Method and apparatus for monitoring a transmission range selector in a hybrid powertrain transmission

Abstract

A method to monitor integrity of a signal output from an operator-manipulable transmission range selector for a powertrain system includes equipping the transmission range selector with a range encoder and a direction encoder, determining a range state and a direction state based upon signals from the range encoder and the direction encoder, determining a discrete position of the transmission range selector based upon the range state and the direction state, and performing back rationality to verify the discrete position of the transmission range selector.

Description

TECHNICAL FIELD

This disclosure is related to control systems for hybrid powertrain systems.

BACKGROUND

The statements in this section merely provide background information related to the present disclosure and may not constitute prior art.

Known hybrid powertrain architectures can include multiple torque-generative devices, including internal combustion engines and non-combustion machines, e.g., electric machines, which transmit torque through a transmission device to an output member. One exemplary hybrid powertrain includes a two-mode, compound-split, electro-mechanical transmission which utilizes an input member for receiving tractive torque from a prime mover power source, preferably an internal combustion engine, and an output member. The output member can be operatively connected to a driveline for a motor vehicle for transmitting tractive torque thereto. Machines, operative as motors or generators, can generate torque inputs to the transmission independently of a torque input from the internal combustion engine. The machines may transform vehicle kinetic energy transmitted through the vehicle driveline to energy that is storable in an energy storage device. A control system is operative to monitor various inputs from the vehicle and the operator and provides operational control of the hybrid powertrain, including controlling transmission operating state and gear shifting, controlling the torque-generative devices, and regulating the power interchange among the energy storage device and the machines to manage outputs of the transmission, including torque and rotational speed. A control system can monitor input and control signals and execute algorithms to verify and secure operation of the powertrain.

SUMMARY

A method to monitor integrity of a signal output from an operator-manipulable transmission range selector for a powertrain system includes equipping the transmission range selector with a range encoder and a direction encoder, determining a range state and a direction state based upon signals from the range encoder and the direction encoder, determining a discrete position of the transmission range selector based upon the range state and the direction state, and performing back rationality to verify the discrete position of the transmission range selector.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more embodiments will now be described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a schematic diagram of an exemplary hybrid powertrain, in accordance with the present disclosure;

FIG. 2 is a schematic diagram of an exemplary architecture for a control system and hybrid powertrain, in accordance with the present disclosure; and

FIGS. 3, 4, and 5 are schematic diagrams, in accordance with the present disclosure.

DETAILED DESCRIPTION

Referring now to the drawings, wherein the showings are for the purpose of illustrating certain exemplary embodiments only and not for the purpose of limiting the same, FIGS. 1 and 2 depict an exemplary electro-mechanical hybrid powertrain. The exemplary electro-mechanical hybrid powertrain in accordance with the present disclosure is depicted in FIG. 1, comprising a two-mode, compound-split, electro-mechanical hybrid transmission 10 operatively connected to an engine 14 and torque machines comprising first and second electric machines (‘MG-A’) 56 and (‘MG-B’) 72. The engine 14 and first and second electric machines 56 and 72 each generate mechanical power which can be transferred to the transmission 10. The power generated by the engine 14 and the first and second electric machines 56 and 72 and transferred to the transmission 10 is described in terms of input and motor torques, referred to herein as T_I, T_A, and T_B respectively, and speed, referred to herein as N_I, N_A, and N_B, respectively.

The exemplary engine 14 comprises a multi-cylinder internal combustion engine selectively operative in several states to transfer torque to the transmission 10 via an input member 12, and can be either a spark-ignition or a compression-ignition engine. The engine 14 includes a crankshaft (not shown) operatively coupled to the input member 12 of the transmission 10. A rotational speed sensor 11 monitors rotational speed of the input member 12. Power output from the engine 14, comprising rotational speed and engine torque, can differ from the input speed N_I and the input torque T_I to the transmission 10 due to placement of torque-consuming components on the input member 12 between the engine 14 and the transmission 10, e.g., a hydraulic pump (not shown) and/or a torque management device (not shown).

The exemplary transmission 10 comprises three planetary-gear sets 24, 26 and 28, and four selectively engageable torque-transferring devices, i.e., clutches C170, C262, C373, and C475. As used herein, clutches refer to any type of friction torque transfer device including single or compound plate clutches or packs, band clutches, and brakes, for example. A hydraulic control circuit (‘HYD’) 42, preferably controlled by a transmission control module (hereafter ‘TCM’) 17, is operative to control and monitor clutch states. Clutches C262 and C475 preferably comprise hydraulically-applied rotating friction clutches. Clutches C170 and C373 preferably comprise hydraulically-controlled stationary devices that can be selectively grounded to a transmission case 68. Each of the clutches C170, C262, C373, and C475 is preferably hydraulically applied, selectively receiving pressurized hydraulic fluid via the hydraulic control circuit 42.

