# Temperature Sensor Validity Interlock and RTD Transport Recovery Workpackage

Disposition: abandoned by owner; unfinished completion gates are not passed

Status: abandoned
Type: workpackage
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Historical record from campaign 018-complete-rtd-validity-interlock-and-transport-recovery; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Canonical Truth after completion: E:/dev/high_point/7520553_SMI_FW/docs/temperature-sensor-safety-and-recovery.md

## Deferral and Entry Gate

This work is intentionally planned but must not change the current candidate,
the connected controller, persisted configuration, or heater behavior before
activation. Activation requires the four current workpackages named in
`wp-temperature-control-profile-recovery-and-steady-state-regulation.md` to be
closed and explicit owner authorization for a separately hashed successor
firmware image.

This workpackage and the deferred temperature-profile workpackage both touch
temperature control and qualification. At activation, choose their order or
combine their implementation/requalification deliberately; do not develop two
competing interlock or PID-state paths in parallel.

## Current Context

Setup A experienced a persistent loss of RTD acquisition after prior firmware
and bench activity. Live read-only evidence showed all raw counts and all
temperature values fixed at zero while enabled PID control interpreted zero as
a real measurement and saturated heater demand at 999/1000 ticks. An external
power cycle restored a valid RTD count and temperature without changing
firmware or configuration. The recovered temperature was approximately 109.7 C,
consistent with hazardous unintended heating during the invalid-reading state.

The current implementation has no end-to-end sensor-valid contract:

- temperature globals begin at zero and are usable by PID before a valid sample;
- `POWER_ON_TEMPERATURE_OK` can mean only that the communications thread ran;
- I2C-to-SPI bridge initialization and transfer failures are discarded by RTD
  callers;
- converter data-ready timeout causes an internal retry but no visible fault;
- the MAX31865 RTD-data fault bit is cleared without decoding and reporting the
  fault-status register;
- there is no sample age/sequence, consecutive-valid count, or latched sensor
  fault exposed to the controller or HMI;
- PID and high-heat control do not require a recent valid measurement.

The original 10/75 C proposal was a suggested mechanism, not the product goal.
The clarified product goal is to prevent heater runaway from a faulty or
untrustworthy temperature reading while preserving the existing 0.0--70.1 C
normal setpoint range. A fixed 10 C lower validity threshold is therefore not
the selected direction: a legitimate, transport-confirmed 0 C sample must be
distinguishable from zero-initialized RAM or a failed conversion path.

Hardware version 1 reaches the RTD converter through an NXP SC18IS606
I2C-to-SPI bridge at address 0x2C. The bridge has a RESET input and an interrupt
output, but the current firmware defines neither signal; schematic/PCB review
must establish whether either is routed to the MCU. The bridge has no useful
dedicated transaction-status register for polling, so health must be inferred
from I2C acknowledgements, completion/interrupt behavior when available, and
known converter register round trips.

The MAX31865 provides specific fault status for high/low RTD resistance,
reference/force-path faults, and over/undervoltage. The alternate ADS1248 path
has register readback, data-ready timing, system monitoring, and sensor
burnout-detection capabilities. Detection must follow the converter actually
identified on the approved hardware rather than assuming one implementation.

The current firmware also contains a dormant LM73 I2C temperature-sensor path.
The owner excluded LM73 testing from this product/release and from this
successor workpackage on 2026-07-24. Retain the source reference as inventory,
but do not implement an LM73 acceptance path, schedule LM73 fault injection, or
make an LM73 qualification claim. Any future LM73 use requires a separately
approved workpackage and full hardware qualification. This package therefore
owns only the supported RTD acquisition path and its bridge/converter layers.

## Requested Safety Contract

- Preserve the existing normal main-temperature setpoint range of 0.0 through
  70.1 C unless a separate product decision changes it.
- Heating is forced off independently of PID demand whenever the temperature
  sample is stale, not yet initialized, non-finite, backed by a failed
  transport/converter status, based on an out-of-hardware-range raw code, or
  otherwise declared untrustworthy.
- The HMI presents a clear persistent message such as `Temperature probe error
  - heating disabled`, with a service-detail code that distinguishes the fault
  layer.
- The condition is logged with measured/raw value, sample age, detected sensor
  and converter type, transport status, converter fault bits, recovery attempt,
  and firmware version.
- Heating cannot resume from zero-initialized RAM or one plausible sample after
  a fault. Recovery requires an owner-approved number of consecutive valid
  samples and a deliberate unlatch policy.
- A separate heater-response watchdog limits sustained heater energy when the
  primary sensor reports plausible but nonresponsive data.
- An independent secondary temperature limit or certified thermal cutoff is the
  required defense for primary-sensor failures that continue to produce
  plausible values; software observing only that same sensor cannot prove the
  chamber's true temperature.

