Delphi Electronic Throttle Control Systems
Driver Features, System
Security, and OEM Benefits.
ETC for the Mass Market

ABSTRACT
Delphi has developed a second-generation Electronic Throttle Control system optimized for high volume applications. The Delphi system integrates several unique driver performance features, extensive security/ diagnostics, and provides significant benefits for the
vehicle manufacturer. For Model Year 2000, the Delphi ETC system has been successfully implemented on several popular SUVs and passenger cars built and sold around the world. The ETC driver features, security systems, and manufacturer benefits are presented as implemented on these Model Year 2000 applications.

INTRODUCTION
Electronic Throttle Control (ETC) has been around for about 15 years[1][2][3][4], and now is ready for the mass market. Delphi has created a second-generation ETC system for several popular Model year 2000 applications built and sold in Asia, Europe, and North America. The Delphi ETC system is standard equipment on several high volume V-6 SUVs, and one of the most popular vehicles made in Europe, the 1.6L.Opel Vectra. What is really important is the functionality inside the Delphi systems. The Delphi system integrates several unique driver performance features such as Driver Selectable Performance pedal to throttle gains (Power for
performance and Winter for control), an Altitude Compensated Pedal to Throttle transfer function (to avoid that weak feeling in the mountains), Vehicle and Engine Speed Governors to protect the engine and the driver, and several driveability enhancing features such as Tip-In Bump Elimination on manual transmissions, and Catalyst Light-Off Spark Retard Compensation. Also inside the Delphi system is the security of clever diagnostics and relentless redundant systems. Redundancies in the pedal/throttle sensor hardware have become an ETC standard with multiple sensors processed to ensure secure pedal and throttle signals. Delphi applies this same rigor to their controller hardware and software.

Delphi’s ETC system diagnostics, redundant path software, and watchdog CPU provide a superior level of security. Delphi’s ETC system also provides back-up controls such that even in the unlikely event of a throttle failure, the vehicle power can still be safely modulated by the driver.

Delphi ETC also has built in several benefits for the vehicle manufacturer. The 2000 Delphi ETC system implementation cost is low because the ETC system integrates Throttle Control, Cruise Control and Idle Control into a single actuator directed by a single engine controller. The Delphi ETC system reduces the number of required components and eliminates their associated sourcing/price/application/warranty costs. Factor in the integrated ETC functions of torque estimation/control, traction/vehicle stability control, noise control, and throttle command conditioning for driveability/emissions, and Delphi ETC far exceeds the payback point. Delphi – ETC. Leading Edge ETC for the New Millennium – available for the mass market.

DELPHI EXPERIENCE WITH THROTTLE CONTROL SYSTEMS

Delphi has over 50 years of experience with systems providing engine power control functions including governing, cruise control, idle speed control, traction control, vehicle stability control, and adaptive cruise control. The required technology has been developed together with Delphi’s customers and suppliers. Delphi’s customers are particularly involved in providing functional requirements and in the fine-tuning and validation of the system for specific vehicle applications.

DELPHI ETC SYSTEM ARCHITECTURES

DELPHI EXPERIENCE WITH THROTTLE CONTROL SYSTEMS

DELPHI ETC SYSTEM ARCHITECTURES

Generation I Architecture – Delphi’s first generation ETC system [5] used an architecture optimized for application as an optional feature on a small percentage of an engine management system’s volume. A small electronic controller was added to interface with the ETC components and perform a portion of the ETC processing. The ETC controller communicated with the powertrain control module (PCM) via a serial communication link. This architecture minimized the hardware impact on the PCM so that vehicles not using ETC carried no additional cost. The majority of the ETC processing was performed in the PCM, enabling close coordination of air, fuel, EGR, spark and transmission control for optimal powertrain performance. Generation II Architecture – Delphi’s second generation ETC system was designed for high-volume applications where ETC is standard. All ETC processing is located in the main processor of the Engine or Powertrain control module (ECM/PCM). A small, single chip microprocessor is used to provide redundant confirmation of key ETC input signals and to perform checks on the operation of the Main CPU. The controller is compatible with commonly used ETC components. Accelerator pedal position sensing is done with 2 or 3 potentiometers. The electronic throttle body has 2 potentiometers for sensing throttle valve angle, a DC brush type actuator for positioning the throttle, 2 stage gear reduction, and a return spring mechanism which positions the valve slightly open when the actuator is not powered. The controller regulates the throttle actuator’s output torque with a pulse-width modulated reversible output. Advanced control strategies are used to eliminate the mechanical connection between the driver’s foot to the engine in Delphi ETC.