The first and second electric machines 56 and 72 preferably comprise three-phase AC machines, each including a stator (not shown) and a rotor (not shown), and respective resolvers 80 and 82. The motor stator for each machine is grounded to an outer portion of the transmission case 68, and includes a stator core with coiled electrical windings extending therefrom. The rotor for the first electric machine 56 is supported on a hub plate gear that is operatively attached to shaft 60 via the second planetary gear set 26. The rotor for the second electric machine 72 is fixedly attached to a sleeve shaft hub 66.

Each of the resolvers 80 and 82 preferably comprises a variable reluctance device including a resolver stator (not shown) and a resolver rotor (not shown). The resolvers 80 and 82 are appropriately positioned and assembled on respective ones of the first and second electric machines 56 and 72. Stators of respective ones of the resolvers 80 and 82 are operatively connected to one of the stators for the first and second electric machines 56 and 72. The resolver rotors are operatively connected to the rotor for the corresponding first and second electric machines 56 and 72. Each of the resolvers 80 and 82 is signally and operatively connected to a transmission power inverter control module (hereafter ‘TPIM’) 19, and each senses and monitors rotational position of the resolver rotor relative to the resolver stator, thus monitoring rotational position of respective ones of first and second electric machines 56 and 72. Additionally, the signals output from the resolvers 80 and 82 are interpreted to provide the rotational speeds for first and second electric machines 56 and 72, i.e., N_A and N_B, respectively.

The transmission 10 includes an output member 64, e.g. a shaft, which is operably connected to a driveline 90 for a vehicle (not shown), to provide output power to the driveline 90 that is transferred to vehicle wheels 93, one of which is shown in FIG. 1. The output power at the output member 64 is characterized in terms of an output rotational speed N_O and an output torque T_O. A transmission output speed sensor 84 monitors rotational speed and rotational direction of the output member 64. Each of the vehicle wheels 93 is preferably equipped with a sensor 94 adapted to monitor wheel speed, the output of which is monitored by a control module of a distributed control module system described with respect to FIG. 2, to determine vehicle speed, and absolute and relative wheel speeds for braking control, traction control, and vehicle acceleration management.

The input torque from the engine 14 and the motor torques from the first and second electric machines 56 and 72 (T_I, T_A, and T_B respectively) are generated as a result of energy conversion from fuel or electrical potential stored in an electrical energy storage device (hereafter ‘ESD’) 74. The ESD 74 is high voltage DC-coupled to the TPIM 19 via DC transfer conductors 27. The transfer conductors 27 include a contactor switch 38. When the contactor switch 38 is closed, under normal operation, electric current can flow between the ESD 74 and the TPIM 19. When the contactor switch 38 is opened electric current flow between the ESD 74 and the TPIM 19 is interrupted. The TPIM 19 transmits electrical power to and from the first electric machine 56 through a first motor control module (‘MCP-A’) 33 using transfer conductors 29, and the TPIM 19 similarly transmits electrical power to and from the second electric machine 72 through a second motor control module (‘MCP-B’) 34 using transfer conductors 31 to meet the torque commands for the first and second electric machines 56 and 72 in response to the motor torques T_A and T_B. Electrical current is transmitted to and from the ESD 74 in accordance with whether the ESD 74 is being charged or discharged.

The TPIM 19 preferably includes a hybrid control module (hereafter ‘HCP’) 5 and the pair of power inverters and respective motor control modules 33 and 34 configured to receive the torque commands and control inverter states therefrom for providing motor drive or regeneration functionality to meet the commanded motor torques T_A and T_B. The power inverters comprise known complementary three-phase power electronics devices, and each includes a plurality of insulated gate bipolar transistors (not shown) for converting DC power from the ESD 74 to AC power for powering respective ones of the first and second electric machines 56 and 72, by switching at high frequencies. The insulated gate bipolar transistors form a switch mode power supply configured to receive control commands. There is typically one pair of insulated gate bipolar transistors for each phase of each of the three-phase electric machines. States of the insulated gate bipolar transistors are controlled to provide motor drive mechanical power generation or electric power regeneration functionality. The three-phase inverters receive or supply DC electric power via DC transfer conductors 27 and transform it to or from three-phase AC power, which is conducted to or from the first and second electric machines 56 and 72 for operation as motors or generators via transfer conductors 29 and 31 respectively.

FIGS. 2 and 3 are schematic block diagrams of the distributed control module system of the control system. As used herein, the term ‘control system’ is defined as the control modules, wiring harnesses (not shown), communications links, sensors and actuators that monitor and control operation of the powertrain system. The control system monitors sensor inputs and commands outputs for controlling the actuators. The distributed control module system comprises a subset of overall vehicle control architecture, and provides coordinated system control of the exemplary hybrid powertrain described in FIG. 1. The control system includes the distributed control module system for synthesizing information and inputs, and executing algorithms to control actuators to meet control objectives, including objectives related to fuel economy, emissions, performance, drivability, and protection of hardware, including batteries of ESD 74 and the first and second electric machines 56 and 72. The distributed control module system includes an engine control module (hereafter ‘ECM’) 23, the TCM 17, a battery pack control module (hereafter ‘BPCM’) 21, and the TPIM 19. The HCP 5 provides supervisory control and coordination of the ECM 23, the TCM 17, the BPCM 21, and the TPIM 19. A user interface (‘UI’) 13 is preferably signally connected to a plurality of devices through which a vehicle operator controls, directs, and commands operation of the electro-mechanical hybrid powertrain. The devices include an accelerator pedal 113 (‘AP’), an operator brake pedal 112 (‘BP’), a transmission range selector 114 (‘PRNDL’), and a vehicle speed cruise control (not shown). The transmission range selector 114 may have a discrete number of operator-selectable positions, including the rotational direction of the output member 64 to enable one of a forward and a reverse direction. The user interface 13 can comprise a single device, as shown, or alternatively can comprise a plurality of user interface devices directly connected to the individual control modules (not shown).

