SAE TECHNICAL

PAPER SERIES

2000-01-0556

Delphi Electronic Throttle Control Systems for

Model Year 2000; Driver Features, System
Security, and OEM Benefits.
ETC for the Mass Market
Daniel McKay, Gary Nichols and Bart Schreurs
Delphi Automotive Systems

Reprinted From: Electronic Engine Controls 2000: Controls

(SP1500)

SAE 2000 World Congress

Detroit, Michigan
March 69, 2000
400 Commonwealth Drive, Warrendale, PA 15096-0001 U.S.A.

Tel: (724) 776-4841 Fax: (724) 776-5760

The appearance of this ISSN code at the bottom of this page indicates SAEs consent that copies of the
paper may be made for personal or internal use of specific clients. This consent is given on the condition,
however, that the copier pay a $7.00 per article copy fee through the Copyright Clearance Center, Inc.
Operations Center, 222 Rosewood Drive, Danvers, MA 01923 for copying beyond that permitted by Sections 107 or 108 of the U.S. Copyright Law. This consent does not extend to other kinds of copying such as
copying for general distribution, for advertising or promotional purposes, for creating new collective works,
or for resale.
SAE routinely stocks printed papers for a period of three years following date of publication. Direct your
orders to SAE Customer Sales and Satisfaction Department.
Quantity reprint rates can be obtained from the Customer Sales and Satisfaction Department.
To request permission to reprint a technical paper or permission to use copyrighted SAE publications in
other works, contact the SAE Publications Group.

All SAE papers, standards, and selected

books are abstracted and indexed in the
Global Mobility Database

No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without the prior written
permission of the publisher.
ISSN 0148-7191
Copyright 2000 Society of Automotive Engineers, Inc.
Positions and opinions advanced in this paper are those of the author(s) and not necessarily those of SAE. The author is solely
responsible for the content of the paper. A process is available by which discussions will be printed with the paper if it is published in
SAE Transactions. For permission to publish this paper in full or in part, contact the SAE Publications Group.
Persons wishing to submit papers to be considered for presentation or publication through SAE should send the manuscript or a 300
word abstract of a proposed manuscript to: Secretary, Engineering Meetings Board, SAE.

Printed in USA

2000-01-0556

Delphi Electronic Throttle Control Systems for Model Year 2000;

Driver Features, System Security, and OEM Benefits.
ETC for the Mass Market
Daniel McKay, Gary Nichols and Bart Schreurs
Delphi Automotive Systems
Copyright 2000 Society of Automotive Engineers, Inc.

ABSTRACT

Delphis ETC system diagnostics, redundant path

software, and watchdog CPU provide a superior level of
security. Delphis ETC system also provides back-up
controls such that even in the unlikely event of a throttle
failure, the vehicle power can still be safely modulated by
the driver.

Delphi has developed a second-generation Electronic

Throttle Control system optimized for high volume
applications. The Delphi system integrates several
unique driver performance features, extensive security/
diagnostics, and provides significant benefits for the
vehicle manufacturer. For Model Year 2000, the Delphi
ETC system has been successfully implemented on
several popular SUVs and passenger cars built and sold
around the world. The ETC driver features, security
systems, and manufacturer benefits are presented as
implemented on these Model Year 2000 applications.

Delphi ETC also has built in several benefits for the

vehicle manufacturer. The 2000 Delphi ETC system
implementation cost is low because the ETC system
integrates Throttle Control, Cruise Control and Idle
Control into a single actuator directed by a single engine
controller. The Delphi ETC system reduces the number
of required components and eliminates their associated
sourcing/price/application/warranty costs. Factor in the
integrated ETC functions of torque estimation/control,
traction/vehicle stability control, noise control, and throttle
command conditioning for driveability/emissions, and
Delphi ETC far exceeds the payback point. Delphi ETC.
Leading Edge ETC for the New Millennium available for
the mass market.

INTRODUCTION
Electronic Throttle Control (ETC) has been around for
about 15 years[1][2][3][4], and now is ready for the mass
market. Delphi has created a second-generation ETC
system for several popular Model year 2000 applications
built and sold in Asia, Europe, and North America. The
Delphi ETC system is standard equipment on several
high volume V-6 SUVs, and one of the most popular
vehicles made in Europe, the 1.6L.Opel Vectra.

