Disposer & Composter Motor Control: Stall Detect & Safety UI
← Back to: Smart Home & Appliances
Disposer/composter reliability comes down to an evidence-driven control loop: robust motor drive plus accurate stall/torque detection, tied to temperature and odor/VOC sensing, with safety interlocks and clear fault UI. This page focuses on device-level signals, thresholds, and validation steps to prevent false trips and unsafe retries—without expanding into cloud platforms or whole-home gateway architecture.
Closed-loop control for drive, stall evidence, sensing, and safety
This page explains a device-level control loop that links motor drive → torque/stall evidence → odor/temperature sensing → safety interlocks & UI actions, so faults become measurable and recoverable.
Scope is strictly on-board hardware and field evidence: no cloud/app architecture, no protocol-stack deep dive, and no whole-home gateway/HEMS strategy.
What this page delivers (engineering outcomes):
- Signal-first design: how to choose measurable signals (current, speed proxy, temperature slope, odor proxy) so “stall/jam” can be proven instead of guessed.
- False-trip resistant stall logic: a layered discriminator that separates short transients from true stall using time-windows and cross-checks.
- Actionable recovery & safety: how interlocks and UI map to safe actions (derate, reverse, stop, latch) and to field-debug checkpoints.
Figure F1 focuses on the device-level closed loop: measurable evidence drives decisions, decisions drive safe actions.
Four chains that keep the design debuggable and safe
The system is intentionally decomposed into four chains so every later chapter can “fall back” to a specific chain with measurable inputs and clear outputs.
- Drive chain AC/DC entry → power stage → motor → mechanical load
- Torque/Stall chain current / speed proxy / back-EMF → torque estimate → layered criteria → protection action
- Odor/Temp chain NTC locations + VOC/gas proxy → fan/heater/run-mode strategy → user guidance
- Safety/UI chain lid/door/waterproof I/O interlocks → fault decode → UI prompts → manual reset / latch rules
| Chain | Inputs (measurables) | Key risks | Outputs / Actions |
|---|---|---|---|
| Drive | bus voltage, phase/line current, PWM duty, speed proxy | overcurrent transients, torque ripple, EMI-induced resets | derate ramp, controlled stop, reverse attempt, soft-start |
| Torque/Stall | current RMS/peak, speed decay, back-EMF/zero-cross timing | false stall trips during short jams; missed stalls causing overheating | layered stall decision (transient → sustained → confirm), latch rules |
| Odor/Temp | NTC (device hotspots), temperature slope, VOC/gas proxy baseline drift | sensor drift & contamination; heat soak causing delayed trips | cooldown timer, fan/heater strategy, “clean/empty” prompts |
| Safety/UI | lid/door switch, waterproof I/O integrity, fault counters | unsafe restart, user confusion, water ingress false triggers | safe-state enforcement, clear fault codes, manual reset gating |
Figure F2 shows the four chains and the feedback: evidence informs decisions; decisions drive safe actions back into the power stage.
Why stall/jam detection is hard: motor types and non-linear loads
Disposers and compact composters are dominated by non-linear, impact-heavy loads. Short torque shocks can look identical to true stall if the design relies on a single signal. The goal is to align the motor type with the measurable evidence available on the board.
Load behaviors that fool naive stall logic
- Startup inertia: high current with slow speed ramp can be normal. A stall decision must include a startup window or speed rise expectation.
- Intermittent impacts: a hard fragment or fibrous clump can cause a sharp current spike and momentary speed drop, then self-release.
- Wet/dry transitions: torque can jump within a short window. Evidence must confirm whether current stays high without recovery.
- Water/debris noise: splashes and debris can inject electrical and mechanical noise that corrupts speed proxies and current sensing.
Motor type × observability matrix (evidence availability)
The same “stall” symptom can be easy or impossible to prove depending on which signals the motor topology makes observable.