The aforementioned control modules communicate with other control modules, sensors, and actuators via a communications link comprising a local area network (hereafter ‘LAN’) bus 6, in this embodiment. The LAN bus 6 allows for structured communication between the various control modules. The specific communication protocol utilized is application-specific. The LAN bus 6 and appropriate protocols provide for robust messaging and multi-control module interfacing between the aforementioned control modules, and other control modules providing functionality including e.g., antilock braking, traction control, and vehicle stability. Multiple communications buses may be used to improve communications speed and provide some level of signal redundancy and integrity. Communications between the MCP-A 33 and the HCP 5 and between the MCP-B 34 and the HCP 5 is preferably effected using direct links preferably comprising serial peripheral interface (hereafter ‘SPI’) buses 37. Communication between individual control modules can also be effected using a wireless link, e.g., a short range wireless radio communications bus (not shown).

The HCP 5 provides supervisory control of the hybrid powertrain, serving to coordinate operation of the ECM 23, TCM 17, MCP-A 33, MCP-B 34, and BPCM 21. Based upon various command signals from the user interface 13 and the hybrid powertrain, including the ESD 74, the HCP 5 determines an operator torque request, an output torque command, an engine input torque command, clutch torque(s) for the applied torque-transfer clutches C170, C262, C373, C475 of the transmission 10, and the motor torques T_A and T_B for the first and second electric machines 56 and 72. The HCP 5 sends commands to specific control modules to effect control of the engine 14, transmission 10 and the first and second electric machines 56 and 72.

The ECM 23 is operatively connected to the engine 14, and functions to acquire data from sensors and control actuators of the engine 14 over a plurality of discrete lines, shown for simplicity as an aggregate bi-directional interface cable 35. The ECM 23 receives the engine input torque command from the HCP 5. The ECM 23 determines the actual engine input torque, T_I, provided to the transmission 10 at that point in time based upon monitored engine speed and load, which is communicated to the HCP 5. The ECM 23 monitors input from the rotational speed sensor 11 to determine the engine input speed to the input member 12, which translates to the transmission input speed, N_I. The ECM 23 monitors inputs from sensors (not shown) to determine states of other engine operating parameters including, e.g., a manifold pressure, engine coolant temperature, ambient air temperature, and ambient pressure. The engine load can be determined, for example, from the manifold pressure, or alternatively, from monitoring operator input to the accelerator pedal 113. The ECM 23 generates and communicates control signals to control engine actuators, including, e.g., fuel injectors, ignition modules, and throttle control modules, none of which are shown.

The TCM 17 is operatively connected to the transmission 10 and monitors inputs from sensors (not shown) to determine states of transmission operating parameters. The TCM 17 generates and communicates actuator control signals to control the transmission 10, including controlling the hydraulic control circuit 42. Inputs from the TCM 17 to the HCP 5 include estimated clutch torques for each of the clutches, i.e., C170, C262, C373, and C475, and rotational output speed, N_O, of the output member 64. Other actuators and sensors may be used to provide additional information from the TCM 17 to the HCP 5 for control purposes. The TCM 17 monitors inputs from pressure switches (not shown) and selectively actuates pressure control solenoids (not shown) and shift solenoids (not shown) of the hydraulic circuit 42 to selectively actuate the various clutches C170, C262, C373, and C475 to achieve various transmission operating range states, as described hereinbelow.

The BPCM 21 is signally connected to sensors (not shown) to monitor the ESD 74, including states of electrical current and voltage parameters, to provide information indicative of parametric states of the batteries of the ESD 74 to the HCP 5. The parametric states of the batteries preferably include battery state-of-charge, battery voltage, battery temperature, and available battery power, referred to as a range P_BAT—MIN to P_BAT—MAX.

A brake control module (hereafter ‘BrCM’) 22 is operatively connected to friction brakes (not shown) on each of the vehicle wheels 93. The BrCM 22 monitors the operator input to the brake pedal 112 and generates control signals to control the friction brakes and sends a control signal to the HCP 5 to operate the first and second electric machines 56 and 72 based thereon.

FIG. 3 shows details of the TPIM 19. The MCP-A 33 and the HCP 5 are preferably signally connected to the LAN 6. MCP-A 33 and MCP-B 34 are directly signally connected to the HCP 5 using first and second SPI buses 37 which are preferably dedicated, i.e., communicate exclusively between the HCP 5 and the MCP-A 33 and the HCP 5 and the MCP-B 34, respectively.