DELPHI EXPERIENCE WITH THROTTLE

CONTROL SYSTEMS

What is really important is the functionality inside the

Delphi systems. The Delphi system integrates several
unique driver performance features such as Driver
Selectable Performance pedal to throttle gains (Power for
performance and Winter for control), an Altitude
Compensated Pedal to Throttle transfer function (to avoid
that weak feeling in the mountains), Vehicle and Engine
Speed Governors to protect the engine and the driver,
and several driveability enhancing features such as Tip-In
Bump Elimination on manual transmissions, and Catalyst
Light-Off Spark Retard Compensation. Also inside the
Delphi system is the security of clever diagnostics and
relentless redundant systems. Redundancies in the
pedal/throttle sensor hardware have become an ETC
standard with multiple sensors processed to ensure
secure pedal and throttle signals. Delphi applies this
same rigor to their controller hardware and software.

Delphi has over 50 years of experience with systems

providing engine power control functions including
governing, cruise control, idle speed control, traction
control, vehicle stability control, and adaptive cruise
control. The required technology has been developed
together with Delphis customers and suppliers. Delphis
customers are particularly involved in providing functional
requirements and in the fine-tuning and validation of the
system for specific vehicle applications.
DELPHI ETC SYSTEM ARCHITECTURES
Generation I Architecture Delphis first generation ETC
system [5] used an architecture optimized for application
as an optional feature on a small percentage of an engine
management systems volume. A small electronic
controller was added to interface with the ETC
1

controller regulates the throttle actuators output torque

with a pulse-width modulated reversible output.
Advanced control strategies are used to eliminate the
mechanical connection between the drivers foot to the
engine in Delphi ETC.

components and perform a portion of the ETC

processing. The ETC controller communicated with the
powertrain control module (PCM) via a serial
communication link. This architecture minimized the
hardware impact on the PCM so that vehicles not using
ETC carried no additional cost. The majority of the ETC
processing was performed in the PCM, enabling close
coordination of air, fuel, EGR, spark and transmission
control for optimal powertrain performance.

DEPHI MODEL YEAR 2000 ETC APPLICATIONS

Delphi has successfully implemented its ETC system for
several popular Model Year 2000 applications built and
sold around the world. Significant driver benefits will be
discussed as implemented on these applications,
including Driver Selectable Performance, Altitude
Compensation, Vehicle and Engine Speed Governors,
Tip-in Bump Elimination and Catalyst Light-off
Compensation. The Delphi strategy to ensure secure
ETC function will be outlined, including redundant sensor
processing, redundant controller hardware/software,
redundant hardware/system diagnostics and vehicle
performance moding based on system reliability. Finally,
benefits to the manufacturer will be reviewed. Reduced
cost, improved simplicity, engine noise reduction, throttle
command conditioning for emissions, and torque-based
control function availability are major manufacturer
benefits identified.

Generation II Architecture Delphis second generation

ETC system was designed for high-volume applications
where ETC is standard. All ETC processing is located in
the main processor of the Engine or Powertrain control
module (ECM/PCM). A small, single chip microprocessor
is used to provide redundant confirmation of key ETC
input signals and to perform checks on the operation of
the Main CPU. The controller is compatible with
commonly used ETC components. Accelerator pedal
position sensing is done with 2 or 3 potentiometers. The
electronic throttle body has 2 potentiometers for sensing
throttle valve angle, a DC brush type actuator for
positioning the throttle, 2 stage gear reduction, and a
return spring mechanism which positions the valve
slightly open when the actuator is not powered. The

Figure 1.

Figure 2.

and to compensate for external conditions to provide a

more consistent response.

The emissions on the Delphi 2000 ETC equipped

vehicles are significantly lower than those of the models
they replace, placing them in a lower emission
classification for their market. For one engine family, an
A.I.R. pump was also deleted from the engine
management system. Multiple changes contributed to the
reductions, but on average a 15% reduction in tailpipe HC
and NOx emissions is attributed to ETC. Model year 2000
emission results for two of the ETC equipped engines are
presented below in figure 3.