| Motor type | Typical drive | Current evidence | Speed proxy | Stall discrimination & common false triggers |
|---|---|---|---|---|
| Single-phase induction | AC direct / phase control | RMS/peak available, sensitive to line variation | Often unavailable without extra sensor | Usually weak; false trips during startup or line dip; confirm with time-window + temperature slope |
| Universal motor | AC phase control | Large ripple/brush noise; spikes common | Optional tach/Hall; otherwise weak | medium with tach; otherwise weak; impacts and brush noise mimic stalls → require multi-window confirm |
| BLDC | DC bus + inverter (PWM) | Phase current/shunt available with proper sampling | Hall or sensorless back-EMF/zero-cross | strong; cross-check current + speed decay; false trips mostly from sampling unsync or bus ripple |
| PMSM | DC bus + inverter (PWM/FOC) | Phase current central to control loop | Hall/encoder or sensorless estimation | strong; use current + speed + thermal slope; false trips from estimator instability or noisy sensing |
One-line selection guidance: entry designs typically rely on conservative current/thermal protection; mid-tier adds a speed proxy for layered criteria; high-tier combines phase current + speed estimation + thermal slope for reliable recovery actions (derate/reverse/stop/latch).
Figure F2 is a qualitative map: transient spikes can be safe if speed recovers; true stall is sustained high current with persistent speed loss.
Topology trade-offs: efficiency, noise, cost — and observability
Power topology determines more than efficiency and BOM cost. It directly decides which evidence is measurable (current, speed proxy, bus ripple, thermal slope) and therefore how reliable stall/jam decisions can be.
AC direct / phase control (TRIAC / SSR): strengths and side effects
- Fast, low-cost actuation: simple control for fixed-speed operation; minimal control complexity.
- Evidence challenges: phase-chopped waveforms inject switching edges that raise EMI and pollute current sensing near zero-cross.
- Torque ripple: chopped conduction can create torque pulsation; short impacts look like stalls unless time-windows and confirm signals are used.
DC bus + PWM inverter (half-bridge / 3-phase bridge): evidence becomes controllable
- Sampling synchronization: current evidence must be sampled away from switching transients; otherwise “stall” becomes a measurement artifact.
- Bus ripple awareness: rectifier/PFC ripple can distort current thresholds; normalization or cross-check is needed for robust criteria.
- Stronger observability: phase current plus speed proxy (Hall or sensorless back-EMF timing) enables layered stall criteria and safer recovery actions.
Topology → detectable signals → common failures → first protection (engineering table)
| Topology | Detectable signals | Common failure modes | First protection |
|---|---|---|---|
| AC phase control (TRIAC) | line current (RMS/peak), line voltage proxy | EMI resets; false stall on impacts; torque ripple leading to nuisance trips | conservative current time-window; thermal slope confirm; controlled stop + cooldown |
| AC switching (SSR) | line current; device temperature | thermal stress in SSR; limited speed evidence; stalls detected late | thermal derate; current limit; latch rules for repeated trips |
| Rectifier + DC bus + PWM | VBUS, shunt/phase current, temperature | unsynced sampling creates phantom spikes; bus ripple shifts thresholds | sample sync + filtering; derate ramp; reverse attempt with bounded window |
| 3-phase inverter (BLDC/PMSM) | phase current, speed proxy (Hall/BEMF), VBUS, NTC | estimator instability; noisy speed proxy in splash/debris conditions | layered stall criteria (transient→sustained→confirm); safe stop/latch on repeated stalls |
Figure F3 highlights the minimum measurable set that supports a stall/jam discriminator: VBUS, shunt/phase current, hotspot NTC slope, and a speed proxy.
Stall SOP with minimum signals: layered criteria and safe actions
This section defines a practical, firmware-ready stall/jam discriminator using the fewest reliable signals. The method avoids false trips by separating impact transients from sustained stalls and confirming thermal stress via temperature slope.
Minimum Evidence Set (MES): choose the smallest workable combination
MES-1 (lowest cost)
Current (window RMS/peak) + time-window + thermal slope (optional). Use conservative actions and stronger cooldown/latch rules.
MES-2 (recommended)
Current + speed proxy + time-window. Robust separation of transient impacts vs stall, enabling controlled reverse attempts.
MES-3 (high robustness)
Current + speed proxy + dT/dt. Highest confidence decisions and safer recovery under harsh load variability.
Evidence sources and what each one proves
Layered criteria (SOP): A → B → C to avoid false stall trips
Action policy: derate → reverse → stop → cooldown → latch/reset
- Derate: first response when Layer B begins; reduce torque demand to test recovery without abrupt stop.
- Reverse attempt: enable only with bounded count and duration; abort if current remains high or dT/dt rises.
- Stop + cooldown: required when Layer C confirms thermal stress or reverse attempts fail.
- Latch + manual reset: apply after repeated events, interlock anomalies, or persistent temperature slope violations.