Each of the control modules ECM 23, TCM 17, HCP-5, MCP-A 33, MCP-B 34, BPCM 21, and BrCM 22 is preferably a general-purpose digital computer comprising a microprocessor or central processing unit, storage mediums comprising read only memory (‘ROM’), random access memory (‘RAM’), electrically programmable read only memory (‘EPROM’), a high speed clock, analog to digital (‘A/D’) and digital to analog (‘D/A’) circuitry, and input/output circuitry and devices (‘I/O’) and appropriate signal conditioning and buffer circuitry. Each of the control modules has a set of control algorithms, comprising resident program instructions and calibrations stored in one of the storage mediums and executed to provide the respective functions of each computer. Information transfer between the control modules is preferably accomplished using the LAN bus 6 and SPI buses 37. The control algorithms are executed during preset loop cycles such that each algorithm is executed at least once each loop cycle. Algorithms stored in the non-volatile memory devices are executed by one of the central processing units to monitor inputs from the sensing devices and execute control and diagnostic routines to control operation of the actuators, using preset calibrations. Loop cycles are executed at regular intervals, for example each 3.125, 6.25, 12.5, 25 and 100 milliseconds during ongoing operation of the hybrid powertrain. Alternatively, algorithms may be executed in response to the occurrence of an event.

The exemplary hybrid powertrain selectively operates in one of several states that can be described in terms of engine states comprising one of an engine-on state (‘ON’) and an engine-off state (‘OFF’), and transmission operating range states comprising a plurality of fixed gears and continuously variable operating modes, described with reference to Table 1, below.

TABLE 1
	Engine	Transmission Operating	Applied
Description	State	Range State	Clutches
M1_Eng_Off	OFF	EVT Mode 1	C1 70
M1_Eng_On	ON	EVT Mode 1	C1 70
G1	ON	Fixed Gear Ratio 1	C1 70	C4 75
G2	ON	Fixed Gear Ratio 2	C1 70	C2 62
M2_Eng_Off	OFF	EVT Mode 2	C2 62
M2_Eng_On	ON	EVT Mode 2	C2 62
G3	ON	Fixed Gear Ratio 3	C2 62	C4 75
G4	ON	Fixed Gear Ratio 4	C2 62	C3 73

Each of the transmission operating range states is described in the table and indicates which of the specific clutches C170, C262, C373, and C475 are applied for each of the operating range states. A first continuously variable mode, i.e., EVT Mode 1, or M1, is selected by applying clutch C170 only in order to “ground” the outer gear member of the third planetary gear set 28. The engine state can be one of ON (‘M1_Eng_On’) or OFF (‘M1_Eng_Off’). A second continuously variable mode, i.e., EVT Mode 2, or M2, is selected by applying clutch C262 only to connect the shaft 60 to the carrier of the third planetary gear set 28. The engine state can be one of ON (‘M2_Eng_On’) or OFF (‘M2_Eng_Off’). For purposes of this description, when the engine state is OFF, the engine input speed is equal to zero revolutions per minute (‘RPM’), i.e., the engine crankshaft is not rotating. A fixed gear operation provides a fixed ratio operation of input-to-output speed of the transmission 10, i.e., N_I/N_O. A first fixed gear operation (‘G1’) is selected by applying clutches C170 and C475. A second fixed gear operation (‘G2’) is selected by applying clutches C170 and C262. A third fixed gear operation (‘G3’) is selected by applying clutches C262 and C475. A fourth fixed gear operation (‘G4’) is selected by applying clutches C262 and C373. The fixed ratio operation of input-to-output speed increases with increased fixed gear operation due to decreased gear ratios in the planetary gears 24, 26, and 28. The rotational speeds of the first and second electric machines 56 and 72, N_A and N_B respectively, are dependent on internal rotation of the mechanism as defined by the clutching and are proportional to the input speed measured at the input member 12. When the transmission 10 is controlled in EVT Mode 1, the transmission 10 can be commanded to operate in the reverse direction, which is accomplished by operating the second electric machine 72 in the reverse rotational direction through its motor control module in TPIM 19.

In response to operator input via the accelerator pedal 113, the brake pedal 112, and the transmission range selector 114, as captured by the user interface 13, the HCP 5 and one or more of the other control modules determine torque commands to control torque actuators to meet the operator torque request at the output member 64 for transference to the driveline 90. The torque actuators preferably include a plurality of torque generative devices, e.g., the engine 14 and the first and second electric machines 56 and 72 and a torque transferring device comprising the transmission 10 in this embodiment. Based upon operator commands from the user interface 13, the HCP 5 determines the operator torque request and an output torque command from the transmission 10 to the driveline 90 and actuator controls including an input torque from the engine 14, clutch torques for the torque-transfer clutches C170, C262, C373, C475 of the transmission 10 and the motor torque commands for the first and second electric machines 56 and 72 based upon operator commands from the user interface 13.

