NeoECU-Hardware/Architecture/IO_MODULES/DEAD_MAN.md

Dead-Man Engine-Permit Interlock

Purpose

This module provides the hardware run-permission path for the engine outputs. The steering-wheel dead-man switch must be held to assert permission. Two electrically independent, normally-open switch contacts and two independent harness signal paths are required. Releasing the switch, an open circuit, one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset must place the engine outputs in their non-energising state independently of firmware.

This document defines the signal relationships and destinations only. Output driver implementation is documented separately.

Logic domains

Signal	Domain	Active state	Default/fault state
DEADMAN_A_HELD	Protected 5 V logic	High: deadman channel A observes its contact held	Low: released or fault
DEADMAN_B_RELEASED	Protected 5 V logic	High: deadman channel B does not observe its contact held	Low: contact held
DEADMAN_OK	Protected 5 V logic	High: channels have the valid held-state relationship	Low: released or fault
MCU_RUN_PERMIT	3.3 V MCU logic	High: MCU permits engine operation	Low: no permission
ENGINE_PERMIT	5 V logic	High: both hardware and MCU permit operation	Low: no permission
MCU_INJECTOR_SIG	3.3 V MCU logic	High: requested injector on-time	Low: injector off
SAFE_INJECTOR_SIG	5 V logic	High: permitted injector command	Low: injector off
SAFE_IGNITION_INHIBIT	5 V logic	High: ignition output is inhibited	Low: ignition output is permitted
DEADMAN_A_STATUS	3.3 V MCU input	High: channel A contact is observed held	Low: released or fault
DEADMAN_B_STATUS	3.3 V MCU input	High: channel B contact is observed held	Low: released or fault

Each deadman contact has its own harness signal, connector pin, connector-side protection, series/filter network, and default-low bias. The contacts may share the protected 5 V source at the switch, but neither signal path may share a pull-up, pull-down, connector pin, or post-contact conductor with the other. Each contact closes to the protected 5 V source only while the driver holds the switch. Thus an open signal path reads low; a short of only one signal path to the source cannot create the valid two-channel state.

Channel A is conditioned non-inverting to create DEADMAN_A_HELD. Channel B is conditioned inverting to create DEADMAN_B_RELEASED. This complementary encoding makes the sole valid held state A = high, B = low. Both raw, conditioned contact observations also enter protected 3.3 V MCU inputs as DEADMAN_A_STATUS and DEADMAN_B_STATUS; these are diagnostic observations, not the safety-critical shutoff path.

Signal tree

The permission gates operate from +5V_MAIN and accept 3.3 V MCU logic levels. Their outputs are 5 V logic levels.

The logic equations are:

DEADMAN_OK           = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
ENGINE_PERMIT        = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG    = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)

Output destinations

Logic output	Destination	Required behavior
ENGINE_PERMIT	Hardware injection-command permission gate	Must prevent an injector command from reaching the injection output stage when low.
SAFE_INJECTOR_SIG	Dedicated injection output stage command input	The only injector on-command presented to the output stage.
SAFE_IGNITION_INHIBIT	Dedicated ignition output stage inhibit/enable input	Must inhibit the ignition output stage when high and permit it only when low.
DEADMAN_A_STATUS, DEADMAN_B_STATUS	STM32 digital inputs	Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path.

Fail-safe behavior

• With the switch released, the valid relationship is DEADMAN_A_HELD = low and DEADMAN_B_RELEASED = high; DEADMAN_OK is low.
• With the switch held, the only permissive relationship is DEADMAN_A_HELD = high and DEADMAN_B_RELEASED = low; DEADMAN_OK is high.
• An open circuit, an open contact, or a short to the 5 V source on either one signal path produces a non-permissive relationship. A short to ground on a held path also removes permission.
• This architecture protects against one fault in one contact or signal path. It does not claim to detect a common-mode fault that energises both input paths, or simultaneous faults in both contacts/paths. Harness routing and connector assignment shall minimise such common-mode faults; any remaining risk requires explicit system-level acceptance.
• MCU_RUN_PERMIT and MCU_INJECTOR_SIG must default low during reset, boot, brownout, or an unpowered MCU. External bias components shall provide these states during power sequencing.
• If ENGINE_PERMIT becomes low during an injection command, SAFE_INJECTOR_SIG becomes low and removes the command from the injection output stage.
• If ENGINE_PERMIT becomes low during an ignition dwell, SAFE_IGNITION_INHIBIT becomes high and commands the ignition output stage into its non-sparking shutdown behavior.
• If the 5 V permission logic loses power, the injection command input must be externally biased low and the ignition output stage's inhibit input must default to its inhibited state.

Firmware responsibilities

The hardware path is authoritative; firmware cannot override a released or faulted deadman switch. Firmware shall sample both DEADMAN_A_STATUS and DEADMAN_B_STATUS, clear pending injection and ignition schedules on a released state or disagreement, report any disagreement, and keep MCU_RUN_PERMIT low except while engine operation is intentionally enabled.