How to set thresholds (method only, no formula dump)
Figure F4 encodes the SOP: tolerate short spikes, escalate on sustained evidence, and confirm with temperature slope before latching faults.
Thermal loop: sensor placement, dT/dt early warning, and stall coupling
Temperature monitoring is both an early-warning channel and the final safety backstop. Correct NTC placement determines whether the system can predict overheating (slope-based) rather than reacting too late (absolute thresholds only).
Why placement matters: different points see different heat sources
- Power stage hotspot: fastest protection for MOSFET/rectifier/SSR stress; may not represent winding heat.
- Motor/winding vicinity: strongest indicator for locked-rotor heating; coupling varies with mechanical stack-up.
- Cavity air: correlates with user perception and odor management; typically slower response for protection.
- Heater region (if present): dedicated protection for heater and dry-run scenarios; must cooperate with interlocks.
Use temperature slope (dT/dt) for robust decisions
Placement table: response speed, error sources, best use
| Location | Response | Error sources | Best use |
|---|---|---|---|
| Power stage (MOSFET/SSR) | Fast | PCB copper spreading, airflow changes, local self-heating patterns | Immediate device protection; derate trigger; prevent silicon overstress |
| Motor housing / winding vicinity | Medium | Mechanical coupling variance, mounting tolerance, grease/water effects | Stall confirmation (dT/dt); locked-rotor protection; cooldown exit gating |
| Cavity air | Slow | Airflow patterns, fan speed, sensor contamination, splash exposure | User guidance; odor/comfort strategy; not primary fast protection |
| Heater zone (if any) | Fast | Dry-run condition, insulation changes, localized hotspots | Dry-fire prevention; heater derate/stop; safety latching on repeats |
Figure F5 shows a simplified thermal path and NTC placements that support both fast protection and slope-based stall confirmation.
Odor sensing as an engineering proxy: what to measure, what not to claim
The goal is not “odor identification.” The goal is a robust proxy for abnormal operating conditions such as spoilage risk, overheat byproducts, and ventilation blockage, while avoiding false triggers from humidity, splash, and drift.
Signals that are useful (and what they indicate)
Baseline shift
Long-term offset changes typically indicate sensor contamination, aging, or persistent residue in the airflow path.
Short spikes
Single-cycle spikes are often caused by lid events, cleaners, or localized gas pockets. Treat as low confidence unless repeated.
Sustained rise
Multi-window sustained elevation supports vent blocked, residue build-up, or overheat-linked byproducts (confirm with temperature evidence).
Sensor options (engineering attributes only)
What can be trusted vs what must not be promised
| Signals you can use (with conditions) | What not to claim |
|---|---|
| Trend-based abnormality after T/RH gating and stabilization windows (baseline shift or sustained rise across cycles). | “Odor classification” or exact source identification. Single-sample conclusions are unreliable under humidity/splash disturbances. |
| Ventilation effectiveness: fan ON but concentration does not decay in run windows. | Guarantees without airflow context. Airflow path placement can dominate readings more than the chamber itself. |
| Overheat proxy coupling: sustained VOC rise that aligns with dT/dt or hotspot temperature increase. | Claims that ignore temperature evidence. VOC alone cannot distinguish overheat byproducts from cleaners or external exposure. |
Sampling windows: run vs post-run (reduce false triggers)
Closed-loop actions: fan, heater, run-mode, and user prompts
- Soft actions first: boost fan duty, extend purge time, or switch to a lower-power run mode.
- Hard actions when cross-confirmed: stop/cooldown only when temperature evidence also indicates risk.
- User prompts must be concrete: “Clean chamber,” “Check vent path,” “Inspect splash seal” rather than unprovable odor labels.
Figure F6 places VOC and T/RH in stable airflow and highlights zones that frequently create false triggers.
Interlocks as a run gate: prevent unsafe operation and suppress false actions
Interlocks define whether the system may arm and run. Waterproof I/O design determines whether interlock signals remain trustworthy under splash, condensation, corrosion drift, and connector leakage.
Interlock groups (device-level signals and actions)
Waterproof I/O failure patterns and first fixes
Transient false trigger
Water droplets cause threshold jitter and rapid toggling. Fix with debounce, hysteresis input, RC filtering, and margin.
Corrosion drift
Slow changes in contact resistance and leakage paths create intermittent faults weeks later. Add self-check windows and clear fault codes.