Torque security of the hybrid powertrain system can be achieved by executing integrity tests of the control system which include monitoring hardware integrity, monitoring integrity of algorithms and memory devices, securing and monitoring integrity of critical signals during communications within a control module and communications between the control modules, monitoring processor integrity and executing remedial actions. Torque security in presence of an observed fault can include limiting a torque actuator command signal. This can include maximum and minimum limits on torque actuator command signals and maximum rates of change on torque actuator command signals. Specifically, motor torque commands T_A and T_B can be limited to maximum and minimum motor torques, and changes in the motor torque commands T_A and T_B can be limited to effect a maximum rate of change in output torque, e.g., 0.2 g.

Securing and monitoring signal integrity is preferably accomplished by individually securing the control modules and securing the serial communications links between the control modules. The distributed control module system of the embodiment preferably includes each of the torque actuators controlled by a separate control module. This embodiment includes the ECM 23 that monitors sensors and control actuators of the engine 14, the TCM 17 that monitors sensors and control actuators of the transmission 10, the MCP-A 33 that monitors sensors and control actuators of the first electric machine 56, and the MCP-B 34 that monitors sensors and control actuators of the second electric machine 72. The HCP 5 monitors inputs from and commands operation of the ECM 23, TCM 17, MCP-A 33 and MCP-B 34. The control modules communicate the signals using the LAN bus 6 and the SPI bus 37. Each of the ECM 23, MCP-A 33, MCP-B 34 and TCM 17, is responsible for closed loop monitoring and self-security based on secured commands received from the HCP 5.

Securing and monitoring integrity of the signal includes monitoring processor integrity for each of the control modules. The processor integrity can be determined using diagnostics software that monitors data internal to the control module, and rationalizing it in one of the loop cycles. When an inconsistency between monitored data and rationalized data is detected, the inconsistency is recorded as a mismatch or a fault in a fault maturation algorithm, e.g., an X of Y routine wherein a matured fault is detected when X faults are observed out of immediately preceding Y observations of the signal. An example is detecting a matured fault when more than half the immediately preceding observations are mismatches occurring between the monitored data and the rationalized data. When the fault maturation algorithm achieves a threshold number of mismatching observations in the immediately preceding observations, the fault has matured, indicating signal corruption and a requirement for remedial action. The remedial action can be actuator-specific or across the entire control system, and places the powertrain in a torque-safe state. The remedial action will also include storing an OBD compliant code for subsequent retrieval. A diagnostic may preliminarily identify a fault pending, meaning an inconsistency has been detected but the fault maturation algorithm has not reached its threshold. The hardware integrity can be further determined using diagnostics software that monitors the sensors and actuators of the control system.

Monitoring integrity of a signal that is generated and communicated in the control system comprises actions to determine whether a received signal matches the generated signal. A signal can include an operator command signal, a sensor input signal and an actuator command and control signal. With reference to the embodiment described hereinabove, a signal can comprise an actuator command or control signal, including, e.g., motor torque commands for the first and second electric machines 56 and 72, the input torque command to the engine 14, and clutch torque commands for the clutches C170, C262, C373, and C475 of the transmission 10. The signal can include the sensor input signal, e.g., a signal from the rotational speed sensor 11 and the transmission output speed sensor 84 and resolvers 80 and 82. The signal can include an operator command, e.g., an operator input to the accelerator pedal 113, the operator brake pedal 112 and the transmission range selector 114.

FIG. 4 schematically shows signal flow for monitoring integrity of signal output from the transmission range selector 114, described by way of illustration with reference to the hybrid powertrain system of FIGS. 1 and 2. The transmission range selector 114 preferably comprises an operator-manipulated device that can be placed in one of a plurality of discrete positions, e.g., Park, Reverse, Neutral, Drive, and Low (‘PRNDL’) by which an operator selects and communicates a direction of intended vehicle propulsion. The control system controls operation of the transmission 10 including the transmission operating range state in response to the operator commanded direction of intended vehicle propulsion. Preferably the transmission range selector 114 includes two range selector lever position sensors 116 and 118 that are attached to the transmission range selector 114, each comprising a digital encoder that provides discrete output signals corresponding to discrete positions of the transmission range selector 114. Individual positions for each of the discrete positions are typically identified by mechanical detents (not shown) in the transmission range selector 114. The gear selector lever position sensors 116 and 118 are operative to detect and discern distinct gear selector positions and are preferably permanently mechanically aligned with each other to prevent misalignment of the two sensors. Preferably the first sensor 118 comprises a digital encoder that provides a unique set of discrete outputs for each discrete position of the transmission range selector 114, and is referred to as a range encoder 118. Thus, in the embodiment shown, the transmission range selector 114 has discrete positions comprising P, R, N, D_M . . . D1, and the range encoder 118 generates corresponding outputs of RE Output 1, RE Output 2, . . . RE Output N. In this embodiment, the output of the range encoder 118 is a four-bit digital word. The range encoder 118 is signally connected to the TCM 17 preferably through a hardware input/output device (not shown). The TCM 17 decodes the four-bit digital word from the range encoder 118 and generates a transmission shift lever position state (hereafter ‘TSLP’).

