DE102019101739B4 - Device with the ability to check an airbag ignition stage during operation - Google Patents

Abstract

Device for igniting a squib (SQ), which is intended and suitable for carrying out a method for checking the function of a safety switch (text) - with a microelectronic circuit (IC) and - with an ignition element (SQ) and - with a first ignition transistor (T1) and- with a second ignition transistor (T2) and- with a safety switch (Text) with a control input (VG2) and- with a fifth resistor (R5) and- with a node (V5) and- with a supply voltage line (Vbat) and- with a reference ground (GND) and - with a microcomputer (µC) and - with a microelectronic circuit (IC) • with a first data interface (MSPI), and • with a second data interface (SSPI), and • with a safety circuit (Safety Agent) (SA), for monitoring device functions, and • with a sensor interface, (PSI5b), and • with a feedback function block (FbFkt) that can simulate a sensor (PSS), and- whereby the supply spa Nominal line (Vbat) and the reference ground (GND) supply the device with electrical energy and- where the fifth resistor (R5) may or may not be part of the microelectronic circuit (IC) and- where the microelectronic circuit • has a transconductance amplifier (OTA) an output (VG) and • a control signal (VR) and • a control signal generating network (R1, R2) and • a storage capacity (C1) and • a first switch (S1) and • a reference voltage (Vref) and • a test current source (ITST) and • a node (V5) and • means (ADC, MUX2) for detecting the potential at the node (V5) and for detecting the potential at the output (VG) of the transconductance amplifier (OTA) and- wherein the safety switch (text) and the first ignition transistor (T1) and the ignition element (SQ) and the second ignition transistor (T2) are connected in series and- wherein the ignition element (SQ) is connected between the first ignition transistor (T1) and the second ignition transistor (T2) and- wherein the Safety switch (text) and the first ignition transistor (T1) are connected to one another via a common node (V5) and - the ignition element (SQ) is located outside the microelectronic circuit (IC) and - the safety switch (text) is located outside the microelectronic Circuit (IC) is located and- wherein the first ignition transistor (T1) is part of the microelectronic circuit (IC) and- wherein the second ignition transistor (T2) is part of the microelectronic circuit (IC) and- wherein the safety switch (text) and the ignition element (SQ) and the first ignition transistor (T1) and the second ignition transistor (T2) are arranged in series one behind the other in a common ignition current path and - the ignition element (SQ) in the common ignition current path between the first ignition transistor (T1) and the second ignition transistor (T2 ) is arranged and- wherein for an ignition of the ignition element (SQ) the safety switch (text)) and the first ignition transistor (T1) and the second Ignition transistor (T2) switched on, ie switched on, must be and- wherein the safety switch (text) and the first ignition transistor (T1) and the ignition element (SQ) and the second ignition transistor (T2) form an ignition chain and- wherein the ignition chain between the The supply voltage line (Vbat) and the reference ground (GND) are connected - where the node (V5) is located between the safety switch (text) and the first ignition transistor (T1) and - where the fifth resistor (R5) is in the node (V5) a switched-off first safety switch (Text) feeds an electrical current (I5) and- wherein the control signal generating network forms the control signal (VR) depending on the voltage between the node (V5) and the reference potential (GND); - the control signal (VR) is a first input signal of the transconductance amplifier (OTA) and - wherein the reference voltage (Vref) is a second input signal of the transconductance amplifier (OTA) and - wherein the memory ercapacitance (C1) is connected with its first connection to the output (VG) of the transconductance amplifier (OTA) and the first switch (S1) is suitable and / or intended to connect the output (VG) of the transconductance amplifier (OTA) to the To connect the control input of the safety switch (text) and - whereby the test current source (ITST) can feed a test current (ITST) into the node (V5) - the safety circuit (Safety Agent) (SA) through the first data interface (MSPI) the microcomputer (µC) is controlled and - the feedback function block (FbFkt) and the sensor interface (PSI5B) and switching between these via the second data interface (SSPI) is controlled by the microcomputer (µC) - the safety circuit (safety agent ) (SA) can influence the output signal at the output (VG) of the transconductance amplifier (OTA).

Description

Generic term

The invention is directed to a method for checking a safety switch ( T _ext ) in the ignition circuit of an airbag safety system during operation and for the simultaneous checking of the effective path from the sensor interface ( PSl5b ) up to activation ( V _G ) of the safety switch ( T _ext ). However, the invention is not restricted to this application. It can be used in a similar way in similar applications, for example belt tensioner systems, etc. Parts of the invention are of a more general nature.

General introduction

Airbag systems are used in vehicles for restraint in the event of a collision. Since these are safety-relevant devices, these devices are preferably developed according to the ISO 26262 standard. Here, the probability of a dangerous malfunction must be reduced below a predetermined level. With the disclosure presented here, some measures are presented that enable a self-test of the system during operation. This makes it possible to observe a fault, which limits the probability of a malfunction to the time between the occurrence and the visit to the workshop. In critical cases, the time between signaling and stopping is limited.

If an airbag is accidentally deployed while driving, severe injuries and even possible death of the occupants must be assumed. Therefore, a self-test must not increase the likelihood of such an incorrect trip.

In particular, such airbag systems have for igniting the detonator of the explosive device to inflate the respective airbag next to the two ignition transistors ( T ₁ , T ₂ ) an additional safety switch ( T _ext ), which must also be activated for the ignition in order to further increase safety.

From the DE 60 2004 006 973 T2 a control device for activating a vehicle safety activation element is known. The technical teaching of the DE 60 2004 006 973 T2 discloses a series circuit comprising a safety switching transistor (reference numeral 215 of DE 60 2004 006 973 T2 ) and a current regulating transistor (reference number 219 of DE 60 2004 006 973 T2 ), which the actual ignition stage consist of a first ignition transistor (reference number 205 of the DE 60 2004 006 973 T2 ) and a second ignition transistor (reference number 207 of DE 60 2004 006 973 T2 ) with energy for the ignition element (reference number 201 of the DE 60 2004 006 973 T2 ) supply. A monitoring of the functionality of these two transistors (reference numbers 219 and 215 of the DE 60 2004 006 973 T2 ) takes place according to the technical teaching of the DE 60 2004 006 973 T2 not held.

From the DE 102 55 115 B3 a control circuit for the squib of a vehicle restraint system is known. The technical teaching of the DE 102 55 115 B3 discloses a safety switching transistor (reference number 10 the DE 102 55 115 B3 ), the actual ignition stage consist of a first ignition transistor (reference number 2 the DE 102 55 115 B3 ) and a second ignition transistor (reference number 3 the DE 102 55 115 B3 ) with energy for the ignition element (reference number 1 the DE 102 55 115 B3 ) provided. Monitoring of the functionality of the safety transistor (reference number 10 the DE 102 55 115 B3 ) takes place according to the technical teaching of the DE 102 55 115 B3 not held.

From the WO 2004/087 468 A1 a control unit for a restraint system is known. The technical teaching of the WO 2004/087 468 A1 discloses an optional safety switching transistor (reference number 110 of WO 2004/087 468 A1 ), the actual ignition stage consist of a first ignition IC (reference numeral 108 of the WO 2004/087 468 A1 ) and a parallel second ignition IC (reference 107 of WO 2004/087 468 A1 ) is supplied with energy for the ignition element, not shown. A monitoring of the functionality of the safety transistor (reference number 110 of WO 2004/087 468 A1 takes place according to the technical teaching of the WO 2004/087 468 A1 not held.

From the DE 10 2005 030 770 A1 a circuit arrangement and a method for controlling a safety device for a vehicle are known. The technical teaching of the DE 10 2005 030 770 A1 discloses a safety switching transistor (reference number 6th the DE 10 2005 030 770 A1 ), the actual ignition stage consist of a first ignition transistor (reference number 4 of the DE 10 2005 030 770 A1 ) and a second ignition transistor (reference numeral 4 of the DE 10 2005 030 770 A1 ) with energy for the ignition element (reference number 7th the DE 10 2005 030 770 A1 ) provided. It is true that the output node (reference number 8) of the safety transistor (reference number 6th the DE 10 2005 030 770 A1 ) according to the technical teaching of DE 10 2005 030 770 A1 instead of. However, this monitoring is not sufficient for the requirements of ISO 26262.