Hard short / leakage
Connector leakage or short forces stuck states or cross-coupling. Detect open/short patterns and latch to prevent unsafe run loops.
Interlock table: signal → allowed state → failure symptom → first checks
| Interlock signal | Allowed state | Failure symptom | First checks |
|---|---|---|---|
| Lid / Door closed | Armed → Running | Random stop; repeated arm/disarm; “won’t start” after splash | Debounce time, input threshold margin, connector leakage, event counter |
| Trip input | Must latch fault | Immediate stop + cannot restart; repeated fault on retry | Trip line integrity, latch reset rule, overcurrent evidence correlation |
| Water ingress detect | Gate run / reduce confidence | False faults near wet cycles; interlock jitter | Ingress sensor placement, hysteresis, wiring insulation, moisture path |
| Connector health | Stable states only | Stuck-high/stuck-low states; cross-coupling between inputs | Open/short detection, leakage to chassis, corrosion inspection points |
UI alignment rule: never appear “ready” when interlocks are not satisfied
- Safe: motor/heater disabled; UI shows actionable instruction (close lid / check seal).
- Armed: ready indicator only after stable interlocks and basic self-check windows pass.
- Fault-Latched: explicit fault state and reset policy; prevent repeated unsafe attempts.
Figure F7 keeps UI, interlocks, and fault handling consistent to prevent unsafe or misleading operation under wet conditions.
Safety-first UX: severity, actionable prompts, and reset gating
UI is part of the safety loop. It must translate evidence-based protection events into user actions, enforce safe reset rules, and map fault codes to maintainable checks.
Fault severity levels (consistent rules across codes)
- Level 0: informational prompts (clean/purge guidance) without blocking safe operation.
- Level 1: system mitigates automatically (derate, purge) and clears when evidence returns to normal.
- Level 2: requires a verifiable user action (close lid, clear residue, wait cooldown) before retry.
- Level 3: stop and latch to prevent repeated unsafe attempts; reset only after gates are satisfied.
Prompt rule
Use only observable, provable statements and attach one clear user action. Avoid unprovable claims (e.g., exact odor identity or precise blockage source). Never show “Ready” when interlocks are not satisfied.
Reset logic gates (prevent repeated stress and unsafe retries)
Reset gates
Allow restart only when gates are satisfied: Temp < T_reset, dT/dt normalized, Interlock stable closed, and retry counters are within limits (avoid infinite stall-retry loops).
Example fault code table (device-level, maintainable)
| Code | Meaning | What user does | What engineer checks (evidence-first) |
|---|---|---|---|
| IL01 | Interlock not closed (not armed) | Close lid/door fully; wipe seal; retry after stable closure | Interlock raw input jitter, debounce timer, leakage paths after wet cycles |
| IL02 | Interlock opened during run | Close lid; wait stop completion; retry only when Ready is shown | State transitions Safe/Armed/Running, event counter, vibration/water droplet coupling |
| ST01 | Suspected stall (sustained high current) | Stop; clear residue; wait; retry once after Ready | I_RMS duration window, speed proxy (if available), threshold vs transient window |
| ST02 | Repeated stall (latched) | Clear chamber; inspect mechanical blockage; long-press reset after cooldown | Retry counter, reverse attempts, latch conditions, mechanical load evidence vs false detect |
| TH01 | Overheat warning (derate + purge) | Wait; allow purge; avoid immediate restart | NTC location, dT/dt trend, derate trigger threshold, airflow effectiveness |
| TH02 | Overheat trip (latched) | Wait cooldown; do not retry until cleared; long-press reset if allowed | Hotspot vs chamber temp correlation, slope confirm threshold, reset gate T_reset |
| SN01 | Sensor open/short (T/RH or NTC) | Power cycle; if persists, service | ADC raw range, wiring/connector leakage, diagnostic current checks, corrosion drift patterns |
| OD01 | Odor proxy sustained rise (advisory) | Run purge/clean cycle; clean chamber; check vent path | VOC baseline vs T/RH gating, run vs post-run window consistency, splash-zone suppression |
| OD02 | Purge ineffective (fan ON, no decay) | Check vent path; clean filter/duct area; retry purge | VOC decay slope during run window, fan command vs response, airflow path obstruction indicators |
Figure F8 prevents unsafe retry loops by enforcing reset gates and ensuring prompts remain provable and actionable.
