover
a common-mode fault that energises both paths. Firmware must clear/disable
pending injection and dwell schedules whenever `DEADMAN_OK` becomes invalid or
the two MCU status inputs disagree. A firmware test mode may assert
`MCU_RUN_PERMIT`, but it does not override the physical deadman inputs; bench
operation requires a deliberate external test arrangement that presents the
valid two-channel held state. The detailed signal and fault model is defined in
[DEAD_MAN.md](IO_MODULES/DEAD_MAN.md).
Firmware clears pending injection and dwell schedules when `DEADMAN_STATUS`
deasserts. A test mode may assert `MCU_RUN_PERMIT`, but cannot bypass a low
physical deadman input; bench operation requires a deliberate external test
arrangement asserting the single shared signal. The detailed interface and
fault behavior are defined in [DEAD_MAN.md](IO_MODULES/DEAD_MAN.md).
## Outputs