Driver Selectable Performance adjusts the sensitivity or

gain of the accelerator pedal in response to driver input
switch selection (Figure 4). At the touch of a button, the
acceleration response can be selected to match the
driving conditions and mood.
Three modes have been made available for Model Year
2000, Normal, Power, and Winter. Normal mode is the
default setting that provides the acceleration response
that most drivers prefer for most driving conditions. In the
case where the driver desires additional performance,
the Power switch is selected and the ETC system gains
become more aggressive. This sensitizes the pedal to
throttle response and the result is a sporty feel,
especially at launch conditions. The Winter mode switch
is selected by the driver driving in low traction conditions
where fine control of power is needed. Winter mode
results in very conservative throttle gains such that power
may be easily modulated without wheel slip. The
schematic below graphically depicts the switch selection
and the various gain tables of Pedal Flow Area vs. Pedal
Position. The ETC throttle gains may be coordinated with
the appropriate Transmission shift maps on automatic
transmission applications.

WHATS INSIDE THE DELPHI SYSTEMS

DELPHI DRIVER PERFORMANCE FEATURES ETC
brings the most important engine control device under
complete electronic control and eliminates the last
mechanical connection from the driver to the engine. This
capability is a dream come true for anyone working on
advanced engine control systems. Simply bolting ETC on
an engine requires a large amount of work but provides
almost no benefit in itself. The powertrain control system
must be modified to realize the benefits enabled by
having total control of the engine.
Driver Selectable Performance ETC is an extraordinary
tool for enhancing engine and vehicle performance. An
intrinsic benefit of the use of ETC is the ability to modify
the vehicle response to accelerator inputs to more closely
match the optimum characteristics. Consumer research
has determined that the vehicle response to accelerator
inputs is a significant factor in a drivers overall
satisfaction with a vehicle. For powertrain metrics, the
response in the first 20mm of accelerator pedal travel
may be more important than a vehicles 0-100 km/h
acceleration time. ETC provides new capability to modify
the powertrain responsiveness to match driver desires

Altitude Compensated Pedal to Throttle Transfer Function

When travelling through the mountains, the change in
barometric pressure makes it more difficult for people
and engines to breathe. Humans eventually adapt to the
change and, with Delphi ETC, combustion engines adapt
as well. Without ETC altitude compensation, vehicle
performance
feels
weak.
With
ETC
altitude
compensation, the pedal response is unchanged at high
altitude for throttle positions below wide open throttle
(unthrottled).

Figure 3.

Figure 4.
3

Figure 5. Altitude Compensation to Flow Command

Figure 6. Pedal to Power Curves at Different Barometric Pressures

engine speed limiting and ETC engine speed governing
performance are presented below in Figure 7. Vehicle
speed governing provides a similar advantage.

The ETC system compensates the commanded throttle

area for the current altitude by applying a multiplier to the
throttle area as a function of barometric pressure (Figure
5). The driver-selected pedal to power transfer function is
maintained up to the throttle opening point where the
engine becomes unthrottled.(Figure 6.) The maximum
engine power point at altitude is achieved at lower pedal
positions. However, for the most often used range of
pedal travel, the vehicle response remains similar to sea
level response.

Tip-in Bump Elimination on Manual Transmissions On

manual transmission applications, a rapid change from
negative torque to positive torque may result in an
objectionable driveline bump. This is due to the
acceleration and deceleration of the driveline as the
mountings are unloaded and reloaded in the opposite
direction. The Delphi ETC tip-in bump elimination
function significantly reduces torque-induced driveline
oscillations during transitions from negative torque to
positive torque.

Engine and Vehicle Speed Governing While accelerating

a manual transmission vehicle hard or any vehicle through a
corner at top speed on the autobahn, it can be harsh and
unsettling to come up against a fuel cutoff based engine or
vehicle speed limiter. The vehicle decelerates and
accelerates abruptly without warning as the fuel is disabled
and enabled. Further, fuel cutoff based engine and vehicle
speed limiters can increase wear on engine and driveline
parts. Rich and lean mixture excursions in the catalyst result
in high temperatures and rapid aging, while drivetrain wear
may be increased by the sudden torque changes.