Sample-age timeout, response window, minimum expected thermal response, energy
budget, debounce, consecutive-valid count, and operator acknowledgement are
safety policy that must be measured and approved before implementation; none
may permit heating without a valid sample.

## Temperature Constraint Matrix

Activation must reconcile every row below into one approved product contract.
Changing only the runtime watchdog is incomplete.

| Surface | Current behavior | Conflict or required decision |
| --- | --- | --- |
| Main setpoint HMI | accepts 0.0 through 70.1 C | retain; sensor validity must not classify a legitimate 0 C sample as failed merely because of its value |
| Startup semantic validation | accepts finite setpoint 0.0 through 70.1 C | retain and keep consistent across every HMI/service/update/persistence path |
| Normal PID | consumes the stored setpoint directly with no runtime range gate | must refuse invalid setpoints and cannot rely only on UI validation |
| I-limit interpolation | clamps tuning authority below 30 C and above 70 C to endpoint tables | this is not a setpoint or temperature safety clamp and must not be mistaken for one |
| Sample-validity watchdog | no current equivalent | base validity on completed conversion, sequence/age, transport result, converter faults, raw-code bounds, finite conversion, and stable sensor identity rather than a 10 C floor |
| Normal-mode absolute overtemperature layer | no independent immediate cutoff; 75 C was proposed | useful defense for some failures while retaining 0--70.1 C setpoints, but cannot detect a primary sensor stuck falsely low |
| High-heat/decontamination | targets 180 C | any 75 C normal-mode ceiling requires explicit mode handling and a separately approved high-heat safety envelope |
| Heater-response watchdog | absent | sustained high demand with insufficient measured response must trip a bounded energy/time limit, while avoiding false trips from chamber inertia, door events, and low-power regulation |
| Independent protection | no confirmed secondary sensor or thermal cutoff in current software evidence | required to cover plausible-but-wrong primary readings that software cannot distinguish from reality |
| Temperature alarms | relative to setpoint, delayed, and suppressed/reset in some door states | probe/sensor safety fault must be immediate and independent of ordinary process alarms and door state |
| RTD conversion table | out-of-table raw counts are forced back into the chart range | clamping can turn a wiring/converter fault into a plausible temperature; preserve the original raw count and flag out-of-range before conversion/clamping |
| Calibration | adjusted control value includes configured offsets | decide whether safety limits apply to raw physical estimate, adjusted control/display value, or both; a calibration error must not bypass the hard limit |
| Defaults | factory configuration uses 37.0 C while the HMI data-entry default constant is 37.4 C | choose one authoritative default and cover reset, cancel/default-entry, and persistence behavior |
| Startup RAM | temperature begins at 0.0 C before the first conversion | heat must remain inhibited; message timing may have a display grace period, but validity may not |

The recommended starting policy is to retain the normal 0.0--70.1 C setpoint
range, remove the 10 C lower-value test from sensor validity, keep 75 C as a
candidate normal-mode overtemperature layer, apply plausibility checks to both
the unadjusted physical estimate and adjusted control value, treat raw
conversion-table overflow/underflow as a sensor fault, and add a qualified
heater-response/energy watchdog. Independent secondary protection remains
necessary for complete coverage of a plausibly wrong primary sensor.

## Critical High-Heat Conflict

Current firmware includes a high-heat/decontamination mode with a 180 C target.
If 75 C is retained as a normal-mode overtemperature layer, the owner must
choose and document one of these outcomes:

1. 75 C is an absolute product safety limit and high-heat mode is removed or
   permanently inhibited for this product; or
2. high-heat operation remains approved under a separately reviewed,
   authenticated mode-specific range and independent safety limits.