From the DE 10 2010 028 544 A1 a control device for operating a safety system for a vehicle and a method for operating such a safety system for a vehicle are known. Up converter (reference AW der DE 10 2010 028 544 A1 ) and down converters (reference characters DC1 and DC2) are connected by means of different data interfaces (reference characters SPI the DE 10 2010 028 544 A1 and 1 the DE 10 2010 028 544 A1 ) controlled. The technical task can also be combined with the technical teaching of the DE 10 2010 028 544 A1 cannot be solved with the above-mentioned scriptures.

In terms of ISO26262, it must be possible to fully check whether the safety switch ( T _ext ) can actually perform all of its functions. This is not solved in the prior art.

Object of the invention

The invention is therefore based on the object of creating a solution that allows a reliable check of the entire functional chain from the sensor interface ( PSS ) to the safety switch ( T _ext ) allows.

This object is achieved by a device according to claim 1.

Solution of the problem according to the invention

The solution to the task is based on the 1 explained. The claims are decisive for the use.

• • mit einer mikroelektronischen Schaltung (IC) und
• • mit einem Zündelement (SQ) und
• • mit einem ersten Zündtransistor (T₁ ) und
• • mit einem zweiten Zündtransistor (T₂ ) und
• • mit einem Sicherheitsschalter (T_ext ) mit einem Steuereingang (V_G2 ) und
• • mit einem fünften Widerstand (R₅ ) und
• • mit einem Knoten (V₅ ) und
• • mit einer Versorgungsspannungsleitung (V_bat ) und
• • mit einer Bezugsmasse (GND) und
• • mit einem Mikrorechner (µC) und
• • mit einer mikroelektronischen Schaltung (IC)
• • mit einer ersten Datenschnittstelle, insbesondere einer ersten SPI-Schnittstelle (MSPI), und
• • mit einer zweiten Datenschnittstelle, insbesondere einer zweiten SPI-Schnittstelle (SSPI), und
• • mit einer Sicherheitsschaltung (Safety-Agent) (SA), zur Überwachung von Vorrichtungsfunktionen, und
• • mit einer Sensorschnittstelle, insbesondere einer PSI5 Sensoranbindung (PSI5b), und
• • mit einem Rückkopplungsfunktionsblock (FbFkt), der einen Sensor (PSS) simulieren kann, und
• • wobei die Versorgungsspannungsleitung (V_bat ) und die Bezugsmasse (GND) die Vorrichtung mit elektrischer Energie versorgen und
• • wobei der fünfte Widerstand (R₅ ) Teil der mikroelektronischen Schaltung (IC) sein kann oder auch nicht und
• • wobei die mikroelektronische Schaltung
  • ◯ einen Transkonduktanzverstärker (OTA) mit einem Ausgang (V_G ) und
  • ◯ einem Regelsignal (V_R ) und
  • ◯ ein Regelsignalerzeugungsnetzwerk (R₁ , R₂ ) und
  • ◯ eine Speicherkapazität (C₁ ) und
  • ◯ einen ersten Schalter (S₁ ) und
  • ◯ eine Referenzspannung (V_ref ) und
  • ◯ eine Teststromquelle (I_TST ) und
  • ◯ einem Knoten (V₅ ) und
  • ◯ Mittel (ADC, MUX2) zum Erfassen des Potenzials am Knoten (V₅ ) und zum Erfassen des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA)
  umfasst und
• • wobei der Sicherheitsschalter (T_ext ) und der erste Zündtransistor (T₁ ) und das Zündelement (SQ) und der zweite Zündtransistor (T₂ ) in Serie geschaltet sind und
• • wobei das Zündelement (SQ) zwischen dem ersten Zündtransistor (T₁ ) und dem zweiten Zündtransistor (T₂ ) geschaltet ist und
• • wobei der Sicherheitsschalter (T_ext ) und der erste Zündtransistor (T₁ ) über einen gemeinsamen Knoten (V₅ ) miteinander verbunden sind und
• • wobei das Zündelement (SQ) sich außerhalb der mikroelektronischen Schaltung (IC) befindet und
• • wobei der Sicherheitsschalter (T_ext ) sich außerhalb der mikroelektronischen Schaltung (IC) befindet und
• • wobei der erste Zündtransistor (T₁ ) Teil der mikroelektronischen Schaltung (IC) ist und
• • wobei der zweite Zündtransistor (T₂ ) Teil der mikroelektronischen Schaltung (IC) ist und
• • wobei der Sicherheitsschalter (T_ext ) und das Zündelement (SQ) und der erste Zündtransistor (T₁ ) und der zweite Zündtransistor (T₂ ) in einem gemeinsamen Zündstrompfad seriell hintereinander angeordnet sind und
• • wobei das Zündelement (SQ) in dem gemeinsamen Zündstrompfad zwischen dem ersten Zündtransistor (T₁ ) und dem zweiten Zündtransistor (T₂ ) angeordnet ist und
• • wobei für eine Zündung des Zündelements (SQ) der Sicherheitsschalter (T_ext )) und der erste Zündtransistor (T₁ ) und der zweite Zündtransistor (T₂ ) eingeschaltet, d.h. leitend geschaltet, sein müssen und
• • wobei der Sicherheitsschalter (T_ext ) und der erste Zündtransistor (T₁ ) und das Zündelement (SQ) und der zweite Zündtransistor (T₂ ) eine Zündkette bilden und
• • wobei die Zündkette zwischen die Versorgungsspannungsleitung (V_bat ) und die Bezugsmasse (GND) geschaltet ist
• • wobei der Knoten (V₅ ) sich zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ) befindet und
• • wobei der fünfte Widerstand (R₅ ) in den Knoten (V₅ ) bei einem ausgeschalteten ersten Sicherheitsschalter (T_ext ) einen elektrischen Strom (I₅ ) einspeist und
• • wobei das Regelsignalerzeugungsnetzwerk in Abhängigkeit von der Spannung zwischen dem Knoten (V₅ ) und dem Bezugspotenzial (GND) das Regelsignal (V_R ) bildet;
• • wobei das Regelsignal (V_R ) ein erstes Eingangssignal des Transkonduktanzverstärkers (OTA) ist und
• • wobei die Referenzspannung (V_ref ) ein zweites Eingangssignal des Transkonduktanzverstärkers (OTA) ist und
• • wobei die Speicherkapazität (C₁ ) mit ihrem ersten Anschluss mit dem Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) verbunden ist und
• • wobei der erste Schalter (S₁ ) dazu geeignet und/oder vorgesehen ist, den Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) mit dem Steuereingang des Sicherheitsschalters (T_ext ) zu verbinden und
• • wobei die Teststromquelle (I_TST ) einen Teststrom (I_TST ) in den Knoten (V₅ ) einspeisen kann.
• • wobei die Sicherheitsschaltung (Safety-Agent) (SA) über die erste Datenschnittstelle (MSPI) durch den Mikrorechner (µC) gesteuert wird und
• • wobei der Rückkopplungsfunktionsblock (FbFkt) und die Sensorschnittstelle (PSI5B) und die Umschaltung zwischen diesen über die zweite Datenschnittstelle (SSPI) durch den Mikrorechner (µC) gesteuert wird.
• • wobei die Sicherheitsschaltung (Safety-Agent) (SA) das Ausgangssignal am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) beeinflussen kann. Im Gegesatz zum Stand der Technik ist die erfindungsgemäße Vorrichtung somit insbesondere eine Vorrichtung mit
• • einem fünften Widerstand (R₅ ) und
• • wobei die mikroelektronische Schaltung
  • ◯ einen Transkonduktanzverstärker (OTA) mit einem Ausgang (V_G ) und
  • ◯ ein Regelsignal (V_R ) und
  • ◯ ein Regelsignalerzeugungsnetzwerk (R₁ , R₂ ) und
  • ◯ eine Speicherkapazität (C₁ ) und
  • ◯ einen ersten Schalter (S₁ ) und
  • ◯ eine Teststromquelle (I_TST ) und
  • ◯ Mittel (ADC, MUX2) zum Erfassen des Potenzials am Knoten (V₅ ) und zum Erfassen des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA)
  umfasst und
• • wobei der fünfte Widerstand (R₅ ) in den Knoten (V₅ ) bei einem ausgeschalteten ersten Sicherheitsschalter (T_ext ) einen elektrischen Strom (I₅ ) einspeist und
• • wobei das Regelsignalerzeugungsnetzwerk in Abhängigkeit von der Spannung zwischen dem Knoten (V₅ ) und dem Bezugspotenzial (GND) das Regelsignal (V_R ) bildet;
• • wobei das Regelsignal (V_R ) ein erstes Eingangssignal des Transkonduktanzverstärkers (OTA) ist und
• • wobei die Referenzspannung (V_ref ) ein zweites Eingangssignal des Transkonduktanzverstärkers (OTA) ist und
• • wobei die Speicherkapazität (C₁ ) mit ihrem ersten Anschluss mit dem Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) verbunden ist und
• • wobei der erste Schalter (S₁ ) dazu geeignet und/oder vorgesehen ist, den Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) mit dem Steuereingang des Sicherheitsschalters (T_ext ) zu verbinden und
• • wobei die Teststromquelle (I_TST ) einen Teststrom (I_TST ) in den Knoten (V₅ ) einspeisen kann.
• • wobei die Sicherheitsschaltung (Safety-Agent) (SA) über die erste Datenschnittstelle (MSPI) durch den Mikrorechner (µC) gesteuert wird und
• • wobei der Rückkopplungsfunktionsblock (FbFkt) und die Sensorschnittstelle (PSI5B) und die Umschaltung zwischen diesen über die zweite Datenschnittstelle (SSPI) durch den Mikrorechner (µC) gesteuert wird.
• • wobei die Sicherheitsschaltung (Safety-Agent) (SA) das Ausgangssignal am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) beeinflussen kann.