When unfiltered desired Throttle Position is increasing, a

TPS bump eliminator enable threshold value TP1 is
looked up as a function of RPM and gear (See Figure 8).
TP1 is selected such that the throttle opening at TP1
corresponds to the zero torque at the driven wheels. This
is the point at which it is desirable to begin ramping the
throttle opening and avoid concerns with throttle opening
bump.

ETC throttle governing eliminates the startling torque

fluctuations and potential hardware damage caused by
fuel cutoff-based speed limiting strategies. With ETC
governing, the fuel remains on and the RPM/Vehicle
speed is maintained by controlling throttle position
around the target speed. Transitions are smooth and
transparent to the driver. In neutral on automatic
transmission vehicles, the ETC RPM governor also
protects the transmission from abuse by governing to a
lower engine speed. When active, the governor controls
throttle area below the accelerator pedal value using a
proportional plus Integral feedback controller with feedforward compensation. Comparisons between fuel cutoff

When the pedal is applied, the desired unfiltered and

filtered TPS values are allowed to increase until the
unfiltered value has reached TP1. At this point, a linear
throttle opening rate as a function of RPM, gear and
unfiltered TPS position is added to TP1 and the result is
applied as the desired TPS Command. The ramping
function is disabled at a selectable TPS value TP2 and a
lag filter is applied to transition smoothly to the unfiltered
TPS value. The TPS threshold (TP2) above which the
ramp is disabled is selected such that the engine is
against the engine mounts and no bump or ringing will
occur if the throttle is rapidly opened further.
4

Figure 7. Comparison of Fuel Cutoff Speed Limiting vs. ETC Throttle Controlled Engine Speed Governing

Figure 8. Tip-in Bump Elimination

Figure 9. Light-off Spark Torque Correction vs. No Correction

challenge for the engine and vehicle development
community in that these light-off strategies can only be
used up to the level at which a driveability impact is
imperceptible to the driver. The Delphi ETC system has
the capability to compensate for catalyst light-off spark
and fuel-related torque reduction. The ETC throttle is
opened in order to compensate for the torque loss and
retain the original pedal-to-throttle transfer function.

Compensation for Catalyst Light-Off Spark Retard

Strategies In order to rapidly bring the exhaust catalyst
up to operating temperature, spark retard and fuel
enleanment strategies have been implemented. The use
of these strategies changes the pedal to power transfer
function on mechanically throttled vehicles and ETC
vehicles without compensation. Specifically, retarded
spark and/or fuel enleanment light-off results in reduced
power for a given pedal position. This presents a
5

affiliated companies designing systems of higher

criticality, including flight control systems for commercial
aircraft.

SELF-CHECKING FEATURES ETC is a safety-critical

system which requires fail-safe operation. A fail-safe
system focuses on detecting operational problems and
responding in specific ways to them.

Sensor/Switch Redundancy The Delphi ETC system

utilizes a minimum of 2 accelerator pedal sensor
potentiometers and 2 throttle sensor potentiometers (See
Figure 10).

In order to ensure the appropriate level of functional

integrity, the Delphi ETC system utilizes diagnostics,
redundancy, diversity, and extensive testing for ETC
sensors/inputs, processing, and engine power control.
Integrity in the sensor hardware is achieved by applying
multiple pedal/throttle sensors, brake switches, and
related diagnostics. ETC Powertrain controller integrity is
achieved through the use of many controller selfdiagnostics, a checking CPU, and redundant computation
of safety-critical values. Secure power actuation is
achieved using system level rationality diagnostics and
power moding strategies that provide diminished levels of
engine power as failures are detected. Engine power can
be controlled by limiting air, fuel, and/or spark.

