Dead-Man Engine-Permit Interlock

Purpose

This module provides the hardware run-permission path for the engine outputs. The steering wheel has two normally-open deadman switches wired in parallel. Holding either switch closes the circuit; holding both also closes it. Their outputs are tied together at the steering wheel and form one shared deadman signal entering the ECU, not two independently monitored inputs.

The existing active-high 5 V interface is retained: either switch connects the protected 5 V source to DEADMAN_IN. Both switches must be released to remove permission. The ECU conditions this one signal for hardware gating and MCU observation. Output-driver implementation is documented separately.

Logic domains

Signal	Domain	Meaning
`DEADMAN_IN`	Harness-connected 5 V input	High when either parallel switch is held; ECU-side bias holds it low when both are released or the shared signal is open.
`DEADMAN_OK`	Conditioned 5 V logic	Active-high hardware observation of the single deadman input. It is not proof that a switch or harness fault is absent.
`DEADMAN_STATUS`	Protected 3.3 V MCU input	MCU observation of the same combined deadman state; high means asserted.
`MCU_RUN_PERMIT`	3.3 V MCU logic	High permits engine operation; defaults low.
`ENGINE_PERMIT`	5 V logic	High only when deadman and MCU permission are both asserted.
`MCU_INJECTOR_SIG`	3.3 V MCU logic	Requested injector on-time; defaults low.
`SAFE_INJECTOR_SIG`	5 V logic	Permitted injector command; low means off.
`SAFE_IGNITION_INHIBIT`	5 V logic	High inhibits ignition; low permits it. The driver must default to inhibited when permission logic is unpowered.

Steering-wheel wiring and ECU input

The two switches share the protected 5 V source and the switched return signal. The parallel connection is made before the ECU: only one DEADMAN_IN signal conductor and one signal connector pin are required at the ECU, in addition to the supply connection. No separate contact-status wires are provided.

Use one dedicated connector-side protection, series/filter network, default-low bias and non-inverting conditioning path. It produces the 5 V DEADMAN_OK signal and a protected 3.3 V DEADMAN_STATUS observation for the MCU. Keep the hardware gating independent of firmware; the MCU status input is observational. Exact protection, filtering and connector assignments remain implementation items. The generic digital-input module does not replace this dedicated path.

Left switch held	Right switch held	Shared signal / `DEADMAN_OK` (healthy circuit)
No	No	Low
Yes	No	High
No	Yes	High
Yes	Yes	High

Hardware gating

The permission gates operate from +5V_MAIN, accept 3.3 V MCU logic levels, and produce 5 V logic outputs.

The healthy-switch relationship is a physical parallel connection at the steering wheel, not an OR gate or two channels inside the ECU:

DEADMAN_IN asserted  = LEFT_SWITCH_HELD OR RIGHT_SWITCH_HELD
DEADMAN_OK           = conditioned active-high DEADMAN_IN
ENGINE_PERMIT        = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG    = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)

LEFT_SWITCH_HELD and RIGHT_SWITCH_HELD above describe physical switch states only; they are not separately available ECU signals.

Output destinations

Logic output	Destination	Required behavior
`ENGINE_PERMIT`	Injection command gate and ignition-permission inverter	Low removes permission from both engine-output paths.
`SAFE_INJECTOR_SIG`	Injector driver command input	The only injector on-command presented to the output stage.
`SAFE_IGNITION_INHIBIT`	Ignition driver inhibit input	High inhibits the ignition stage; low permits it.
`DEADMAN_STATUS`	One STM32 digital input	Firmware observes the combined deadman state and clears schedules when it deasserts. It cannot identify which switch is held.

Release and fault behavior

Releasing one switch while the other is held leaves permission asserted. Releasing both switches deasserts DEADMAN_OK and removes ENGINE_PERMIT through hardware, without waiting for firmware.
An open shared signal conductor or loss of the switch supply deasserts the input through the ECU-side default-low bias. A shared signal short to ground also deasserts it; the protected source must tolerate the assigned fault.
An open individual switch branch disables that switch only. The other parallel switch can still assert the shared signal.
A stuck-closed switch, a bridged contact or the shared signal shorted to the asserted 5 V source can hold DEADMAN_OK high after both switches are released. This single-input arrangement cannot distinguish those faults from a legitimate held state. It provides no per-switch disagreement or independent-channel fault detection.
MCU_RUN_PERMIT and MCU_INJECTOR_SIG must default low during reset, boot, brownout or an unpowered MCU. External bias components establish these states through power sequencing. The MCU can withdraw permission even when the deadman signal is high.
If ENGINE_PERMIT becomes low during injection, SAFE_INJECTOR_SIG becomes low and removes the injector command.
If ENGINE_PERMIT becomes low during ignition dwell, SAFE_IGNITION_INHIBIT becomes high and requests the ignition driver's documented non-sparking shutdown behavior.
If the 5 V permission logic loses power, the injector command must be biased low and the ignition driver must default to inhibited. Verify this behavior in the completed input, gate and driver implementation.

Firmware responsibilities

Firmware samples the single DEADMAN_STATUS input, clears pending injection and ignition schedules when it deasserts, and keeps MCU_RUN_PERMIT low except while engine operation is intentionally enabled. It has no individual switch states to compare and must not claim to detect contact disagreement or a stuck-high shared signal from this observation alone.

A firmware test mode may assert MCU_RUN_PERMIT, but cannot override a low hardware deadman input. Bench operation requires a deliberate external test arrangement that asserts the single DEADMAN_IN signal.

6.5 KiB Raw Blame History