The invention relates to a device for igniting a squib ( SQ ), which are used to carry out a procedure for checking the functionality of a safety switch ( T _ext ) is provided and suitable

• • with a microelectronic circuit ( IC ) and
• • with an ignition element ( SQ ) and
• • with a first ignition transistor ( T ₁ ) and
• • with a second ignition transistor ( T ₂ ) and
• • with a safety switch ( T _ext ) with a control input ( V _G2 ) and
• • with a fifth resistor ( R ₅ ) and
• • with a knot ( V ₅ ) and
• • with a supply voltage line ( V _asked ) and
• • with a reference mass ( GND ) and
• • with a microcomputer ( µC ) and
• • with a microelectronic circuit ( IC )
• • with a first data interface, in particular a first SPI interface ( MSPI ), and
• • with a second data interface, in particular a second SPI interface ( SSPI ), and
• • with a safety circuit (safety agent) ( SA ), for monitoring device functions, and
• • with a sensor interface, in particular a PSI5 sensor connection ( PSI5b ), and
• • with a feedback function block ( FbFkt ), which has a sensor ( PSS ) can simulate, and
• • where the supply voltage line ( V _asked ) and the reference ground ( GND ) supply the device with electrical energy and
• • where the fifth resistor ( R ₅ ) Part of the microelectronic circuit ( IC ) may or may not be and
• • being the microelectronic circuit
  • ◯ a transconductance amplifier ( OTA ) with one output ( V _G ) and
  • ◯ a control signal ( V _R ) and
  • ◯ a control signal generation network ( R ₁ , R ₂ ) and
  • ◯ a storage capacity ( C ₁ ) and
  • ◯ a first switch ( S ₁ ) and
  • ◯ a reference voltage ( V _ref ) and
  • ◯ a test current source ( I _TST ) and
  • ◯ a knot ( V ₅ ) and
  • ◯ Medium ( ADC , MUX2) to record the potential at the node ( V ₅ ) and for recording the potential at the output ( V _G ) of the transconductance amplifier ( OTA )
  includes and
• • where the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) are connected in series and
• • where the ignition element ( SQ ) between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) is switched and
• • where the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via a common node ( V ₅ ) are connected to each other and
• • where the ignition element ( SQ ) outside the microelectronic circuit ( IC ) is located and
• • where the safety switch ( T _ext ) outside the microelectronic circuit ( IC ) is located and
• • where the first ignition transistor ( T ₁ ) Part of the microelectronic circuit ( IC ) is and
• • where the second ignition transistor ( T ₂ ) Part of the microelectronic circuit ( IC ) is and
• • where the safety switch ( T _ext ) and the ignition element ( SQ ) and the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are arranged in series one behind the other in a common ignition current path and
• • where the ignition element ( SQ ) in the common ignition current path between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) is arranged and
• • where for an ignition of the ignition element ( SQ ) the safety switch ( T _ext )) and the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) must be switched on, ie switched on, and
• • where the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) form an ignition chain and
• • where the ignition chain is between the supply voltage line ( V _asked ) and the reference ground ( GND ) is switched
• • where the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) is located and
• • where the fifth resistor ( R ₅ ) in the node ( V ₅ ) when the first safety switch is switched off ( T _ext ) an electric current ( I ₅ ) feeds and
• • where the control signal generation network depends on the voltage between the node ( V ₅ ) and the reference potential ( GND ) the control signal ( V _R ) forms;
• • where the control signal ( V _R ) a first input signal of the transconductance amplifier ( OTA ) is and
• • where the reference voltage ( V _ref ) a second input signal of the transconductance amplifier ( OTA ) is and
• • where the storage capacity ( C ₁ ) with their first connection to the output ( V _G ) of the transconductance amplifier ( OTA ) is connected and
• • where the first switch ( S ₁ ) is suitable and / or intended to use the output ( V _G ) of the transconductance amplifier ( OTA ) with the control input of the safety switch ( T _ext ) to connect and
• • where the test current source ( I _TST ) a test current ( I _TST ) in the node ( V ₅ ) can feed.
• • where the safety circuit (safety agent) ( SA ) via the first data interface ( MSPI ) through the microcomputer ( µC ) is controlled and
• • where the feedback function block ( FbFkt ) and the sensor interface (PSI5B) and switching between these via the second data interface ( SSPI ) through the microcomputer ( µC ) is controlled.
• • where the safety circuit (safety agent) ( SA ) the output signal at the output ( V _G ) of the transconductance amplifier ( OTA ) can influence. In contrast to the prior art, the device according to the invention is thus in particular a device with
• • a fifth resistor ( R ₅ ) and
• • being the microelectronic circuit
  • ◯ a transconductance amplifier ( OTA ) with one output ( V _G ) and
  • ◯ a control signal ( V _R ) and
  • ◯ a control signal generation network ( R ₁ , R ₂ ) and
  • ◯ a storage capacity ( C ₁ ) and
  • ◯ a first switch ( S ₁ ) and
  • ◯ a test current source ( I _TST ) and
  • ◯ Medium ( ADC , MUX2) to record the potential at the node ( V ₅ ) and for recording the potential at the output ( V _G ) of the transconductance amplifier ( OTA )
  includes and
• • where the fifth resistor ( R ₅ ) in the node ( V ₅ ) when the first safety switch is switched off ( T _ext ) an electric current ( I ₅ ) feeds and
• • where the control signal generation network depends on the voltage between the node ( V ₅ ) and the reference potential ( GND ) the control signal ( V _R ) forms;
• • where the control signal ( V _R ) a first input signal of the transconductance amplifier ( OTA ) is and
• • where the reference voltage ( V _ref ) a second input signal of the transconductance amplifier ( OTA ) is and
• • where the storage capacity ( C ₁ ) with their first connection to the output ( V _G ) of the transconductance amplifier ( OTA ) is connected and
• • where the first switch ( S ₁ ) is suitable and / or intended to use the output ( V _G ) of the transconductance amplifier ( OTA ) with the control input of the safety switch ( T _ext ) to connect and
• • where the test current source ( I _TST ) a test current ( I _TST ) in the node ( V ₅ ) can feed.
• • where the safety circuit (safety agent) ( SA ) via the first data interface ( MSPI ) through the microcomputer ( µC ) is controlled and
• • where the feedback function block ( FbFkt ) and the sensor interface (PSI5B) and switching between these via the second data interface ( SSPI ) through the microcomputer ( µC ) is controlled.
• • where the safety circuit (safety agent) ( SA ) the output signal at the output ( V _G ) of the transconductance amplifier ( OTA ) can influence.

