# Dead-Man Engine-Permit Interlock

## Purpose

This module provides the hardware run-permission path for the engine outputs.
The steering wheel has two normally-open deadman switches wired in parallel.
Holding either switch closes the circuit; holding both also closes it. Their
outputs are tied together at the steering wheel and form **one shared deadman
signal entering the ECU**, not two independently monitored inputs.

The existing active-high 5 V interface is retained: either switch connects the
protected 5 V source to `DEADMAN_IN`. Both switches must be released to remove
permission. The ECU conditions this one signal for hardware gating and MCU
observation. Output-driver implementation is documented separately.

## Logic domains

| Signal | Domain | Meaning |
| --- | --- | --- |
| `DEADMAN_IN` | Harness-connected 5 V input | High when either parallel switch is held; ECU-side bias holds it low when both are released or the shared signal is open. |
| `DEADMAN_OK` | Conditioned 5 V logic | Active-high hardware observation of the single deadman input. It is not proof that a switch or harness fault is absent. |
| `DEADMAN_STATUS` | Protected 3.3 V MCU input | MCU observation of the same combined deadman state; high means asserted. |
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High permits engine operation; defaults low. |
| `ENGINE_PERMIT` | 5 V logic | High only when deadman and MCU permission are both asserted. |
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | Requested injector on-time; defaults low. |
| `SAFE_INJECTOR_SIG` | 5 V logic | Permitted injector command; low means off. |
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High inhibits ignition; low permits it. The driver must default to inhibited when permission logic is unpowered. |

## Steering-wheel wiring and ECU input

The two switches share the protected 5 V source and the switched return signal.
The parallel connection is made before the ECU: only one `DEADMAN_IN` signal
conductor and one signal connector pin are required at the ECU, in addition to
the supply connection. No separate contact-status wires are provided.

Use one dedicated connector-side protection, series/filter network, default-low
bias and non-inverting conditioning path. It produces the 5 V `DEADMAN_OK`
signal and a protected 3.3 V `DEADMAN_STATUS` observation for the MCU. Keep the
hardware gating independent of firmware; the MCU status input is observational.
Exact protection, filtering and connector assignments remain implementation
items. The generic digital-input module does not replace this dedicated path.

| Left switch held | Right switch held | Shared signal / `DEADMAN_OK` (healthy circuit) |
| --- | --- | --- |
| No | No | Low |
| Yes | No | High |
| No | Yes | High |
| Yes | Yes | High |

## Hardware gating

The permission gates operate from `+5V_MAIN`, accept 3.3 V MCU logic levels,
and produce 5 V logic outputs.

![Parallel switches and single deadman input](../diagrams/deadman-inputs.svg)

![Single-input engine permission](../diagrams/deadman-permit.svg)

![Permitted injector command and ignition inhibit](../diagrams/deadman-outputs.svg)

The healthy-switch relationship is a physical parallel connection at the
steering wheel, not an OR gate or two channels inside the ECU:

```text
DEADMAN_IN asserted  = LEFT_SWITCH_HELD OR RIGHT_SWITCH_HELD
DEADMAN_OK           = conditioned active-high DEADMAN_IN
ENGINE_PERMIT        = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG    = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```

`LEFT_SWITCH_HELD` and `RIGHT_SWITCH_HELD` above describe physical switch
states only; they are not separately available ECU signals.

## Output destinations

| Logic output | Destination | Required behavior |
| --- | --- | --- |
| `ENGINE_PERMIT` | Injection command gate and ignition-permission inverter | Low removes permission from both engine-output paths. |
| `SAFE_INJECTOR_SIG` | Injector driver command input | The only injector on-command presented to the output stage. |
| `SAFE_IGNITION_INHIBIT` | Ignition driver inhibit input | High inhibits the ignition stage; low permits it. |
| `DEADMAN_STATUS` | One STM32 digital input | Firmware observes the combined deadman state and clears schedules when it deasserts. It cannot identify which switch is held. |

## Release and fault behavior

- Releasing one switch while the other is held leaves permission asserted.
  Releasing both switches deasserts `DEADMAN_OK` and removes `ENGINE_PERMIT`
  through hardware, without waiting for firmware.
- An open shared signal conductor or loss of the switch supply deasserts the
  input through the ECU-side default-low bias. A shared signal short to ground
  also deasserts it; the protected source must tolerate the assigned fault.
- An open individual switch branch disables that switch only. The other
  parallel switch can still assert the shared signal.
- A stuck-closed switch, a bridged contact or the shared signal shorted to the
  asserted 5 V source can hold `DEADMAN_OK` high after both switches are
  released. This single-input arrangement cannot distinguish those faults
  from a legitimate held state. It provides no per-switch disagreement or
  independent-channel fault detection.
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
  boot, brownout or an unpowered MCU. External bias components establish these
  states through power sequencing. The MCU can withdraw permission even when
  the deadman signal is high.
- If `ENGINE_PERMIT` becomes low during injection, `SAFE_INJECTOR_SIG` becomes
  low and removes the injector command.
- If `ENGINE_PERMIT` becomes low during ignition dwell,
  `SAFE_IGNITION_INHIBIT` becomes high and requests the ignition driver's
  documented non-sparking shutdown behavior.
- If the 5 V permission logic loses power, the injector command must be biased
  low and the ignition driver must default to inhibited. Verify this behavior
  in the completed input, gate and driver implementation.

## Firmware responsibilities

Firmware samples the single `DEADMAN_STATUS` input, clears pending injection
and ignition schedules when it deasserts, and keeps `MCU_RUN_PERMIT` low except
while engine operation is intentionally enabled. It has no individual switch
states to compare and must not claim to detect contact disagreement or a
stuck-high shared signal from this observation alone.

A firmware test mode may assert `MCU_RUN_PERMIT`, but cannot override a low
hardware deadman input. Bench operation requires a deliberate external test
arrangement that asserts the single `DEADMAN_IN` signal.