Preferably, the second sensor 116 comprises a digital encoder that provides a unique set of discrete outputs for each of a plurality of valid subsets of the discrete positions, with each subset comprising a rotational direction of the output member 64 of the transmission 10 corresponding to an operator-selected direction of intended vehicle propulsion. In this embodiment the second sensor 116 generates four subsets, comprising four unique outputs corresponding to one of the Park, Reverse, Neutral, and Drive positions. The second sensor 116 is referred to as a direction encoder 116. Thus, in the embodiment shown, the transmission range selector 114 has discrete positions comprising P, R, N, D_M . . . D1, and the direction encoder 116 generates outputs of DE Output 1, DE Output 2, DE Output 3, DE Output 4, and DE Output 5, wherein discrete position P has corresponding output DE Output 1, discrete position R has corresponding output DE Output 2, discrete position N has corresponding output DE Output 3, discrete position D_M . . . D1 have corresponding output DE Output 4, and unknown discrete positions have corresponding output DE Output 5. In this embodiment, the output of the direction encoder 116 is a five-bit digital word. The direction encoder 116 is signally connected to the HCP 5 through a hardware input/output device (not shown). The HCP 5 decodes the five-bit digital word and generates a transmission shift lever direction state (hereafter ‘TDS’). The TDS preferably comprises a digital word, e.g., a four-bit or an eight-bit representation of the direction state, i.e., one of Park, Reverse, Neutral, and Drive, and Unknown direction state when the TDS is unable to determine a direction state.

The TDS and the output of the direction encoder 116 are input to a transmission direction state rationality algorithm (‘TDS Rationality Check’) 410, which verifies that the TDS output from the HCP 5 corresponds to the transmission direction indicated by the direction encoder 116 prior to being processed through the HCP 5. The signal output from the direction encoder 116 is compared to the expected direction encoder states for each of the direction states, i.e., Park, Reverse, Neutral, Drive, and Unknown, to determine that there is a complete correspondence to one and only one of the direction states. A fault can be set when there is not a positive correspondence. The rationality algorithm 410 compares the TDS with the signal output from the direction encoder 116 to verify that the TDS corresponds to the signal output from the direction encoder 116. Preferably there is a positive match between the two signals, i.e., the TDS corresponds directly to the signal output from the direction encoder 116. In this instance, no fault is indicated by the output of the rationality algorithm 410. When there is not a positive match between the two signals, the TDS is compared to the expected direction encoder states for each of the direction states, i.e., Park, Reverse, Neutral, and Drive. When the signal output from the direction encoder 116 is within one bit of one and only one of the direction states, the rationality algorithm 410 verifies that TDS matches that direction state. A fault is indicated by the output of the rationality algorithm 410 when there is not a match. When the signal output from the direction encoder 116 is not within one bit of one of the direction states (e.g. two or more bits are incorrect), the rationality algorithm 410 verifies that the TDS indicates the direction as Unknown. Otherwise the rationality check 410 can indicate a fault.

The TDS and the TSLP are input to a range validation logic algorithm (‘TDS Validation Logic’) 425, which compares the TDS and TSLP states to validate that there is logical consistency therebetween. When the range is validated, i.e., there is a match between a positive TDS and a positive TSLP, an output is a validated transmission range state (hereafter ‘VTRS’), which is validated using a dual-store check (430) and subsequently checked for a fault prior to use by the HCP 5. When the range is not validated, vehicle propulsion can be disabled, preferably by placing the vehicle in Neutral state. When the TDS has been error-corrected, and there is a match between the error-corrected TDS and the positive TSLP, the TSLP is valid and used as the VTRS. When there is an active fault with the direction encoder 116, or the direction encoder 116 generates an illegal value, the VTRS is commanded to a restricted range, e.g., disabling one or more of the low range Drive gears. When the TDS is positive and the TSLP indicates the range encoder 118 is between ranges or has an active fault, or the TCM 17 is off-line, the VTRS is commanded based upon the direction encoder 116 and operated at a restricted range, e.g., disabling one or more of the low range Drive gears, and used as the VTRS. The VTRS comprises a signal output corresponding to one of the discrete positions of the transmission range selector 114, including Park, Reverse, Neutral, Drive_M . . . Drive1 as shown. The VTRS comprises Park, Reverse, Neutral, Drive6, Drive5, Drive4, Drive3, Drive2, and Drive1 in one embodiment. Additional discrete positions of the transmission range selector 114 can be used in other embodiments, and can be achieved during ongoing operation of the vehicle using operator-selectable features referred to as tap up/tap down controls (not shown).

The VTRS output is input to a back rationality check algorithm (‘VTRS Back Rationality Check’) 420. The back rationality check algorithm 420 monitors the TDS and the TSLP, and compares the VTRS thereto, including executing multiple checks to compare the VTRS to non-selected TDS outputs from HCP 5. The back rationality checks can be specific to each of Park, Reverse, Neutral, Drive6, Drive5, Drive4, Drive3, Drive2, and Drive1.