The device according to the invention is preferably in a micro-integrated electronic circuit ( IC ) and their outside space ( EXT ) divided. The exemplary limit is in the exemplary 1 shown in dashed lines.

The core of the device is the ignition element ( SQ ), which is in the outer space ( EXT ) outside of the micro-integrated electronic circuit ( IC ) is located. In air bag systems, the ignition element ( SQ ) to detonate the explosive device for the deployment of the air bag.

The ignition chain consists of an external safety switch ( T _ext ), typically in the form of a MOS transistor or a similar semiconductor switch, as well as a first ignition transistor ( T ₁ ) and a second ignition transistor ( T ₂ ). The external safety switch ( T _ext ) is typically located outside ( EXT ). The first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are typically part of the micro-integrated electronic circuit ( IC ). The ignition element ( SQ ) is between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) arranged so that both have to switch through to activate the ignition element ( SQ ) and initiate the deployment of the air bag sack. To further increase safety, the external safety switch ( T _ext ) to this series connection of the first ignition transistor ( T ₁ ), Ignition element ( SQ ) and the second ignition transistor ( T ₂ ) also connected in series so that all three transistors ( T ₁ , T ₂ , text ) have to switch through to activate the ignition element ( SQ ) to activate.

The chain of safety switches ( T _ext ), first ignition transistor ( T ₁ ), Ignition element ( SQ ) and the second ignition transistor ( T ₂ ) is typically between the supply voltage line ( V _asked ), which is preferably at supply voltage potential, and reference ground ( GND ) switched.

The knot ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) is hereinafter referred to as V5 potential ( V ₅ ) designated.

The control electrodes of the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are controlled by a control circuit ( CTR ) controlled.

A fifth resistance ( R ₅ ) ensures that when the first safety switch ( T _ext ) a sufficient, very low current ( I ₅ ) from the supply voltage line ( V _asked ) through a first voltage divider ( R ₁ , R ₂ ) from a first resistance ( R ₁ ) and a second resistor ( R ₂ ) flows. The voltage divider from the first resistor ( R ₁ ) and second resistor ( R ₂ ) has the control signal ( V _R ) on. The negative input of a transconductance amplifier ( OTA ) is with this control signal ( V _R ) connected. Through the fifth resistance ( R ₅ ) ensures that the transconductance amplifier ( OTA ) even then a usable control signal ( V _R ) when the safety switch ( T _ext ) is open. The transconductance amplifier ( OTA ) then delivers at its output ( V _G ) an output current ( I _G ), which depends on the difference in the voltage value of the control signal ( V _R ), which is the output signal of the voltage divider ( R ₁ , R ₂ ) from first resistance ( R ₁ ) and second resistor ( R ₂ ) is to a reference voltage ( V _ref ) depends. With the output current generated in this way ( I _G ) of the transconductance amplifier ( OTA ) a storage capacity ( C ₁ ) at the output of the transconductance amplifier ( OTA ) charged or discharged. In the example, a first connection of the storage capacity ( C ₁ ) with the output of the transconductance amplifier ( OTA ) and the second connection of the storage capacity ( C ₁ ) with a reference potential (here GND ). A first switch ( S ₁ ), which is typically a MOS transistor or the like, the potential at the first connection of the storage capacitance ( C ₁ ) with the control electrode of the safety switch ( T _ext ) connect. As a rule, the safety switch ( T _ext ) a parasitic gate-source capacitance, which is not shown here and which when the first switch is open ( S ₁ ) the gate-source voltage of the safety switch ( T _ext ) still holds for a typically sufficient time. The first switch ( S ₁ ) is used in the example 1 through a microcomputer ( µC ) controlled by means of an exemplary switch control signal (µC ₁ ). The output current ( I _G ) of the transconductance amplifier ( OTA ) can by a safety circuit ( SA ), generally as " Safety Agent ", additionally and preferably controlled with higher priority. The safety circuit ( SA ) via a corresponding on / off signal ( ON_REG ) of the transconductance amplifier ( OTA ) the output current ( I _G ) of the transconductance amplifier ( OTA ) in its output node ( V _G ) must be set to zero and thereby switch off the control. The potential of the control electrode of the external safety switch ( T _ext ) is typically retained for a certain time, since then the parasitic gate-source capacitance of the external safety switch ( T _ext ) between the control electrode of the external safety switch ( T _ext ) and the node ( V ₅ ) with V5 potential between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) maintains the gate-source voltage for a short time.

The micro-integrated circuit ( IC ) preferably has two SPI interfaces: A first SPI interface ( MSPI ) with a first SPI bus ( SPI ) for controlling the microcomputer within the micro-integrated circuit ( IC ) and a second SPI interface ( SSPI ) with a second SPI bus ( SPI2 / PSI5d ) for controlling the sensor interfaces within the micro-integrated circuit ( IC ).

The first SPI bus ( SPI ) is used to configure the micro-integrated circuit ( IC ) as well as reading and writing the registers etc.

The second SPI bus ( SSPI ) is used to control the data path of the sensors excluding the safety circuit ( SA ) (Safety agent). The safety circuit ( SA ) (Safety agent) is according to the invention via a first other signal path ( CS , MSPI , SPI ) from other signals ( CS , SPI ) and assemblies ( MSPI ) controlled as the second signal path ( SPI2 / PSI5d , SSPI , [ CS2 ] or [ SPI2 / PSI5d , SSPI , [ SI3 ], FbFkt, [Diag], MUX ]) of the sensors. The safety circuit ( SA ) (Safety Agent) is only used via the first SPI interface ( MSPI ) controlled. The safety circuit ( SA ) by the way, preferentially hears communication only on the second SPI bus ( SSPI ) with and compares the complete, physical SPI data frame (English: SPI frame) and / or data frame sequences with those from the safety circuit ( SA ) determined expected values and / or expected value sequences.

With the first SPI bus ( SPI ) the configuration of the SA (and the rest of the circuit) is done. The SA in this case only receives the forwarding of decoded control signals.

A PSIS sensor system outside of the micro-integrated circuit ( PSS ) with a PSI5 sensor connection ( PSI5b ) is via a multiplexer ( MUX ) with the PSI5 interface ( PSI5IF ) connected. The PSI5 interface ( PSI5IF ) typically has several PSI5 sensor connection options. In the exemplary case of 1 this is an example of a first PSIS sensor connection ( PSI5a ) and a second PSIS sensor connection ( PSI5b ). Further sensor connections can also be provided. Using a multiplexer ( MUX ) the exemplary PSI5 signal ( PSI5b ) of the exemplary PSI5 sensor ( PSS ) by a synthesized test signal from a feedback function block simulating this sensor ( FbFkt ), which in the example of the 1 the multiplexer ( MUX ) by means of a toggle signal ( Diag ) controls by way of example. The feedback function block ( FbFkt ) is used in the example 1 via the second SPI bus ( SPI2 , PSI5d ) and the second SPI interface ( SSPI ) controlled. In this way the microcomputer ( µC ) simulate given test cases and the reaction of the system within the micro-integrated circuit ( IC ) check.