DEPHI ETC APPLICATIONS

Delphi has successfully implemented its’ ETC system for several popular Model Year 2000 applications built and sold around the world. Significant driver benefits will be discussed as implemented on these applications, including Driver Selectable Performance, Altitude Compensation, Vehicle and Engine Speed Governors, Tip-in Bump Elimination and Catalyst Light-off Compensation. The Delphi strategy to ensure secure ETC function will be outlined, including redundant sensor processing, redundant controller hardware/software, redundant hardware/system diagnostics and vehicle performance moding based on system reliability. Finally, benefits to the manufacturer will be reviewed. Reduced cost, improved simplicity, engine noise reduction, throttle command conditioning for emissions, and torque-based control function availability are major manufacturer benefits identified.

Figure 1.

Figure 2.

The emissions on the Delphi 2000 ETC equipped vehicles are significantly lower than those of the models they replace, placing them in a lower emission classification for their market. For one engine family, an A.I.R. pump was also deleted from the engine management system. Multiple changes contributed to the reductions, but on average a 15% reduction in tailpipe HC and NOx emissions is attributed to ETC. Model year 2000 emission results for two of the ETC equipped engines are presented below in figure 3.

WHAT’S INSIDE THE DELPHI SYSTEMS

DELPHI DRIVER PERFORMANCE FEATURES – ETC brings the most important engine control device under complete electronic control and eliminates the last mechanical connection from the driver to the engine. This capability is a dream come true for anyone working on advanced engine control systems. Simply bolting ETC on an engine requires a large amount of work but provides almost no benefit in itself. The powertrain control system must be modified to realize the benefits enabled by having total control of the engine.

Driver Selectable Performance – ETC is an extraordinary tool for enhancing engine and vehicle performance. An intrinsic benefit of the use of ETC is the ability to modify the vehicle response to accelerator inputs to more closely match the optimum characteristics. Consumer research has determined that the vehicle response to accelerator inputs is a significant factor in a driver’s overall satisfaction with a vehicle. For powertrain metrics, the response in the first 20mm of accelerator pedal travel may be more important than a vehicle’s 0-100 km/h acceleration time. ETC provides new capability to modify the powertrain responsiveness to match driver desires and to compensate for external conditions to provide a more consistent response.

Driver Selectable Performance adjusts the sensitivity or gain of the accelerator pedal in response to driver input switch selection (Figure 4). At the touch of a button, the acceleration response can be selected to match the driving conditions and mood.

Three modes have been made available for Model Year 2000, Normal, Power, and Winter. Normal mode is the default setting that provides the acceleration response that most drivers prefer for most driving conditions. In the case where the driver desires additional performance, the Power switch is selected and the ETC system gains become more aggressive. This sensitizes the pedal to throttle response and the result is a sporty feel, especially at launch conditions. The Winter mode switch is selected by the driver driving in low traction conditions where fine control of power is needed. Winter mode results in very conservative throttle gains such that power may be easily modulated without wheel slip. The schematic below graphically depicts the switch selection and the various gain tables of Pedal Flow Area vs. Pedal Position. The ETC throttle gains may be coordinated with the appropriate Transmission shift maps on automatic transmission applications.

Altitude Compensated Pedal to Throttle Transfer Function – When travelling through the mountains, the change in barometric pressure makes it more difficult for people and engines to breathe. Humans eventually adapt to the change and, with Delphi ETC, combustion engines adapt as well. Without ETC altitude compensation, vehicle performance feels weak. With ETC altitude compensation, the pedal response is unchanged at high altitude for throttle positions below wide open throttle (unthrottled).

Figure 3.

Figure 4.