When the VTRS output indicates the transmission range selector 114 indicates Park, the algorithm 420 executes a first logic check that verifies that Park is indicated based upon the TSLP. This includes verifying the TSLP indicates Park and verifying the TDS does not indicate any one of Reverse, Neutral or Drive. The algorithm 420 executes a second logic check that verifies that Park is indicated based upon the TDS. This includes verifying the TDS indicates Park and verifying absence of system faults. A fault is indicated when there is a fault in any of the verifications.

When the VTRS output indicates the transmission range selector 114 indicates Reverse, the algorithm 420 executes a first logic check that verifies that Reverse is indicated based upon the TSLP. This includes verifying the TSLP indicates Reverse and verifying the TDS does not indicate any one of Park, Neutral or Drive. The algorithm 420 executes a second logic check that verifies that Reverse is indicated based upon the TDS. This includes verifying the TDS indicates Reverse and verifying absence of system faults. A fault is indicated when there is a fault in any of the verifications.

When the VTRS output indicates the transmission range selector 114 indicates Neutral, the algorithm 420 executes a first logic check that verifies that Neutral is indicated based upon the TSLP and the TDS. This includes verifying the TSLP indicates Neutral and verifying the TDS indicates Neutral. The algorithm 420 executes a second logic check that compares the TSLP and the TDS for logical inconsistencies. The algorithm 420 executes a third logic check to determine whether the VTRS commands Neutral, including whether Neutral has been commanded due to an active fault in one of the range encoder 118 and the direction encoder 116. A fault is indicated when there is a fault in any of the verifications.

When the VTRS output indicates the transmission range selector 114 indicates one of the Drive ranges, indicated by DriveX wherein X indicates the specific Drive range, e.g., one of Drive6, Drive5, Drive4, Drive3, Drive2, and Drive1 in this embodiment. The algorithm 420 executes a first logic check that verifies that the DriveX range is indicated based upon the TSLP. This includes verifying the TSLP indicates the Drive range and verifying the TDS does not indicate any one of Park, Reverse, or Neutral. The algorithm 420 executes a second logic check that verifies that the specific drive range DriveX is indicated based upon the TDS. This includes verifying the TDS indicates DriveX and verifying absence of system faults. A fault is indicated when there is a fault in any of the verifications.

When a fault occurs in any one of the transmission direction state rationality algorithm 410, the back rationality check algorithm 420, the range validation logic algorithm 425, or the one of dual store functions 415, 430, the control system executes remedial action (440) to mitigate risks associated with the presence of the fault. The remedial action places the powertrain in a torque-safe state. The remedial action further includes storing an OBD compliant code for subsequent retrieval. A diagnostic may preliminarily identify a fault pending, meaning data corruption or an inconsistency has been detected but the fault maturation algorithm has not reached its threshold. One specific remedial action can include operating the system in one specific operating range.

The TDS and VTRS are subjected to dual store functions 415, 430. FIG. 5 shows an exemplary system for signal flow that includes securing and verifying integrity of an input signal to an originating control module and including dual store functionality. An input signal comprising one of the TDS and VRTS is generated as a control signal in this embodiment. The input signal is generated (502) and is captured as a primary signal 504 and a redundant signal 504′. This can include the input signal from the sensor converted to a digital representation of the input from the sensor using an analog-to-digital converter (not shown) which may be interposed between the sensor and the originating control module. Diagnostics (‘Diagnostics’) are executed on both the primary signal and the redundant signal (506, 506′). Diagnostics can include limit checks that indicate when the signal is outside of a predetermined operating range for the signal, a rationality check of the signal, and other diagnostics check that can indicate corruption of the signal. If a corrupted signal is detected (‘Signal Fault’) in either or both the primary signal and the redundant signal, a default signal is generated (‘Defaulting’) (508, 508′) and communicated to a rationality check 510. The default signal preferably comprises a predetermined signal that is recognizable in the control module as indicating the primary signal or the redundant signal has been corrupted. When a fault is not detected (‘No Fault’), the primary and/or the redundant signals are communicated to the rationality check 510. The rationality check 510 compares the primary signal and the redundant signal and identifies a fault (‘Fault’) when there is a difference detected between the primary and redundant signals. When the rationality check 510 indicates that the primary signal is valid (‘Valid Signal’), the primary signal is communicated to a dual store function (‘Dual Store’) 511. The dual store function 511 monitors and compares present contents in first and second memory locations 512, 512′ to verify integrity of the memory locations, preferably during each 6.25 ms loop cycle. When the dual store function 511 verifies integrity of the first and second memory locations, i.e., the present contents in the first and second memory locations are identical, the primary signal is stored as the primary signal in the first memory location (‘Store Primary Signal’) (512) and stored as a secondary signal in the second memory location (‘Store Secondary Signal’) (512′). The primary signal stored in the first memory location is subsequently communicated to a control path (‘Primary Signal To Control Path’). The secondary signal stored in the second memory location is subsequently communicated to a security path. (‘Secondary Signal To Security Path’). If there is a difference between the present contents of the memory locations, a fault (‘Fault’) is recorded indicating corruption of one of the first and second memory locations.