The safety circuit ( SA ) sends an ARM signal when checking the PSI5 interface if predefined boundary conditions are present ( POOR ) to the microcomputer ( µC ), which then causes predetermined reactions.

The safety circuit (PA) allows the potential at the control electrode of the safety switch ( T _ext ) through the transconductance amplifier ( OTA ) via the on / off signal ( ON_REG ) of the transconductance amplifier ( OTA ) only under predetermined conditions.

Via a third control signal ( CS3 ) the microcomputer ( µC ) via the first SPI bus ( SPI ) and the first SPI interface ( MSPI ) an analog-to-digital converter ( ADC ) and typically read out its measured values. The analog-to-digital converter ( ADC ) can use a second multiplexer (MUX2) different nodes within the micro-integrated circuit ( IC ) measured. In particular, it is suggested that the output ( V _G ) of the transconductance amplifier ( OTA ) and the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) with V5 potential in this way for the microcomputer to measure.

The procedure suggested below can now be used to check whether the external safety switch ( T _ext ) can perform its function.

• • Messung des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC);
• • Messung des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ) über den Analog-zu-Digitalwandler (ADC);
• • Öffnen des ersten Schalters (S₁ ). Hierdurch beginnt der Sicherheitsschalter (T_ext ) zu floaten. D.h. seine Anschlüsse folgen den Bewegungen des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ).
• • Einspeisen eines Teststroms (i_TST ) mittels einer Teststromquelle (I_TST ) in den Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ). Hierdurch verschiebt sich das V5 Potenzial des Knotens (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ );
• • Messung des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zugehörigen ersten V5-Spannungswertes;
• • Messung des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines ersten zugehörigen Regelspannungswertes;
• • Vergleich des Betrags des ersten V5-Spannungswertes mit dem Betrag des ersten Regelspannungswertes und Ermittlung eines ersten Vergleichsergebnisses;
• • Schließen auf einen Fehler, wenn der Betrag des ersten V5-Spannungswertes über dem Betrag des ersten Regelspannungswertes liegt; (Liegt die Reglerspannung, also der erste Regelspannungswert, beispielsweise bei 21,7V, so können je nach Konstruktion beispielsweise 19V für das V5-Potenzial in diesem Schaltzustand erwartet werden.)
• • Schließen des ersten Schalters (S₁ );
• • Ggf. Abwarten einer Verzögerungszeit (T) zur Einregelung des V5-Potenzials durch den Transkonduktanzverstärker (OTA);
• • Messung des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zugehörigen zweiten V5-Spannungswertes;
• • Messung des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zweiten zugehörigen Regelspannungswertes;
• • Vergleich des Betrags des zweiten V5-Spannungswertes am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext ) und dem ersten Zündtransistor (T₁ ) gegen Bezugsmasse (GND) mit dem Betrag des zweiten Regelspannungswertes und Ermittlung eines zweiten Vergleichsergebnisses;
• • Schließen auf einen Fehler, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht. Der Toleranzbereich sollte in der Konstruktionsphase den jeweiligen Bedingungen der Anwendung angepasst werden. Dies kann beispielsweise durch Simulation kritischer Fälle geschehen. Mittels des Analog-zu-Digital-Wandlers (ADC) überprüft dann der Mikrorechner (µC), ob beispielsweise das Potenzial am Knoten V₅ gegen Bezugsmasse (GND) auf einen beispielhaften Zielwert 21,7V geregelt wurde.

As a first possibility of such a method, a method with the following steps is proposed:

• • Measurement of the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) via the analog-to-digital converter ( ADC );
• • Measurement of the V5 potential at the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via the analog-to-digital converter ( ADC );
• • Open the first switch ( S ₁ ). This starts the safety switch ( T _ext ) to float. Ie its connections follow the movements of the V5 potential at the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ).
• • Feeding in a test current ( i _TST ) using a test current source ( I _TST ) in the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ). This shifts the V5 potential of the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ );
• • Measurement of the V5 potential at the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via the analog-to-digital converter ( ADC ) and determining an associated first V5 voltage value;
• • Measurement of the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) via the analog-to-digital converter ( ADC ) and determining a first associated control voltage value;
• • Comparison of the magnitude of the first V5 voltage value with the magnitude of the first control voltage value and determination of a first comparison result;
• • Inferring that there is a fault if the magnitude of the first V5 voltage value is greater than the magnitude of the first control voltage value; (If the controller voltage, i.e. the first control voltage value, is 21.7V, for example, 19V can be expected for the V5 potential in this switching state, depending on the design.)
• • Close the first switch ( S ₁ );
• • If necessary, waiting for a delay time (T) to regulate the V5 potential by the transconductance amplifier ( OTA );
• • Measurement of the V5 potential at the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via the analog-to-digital converter ( ADC ) and determining an associated second V5 voltage value;
• • Measurement of the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) via the analog-to-digital converter ( ADC ) and determining a second associated control voltage value;
• • Comparison of the magnitude of the second V5 voltage value at the node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) against reference ground ( GND ) with the magnitude of the second control voltage value and determination of a second comparison result;
• • Conclusion of an error if the magnitude of the second V5 voltage value differs from the magnitude of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or more than +/- 10% and / or more than +/- 25%. The tolerance range should be adapted to the respective conditions of the application in the design phase. This can be done, for example, by simulating critical cases. Using the analog-to-digital converter ( ADC ) then the microcomputer checks ( µC ) whether, for example, the potential at the node V ₅ against reference ground ( GND ) was regulated to an exemplary target value of 21.7V.

The safety circuit ( SA ) (Safety agent) in the most general variant listens to the SPI communication between the microcomputer ( µC ) and the micro-integrated circuit ( IC ) on the SPI buses ( SPI , SPI2 ) With. In the preferred implementation, however, the safety circuit ( SA ) (Safety agent) the SPI communication between the microcomputer ( µC ) and the micro-integrated circuit ( IC ) only on the second SPI bus ( SPI2 ) With. The corresponding connections are in 1 not shown. The decisions are made by the safety circuit ( SA ) (Safety Agent) in an analogous manner and independently of the rest of the circuit, whereby the safety circuit ( SA ) (Safety Agent) is able to determine expected values and expected value sequences and to compare these with what is happening in the integrated circuit. A test state must be specially activated so that the safety circuit prevents faulty triggering through a self-test.

The advantage of simulating the sensor ( PSS ) using the feedback function block ( FbFkt ) is that the circuit is without a connected sensor ( PSS ) or external components can be tested without violating the safety requirements.

In this context, reference is made to the disclosed property right registrations DE 10 2018 107 449 A1 , DE 10 2018 107 452 A1 , DE 10 2018 107 438 A1 , DE 10 2018 107 441 A1 , DE 10 2018 107 446 A1 and DE 10 2018 107 448 A1 as well as the undisclosed property right registrations 10 2018 107 451.4 and 10 2018 107 455.7, which are fully part of the disclosure.

Advantage of the invention

The method presented here and the corresponding device allow the simulation of permissible and incorrect sensor behavior by emulating the sensor interface, whereby the output of the transconductance amplifier ( OTA ) can be assessed during operation without the ignition device igniting ( SQ ) can come. Furthermore, a safe functional check of the safety switch ( T _ext ) possible during operation. Since two different data paths are used, the effective path can be checked completely without causing accidental triggering by a single fault in the circuit.