Field SOP: symptom → 2 measurements → discriminator → first fix
This playbook forces short, repeatable steps. Each symptom uses the same four lines and prioritizes Current + Temperature as the default first pair of measurements.
Default “first 2 measurements”
Start with I_RMS / Peak and NTC (PWR or MOTOR). Use Speed proxy only when available to separate true stall from transient or false detection. Use VOC + T/RH for odor proxy issues with run/post-run window gating.
Symptom cards (fixed 4-line format)
Figure F9 keeps diagnosis evidence-driven and prevents scope creep: current/temperature first, then speed/interlock/VOC only when needed.
H2-11. IC / BOM Selection Map
This chapter maps each functional block to selection checkpoints and concrete example MPNs. The intent is fast, evidence-driven BOM decisions for motor drive, stall/torque detection, odor/temperature sensing, and safety UI—without drifting into platform or protocol architecture.
- Block → specs → pitfalls
- MPN examples (device-level)
- Signals that enable stall/torque logic
- I/O protection choices
Selection Table (by functional block)
| Block | Key specs to check | Common traps | Example MPNs (type) |
|---|---|---|---|
| AC motor switch / phase control |
|
|
|
| BLDC / inverter gate drive |
|
|
|
| Current sensing |
|
|
|
| MCU / control core |
|
|
|
| Temperature sensing |
|
|
|
| Odor / VOC sensing |
|
|
|
| I/O protection (device-level) |
|
|
|
MPN Quick List (copy-friendly)
- BTA16-600B — TRIAC (AC switching / phase control)
- MOC3063-M — Zero-cross optotriac driver (TRIAC interface)
- DRV8323HRTAR — 65V 3-phase smart gate driver + CSA
- DRV8301 — 3-phase gate driver + CSA
- INA240A2PWR — Current-sense amplifier (enhanced PWM rejection)
- WSL2512R0120FEA — 12 mΩ metal-strip shunt resistor
- ACS758LCB-100B-PFF-T — Inline Hall current sensor (high current)
- STM32L052K8T6 — Ultra-low-power MCU example
- STM32L072KZ — Ultra-low-power MCU example
- NCP15XH103F03RC — 10 kΩ NTC thermistor
- SGP40-D-R4 — VOC sensor (I²C)
- SHT40-AD1B-R2 — Humidity/temperature sensor (I²C)
- SMF05C.TCT — TVS diode array for I/O protection
Citation suggestion: “Figure F10 — Disposer/Composter IC & BOM Map (device-level blocks and example MPNs), ICNavigator.”
H2-12. FAQs ×12 (Evidence-Based, No Scope Creep)
Each answer uses the same discipline: first 2 checks → discriminator → first fix. Every item maps back to on-page chapters (drive/torque/temperature/odor/interlock/UI/validation/IC-BOM).
- 2 checks first
- One discriminator
- Smallest safe fix
- Maps to H2 references
1) “Stops immediately after start” — current threshold or interlock not closed?
- First 2 checks: interlock raw input stability (debounce window) + start-window current rise (RMS/peak).
- Discriminator: if interlock never reaches a stable “closed” state, the system should remain Safe/Armed and current typically stays low. If current spikes then drops, stall logic or protection is likely acting.
- First fix: harden interlock margin/debounce in wet conditions, then retune stall Layer A (transient) vs Layer B (sustained) separation.
2) “Hums but does not rotate” — phase-control issue or mechanical jam?
- First 2 checks: current shape (RMS vs switching ripple) + temperature slope dT/dt near the power device or winding proxy.
- Discriminator: a true jam tends to show sustained high current plus fast dT/dt rise. A drive/topology issue often shows abnormal current shape (torque not building) without a matching thermal slope signature.
- First fix: validate the chosen topology’s “detectability” (sampling sync, commutation behavior), then follow the field playbook to isolate mechanical vs control.
3) “Overheat trips in a few seconds” — sensor placement or stall time window?
- First 2 checks: NTC placement/thermal coupling realism + dT/dt behavior during the first seconds of load.
- Discriminator: poor placement produces delayed or inconsistent readings, while a real stall/overload correlates with sustained current and a reproducible dT/dt rise. Slope-based gating is more robust than absolute temperature alone.
- First fix: refine the thermal point and use slope early-warning, then align stall Layer B/C confirmation timing to thermal dynamics.
4) “Frequent false stall detect” — sampling sync or speed estimate jitter?
- First 2 checks: PWM-synchronous current sampling consistency + speed proxy stability (capture/edge timing jitter).