Figure 6. Pedal to Power Curves at Different Barometric Pressures

The ETC system compensates the commanded throttle area for the current altitude by applying a multiplier to the throttle area as a function of barometric pressure (Figure 5). The driver-selected pedal to power transfer function is maintained up to the throttle opening point where the engine becomes unthrottled.(Figure 6.) The maximum engine power point at altitude is achieved at lower pedal positions. However, for the most often used range of pedal travel, the vehicle response remains similar to sea level response.

Engine and Vehicle Speed Governing – While accelerating a manual transmission vehicle hard or any vehicle through a corner at top speed on the autobahn, it can be harsh and unsettling to come up against a fuel cutoff based engine or vehicle speed limiter. The vehicle decelerates and accelerates abruptly without warning as the fuel is disabled and enabled. Further, fuel cutoff based engine and vehicle speed limiters can increase wear on engine and driveline parts. Rich and lean mixture excursions in the catalyst result in high temperatures and rapid aging, while drivetrain wear may be increased by the sudden torque changes.

ETC throttle governing eliminates the startling torque fluctuations and potential hardware damage caused by fuel cutoff-based speed limiting strategies. With ETC governing, the fuel remains on and the RPM/Vehicle speed is maintained by controlling throttle position around the target speed. Transitions are smooth and transparent to the driver. In neutral on automatic transmission vehicles, the ETC RPM governor also protects the transmission from abuse by governing to a lower engine speed. When active, the governor controls throttle area below the accelerator pedal value using a proportional plus Integral feedback controller with feed forward compensation. Comparisons between fuel cutoff engine speed limiting and ETC engine speed governing performance are presented below in Figure 7. Vehicle speed governing provides a similar advantage.

Tip-in Bump Elimination on Manual Transmissions – On manual transmission applications, a rapid change from negative torque to positive torque may result in an objectionable driveline bump. This is due to the acceleration and deceleration of the driveline as the mountings are unloaded and reloaded in the opposite direction. The Delphi ETC tip-in bump elimination function significantly reduces torque-induced driveline oscillations during transitions from negative torque to positive torque.When unfiltered desired Throttle Position is increasing, a TPS bump eliminator enable threshold value TP1 is looked up as a function of RPM and gear (See Figure 8). TP1 is selected such that the throttle opening at TP1 corresponds to the zero torque at the driven wheels. This is the point at which it is desirable to begin ramping the throttle opening and avoid concerns with throttle opening bump. When the pedal is applied, the desired unfiltered and filtered TPS values are allowed to increase until the unfiltered value has reached TP1. At this point, a linear throttle opening rate as a function of RPM, gear and unfiltered TPS position is added to TP1 and the result is applied as the desired TPS Command. The ramping function is disabled at a selectable TPS value TP2 and a lag filter is applied to transition smoothly to the unfiltered TPS value. The TPS threshold (TP2) above which the ramp is disabled is selected such that the engine is against the engine mounts and no bump or ringing will occur if the throttle is rapidly opened further.

Figure 7. Comparison of Fuel Cutoff Speed Limiting vs. ETC Throttle Controlled Engine Speed Governing

Figure 8. Tip-in Bump Elimination

Figure 9. Light-off Spark Torque Correction vs. No Correction

Compensation for Catalyst Light-Off Spark Retard Strategies – In order to rapidly bring the exhaust catalyst up to operating temperature, spark retard and fuel enleanment strategies have been implemented. The use of these strategies changes the pedal to power transfer function on mechanically throttled vehicles and ETC vehicles without compensation. Specifically, retarded spark and/or fuel enleanment light-off results in reduced power for a given pedal position. This presents a challenge for the engine and vehicle development community in that these light-off strategies can only be used up to the level at which a driveability impact is imperceptible to the driver. The Delphi ETC system has the capability to compensate for catalyst light-off spark and fuel-related torque reduction. The ETC throttle is opened in order to compensate for the torque loss and retain the original pedal-to-throttle transfer function.