Additional voltage references, sensor grounds, or a third

accelerator pedal sensor are available to increase the
overall accelerator position sensing reliability depending
upon the customer requirements (See Figure 11).
Electrically isolated voltage references and grounds may
be used so that a single point electrical short/open
condition does not invalidate all Pedal/Throttle Position
sensors. The sensor output characteristics are diversified
to improve the detectability of common mode failures
using correlation rationality diagnostics (See Figures 12
and 13). The system also uses redundant brake switches
that are logically opposed; one normally open and one
normally closed. As with the throttle and pedal sensors,
brake switch redundancy and diversity facilitates reliable
brake apply signals and rationality diagnostics. A
patented pedal sensor position determination method
based upon the fault status of the sensors is used to
convert the multiple sensor readings into a single, highly
reliable value of accelerator position.[6]

Throughout the ETC design, assumptions are made that

failures are present and the design is done to provide
detection of the failure and provide a safe vehicle
response. During verification, implementations are
assumed faulty until proven by testing to operate to the
design intent during normal and failed conditions.
Considering the complexity of the processing core and
the control software, a large portion of the work is spent
in this area. Many of the techniques used to design and
verify the system were based on the experience within

Figure 10. ETC Block Diagram

6

Figure 11. Accelerator Pedal Module

Figure 12. Accelerator Pedal Sensor Typical Characteristic

Figure 13. Typical Throttle Sensor Characteristics

Figure 14. SPI Serial Data

significantly greater than that of the indicated throttle

position airflow are considered faults. Throttle return
diagnostics are also performed to evaluate the ability of
the throttle return springs to bring the throttle back to
default position when unpowered. Based on the results of
these tests, the ETC actuator may be disabled or an
alternate performance mode utilized. Actuation faults
may be caused by open/shorted motor leads, an
obstruction in the throttle bore, motor driver circuit faults,
a severe leak in the intake system, a broken throttle
blade, or a faulty throttle actuator.

Controller Hardware Redundancy The Delphi ETC

system is equipped with primary (main) and redundant
(checking) processors. The main processor performs all
ETC and engine management tasks, while the Watchdog
processor performs redundant ETC sensor and switch
reads, redundant ETC diagnostics, redundant security
moding, fuel/spark/throttle output enable control and self
checks. In addition to the hardware, there are several
levels of diagnostic redundancy to maintain system
integrity.
ETC System Diagnostics and Security Moding The
ETC system diagnoses the ETC sensors, and switches,
ETC throttle actuator, as well as the engines ability to
safely control power (See Figure 14.). ETC diagnostics
evaluate sensors, controllers, software, electronics,
continuity, correlation, and range/rationality. Based upon
the overall ETC system failure status, the ETC moding
security system may allow full engine power, reduce
engine power significantly, or completely shut down the
engine.

ETC Powertrain Controller Processing ETC powertrain

controller processing is managed using many PCM/
controller internal self tests, a checking CPU and
diagnostics for safety-critical ETC software. These
diagnostic and checking systems ensure failsafe
operation of the ETC/Powertrain control system.
Because the powertrain controller contains a small
percentage of safety-critical software residing with the
non-safety-critical software, some special design
considerations are made. First, the safety-critical
software is designed assuming other software in the
controller may not operate properly and could affect the
safety-critical part. Detection methods and actions are
designed to provide a specific response if such a problem
occurs. These methods have no effect under normal
operating conditions, but they simplify the analysis
required by minimizing the effect of failures in the
controller.

Switch and Sensor Diagnostics The ETC pedal and

throttle potentiometer sensors, for example, are checked
for acceptable voltage range and scaled sensor output
correlation with the other sensor(s). ETC sensor voltage
references are measured back as analog inputs and
evaluated for proper range. Unreliable sensor or
reference signals are excluded from the system control.
The redundant brake switches are checked for stuck
conditions and comparative state correlation. Detection
of faulty brake inputs results in a default condition where
the aggregate brake state indication is always on. The
remaining switch/sensor inputs are evaluated for stuck
conditions, noisy conditions, and/or continuity as typically
found in OBD II comprehensive components diagnostics.
If sensor or switch faults, which reduce the ETC system
reliability are detected, appropriate security moding
action is taken.

The data interfaces between the various sub-systems

within the powertrain controller are strictly defined and
managed through a layered architecture and an
Application Programming Interface (API) structure. Each
function that can take control of engine power through the
ETC software must pass a safety gate and an authority
limit within the safety-critical portion of the software. A
safety gate performs a simple check before accepting a
request from a specific function. For example, before a
request from cruise control is accepted, the safety-critical
software may check that vehicle speed is high enough
and the brakes are not applied.