Do not silently exempt high-heat mode from an overtemperature cutoff. High heat
requires its own approved maximum, sensor-validity rules, response limits, and
independent thermal protection.

## Diagnostic Model

| Layer | Detectable evidence | Required classification |
| --- | --- | --- |
| Sample contract | sample sequence, last-success tick, first-valid flag, finite value, raw count and hardware plausibility | not initialized, stale, non-finite, implausible raw count, conversion/calibration invalid |
| MCU I2C bus | SSP return from open/address/write/read, timeout/NACK/arbitration/bus status, optional SDA/SCL level check | driver failure, address NACK, write failure, read failure, bus stuck/busy |
| SC18IS606 bridge | ACK at 0x2C, configure-command result, converter register round trip, optional INT and RESET signals if routed | bridge absent/unresponsive, downstream SPI round-trip failure, completion timeout |
| Converter identity | repeated known-register signature and stable selected type | unknown, signature mismatch, type changed unexpectedly |
| MAX31865 | RTD LSB fault indication, fault-status register 0x07, configured-register readback, conversion deadline | RTD open/short or threshold fault, reference/force fault, over/undervoltage, configuration mismatch, conversion timeout |
| ADS1248 | configuration-register readback, DRDY deadline, bounded raw code, approved burnout/system-monitor checks | configuration mismatch, conversion timeout, open sensor/path, saturated or implausible ADC code |
| Thermal response | heater command, accumulated energy/on-time, sample history, door/mode state | high demand without minimum qualified response, excessive continuous-on time, unexpected rate/direction |
| Independent safety | secondary sensor, thermostat/thermal fuse, heater current/output feedback where present | primary/secondary disagreement, absolute hardware trip, commanded-off but current present |
| Control/HMI | interlock state, source fault, heater command and physical output state | heating inhibited, recovery pending, service required, recovered-but-latched |

Temperature value equality is not a stale detector because a stable chamber can
produce repeated values. Freshness must use a successfully completed conversion
sequence and timestamp.

## Recovery Policy to Design

Every recovery attempt begins by forcing all heater requests and the physical
heater output off through a path independent of normal PID calculations.

Use a bounded escalation sequence with counters and last-result capture:

1. classify and latch the fault; inhibit heat and notify the HMI;
2. retry one complete converter transaction after clearing/reading fault state;
3. reinitialize and verify the converter configuration by register readback;
4. close/reopen the MCU I2C driver and reconfigure the SC18IS606;
5. perform an approved I2C bus-clear procedure only if electrical review says it
   is safe for every device on the shared bus;
6. assert the SC18IS606 RESET input if schematic review proves it is routed and
   safe, then reconfigure and verify the downstream converter;
7. stop after the approved retry limit and require service/power-cycle action.

Do not loop recovery indefinitely, hide repeated faults, clear a converter
fault before preserving it, or automatically restore heat immediately after one
plausible value. If the bridge RESET signal is not routed, firmware can identify
the likely failed layer but cannot guarantee recovery from every bridge latch;
the HMI must then say that a power cycle/service action is required.

## Architecture Direction

- Add one authoritative temperature-sample status structure owned by the
  acquisition thread: value, raw value/count, sequence, timestamp, sensor type,
  transport status, converter status, consecutive successes/failures, recovery
  state, and latched fault reason.
- Make that structure and controller interlock independent of the identified
  RTD converter so either supported RTD converter obeys the same first-valid,
  freshness, fault-latch, and heater-inhibit rules.
- Publish a small snapshot API so controller, HMI, logger, and diagnostics use a
  consistent atomic view instead of unrelated globals.
- Place the final heater interlock at the lowest common output authority so it
  covers normal PID, high heat, service/tuning operations, and stale commands.
  Also gate PID state updates to prevent integral windup during invalid input.
- Keep sensor acquisition/recovery separate from HMI presentation. The HMI
  reports state but cannot be the only mechanism disabling heat.
- Add distinct system/log fault bits rather than reusing the SD error bit or
  treating thread startup as sensor health.
- Preserve fault evidence across automatic retries in RAM and event logs; decide
  separately whether a compact last-fault record belongs in persistent storage.
- Add a thermal-response supervisor that observes accumulated heater command
  and fresh temperature history. Its thresholds must come from attended chamber
  characterization, not guesses, and it must fail safe when its prerequisites
  are unavailable.
- Inventory independent hardware protection. If no secondary sensor or
  thermostat/thermal fuse exists, record that software cannot fully protect
  against a primary sensor that remains electrically healthy but reports a
  plausible false temperature.