SELF-CHECKING FEATURES – ETC is a safety-critical system which requires fail-safe operation. A fail-safe system focuses on detecting operational problems and responding in specific ways to them. In order to ensure the appropriate level of functional integrity, the Delphi ETC system utilizes diagnostics, redundancy, diversity, and extensive testing for ETC sensors/inputs, processing, and engine power control. Integrity in the sensor hardware is achieved by applying multiple pedal/throttle sensors, brake switches, and related diagnostics. ETC Powertrain controller integrity is achieved through the use of many controller self diagnostics, a checking CPU, and redundant computation of safety-critical values. Secure power actuation is achieved using system level rationality diagnostics and power moding strategies that provide diminished levels of engine power as failures are detected. Engine power can be controlled by limiting air, fuel, and/or spark. Throughout the ETC design, assumptions are made that failures are present and the design is done to provide detection of the failure and provide a safe vehicle response. During verification, implementations are assumed faulty until proven by testing to operate to the design intent during normal and failed conditions. Considering the complexity of the processing core and the control software, a large portion of the work is spent in this area. Many of the techniques used to design and verify the system were based on the experience within affiliated companies designing systems of higher criticality, including flight control systems for commercial aircraft.

Sensor/Switch Redundancy – The Delphi ETC system utilizes a minimum of 2 accelerator pedal sensor potentiometers and 2 throttle sensor potentiometers (See Figure 10). Additional voltage references, sensor grounds, or a third accelerator pedal sensor are available to increase the overall accelerator position sensing reliability depending upon the customer requirements (See Figure 11). Electrically isolated voltage references and grounds may be used so that a single point electrical short/open condition does not invalidate all Pedal/Throttle Position sensors. The sensor output characteristics are diversified to improve the detectability of common mode failures using correlation rationality diagnostics (See Figures 12 and 13). The system also uses redundant brake switches that are logically opposed; one normally open and one normally closed. As with the throttle and pedal sensors, brake switch redundancy and diversity facilitates reliable brake apply signals and rationality diagnostics. A patented pedal sensor position determination method based upon the fault status of the sensors is used to convert the multiple sensor readings into a single, highly reliable value of accelerator position.[6]

Figure 10. ETC Block Diagram

Figure 11. Accelerator Pedal Module

Figure 12. Accelerator Pedal Sensor Typical Characteristic

Figure 13. Typical Throttle Sensor Characteristics

Figure 14. SPI Serial Data

Controller Hardware Redundancy – The Delphi ETC system is equipped with primary (main) and redundant (checking) processors. The main processor performs all ETC and engine management tasks, while the Watchdog processor performs redundant ETC sensor and switch reads, redundant ETC diagnostics, redundant security moding, fuel/spark/throttle output enable control and self checks. In addition to the hardware, there are several levels of diagnostic redundancy to maintain system integrity.

ETC System Diagnostics and Security Moding – The ETC system diagnoses the ETC sensors, and switches, ETC throttle actuator, as well as the engine’s ability to safely control power (See Figure 14.). ETC diagnostics evaluate sensors, controllers, software, electronics, continuity, correlation, and range/rationality. Based upon the overall ETC system failure status, the ETC moding security system may allow full engine power, reduce engine power significantly, or completely shut down the engine.

Switch and Sensor Diagnostics – The ETC pedal and throttle potentiometer sensors, for example, are checked for acceptable voltage range and scaled sensor output correlation with the other sensor(s). ETC sensor voltage references are measured back as analog inputs and evaluated for proper range. Unreliable sensor or reference signals are excluded from the system control. The redundant brake switches are checked for stuck conditions and comparative state correlation. Detection of faulty brake inputs results in a default condition where the aggregate brake state indication is always on. The remaining switch/sensor inputs are evaluated for stuck conditions, noisy conditions, and/or continuity as typically found in OBD II comprehensive components diagnostics. If sensor or switch faults, which reduce the ETC system reliability are detected, appropriate security moding action is taken. For example, if a brake switch has failed, the cruise control function will be disabled, and if all pedal inputs are diagnosed to be unreliable, the engine will be forced to idle.

