# Dead-Man Engine-Permit Interlock

## Purpose

This module provides the hardware run-permission path for the engine outputs.
The steering-wheel dead-man switch must be held to assert permission. Two
electrically independent, normally-open switch contacts and two independent
harness signal paths are required. Releasing the switch, an open circuit,
one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset
must place the engine outputs in their non-energising state independently of
firmware.

This document defines the signal relationships and destinations only. Output
driver implementation is documented separately.

## Logic domains

| Signal | Domain | Active state | Default/fault state |
| --- | --- | --- | --- |
| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault |
| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held |
| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault |
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault |
| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault |

Each deadman contact has its own harness signal, connector pin, connector-side
protection, series/filter network, and default-low bias. The contacts may share
the protected 5 V source at the switch, but neither signal path may share a
pull-up, pull-down, connector pin, or post-contact conductor with the other.
Each contact closes to the protected 5 V source only while the driver holds the
switch. Thus an open signal path reads low; a short of only one signal path to
the source cannot create the valid two-channel state.

Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B
is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary
encoding makes the sole valid held state `A = high`, `B = low`. Both raw,
conditioned contact observations also enter protected 3.3 V MCU inputs as
`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations,
not the safety-critical shutoff path.

## Signal tree

The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
levels. Their outputs are 5 V logic levels.

![Deadman inputs](../diagrams/deadman-inputs.svg)

![Deadman permit](../diagrams/deadman-permit.svg)

![Deadman outputs](../diagrams/deadman-outputs.svg)

The logic equations are:

```text
DEADMAN_OK           = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
ENGINE_PERMIT        = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG    = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```

## Output destinations

| Logic output | Destination | Required behavior |
| --- | --- | --- |
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. |

## Fail-safe behavior

- With the switch released, the valid relationship is
  `DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low.
- With the switch held, the only permissive relationship is
  `DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high.
- An open circuit, an open contact, or a short to the 5 V source on either one
  signal path produces a non-permissive relationship. A short to ground on a
  held path also removes permission.
- This architecture protects against one fault in one contact or signal path.
  It does not claim to detect a common-mode fault that energises both input
  paths, or simultaneous faults in both contacts/paths. Harness routing and
  connector assignment shall minimise such common-mode faults; any remaining
  risk requires explicit system-level acceptance.
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
  boot, brownout, or an unpowered MCU. External bias components shall provide
  these states during power sequencing.
- If `ENGINE_PERMIT` becomes low during an injection command,
  `SAFE_INJECTOR_SIG` becomes low and removes the command from the injection
  output stage.
- If `ENGINE_PERMIT` becomes low during an ignition dwell,
  `SAFE_IGNITION_INHIBIT` becomes high and commands the ignition output stage
  into its non-sparking shutdown behavior.
- If the 5 V permission logic loses power, the injection command input must
  be externally biased low and the ignition output stage's inhibit input must
  default to its inhibited state.

## Firmware responsibilities

The hardware path is authoritative; firmware cannot override a released or
faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and
`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a
released state or disagreement, report any disagreement, and keep
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.