Features of the invention

The basis of the invention is a device for igniting a squib ( SQ ), which are used to carry out the procedure described below for checking the function of a safety switch ( T _ext ) is provided and suitable. It is a device with a microelectronic circuit ( IC ), with an ignition element ( SQ ), with a first ignition transistor ( T ₁ ), with a second ignition transistor ( T ₂ ), with a safety switch ( T _ext ), which has a control input ( V _G2 ), with a fifth resistor ( R ₅ ), with a knot ( V ₅ ), with a supply voltage line ( V _asked ) and with a reference mass ( GND ). The supply voltage line ( V _asked ) and the reference ground ( GND ) supply the device with electrical energy. The fifth resistance ( R ₅ ) can be part of the microelectronic circuit ( IC ) be or not. The microelectronic circuit typically includes a transconductance amplifier ( OTA ) with one output ( V _G ), a control signal ( V _R ), a control signal generation network ( R ₁ , R ₂ ), which is preferably a first voltage divider from a first resistor ( R ₁ ) and a second resistor ( R ₂ ) with the control signal ( V _R ) than its output is a storage capacity ( C ₁ ), a first switch ( S ₁ ), a reference voltage ( V _ref ), a test current source ( I _TST ), a knot ( V ₅ ) and medium ( ADC , MUX2) to record the potential at the node ( V ₅ ) and for recording the potential at the output ( V _G ) of the transconductance amplifier ( OTA ). With the means for recording the potential at the node ( V ₅ ) and for recording the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) it is preferably an analog-to-digital converter ( ADC ), which via a multiplexer (MUX2) different potentials within the microelectronic circuit ( IC ) and which can be recorded by an external microcomputer ( µC ) can be controlled and read out. The safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) are connected in series. The ignition element ( SQ ) is between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) switched. The safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) are via a common node ( V ₅ ) connected with each other. The ignition element ( SQ ) is preferably located outside the microelectronic circuit ( IC ). The safety switch ( T _ext ) is preferably located outside the microelectronic circuit ( IC ). The first ignition transistor ( T ₁ ) is part of the microelectronic circuit ( IC ). The second ignition transistor ( T ₂ ) is part of the microelectronic circuit ( IC ). The safety switch ( T _ext ) and the ignition element ( SQ ) and the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are arranged in series one behind the other in a common ignition current path. The ignition element ( SQ ) is in the common ignition current path between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) arranged. For an ignition of the ignition element ( SQ ) the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) must be switched on, ie switched on, at the same time. The safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) form an ignition chain. The term ignition chain refers to the serial connection. This ignition chain is between the supply voltage line ( V _asked ) and reference ground ( GND ) switched. The knot ( V ₅ ) is located between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ). The fifth resistance ( R ₅ ) feeds into the node ( V ₅ ) when the first safety switch is switched off ( T _ext ) an electric current ( I ₅ ), which affects the operability of the control signal generation network ( R ₁ , R ₂ ) in this state. The control signal generation network ( R ₁ , R ₂ ) forms depending on the voltage between the node ( V ₅ ) and the reference potential ( GND ) the control signal ( V _R ). This control signal ( V _R ) is a first input signal of the transconductance amplifier ( OTA ). The reference voltage ( V _ref ) is a second input signal of the transconductance amplifier ( OTA ). The storage capacity ( C ₁ ) is first connected to the output ( V _G ) of the transconductance amplifier ( OTA ) connected and integrated the output current ( I _G ) of the transconductance amplifier ( OTA ) minus the leakage currents. The storage capacity ( C ₁ ) it can also be a network of components with a capacitive or integrating effect that at least temporarily behaves functionally similar to an ideal capacitance. The first switch ( S ₁ ) is suitable and / or intended to use the output ( V _G ) of the transconductance amplifier ( OTA ) with the Control input of the safety switch ( T _ext ) connect to. The test current source ( I _TST ) can preferably be initiated by a controller ( CTR ) or an external microcomputer ( µC ) a test current ( i _TST ) in the node ( V ₅ ) feed.

In addition to these features, the invention also includes a structuring of the data communication that is necessary to prevent activation due to a data error. This structuring has a more general character. This partial invention relates to a safety-relevant device for use in vehicles, in particular an airbag ignition system with a microcomputer ( µC ), a microelectronic circuit ( IC ), a first data interface, in particular with a first SPI interface ( MSPI ), a second data interface, in particular with a second SPI interface ( SSPI ), a safety circuit (safety agent) ( SA ), for monitoring device functions, with a sensor interface, in particular a PSI5 sensor connection ( PSI5b ), and with a feedback function block ( FbFkt ), which has a sensor ( PSS ) can simulate. The safety circuit (safety agent) ( SA ) is transmitted via the first data interface ( MSPI ) through the microcomputer ( µC ) controlled. The feedback function block ( FbFkt ) and the sensor interface (PSI5B) and switching between these is carried out via the second data interface ( SSPI ) through the microcomputer ( µC ) controlled. In a further embodiment of this partial invention, the safety circuit (safety agent) ( SA ) the output signal at the output ( V _G ) of the transconductance amplifier ( OTA ) influence. This allows the safety circuit to rule out incorrect ignition when the system is tested.

The invention further comprises a method according to the invention for checking the functionality of a safety switch ( T _ext ) in an airbag ignition system. For this, the airbag ignition system must have a safety switch ( T _ext ) with a control electrode ( V _G2 ), a first ignition transistor ( T ₁ ), a second ignition transistor ( T ₂ ), an ignition element ( SQ ), a transconductance amplifier ( OTA ) with one output ( V _G ) and a first switch ( S ₁ ) include.

• • (1) Start
• • (2) Messung des Potenzials am Ausgang (V_G );
• • (3) Messung des V5-Potenzials des Knotens (V5);
• • (4) Öffnen des ersten Schalters (S₁ );
• • (5) Einspeisen eines zusätzlichen Teststroms (i_TST ) in den Knoten (V5);
• • (6) Messung des V5-Potenzials am Knoten (V5) und Ermittlung eines zugehörigen ersten V5-Spannungswertes;
• • (7) Messung des Potenzials am Ausgang (VG) des Transkonduktanzverstärkers (OTA) und Ermittlung eines ersten zugehörigen Regelspannungswertes;
• • (8) Vergleich des Betrags des ersten V5-Spannungswertes mit dem Betrag des ersten Regelspannungswertes und Ermittlung eines ersten Vergleichsergebnisses;
• • (9) Schließen auf einen Fehler, wenn der Betrag des ersten V5-Spannungswertes über dem Betrag des ersten Regelspannungswertes liegt.
• • (10) Schließen auf eine Fehlerfreiheit, wenn der Betrag des ersten V5-Spannungswertes unter dem Betrag des ersten Regelspannungswertes liegt oder um nicht mehr als ein vorgegebener Toleranzwert von dem Betrag des ersten Regelspannungswertes abweicht, was im Sinne dieser Offenlegung noch als ein unter dem Betrag des ersten Regelspannungswertes liegen bewertet wird.
• • (11) Ende.

The first switch ( S ₁ ) can output ( V _G ) of the transconductance amplifier ( OTA ) with the control electrode ( V _G2 ) of the safety switch ( T _ext ) electrically connect and can disconnect such a connection. The safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) are connected in series. The ignition element ( SQ ) is between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) switched. The safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) are via a common node ( V ₅ ) connected with each other. The procedure (see example 2 ) comprises at least the following steps:

• • (1) Start
• • (2) Measurement of the potential at the output ( V _G );
• • (3) measurement of the V5 potential of the node (V5);
• • (4) Open the first switch ( S ₁ );
• • (5) Feeding in an additional test current ( i _TST ) in the node (V5);
• • (6) measurement of the V5 potential at the node (V5) and determination of an associated first V5 voltage value;
• • (7) Measurement of the potential at the output (VG) of the transconductance amplifier ( OTA ) and determining a first associated control voltage value;
• • (8) Comparison of the amount of the first V5 voltage value with the amount of the first control voltage value and determination of a first comparison result;
• • (9) Conclusion of an error if the magnitude of the first V5 voltage value is greater than the magnitude of the first control voltage value.
• • (10) Conclusion that there is no error if the amount of the first V5 voltage value is below the amount of the first control voltage value or does not deviate from the amount of the first control voltage value by more than a specified tolerance value, which in the sense of this disclosure is still considered to be below the The amount of the first control voltage value is evaluated.
• • (11) end.

