Theory Of Operation
The purpose of the diagnostic is to monitor the correct functionality of the Transmission Control Module (TCM) Central Processing Unit (CPU) by checking several rationalities of a question-answer communication between the CPU and the independent watchdog Application-Specific Integrated Circuit (ASIC).
Rationality Check between the CPU and the watchdog ASIC: The watchdog ASIC provides a question randomly out of a number of predefined questions, which the CPU receives via the Serial Peripheral Interface (SPI) bus. The CPU must respond correctly within a defined time period. A wrong answer leads to an increment and a correct answer leads to a decrement of the watchdog internal error counter (minimum value: 0, maximum value: 8). Values between 0 and 4 indicate normal behavior because the CPU does not necessarily always answer correctly (see following paragraph). If the value of the error counter reaches 5, the output stages to the solenoids will be switched off by the watchdog ASIC. If the value of the error counter reaches 8, the watchdog ASIC will initiate a TCM reset and the CPU will store a failure.
In order to check the correct behavior of the watchdog ASIC, the CPU purposely does not always answer the questions of the watchdog correctly. The watchdog monitoring software in the TCM occasionally sends wrong answers or sends correct answers too early or too late (failure in timing) to the watchdog ASIC. The CPU then compares the error counter of the watchdog ASIC, which is transmitted in a SPI message, with the expected value calculated in the CPU. If the received watchdog error counter value is unequal to the expected value, the CPU increments its own error counter. A failure is detected if the CPU error counter is greater than a threshold.
Program Flow Control: To ensure that all safety relevant software modules are processed in the correct sequence, the questions transmitted by the watchdog ASIC to the CPU are answered by an algorithm that uses the checksums of all safety relevant software modules. This algorithm responds back to the watchdog ASIC with a correct answer only if all software module checksums are processed in the right order.