## Delivery Stages

| Stage | Outcome | Entry Evidence | Exit Evidence |
| --- | --- | --- | --- |
| 0. Activate and baseline | Exact hardware path, firmware, and failure signature are controlled | Deferral gate closed; owner approval; recoverable heater-safe setup | Schematic routing, converter identity, current/failed live snapshots, recovery image |
| 1. Approve safety policy | Setpoint, sample validity, raw-count, calibration, response/energy, independent protection, latch, high-heat, and recovery behavior are unambiguous | Clarified runaway-prevention goal, constraint matrix, and incident evidence | Signed validity/response state table, authoritative defaults, and high-heat disposition |
| 2. Instrument acquisition | Every transport and converter operation produces actionable status | Stage 1 contract | Fault taxonomy, sample age/sequence, register/fault capture, diagnostic readout |
| 3. Implement interlock and message | Invalid input cannot energize heat and is clearly visible | Instrumented acquisition | Independent output inhibit, PID freeze/reset policy, HMI and event logging |
| 4. Implement bounded recovery | Recoverable bus/bridge/converter states recover without unsafe output | Approved electrical and retry policy | Layered reset/retry behavior and latched terminal failure |
| 5. Fault-injection qualification | Each failure class is detected, bounded, visible, and recoverable as specified | Automated tests and safe target | Injection matrix, heater-current proof, messages, logs, cold/soft-reset results |
| 6. Requalify successor | New image meets temperature and existing regression gates | Exact hashes and completed focused tests | Attended sign-off, promoted docs, release evidence |

## Verification Matrix

- Valid cold-sample tests across the retained setpoint range, including values
  below, at, and above 10 C, proving that confirmed low temperature is not
  confused with zero-initialized RAM or a failed conversion.
- Candidate normal-mode overtemperature tests at 74.9, 75.0, and 75.1 C if the
  75 C layer is approved, plus NaN, infinity, stale sample, and raw saturation.
- Setpoint entry/load tests below, at, and above every approved boundary through
  both HMI entry points, service/default behavior, VEEPROM startup, USB update,
  and direct semantic-validation fixtures.
- Cross-product tests for minimum/maximum setpoint versus minimum/maximum actual
  temperature, calibration offset, alarm thresholds, and raw chart boundaries.
- Startup with sensor healthy, sensor absent, bridge absent, DRDY held inactive,
  and first valid sample delayed.
- Inject I2C address NACK, write error, read error, timeout/busy state, and
  approved SDA/SCL stuck conditions.
- Inject SC18IS606 configuration failure, corrupted/short readback, missing
  completion indication where available, and MCU-only reset while bridge and
  converter remain powered.
- MAX31865 open RTD, short RTD, high/low threshold, reference/force, voltage,
  configuration, and conversion-timeout faults; equivalent approved ADS1248
  cases if that converter remains supported.
- Confirm heater command and physical output go off within an approved maximum
  latency for every fault, including normal PID, saturation, high-heat entry,
  service screens, and recovery attempts.
- Confirm the message persists across screen navigation, includes a useful
  service code, and does not flicker during retries.
- Confirm recovery requires the approved consecutive-valid window and latch
  acknowledgement; repeated failure reaches a terminal service-required state.
- Inject a frozen-but-plausible low reading while commanding heat; verify the
  response/energy watchdog removes output within the approved bound.
- Inject slowly drifting, biased, and plausible-but-wrong primary readings and
  prove the limits of single-sensor software detection plus the operation of
  any secondary/hardware cutoff.
- Compare MCU-only reset, watchdog reset, J-Flash reset/start, USB update reset,
  and full power cycle while recording bridge/converter behavior.
- Run regression for door behavior, logging, alarms, configuration persistence,
  SD degraded mode, and the separately deferred PID-profile correction.