• • (12) Schließen des ersten Schalters (S₁ );
• • (13) Optionales Abwarten einer Verzögerungszeit (T) zur Einregelung des V5-Potenzials durch den Transkonduktanzverstärker (OTA);
• • (14) Messung des V5-Potenzials am Knoten (V5) und Ermittlung eines zugehörigen zweiten V5-Spannungswertes;
• • (15) Messung des Potenzials am Ausgang (VG) des Transkonduktanzverstärkers (OTA) und Ermittlung eines zweiten zugehörigen Regelspannungswertes;
• • (16) Vergleich des Betrags des zweiten V5-Spannungswertes mit dem Betrag des zweiten Regelspannungswertes und Ermittlung eines zweiten Vergleichsergebnisses;
• • (17) Schließen auf einen Fehler, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht.
• • (18) Schließen auf eine Fehlerfreiheit, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um nicht mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht.
• • (11) Ende (nicht zusätzlich).

A refined procedure (see example 3 ), which is based on the procedure described immediately above, includes the additional steps:

• • (12) Closing the first switch ( S ₁ );
• • (13) Optional waiting for a delay time (T) for regulating the V5 potential by the transconductance amplifier ( OTA );
• • (14) Measurement of the V5 potential at the node (V5) and determination of an associated second V5 voltage value;
• • (15) Measurement of the potential at the output (VG) of the transconductance amplifier ( OTA ) and determining a second associated control voltage value;
• • (16) comparison of the magnitude of the second V5 voltage value with the magnitude of the second control voltage value and determination of a second comparison result;
• • (17) Inferring an error if the magnitude of the second V5 voltage value differs from the magnitude of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5 % and / or more than +/- 10% and / or more than +/- 25%.
• • (18) Inferring that there is no error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by no more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or more than +/- 10% and / or more than +/- 25%.
• • (11) end (not additional).

The basis of the invention thus consists of a method for igniting a squib, which is initially characterized by a few technical features.

A first and a second ignition transistor ( T ₁ ; T ₂ ), a safety switch ( T _ext ), a transconductance amplifier ( OTA ) and a resistor ( R ₅ ) again, which are crucial for the invention. The transconductance amplifier ( OTA ) also has an output ( V _G ), the safety switch ( T _ext ) has a control electrode and is connected in series with the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) and the ignition element ( SQ ), whereby the connection between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via a node ( V ₅ ) he follows.

In addition, the resistance ( R ₅ ) between the supply potential and the nodes ( V ₅ ) switched.

Thus, after isolating the control electrode of the safety switch ( T _ext ) opposite the exit ( V _G ) and the subsequent injection of a test current ( i _TST ) in the node ( V ₅ ) a measurement of the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) which have the consequence that a first control voltage value is determined.

The measurement of a V5 potential at the node ( V ₅ ) then supplies a first V5 voltage value. The control electrode of the safety switch ( T _ext ) with the output ( V _G ) connected.

The next step is again a measurement of the V5 potential at the node ( V ₅ ), which results in the determination of a second V5 voltage value. In addition, there is a measurement of the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) instead of. This in turn determines a second control voltage value.

It is always concluded that there is a fault if the amount of the first V5 voltage value is above the amount of the first control voltage set. An error is also concluded if, after a comparison result has been determined between the second V5 voltage value and the second control voltage value, a deviation of more than +/- 1% and / or more than +/- 2% and / or more than + / -5% and / or more than +/- 10% and / or more than +/- 25% occurs.

In a second process, which is technically characterized in that a first and a second ignition transistor ( T ₁ ; T ₂ ), a safety switch ( T _ext ), a transconductance amplifier ( OTA ) and a resistor ( R ₅ ) available. The transconductance amplifier ( OTA ) also has an output ( V _G ), the safety switch ( T _ext ) has a control electrode and is connected in series with the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) and the ignition element ( SQ ), whereby the connection between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via a node ( V ₅ ) he follows.

In addition, the resistance ( R ₅ ) between the supply potential and the nodes ( V ₅ ) switched.

After isolating the control electrode of the safety switch ( T _ext ) opposite the exit ( V _G ) and the subsequent injection of a test current ( i _TST ) in the node ( V ₅ ) the potential is measured at the output ( V _G ) of the transconductance amplifier ( OTA ) and the determination of a first control voltage value.

The measurement of a V5 potential at the node ( V ₅ ) then supplies a first V5 voltage value. It is always concluded that there is a fault if the amount of the first V5 voltage value is above the amount of the first control voltage set.

In a third process, which is technically characterized in that a first and a second ignition transistor ( T ₁ ; T ₂ ), a safety switch ( T _ext ), a transconductance amplifier ( OTA ) and a resistor ( R ₅ ) available. The transconductance amplifier ( OTA ) also has an output ( V _G ), the safety switch ( T _ext ) has a control electrode and is connected in series with the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) and the ignition element ( SQ ), whereby the connection between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) via a node ( V ₅ ) he follows.

In addition, the resistance ( R ₅ ) between the supply potential and the nodes ( V ₅ ) switched.

The control electrode of the safety switch ( T _ext ) with the output ( V _G ) connected.

The next step is a measurement of the V5 potential at the node ( V ₅ ) which results in the determination of a second V5 voltage value. In addition, there is a measurement of the potential at the output ( V _G ) of the transconductance amplifier ( OTA ) instead of. This in turn determines a second control voltage value.

An error is always concluded if the magnitude of the first V5 voltage value is greater than the magnitude of the first control voltage value. It is also concluded that there is an error if, after determining a comparison result between the second V5 voltage value and the second regulator voltage value, there is a deviation of more than +/- 1% and / or more than +/- 2% and / or more than + / -5% and / or more than +/- 10% and / or more than +/- 25% occurs.

Figure list

• 1 shows schematically simplified a proposed device.
• 2 shows the basic procedure for testing the safety switch ( T _ext ).
• 3 shows the refined procedure for testing the safety switch ( T _ext ).

List of reference symbols

1

Process step 1 : Begin;

2

Process step 2 : Measurement of the potential at the output ( V _G );

3

Process step 3 : Measurement of the V5 potential of the node (V5);

4th

Process step 4th : Opening the first switch ( S ₁ );

5

Process step 5 : Feeding in an additional test current ( i _TST ) in the node (V5);

6

Process step 6th : Measurement of the V5 potential at the node (V5) and determination of an associated first V5 voltage value;

7th

Process step 7th : Measurement of the potential at the output (VG) of the transconductance amplifier ( OTA ) and determining a first associated control voltage value;

8th

Process step 8th : Comparison of the magnitude of the first V5 voltage value with the magnitude of the first control voltage value and determination of a first comparison result;

9

Process step 9 : Inferring a fault if the magnitude of the first V5 voltage value is above the magnitude of the first control voltage value;

10

Process step 10 : Inferring that the first V5 voltage value is free of errors if the amount of the first V5 voltage value is below the amount of the first control voltage value or does not deviate from the amount of the first control voltage value by more than a specified tolerance value, which in the sense of this disclosure is still considered to be below the amount of the first Control voltage values are evaluated;

11

Process step 11 : The End;

12

Process step 12 : Closing the first switch ( S ₁ );

13

Process step 13 : Optional waiting for a delay time (T) to regulate the V5 potential by the transconductance amplifier ( OTA );

14th

Process step 14th : Measurement of the V5 potential at the node (V5) and determination of an associated second V5 voltage value;

15th

Process step 15th : Measurement of the potential at the output (VG) of the transconductance amplifier ( OTA ) and determining a second associated control voltage value;

16

Process step 16 : Comparison of the magnitude of the second V5 voltage value with the magnitude of the second control voltage value and determination of a second comparison result;

17th

Process step 17th : Conclusion of an error if the magnitude of the second V5 voltage value differs from the magnitude of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates by more than +/- 10% and / or more than +/- 25%;