Throttle Actuator Diagnostics – The ETC throttle actuator is used to control throttle position and airflow into the engine. It is typically a DC motor driven by a bi-directional pulse-width modulated signal (H-Bridge). Throttle actuation diagnostics are performed to evaluate the ETC throttle actuator and the throttle feedback mechanisms for performance faults. Specifically, throttle actuation diagnostics, airflow actuation, and throttle return diagnostics are performed. Throttle actuation diagnostics verify that the actuator is able to follow the command in static and dynamic cases [7]. The airflow actuation diagnostic is a rationality diagnostic which compares airflow measured by an air flow meter (AFM) and/or a manifold absolute pressure sensor (MAP) to throttle position estimated airflow. Actual MAP/AFM flows significantly greater than that of the indicated throttle position airflow are considered faults. Throttle return diagnostics are also performed to evaluate the ability of the throttle return springs to bring the throttle back to default position when unpowered. Based on the results of these tests, the ETC actuator may be disabled or an alternate performance mode utilized. Actuation faults may be caused by open/shorted motor leads, an obstruction in the throttle bore, motor driver circuit faults, a severe leak in the intake system, a broken throttle blade, or a faulty throttle actuator.

ETC Powertrain Controller Processing – ETC powertrain controller processing is managed using many PCM/ controller internal self tests, a checking CPU and diagnostics for safety-critical ETC software. These diagnostic and checking systems ensure failsafe operation of the ETC/Powertrain control system. Because the powertrain controller contains a small percentage of safety-critical software residing with the non-safety-critical software, some special design considerations are made. First, the safety-critical software is designed assuming other software in the controller may not operate properly and could affect the safety-critical part. Detection methods and actions are designed to provide a specific response if such a problem occurs. These methods have no effect under normal operating conditions, but they simplify the analysis required by minimizing the effect of failures in the controller. The data interfaces between the various sub-systems within the powertrain controller are strictly defined and managed through a layered architecture and an Application Programming Interface (API) structure. Each function that can take control of engine power through the ETC software must pass a “safety gate” and an authority limit within the safety-critical portion of the software. A safety gate performs a simple check before accepting a request from a specific function. For example, before a request from cruise control is accepted, the safety-critical software may check that vehicle speed is high enough and the brakes are not applied. Each function that can control engine power through the ETC software is only given the authority needed to perform its function. For example, the authority allowed for idle speed control is limited, much like the airflow capacity of an idle air actuator is matched to the engine requirements. Delphi ETC uses a single actuator to control engine airflow for all purposes, so the authority limits that used to be in the hardware designs have been enhanced and put into software.

ETC Processing Diagnostics – There are three specific ETC processing checks that are performed to ensure proper system operation: throttle authority limiting, dual path software, and process sequencing. Throttle authority limiting does not allow the final value of desired throttle position to exceed a reasonable value relative to 9 the accelerator pedal inputs and the cruise control state. For example, 5% pedal should generally not result in a command of 100% throttle. Throttle authority limiting ensures that the complicated processing to determine the throttle command is rational with respect to the pedal input. Dual path software computes critical values twice, using diversified values of identical input data and diversified implementations of the same algorithm. The diversification is designed to allow detection of known failure mechanisms in hardware and software by producing a different result from the two paths. If the results from the two paths differ by more than a tolerance amount, a diagnostic failure is recorded. Dual path provides the benefit of redundancy in computing critical values without the complexity and problems associated with performing complex computations in multiple processors in a real time system. Finally, process sequencing verifies that all safety-critical software is executed in the proper order. This is important to ensure that no processes are skipped or are receiving old data.

Main CPU/Controller Diagnostics – In addition to the specific processing checks for ETC, many diagnostics of the internal controller operation are performed to provide additional detection of failures. The controller self checks include: RAM, ROM Checksum, Stack, COP Watchdog Timer, A/D Diagnostics, and Main and Checking CPU input correlation. RAM verifies that all RAM and registers return any value written to them. ROM Checksum identifies corruption of program or calibration memory. COP actively tests that all watchdog timers will reset the CPU if not serviced correctly. The A/D diagnostic is the hardware diagnostic for the analog inputs. Main vs. checking CPU input correlation compares ETC critical analog and discrete signals read by each processor to ensure valid inputs and input hardware function.

Checking CPU Processing – A portion of the ETC processing and diagnostics are repeated in the checking CPU and continuously compared to the main processor results. The pedal sensor processing/diagnostics and throttle authority limit checks are duplicated in the watchdog controller. The results are passed to the main controller for comparison and security moding action, as needed. The checking CPU will also take action to disable air, fuel, or spark if severe faults are detected by either processor. Both processors have the ability to diagnose unacceptable system conditions and subsequently disable air, fuel, and spark outputs

independently.