- Discriminator: if current readings move with PWM phase, the torque estimate will wander. If speed proxy toggles or jitters near the threshold, “Speed↓” will misfire even when torque is normal.
- First fix: lock sampling to a stable phase, and widen/structure the transient window (Layer A) so impact loads do not look like stalls.
5) “Odor alarm but temperature is not high” — VOC drift or ventilation path issue?
- First 2 checks: VOC baseline trend (multi-cycle) + run-window purge effectiveness (VOC decay slope) with T/RH context.
- Discriminator: drift appears as a slow baseline lift with weak correlation to operation state. Ventilation issues show poor decay during fan/purge windows even when humidity compensation is applied.
- First fix: enforce run/post-run gating, add T/RH compensation, and re-check sensor placement away from splash/condensation zones.
6) “Random reboot / wrong codes in humid environments” — I/O leakage or supply dip?
- First 2 checks: interlock/UI input toggle counter + brownout/reset flag (or minimum-rail event marker) during the incident.
- Discriminator: leakage typically causes frequent input toggles and inconsistent fault codes without a true reset. Supply dips produce clear reset traces and often correlate with jam events or motor start transients.
- First fix: harden waterproof I/O margins and protection return paths, then use the field playbook to separate reset vs false-trigger patterns.
7) “Reverse unjam makes it worse” — strategy error or thresholds too sensitive?
- First 2 checks: stall trigger history (which layer fired) + reverse retry count/spacing under the same load condition.
- Discriminator: sensitive thresholds treat impact loads as stalls, causing repeated reversals that compact debris. A strategy issue shows reversals firing too early/too often without a controlled derate and cooldown gate.
- First fix: apply “derate → short reverse → stop → cool gate → limited retries → latch” with explicit Layer A/B/C boundaries.
8) “Same batch, some units are much noisier” — drive method or mechanical tolerance?
- First 2 checks: current ripple signature under identical load + thermal/efficiency trend (dT/dt or steady rise) across units.
- Discriminator: drive/control differences typically change current shape and torque ripple. Mechanical tolerance often keeps current similar while noise varies strongly with assembly, debris, or wet/dry load transitions.
- First fix: use the motor/load observability matrix to classify evidence, then revisit topology and switching decisions that amplify torque ripple and acoustic noise.
9) “VOC reading slowly drifts upward” — which two validation steps first?
- First 2 checks: correlate VOC vs RH (humidity sensitivity) + repeat a fixed sampling window across several normal cycles to quantify baseline drift.
- Discriminator: strong RH coupling implies compensation/gating gaps. Baseline lift without operational correlation suggests contamination, aging, or splash-zone placement effects.
- First fix: lock windowing (run/post-run), verify placement away from splash/condensation, and apply drift handling before enabling user-facing alarms.
10) “Users do not understand prompts” — how to map fault codes to actions safely?
- First 2 checks: fault level policy (auto-recover vs user-action vs latched) + whether each prompt includes exactly one executable user action.
- Discriminator: mixed policies (showing READY when interlock is not satisfied) creates unsafe retries. Claims that cannot be verified (“specific cause”) reduce trust and hinder serviceability.
- First fix: standardize “Code / Meaning / User action / Engineer check,” align reset gates to safety policy, and keep text evidence-based.
11) “Current is not high, but it still stops” — speed vs thermal criteria?
- First 2 checks: speed proxy validity (drop/jitter) + temperature slope dT/dt (slope is more robust than absolute T).
- Discriminator: speed-criterion misfires when capture jitter or edge noise crosses a threshold. Thermal slope triggers when hot spots rise quickly even without large current (poor coupling/venting or localized heating).
- First fix: require multi-signal confirmation (speed + current or dT/dt + time window) before stop/latch actions.
12) “After water ingress, buttons false-trigger” — interlock/debounce/hardware isolation fallback?
- First 2 checks: raw input level hovering near threshold + input toggle counter under wet conditions (short vs slow drift behavior).
- Discriminator: rapid toggles indicate droplet-induced leakage near the threshold; slow drift suggests corrosion/leakage path formation. Both can mimic user commands and break the safety state machine.
- First fix: add threshold margin + debounce + device-level I/O protection return integrity, and enforce UI policy that never invites retries during unstable inputs.
Citation suggestion: “Figure F11 — FAQ Evidence Map (Disposer/Composter), ICNavigator.”