When the rationality check 510 indicates corruption of one or both of the primary and the redundant signals, or the dual store function 511 indicates corruption of the present contents of one the first and second memory locations 512, 512′ the control system identifies occurrence of the fault (‘Fault’). The control system determines whether the corrupted signal has matured (‘Mature Fault’) (514), and executes remedial action (516) to mitigate risks associated with the presence of the fault. A fault maturation algorithm can be executed, including, e.g., an X of Y routine wherein a fault has matured when X mismatched signals are observed out of immediately preceding Y signal observations. An example includes determining a fault has matured when more than half the immediately preceding observations indicate a corrupted signal.

Monitoring integrity of a signal transmitted over a serial bus includes detecting missing data, e.g., detecting loss of a message frame and taking a short term mitigation action and informing the receiving control module that no new data is available. Detecting missing data also includes detecting long term loss of communications to one of the control modules and taking a remedial action.

It is understood that modifications are allowable within the scope of the disclosure. The disclosure has been described with specific reference to the preferred embodiments and modifications thereto. Further modifications and alterations may occur to others upon reading and understanding the specification. It is intended to include all such modifications and alterations insofar as they come within the scope of the disclosure.

Claims

1. Method to monitor integrity of a signal output from an operator-manipulable transmission range selector for a powertrain system wherein a control module performs the following steps, comprising: determining a range state corresponding to a signal from a range encoder attached to the transmission range selector and determining a direction state corresponding to a signal from a direction encoder attached to the transmission range selector, wherein the range state directly corresponds to a discrete position of the transmission range selector and wherein the direction state corresponds to rotational direction of an output member of the powertrain system;determining the discrete position of the transmission range selector based upon the range state and the direction state; andperforming back rationality to verify the discrete position of the transmission range selector.

2. The method of claim 1, wherein performing back rationality to verify the discrete position of the transmission range selector comprises comparing the discrete position of the transmission range selector to the range state from the range encoder and the direction state from the direction encoder, and comparing the discrete position of the transmission range selector to the range state from the range encoder and to each of a plurality of non-selected direction states of the direction encoder.

3. The method of claim 2, further comprising verifying the discrete position of the transmission range selector when the range state from the range encoder indicates the discrete position of the transmission range selector and the direction state of the direction encoder does not indicate any of the non-selected direction states of the direction encoder.

4. The method of claim 1, further comprising determining a validated transmission range state corresponding to the discrete position of the transmission range selector based upon the range state and the direction state.

5. The method of claim 4, further comprising performing a dual-store check of the validated transmission range state.

6. The method of claim 5, further comprising controlling operation of the transmission based upon the validated transmission range state.

7. The method of claim 1, further comprising verifying the direction state corresponds to the signal from the direction encoder.

8. The method of claim 7, further comprising performing a dual store check of the direction state.

9. The method of claim 7, comprising identifying presence of error in the direction state when the direction state fails to correspond to the signal from the direction encoder, and correcting the direction state based upon the error in the direction state.

10. The method of claim 1, further comprising controlling operation of the transmission to a neutral range state when a fault is identified in one of the range state and the direction state.

11. Method to monitor integrity of a signal output from an operator-manipulable transmission range selector for a transmission of a hybrid powertrain system, wherein a control module performs the following steps comprising: determining a range state corresponding to a signal input from a range encoder attached to the transmission range selector and determining a direction state corresponding to a signal input from a direction encoder attached to the transmission range selector, wherein the range state directly corresponds to a discrete position of the transmission range selector and wherein the direction state corresponds to rotational direction of an output member of the transmission;determining a preferred discrete position of the transmission range selector comprising an operator-selected transmission range based upon the range state and the direction state;verifying the preferred discrete position of the transmission range selector based upon the range state and the direction state; andcontrolling operation of the transmission based upon the validated transmission range state.

12. The method of claim 11, wherein verifying the preferred discrete position of the transmission range selector based upon the range state and the direction state comprises comparing the preferred discrete position of the transmission range selector to the range state and the direction state.

13. The method of claim 11, wherein verifying the preferred discrete position of the transmission range selector based upon the range state and the direction state comprises comparing the preferred discrete position of the transmission range selector to each of a plurality of non-selected direction states.

14. The method of claim 13, wherein comparing the preferred discrete position of the transmission range selector to each of a plurality of non-selected direction states comprises comparing the preferred discrete position of the transmission range selector to each of a Park state, a Neutral State, and a Drive State when the preferred discrete position of the transmission range selector comprises a Reverse state.

15. System for monitoring integrity of a signal output from an operator-manipulable transmission range selector for a powertrain system, comprising: a range encoder providing a respective signal;a direction encoder providing a respective signal; anda computer-readable medium encoded with a set of program instructions configured to: determine a range state corresponding to the signal from the range encoder and determine a direction state corresponding to the signal from the direction encoder, wherein the range state directly corresponds to a discrete position of the transmission range selector and wherein the direction state corresponds to rotational direction of an output member of the powertrain system;determine a discrete position of the transmission range selector comprising an operator-selected transmission range based upon the range state and the direction state, andexecute back rationality to verify the discrete position of the transmission range selector comprising the operator-selected transmission range.