ETC Security Operating Modes – As failures are detected by the diagnostics, specific actions to invalidate inputs or disable certain functions are taken. In addition, information from the controller diagnostics is used to evaluate system reliability and to determine appropriate security moding action. The actions taken change with the operating mode of the ETC control. Failures that indicate a problem with sensing or computing driver intent (what the driver is requesting through the accelerator pedal) may affect the driver command mode. Driver command mode has three states: normal, limit performance and forced idle. Failures that indicate a problem with controlling engine power may affect the power control mode. Power control mode has three states: normal, power management, and engine shutdown. Combined, there are six ETC operating modes: normal, limit performance, limit performance with power management, forced idle, forced idle with power management, and forced engine shutdown. Each mode and the diagnostics used to evaluate it are described below. When the operating mode moves to a lower level of power, it remains at that level for the remainder of the ignition cycle. All drivers adjust to a reduced level of engine power when one of these modes activates. Changes to a higher level of power during driving may be quite unexpected by the driver.

ETC Normal Mode – This mode is selected at power-up and will remain until a problem occurs which requires a lower level of performance. The accelerator pedal provides full control over engine power and all functions are available.

ETC Limit Performance Mode – This mode will set when a reduction in the reliability of determining driver intent has been detected or when the ability to create high levels of engine power is impaired. Generally, this mode will be caused by loss of accelerator pedal sensor redundancy or internal controller faults. An example is the case where two of three pedal sensor inputs are unreliable. In limit performance mode, the engine power for all pedal positions is lower, maximum engine power is limited, engine response to increases in pedal position is slowed, pressing the brake returns the engine to idle power and a warning lamp for the driver may be illuminated. Positioning of the throttle to a desired value is maintained. It is immediately obvious to all drivers that the engine is weak, but the vehicle is able to keep up with normal traffic flow.

ETC Forced Idle Mode – This mode will set when no reliable information about driver intent is available. Generally, this mode will be caused by a complete failure of all accelerator pedal sensors (connector removed), A/D failure or internal controller failures. The engine will start and run at idle but will not respond to the accelerator pedal at all. The vehicle will provide heating, cooling, electricity and lighting, but will not be drivable.

ETC Power Management Mode – This mode will set the ETC system is unable to reliably control engine power using the throttle. The throttle output is disabled to allow the throttle to return to the default position[8] and engine power is controlled using fuel and spark only. Generally, this mode is caused by an inability to position the throttle to the commanded value or a complete failure of all throttle position information. In power management mode, the desired engine power is determined from the accelerator position and idle power requirements. Engine power is reduced when needed to the desired value by turning fuel to cylinders off and retarding spark advance. Limit performance mode is enabled when in power management unless forced idle mode is already active. Vehicle response is similar to limit performance except the maximum engine power is more severely limited (depending upon the default throttle position setting) and, under some conditions, should be drivable but will not be able to accelerate with normal traffic flow or climb steep hills. The fuel and spark control will not permit conditions that may cause damage to the engine or emissions system even after long periods of operation in this mode.

ETC Engine Shutdown Mode – This mode will set when the ETC system is unable to reliably process the control algorithms or cannot control engine power. Generally, this mode will be caused by detection of a severe internal processing problem in the ECM or an inability of the intake air system or throttle body to restrict engine airflow. Fuel, spark, and throttle outputs will be disabled and the engine will not produce any power. The vehicle response is the same as many other kinds of failures that cause a loss of power, such as running out of fuel.

Diagnostic Fault Backup Controls – From the discussion of the ETC fault moding, it can be observed that the Delphi ETC security design provides system security and back-up controls to insure safety and retain maximum vehicle functionality. Limited performance mode reduces delivered engine power and rate of change of power such that the driver can continue the trip with some system faults. Power manage mode allows the driver to continue even when the throttle has failed. This is possible because the ETC throttle design differs from a mechanical throttle in that the default position is partially open. Maximum power available is determined by this default position and power is reduced by decreasing fuel delivery and/or retarding spark. Forced idle mode is commanded when the driver intent cannot be reliably obtained. This mode allows the use of air conditioning and heating functions that may be required due to adverse weather. Engine shutdown mode indicates that serious system concerns have been identified and that it is most secure to disable the engine.