18th

Process step 18th : Inferring that there is no error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by no more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates more than +/- 10% and / or more than +/- 25%;

ADC

Analog-to-digital converter;

POOR

Arm signal from the safety circuit to the microcomputer ( µC );

C ₁

Storage capacity;

CS

first control signal to control the safety circuit ( SA ) via the first SPI interface ( MSPI ) and the first SPI bus ( SPI ) through the microcomputer ( µC );

CS2

second control signal for controlling the PSI5 interface ( PSI5IF ) via the second SPI interface ( SSPI ) and the second SPI bus ( SPI2 / PSI5d ) through the microcomputer ( µC );

CS3

third control signal for controlling the analog-to-digital converter ( ADC ) via the first SPI interface ( MSPI ) and the first SPI bus ( SPI ) through the microcomputer ( µC );

CTR

Control circuit;

Diag

Switching signal;

EXT

External space of the micro-integrated electronic circuit;

FbFkt

Feedback function block;

GND

Reference ground;

I ₅

Current through the fifth resistor ( R ₅ );

IC

micro-integrated electronic circuit;

I _G

Output current of the transconductance amplifier ( OTA );

I _TST

Test current source;

i _TST

Test current of the test current source ( I _TST );

µC

Microcomputer;

µC1

Control line with that of the microcomputer ( µC ) the first switch ( S ₁ ) controls;

MSPI

first SPI interface on the first SPI bus ( SPI ), which here exemplify the non-sensor part of the micro-integrated circuit ( IC ) with the microcomputer ( µC ) connects and makes it controllable through it;

MUX

Multiplexer;

ON_REG

On / off signal for the transconductance amplifier;

OTA

Transconductance amplifier. When switched on, the transconductance amplifier supplies an output current ( I _G ), which is proportional to the voltage difference at its two inputs (+, -). Via an on-off signal ( ON_REG ) the transconductance amplifier can be switched on and off. The transconductance amplifier supplies an output current when switched off ( I _G ), which is essentially zero except for parasitic currents;

PSI5a

first PSI5 sensor connection;

PSI5b

second PSI5 sensor connection;

PSI5IF

PSI5 interface;

PSS

PSI5 sensor system;

R ₁

first resistor, the part of the first voltage divider ( R ₁ , R ₂ ) is;

R ₂

second resistor, the part of the first voltage divider ( R ₁ , R ₂ ) is;

R ₃

third resistance;

R ₄

fourth resistance;

R ₅

fifth resistance;

S ₁

first switch. The first switch is represented by the example in 1 marked microcomputer ( µC ) controlled via an associated control line (µC ₁ ).

SA

Safety circuit (safety agent);

SI3

fourth control signal for controlling the feedback function block ( FbFkt ) via the second SPI interface ( SSPI ) and the second SPI bus ( SPI2 / PSI5d ) through the microcomputer ( µC );

SPI

first SPI bus. Instead of an SPI bus, other data bus standards can also be used.

SPI2 / PSI5d

second SPI bus. Instead of an SPI bus, other data bus standards such as PSI5 can also be used.

SSPI

second SPI interface on the second SPI bus (SPI2 / PSI5), which here is an example of the sensor part of the micro-integrated circuit ( IC ) with the microcomputer ( µC ) connects;

SQ

Ignition element;

T ₁

first ignition transistor;

T ₂

second ignition transistor;

text

Safety switch.

V ₅

Node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) with V5 potential;

Vbat

Supply voltage line, which is typically at supply voltage potential;

V _G

Output of the transconductance amplifier ( OTA );

V _G2

Control input of the safety switch ( T _ext );

V _R

Control signal. The control signal is preferably the output signal of the first voltage divider ( R ₁ , R ₂ );

V _ref

Reference voltage;

Claims (1)

Device for igniting a squib (SQ) which is intended and suitable for carrying out a method for _checking the function of a safety _switch (T _ext ) - with a microelectronic circuit (IC) and - with an ignition element (SQ) and - with a first ignition transistor (T ₁ ) and - with a second ignition transistor (T ₂ ) and - with a safety _switch (T _ext ) with a control input (V _G2 ) and - with a fifth resistor (R ₅ ) and - with a node (V ₅ ) and - with a supply voltage line (V _bat ) and - with a reference ground (GND) and - with a microcomputer (µC) and - with a microelectronic circuit (IC) • with a first data interface (MSPI), and • with a second data interface (SSPI), and • with a safety circuit (Safety Agent) (SA) for monitoring device functions, and • with a sensor interface (PSI5b), and • with a feedback function block (FbFkt) that can simulate a sensor (PSS) n, and - where the supply voltage line (V _bat ) and the reference ground (GND) supply the device with electrical energy and - where the fifth resistor (R ₅ ) may or may not be part of the microelectronic circuit (IC) and - where the microelectronic Circuit • a transconductance amplifier (OTA) with an output (V _G ) and • a control signal (V _R ) and • a control signal generating network (R ₁ , R ₂ ) and • a storage capacity (C ₁ ) and • a first switch (S ₁ ) and • a reference voltage (V _ref ) and • a test current source (I _TST ) and • a node (V ₅ ) and • means (ADC, MUX2) for detecting the potential at the node (V ₅ ) and for detecting the potential at the output ( V _G ) of the transconductance amplifier (OTA) comprises and - wherein the safety switch (T _ext ) and the first ignition transistor (T ₁ ) and the ignition element (SQ) and the second ignition transistor (T ₂ ) are connected in series and - wherein the ignition element (SQ) is connected between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) and - the safety switch (T _ext ) and the first ignition transistor (T ₁ ) via a common node (V ₅ ) with one another are connected and - where the ignition element (SQ) is located outside the microelectronic circuit (IC) and - where the safety _switch (T _ext ) is located outside the microelectronic circuit (IC) and - where the first ignition transistor (T ₁ ) is part of the microelectronic Circuit (IC) and - wherein the second ignition transistor (T ₂ ) is part of the microelectronic circuit (IC) and - wherein the safety _switch (T _ext ) and the ignition element (SQ) and the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) are arranged in series one behind the other in a common ignition current path and - the ignition element (SQ) in the common ignition current path between the first ignition transistor (T ₁ ) and the second ignition dtransistor (T ₂ ) is arranged and - wherein for an ignition of the ignition element (SQ) the safety switch (T _ext )) and the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) must be switched on, ie switched on, and - the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) and the ignition element (SQ) and the second ignition transistor (T ₂ ) forming an ignition chain, and - the ignition chain between the supply voltage line (V _bat ) and the reference ground (GND) ) is connected - where the node (V ₅ ) is located between the safety switch (T _ext ) and the first ignition transistor (T ₁ ) and - where the fifth resistor (R ₅ ) is in the node (V ₅ ) when the first safety switch is switched off (T _ext ) _feeds an electrical current (I ₅ ) and - the control signal generating network forming the control signal (V _R ) as a function of the voltage between the node (V ₅ ) and the reference potential (GND); - wherein the control signal (V _R ) is a first input signal of the transconductance amplifier (OTA) and - wherein the reference voltage (V _ref ) is a second input signal of the transconductance amplifier (OTA) and - wherein the storage capacitor (C ₁ ) with its first connection to the Output (V _G ) of the transconductance amplifier (OTA) is connected and - whereby the first switch (S ₁ ) is suitable and / or intended to connect the output (V _G ) of the transconductance amplifier (OTA) to the control input of the safety switch (T _ext ) to connect and - wherein the test current source (I _TST ) can feed a test current (I _TST ) into the node (V ₅ ). - where the safety circuit (safety agent) (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC) and - where the feedback function block (FbFkt) and the sensor interface (PSI5B) and the switching between these via the second data interface (SSPI) is controlled by the microcomputer (µC). - whereby the safety circuit (safety agent) (SA) can influence the output signal at the output (V _G ) of the transconductance amplifier (OTA).

Images