For example, if a brake switch has failed, the cruise

control function will be disabled, and if all pedal inputs are
diagnosed to be unreliable, the engine will be forced to
idle.

Each function that can control engine power through the

ETC software is only given the authority needed to
perform its function. For example, the authority allowed
for idle speed control is limited, much like the airflow
capacity of an idle air actuator is matched to the engine
requirements. Delphi ETC uses a single actuator to
control engine airflow for all purposes, so the authority
limits that used to be in the hardware designs have been
enhanced and put into software.

Throttle Actuator Diagnostics The ETC throttle actuator

is used to control throttle position and airflow into the
engine. It is typically a DC motor driven by a bi-directional
pulse-width modulated signal (H-Bridge). Throttle
actuation diagnostics are performed to evaluate the ETC
throttle actuator and the throttle feedback mechanisms
for performance faults. Specifically, throttle actuation
diagnostics, airflow actuation, and throttle return
diagnostics are performed. Throttle actuation diagnostics
verify that the actuator is able to follow the command in
static and dynamic cases [7]. The airflow actuation
diagnostic is a rationality diagnostic which compares
airflow measured by an air flow meter (AFM) and/or a
manifold absolute pressure sensor (MAP) to throttle
position estimated airflow. Actual MAP/AFM flows

ETC Processing Diagnostics There are three specific

ETC processing checks that are performed to ensure
proper system operation: throttle authority limiting, dual
path software, and process sequencing. Throttle
authority limiting does not allow the final value of desired
throttle position to exceed a reasonable value relative to
8

indicate a problem with sensing or computing driver

intent (what the driver is requesting through the
accelerator pedal) may affect the driver command mode.
Driver command mode has three states: normal, limit
performance and forced idle. Failures that indicate a
problem with controlling engine power may affect the
power control mode. Power control mode has three
states: normal, power management, and engine
shutdown. Combined, there are six ETC operating
modes: normal, limit performance, limit performance with
power management, forced idle, forced idle with power
management, and forced engine shutdown. Each mode
and the diagnostics used to evaluate it are described
below. When the operating mode moves to a lower level
of power, it remains at that level for the remainder of the
ignition cycle. All drivers adjust to a reduced level of
engine power when one of these modes activates.
Changes to a higher level of power during driving may be
quite unexpected by the driver.

the accelerator pedal inputs and the cruise control state.

For example, 5% pedal should generally not result in a
command of 100% throttle. Throttle authority limiting
ensures that the complicated processing to determine
the throttle command is rational with respect to the pedal
input.
Dual path software computes critical values twice, using
diversified values of identical input data and diversified
implementations of the same algorithm. The
diversification is designed to allow detection of known
failure mechanisms in hardware and software by
producing a different result from the two paths. If the
results from the two paths differ by more than a tolerance
amount, a diagnostic failure is recorded. Dual path
provides the benefit of redundancy in computing critical
values without the complexity and problems associated
with performing complex computations in multiple
processors in a real time system. Finally, process
sequencing verifies that all safety-critical software is
executed in the proper order. This is important to ensure
that no processes are skipped or are receiving old data.

ETC Normal Mode This mode is selected at power-up

and will remain until a problem occurs which requires a
lower level of performance. The accelerator pedal
provides full control over engine power and all functions
are available.

Main CPU/Controller Diagnostics In addition to the

specific processing checks for ETC, many diagnostics of
the internal controller operation are performed to provide
additional detection of failures. The controller self checks
include: RAM, ROM Checksum, Stack, COP Watchdog
Timer, A/D Diagnostics, and Main and Checking CPU
input correlation. RAM verifies that all RAM and registers
return any value written to them. ROM Checksum
identifies corruption of program or calibration memory.
COP actively tests that all watchdog timers will reset the
CPU if not serviced correctly. The A/D diagnostic is the
hardware diagnostic for the analog inputs. Main vs.
checking CPU input correlation compares ETC critical
analog and discrete signals read by each processor to
ensure valid inputs and input hardware function.

