109 lines
5.9 KiB
Markdown
109 lines
5.9 KiB
Markdown
# Dead-Man Engine-Permit Interlock
|
|
|
|
## Purpose
|
|
|
|
This module provides the hardware run-permission path for the engine outputs.
|
|
The steering-wheel dead-man switch must be held to assert permission. Two
|
|
electrically independent, normally-open switch contacts and two independent
|
|
harness signal paths are required. Releasing the switch, an open circuit,
|
|
one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset
|
|
must place the engine outputs in their non-energising state independently of
|
|
firmware.
|
|
|
|
This document defines the signal relationships and destinations only. Output
|
|
driver implementation is documented separately.
|
|
|
|
## Logic domains
|
|
|
|
| Signal | Domain | Active state | Default/fault state |
|
|
| --- | --- | --- | --- |
|
|
| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault |
|
|
| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held |
|
|
| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault |
|
|
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
|
|
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
|
|
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
|
|
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
|
|
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
|
|
| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault |
|
|
| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault |
|
|
|
|
Each deadman contact has its own harness signal, connector pin, connector-side
|
|
protection, series/filter network, and default-low bias. The contacts may share
|
|
the protected 5 V source at the switch, but neither signal path may share a
|
|
pull-up, pull-down, connector pin, or post-contact conductor with the other.
|
|
Each contact closes to the protected 5 V source only while the driver holds the
|
|
switch. Thus an open signal path reads low; a short of only one signal path to
|
|
the source cannot create the valid two-channel state.
|
|
|
|
Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B
|
|
is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary
|
|
encoding makes the sole valid held state `A = high`, `B = low`. Both raw,
|
|
conditioned contact observations also enter protected 3.3 V MCU inputs as
|
|
`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations,
|
|
not the safety-critical shutoff path.
|
|
|
|
## Signal tree
|
|
|
|
The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
|
|
levels. Their outputs are 5 V logic levels.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The logic equations are:
|
|
|
|
```text
|
|
DEADMAN_OK = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
|
|
ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT
|
|
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
|
|
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
|
|
```
|
|
|
|
## Output destinations
|
|
|
|
| Logic output | Destination | Required behavior |
|
|
| --- | --- | --- |
|
|
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
|
|
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
|
|
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
|
|
| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. |
|
|
|
|
## Fail-safe behavior
|
|
|
|
- With the switch released, the valid relationship is
|
|
`DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low.
|
|
- With the switch held, the only permissive relationship is
|
|
`DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high.
|
|
- An open circuit, an open contact, or a short to the 5 V source on either one
|
|
signal path produces a non-permissive relationship. A short to ground on a
|
|
held path also removes permission.
|
|
- This architecture protects against one fault in one contact or signal path.
|
|
It does not claim to detect a common-mode fault that energises both input
|
|
paths, or simultaneous faults in both contacts/paths. Harness routing and
|
|
connector assignment shall minimise such common-mode faults; any remaining
|
|
risk requires explicit system-level acceptance.
|
|
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
|
|
boot, brownout, or an unpowered MCU. External bias components shall provide
|
|
these states during power sequencing.
|
|
- If `ENGINE_PERMIT` becomes low during an injection command,
|
|
`SAFE_INJECTOR_SIG` becomes low and removes the command from the injection
|
|
output stage.
|
|
- If `ENGINE_PERMIT` becomes low during an ignition dwell,
|
|
`SAFE_IGNITION_INHIBIT` becomes high and commands the ignition output stage
|
|
into its non-sparking shutdown behavior.
|
|
- If the 5 V permission logic loses power, the injection command input must
|
|
be externally biased low and the ignition output stage's inhibit input must
|
|
default to its inhibited state.
|
|
|
|
## Firmware responsibilities
|
|
|
|
The hardware path is authoritative; firmware cannot override a released or
|
|
faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and
|
|
`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a
|
|
released state or disagreement, report any disagreement, and keep
|
|
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.
|