Theory Of Operation

The purpose of this diagnostic is two fold:

1. To monitor all inhibit path functionalities needed to bring the Transmission Control Module (TCM) to a safe state in case of a failure. Proper inhibit path operation means that the TCM is able to switch off a single output stage and it is able to switch off all output stages by:
   • Switching off the output stages power supply (High Side Switch)
   • Activating the peripheral reset line
   • Deactivating the peripheral clock

   Functional Check of Inhibit Path:  To ensure that the deactivation of the output stages is working correctly, the functionalities for deactivation of the output stages are tested during initialization of the TCM.

   Rationality Check of Peripheral Reset Line:  The peripheral reset line is monitored for an unexpected reset during normal operation.

   Rationality Check of Peripheral Clock when Peripheral Clock is switched Off or switched On:  All actuators are controlled by the peripheral clock. In some cases the peripheral clock is used to deactivate the actuators (e.g. if the SPI communication is disturbed). Therefore the peripheral clock is also monitored by using hardware information from the controlling ASIC.

2. Watchdog monitoring.

Rationality Check between the CPU and the watchdog ASIC:  The watchdog ASIC provides a question randomly out of a number of predefined questions, which the CPU receives via the Serial Peripheral Interface (SPI) bus. The CPU must respond correctly within a defined time period. A wrong answer leads to an increment and a correct answer leads to a decrement of the watchdog internal error counter (minimum value: 0, maximum value: 8). Values between 0 and 4 indicate normal behavior because the CPU does not necessarily always answer correctly (see following paragraph). If the value of the error counter reaches 5, the output stages to the solenoids will be switched off by the watchdog ASIC. If the value of the error counter reaches 8, the watchdog ASIC will initiate a TCM reset and the CPU will store a failure.

In order to check the correct behavior of the watchdog ASIC, the CPU purposely does not always answer the questions of the watchdog correctly. The watchdog monitoring software in the TCM occasionally sends wrong answers or sends correct answers too early or too late (failure in timing) to the watchdog ASIC. The CPU then compares the error counter of the watchdog ASIC, which is transmitted in a SPI message, with the expected value calculated in the CPU. If the received watchdog error counter value is unequal to the expected value, the CPU increments its own error counter. A failure is detected if the CPU error counter is greater than a threshold.

Program Flow Control:  To ensure that all safety relevant software modules are processed in the correct sequence, the questions transmitted by the watchdog ASIC to the CPU are answered by an algorithm that uses the checksums of all safety relevant software modules. This algorithm responds back to the watchdog ASIC with a correct answer only if all software module checksums are processed in the right order.