ETC Limit Performance Mode This mode will set when

a reduction in the reliability of determining driver intent
has been detected or when the ability to create high
levels of engine power is impaired. Generally, this mode
will be caused by loss of accelerator pedal sensor
redundancy or internal controller faults. An example is
the case where two of three pedal sensor inputs are
unreliable. In limit performance mode, the engine power
for all pedal positions is lower, maximum engine power is
limited, engine response to increases in pedal position is
slowed, pressing the brake returns the engine to idle
power and a warning lamp for the driver may be
illuminated. Positioning of the throttle to a desired value is
maintained. It is immediately obvious to all drivers that
the engine is weak, but the vehicle is able to keep up with
normal traffic flow.

Checking CPU Processing A portion of the ETC

processing and diagnostics are repeated in the checking
CPU and continuously compared to the main processor
results. The pedal sensor processing/diagnostics and
throttle authority limit checks are duplicated in the
watchdog controller. The results are passed to the main
controller for comparison and security moding action, as
needed. The checking CPU will also take action to
disable air, fuel, or spark if severe faults are detected by
either processor. Both processors have the ability to
diagnose unacceptable system conditions and
subsequently disable air, fuel, and spark outputs
independently.

ETC Forced Idle Mode This mode will set when no

reliable information about driver intent is available.
Generally, this mode will be caused by a complete failure
of all accelerator pedal sensors (connector removed), A/
D failure or internal controller failures. The engine will
start and run at idle but will not respond to the accelerator
pedal at all. The vehicle will provide heating, cooling,
electricity and lighting, but will not be drivable.
ETC Power Management Mode This mode will set the
ETC system is unable to reliably control engine power
using the throttle. The throttle output is disabled to allow
the throttle to return to the default position[8] and engine
power is controlled using fuel and spark only. Generally,
this mode is caused by an inability to position the throttle
to the commanded value or a complete failure of all
throttle position information. In power management

ETC Security Operating Modes As failures are

detected by the diagnostics, specific actions to invalidate
inputs or disable certain functions are taken. In addition,
information from the controller diagnostics is used to
evaluate system reliability and to determine appropriate
security moding action. The actions taken change with
the operating mode of the ETC control. Failures that
9

mode, the desired engine power is determined from the

accelerator position and idle power requirements. Engine
power is reduced when needed to the desired value by
turning fuel to cylinders off and retarding spark advance.
Limit performance mode is enabled when in power
management unless forced idle mode is already active.
Vehicle response is similar to limit performance except
the maximum engine power is more severely limited
(depending upon the default throttle position setting) and,
under some conditions, should be drivable but will not be
able to accelerate with normal traffic flow or climb steep
hills. The fuel and spark control will not permit conditions
that may cause damage to the engine or emissions
system even after long periods of operation in this mode.

Throttle Command Conditioning The Delphi ETC

throttle command may be filtered and rate-limited in the
opening and closing throttle directions. Filtering and ratelimiting are beneficial to ensure consistent vehicle
response, to reduce emissions and emission variability,
to add stability to vehicle acceleration control, and to
improve transitions across the zero torque point.

ETC Engine Shutdown Mode This mode will set when

the ETC system is unable to reliably process the control
algorithms or cannot control engine power. Generally, this
mode will be caused by detection of a severe internal
processing problem in the ECM or an inability of the
intake air system or throttle body to restrict engine
airflow. Fuel, spark, and throttle outputs will be disabled
and the engine will not produce any power. The vehicle
response is the same as many other kinds of failures that
cause a loss of power, such as running out of fuel.

Compensating for highly varied driver pedal inputs,

filtering/rate-limiting reduces the variability of vehicle
responses[9]. Acceleration performance is more
repeatable and predictable and acceleration rates of
change can be controlled to improve driveline shock. This
is also helpful to reduce emissions. Controlling the rate of
change of engine airflow allows the fuel system to
maintain an air/fuel mixture closer to the optimal value,
especially for drivers that change the accelerator position
rapidly. Consistent transient response also simplifies the
calibration of good fuel control. Manufacturers benefit
from simplified calibration, reduced emissions and more
consistent vehicle response.

