There can be more sensors on one input, but that would require more than just three wires as you need to daisy chain the signal and signal inputs from PIR and TMP. Not problem for someone who is using CAT5e cable to wire the sensors, it is actually cheaper than original 4-wire cable.
To sum up possibilities with such setting. We are able to see these states:
- normal operation
- unknown state / damaged
In software we measure the voltage level in zone thread every 250 millisecond. 4 times a second is safe way as the PIR modules usually keep the outputs on or off for one whole second. Also the thread has highest priority. In order to compensate for different wire lengths, there are voltage rages feedback specified for each state, rather than a single value. And because input voltage can change when switching to battery and back, the whole measurement is compensated to the input voltage as well.