## Milestones

### Milestone 1: Policy and hardware path approved

- [ ] Deferral entry gate and heater-safe target authority are satisfied.
- [ ] Schematic confirms SC18IS606 RESET/INT routing and shared-bus devices.
- [ ] HMI, semantic validator, PID, calibration, alarm, conversion-table,
  response-watchdog, hardware-protection, and default-value constraints are resolved.
- [ ] The candidate 75 C normal-mode layer versus 180 C high-heat behavior is resolved.
- [ ] Sample age, response/energy budget, debounce, latch, acknowledgement,
  retry, and maximum heater-off latency are approved.

### Milestone 2: Diagnostics and interlock implemented

- [ ] Acquisition publishes an atomic valid/fresh sample contract.
- [ ] I2C, bridge, converter, probe, range, and stale faults are distinguishable.
- [ ] Frozen/plausible low readings are bounded by the qualified heater-response watchdog.
- [ ] Every heat-producing path is independently inhibited on invalid input.
- [ ] PID cannot wind up from invalid temperature.
- [ ] HMI and logs preserve actionable fault and recovery details.

### Milestone 3: Recovery and target qualification complete

- [ ] Bounded recovery passes all electrically approved injected faults.
- [ ] Nonrecoverable bridge states remain safe and request power-cycle/service.
- [ ] Physical heater-current evidence proves output removal within the limit.
- [ ] Soft-reset/J-Flash versus full-power-cycle reproduction is characterized.
- [ ] Exact successor hashes pass required regression and release review.

## Open Questions

- What sustained heater command/energy and minimum temperature response are
  safe and achievable across chamber load, ambient, door, and setpoint cases?
- Is 75 C retained as a normal-mode limit, and what separately approved
  high-heat safety envelope is required?
- Do overtemperature/plausibility limits apply to the unadjusted RTD estimate,
  the calibrated control/display value, or both, and how are excessive offsets handled?
- What independent secondary sensor, thermostat, thermal fuse, or heater-current
  feedback exists, and what hardware change is required if none exists?
- Is the authoritative default 37.0 C or the HMI constant 37.4 C?
- Are the SC18IS606 RESET and INT pins routed to controllable/readable MCU pins?
- What maximum sample age and heater-off latency are approved?
- Must the fault remain latched until operator acknowledgement, power cycle, or
  service action, even after multiple good samples?
- What debounce/hysteresis is acceptable without delaying heater removal?
- Which controller carries the final independent heater-inhibit authority, and
  can physical output feedback/current be measured?
- Is ADS1248 support still a production requirement, or can qualification focus
  on the confirmed converter for each hardware revision?

## Reference Constraints

- NXP SC18IS606 data sheet: `https://www.nxp.com/docs/en/data-sheet/SC18IS606.pdf`
- Analog Devices MAX31865 data sheet: `https://www.analog.com/media/en/technical-documentation/data-sheets/max31865.pdf`
- TI ADS1248 product/data-sheet page: `https://www.ti.com/product/ADS1248`

## Completion Standard

This workpackage is complete when no temperature-control or high-heat path can
energize the heater without a recent trustworthy sensor sample; the existing
0.0--70.1 C normal setpoint range remains supported; transport, bridge,
converter, probe, raw-range, stale, and nonresponsive-heating failures are
distinguishable and visible; bounded recovery is proven without unsafe output;
plausible-but-wrong primary readings are covered by approved independent
protection or explicitly accepted as a residual hardware risk; unrecoverable
states remain latched safe; and the exact successor image passes attended fault
injection and required release regression.

## Closeout Routing

- Current truth promoted to: `E:/dev/high_point/7520553_SMI_FW/docs/temperature-sensor-safety-and-recovery.md`
- Historical context remains in: this workpackage and a dated incident/evidence record created at activation
- Runtime/status evidence: `work/evidence/setup-<a|b>/temperature-sensor-safety/`
- Cleanup deferred to: unrelated PID retuning, UI redesign, or hardware respin beyond required RESET/INT routing

## Owner-directed reconciliation — 2026-09-23

Delivery detail for abandoned CAMP-0018; unfinished RTD work is not represented as implemented or qualified.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: deferred by owner until all currently open SMI workpackages are closed; RTD-only scope, LM73 excluded
> Next Action: none; activate only after the deferral gate clears and the owner approves the layered runaway-prevention contract

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