Diagnostic Fault Backup Controls From the discussion

of the ETC fault moding, it can be observed that the
Delphi ETC security design provides system security and
back-up controls to insure safety and retain maximum
vehicle functionality. Limited performance mode reduces
delivered engine power and rate of change of power such
that the driver can continue the trip with some system
faults. Power manage mode allows the driver to continue
even when the throttle has failed. This is possible
because the ETC throttle design differs from a
mechanical throttle in that the default position is partially
open. Maximum power available is determined by this
default position and power is reduced by decreasing fuel
delivery and/or retarding spark. Forced idle mode is
commanded when the driver intent cannot be reliably
obtained. This mode allows the use of air conditioning
and heating functions that may be required due to
adverse weather. Engine shutdown mode indicates that
serious system concerns have been identified and that it
is most secure to disable the engine.

Torque Estimator Controller Torque estimation and

control[10][11] are available for traction/stability/
transmission control and future implementations
requiring ETC and torque-based control. The torque
estimator computes torque based upon fuel and air and
delivered spark. The torque controller, when active, is
used to manage torque with air, fuel, and spark. ETC and
torque control are becoming standard equipment for
internal combustion engines and are a necessity for
many advanced engine control concepts such as lean
burn or direct injection. Delphi ETC torque management
is available today and for the future needs of
manufacturers.

CONCLUSION
BENEFITS FOR VEHICLE MANUFACTURER
For Model Year 2000, two important global vehicle
manufacturers have successfully implemented the Delphi
ETC system on several popular vehicles. The driver
benefits, strategy to ensure secure ETC function, and the
benefits to the manufacturer have been reviewed as
implemented on these applications. Delphi ETC provides
reduced cost, simplicity, and a host of features which are
an integral part of a range of advanced engine
management system solutions for today and tomorrow.

Reduced Implementation Cost The Delphi ETC system

integrates accelerator control, cruise control and idle
control into a single actuator directed by a single engine
controller. This integrated architecture simplifies
communication, reduces parts and eliminates associated
costs. System diagnostics and security are also
enhanced with the integrated design.

10

REFERENCES
1. E.S.
Mausner,
Drive-By-Wire
systems
for
commercial vehicles and passenger cars present
status and future perspective, SAE Technical Paper
No. 890478, 1989.
2. P. Ausiello, P. Nenzioni, O. Quelenis, P. Wallerand, G.
Zanon, Drive By Wire System for Fuel Economy,
Driveability and Comfort, SAE Technical Paper No.
92A228, 1992.
3. H. M. Streib, H. Bischof, Electronic Throttle Control
(ETC): A Cost Effective System for Improved
Emissions, Fuel Economy, and Driveability, SAE
Technical Paper No.960338, 1996.
4. N.
Stanton,
P.
Marsden,
Drive-By-Wiresystems:some reflections on the trend to automate
the driver role, SAE Technical SAE Technical Paper
No. 18-211-D4-267, 1997.
5. R. Amann, M. Damico, B. Green, C. Han, A. Haider,
J. Juriga, C. Mantey, 1997 General Motors 5.7 liter
LS1 V8 engine, SAE Technical SAE Technical Paper
No. 970915, 1997.
6. G. Nichols, J. Yergerlehner, Fault Tolerant
Displacement Determination Method, U.S. Patent #
5,602,732, 1997.
7. K. Keegan, Actuation Validation Algorithm, U.S.
Patent # 5,115,396, 1992.
8. R. Byram, B. Hall, K. Haltiner, Throttle Body Default
Actuation, U.S. Patent # 5,492,097, 1996.
9. G. Nichols, Limiting Rate of Change of Throttle
Position in ETC, U.S. Patent # 5,749,343, 1997.
10. P. Azzoni, D. Moro, F. Ponti, Engine and Load Torque
Estimation With Application to Electronic Throttle
Control SAE Technical Paper No.980795, 1998.
11. J. Gerhardt, H. Honninger, H Bischof, A New
Approach to Functional and Software Structure for
Engine Management Systems, SAE Technical Paper
No.980801, 1998.

11