A failed TIM is an absent TIM

The bike that taught me to be careful

On my test bike, the throttle works backwards: the wire sits at a high voltage when you're not touching it, and drops as you twist. Low voltage means more power. Think about what that means for a failure. A broken wire, a dead chip, an output that gives up and falls to zero: on this bike, every one of those asks the motor for full power.

Other bikes work the other way round, and TIM (the Throttle Injection Module, the part of GearSense that drives the throttle) has to be safe on both without anyone setting a switch. That pushed the whole design towards one rule: when something fails, TIM shouldn't fail to anything. It should simply get out of the way.

The rules we designed to

The rider always wins. Touch the throttle and you have it back, at once.

A failed TIM is an absent TIM. Lose power, crash, or hit a fault, and TIM drops out of the circuit as if it had never been fitted.

Physics first, firmware second. The core fail-safe is the relay's resting position, not a line of code. Software checks are layered on top and are never the only protection.

Prove it every ride. The checks that matter run at every power-up, not once on the bench.

Plug and play. No setup, no switches, nothing for the owner to get wrong.

A relay that rests on your throttle

TIM sits between the throttle and the motor controller with a relay. At rest, with no power to its coil, the relay connects your own throttle straight through. TIM can only reach the controller while it deliberately holds the relay on. Unplug it, flatten it or crash its software, and the relay springs back to you. I could have blended TIM's signal with yours electronically, but a blend leaves something on the line when it fails, a switch leaves you in control.

A relay that can prove it let go

Relay contacts can weld shut. Unlikely on a tiny signal like a throttle, but if it happened, TIM would believe it had handed control back when it hadn't. So the relay is a forcibly guided safety relay, the kind used in industrial machinery. A second set of contacts is mechanically locked to the first, so if one welds, the other physically can't move into its normal position, and GearSense reads that. It checks at every power-up and every time it hands control back. If the contacts don't come home, TIM holds the motor at idle, tells you, and refuses to assist again until it's been looked at on the bench.

It's the most expensive part on the board, more than the ESP32 with screen. I kept it because  It's an important feature.

A guard around the one path that matters

TIM's own output only reaches the motor through a guard circuit, and the rider's path never goes near it. The guard does three things in hardware, whatever the firmware asks for:

If TIM's output stops driving, the guard lets it drift to idle, not to wherever the motor controller might pull a floating wire. It clamps the output so it can never go past a set limit, so even a bug that gets "more" and "less" backwards can't ask for more than that. And it lets GearSense see what the motor controller actually sees, so it can check that against what it asked for.

Limits it learns, then can't touch

Every bike's throttle is different, and I didn't want owners fiddling with adjustments. So GearSense learns the throttle by watching the rider's own first twists, without ever moving the motor itself. If that first twist is a timid one, it learns a smaller range and a tighter limit, so learning always errs on the side of less power.

The learned limits are stored in a chip on the board, and that chip is locked out in hardware, two independent ways, whenever TIM is driving or the relay isn't fully at rest. No software, buggy or otherwise, can change a limit while TIM is in control. Both locks are proven at every power-up.

Checking itself without moving the motor

Because the relay disconnects TIM's output from the motor when it's at rest, GearSense can test the whole guard at every power-up with zero risk: is the guard there, is the drift-to-idle working, does the limit actually stop the output. Only once all of that passes does it briefly click the relay, with the output at idle, to prove the locks. Then, while it's assisting, it re-checks the relay, the locks, the output and the limit on every cycle. Any surprise and it lets go.

You can always take it back

GearSense keeps watching your throttle even while TIM is driving. Move it deliberately and the relay drops within a few thousandths of a second. Handing control back to TIM is deliberately slow: your hand has to be off the throttle for a moment, the output is reset to idle before the relay closes, and assist builds up again gently instead of snapping back. Stopping assist when you didn't need to costs nothing. Failing to stop it when you did is the real danger. So letting go is quick, and taking over again is slow.

The rest of the belt and braces

The assist logic itself is built so that if its own reasoning goes wrong, it gives less help, not more. Plugged into a laptop over USB with the bike off, TIM refuses to drive at all. The inputs are sized so a bike with a different throttle can't damage them. And it's one soldered board with no plug-in cards, because on a vibrating bike the connectors are what fail.

And underneath all of it, the brake lever on my bike cuts motor power directly, whatever TIM is doing. That doesn't depend on anything we built. It's still the last word.

Where it stands

The relay's fail-safe resting position has been proven on the bench, and so has the throttle-watching input. Everything else is in the first full TIM board, which is going to manufacture now. The firmware behind the checks is written down in detail but not yet coded, and I won't let TIM drive a real motor under an untested control law. Bench first, then the road.

— Paul