DE102005030770B4 - Circuit arrangement and method for controlling a safety device for a vehicle - Google Patents

Abstract

Circuit arrangement for controlling a safety device (2) for a vehicle with:
a) at least one first switching means (4.1, 4.2) and at least one second switching means (6) for activating at least one actuator (7) of the safety device (2),
b) a first control unit (3) for controlling the at least one first switching means (4.1, 4.2) depending on at least one input signal (1.2, 3.2) of the safety device (2), and
c) a second control unit (5) for controlling the at least one second switching means (6) as a function of at least one input signal (1.2, 3.2) of the safety device (2),
d) the first control unit (3) for generating at least one first control signal (4.0.1) for the first switching means (4.1, 4.2) and at least one first enable signal (6.0.1) for the at least one second switching means (6) independently the second control unit (5) is formed and
e) the second control unit (5) for generating at least one second control signal (6.0.2) for the second switching means (6) and at least one second enable signal ...

Description

The The invention relates to a circuit arrangement for controlling a safety device for a Vehicle according to the generic term of claim 1 and a corresponding method.

in the Automotive technology is becoming increasingly complex safety equipment or occupant protection systems such as airbag and belt tensioner systems as well as rollover sensors used. To check the correct function of such safety devices usually separate monitoring equipment such as microprocessors or special logic circuits used in the form of ASICs (Application Specific Integrated Circuits).

From the DE 44 24 020 A1 a hard-wired logic (sequence control) is known which fulfills the function of an independent monitoring device for a safety device. The sequence control monitors the start-up phase or the self-diagnostic sequence of a triggering device of a vehicle safety device. The output stages of the tripping device are only released for a possible activation of the safety device when the monitoring computer has detected a proper function of a microprocessor of the safety device. As a result, a high degree of security against malfunctions is already achieved.

Indeed depends on that Fail-safety of this safety device in operation after the self-diagnosis alone from the microprocessor, as the control unit in the event of a crash, a trigger decision based meets input signals coming from sensors. In the event of one while operating error in the microprocessor or a fault It therefore in the known safety devices to an undesirable release the safety device come.

From the DE 39 24 595 A1 such as DE 198 24 432 A1 Therefore, circuit arrangement according to the preamble of claim 1 can be seen in which two control units mutually make a release for the trip path of the other controller.

task It is the object of the present invention to provide a circuit arrangement and a method for controlling a safety device for a vehicle to propose, in which the risk of undesirable triggering of Safety device due to faults, failures or disorders a control unit during operation of the safety device is reduced.

These The object is achieved by a circuit arrangement for controlling a safety device for a vehicle with the features of claim 1 and a corresponding method solved. Preferred embodiments of the invention will become apparent from the dependent claims.

One essential idea of the invention is, in addition to the usual Control unit that is authoritative the safety device and in particular the activation of actuators the safety device controls to provide a further control unit, which implements a kind of parallel control. This will be a redundant control of the safety device created, the a much better protection against unwanted tripping in the Error case offers as known safety devices with only a control unit. To realize protection both generate Control units in parallel control and enable signals for switching means. These signals are used to activate the switching means with each other logically linked. The logical links prevent it from being due to errors or errors in one or Both control units generated signals to activate a Actuator of the safety device can come.

At least One of the control units is designed to be used for testing purposes while a test phase generate at least one test drive signal, which at least a test input signal for generates the first and / or second control unit, wherein during the Test phase a trigger is suppressed.

moreover the control units are formed to the at least one drive signal the first control unit for to monitor the at least one sensor and the at least one second enable signal and / or the at least one to disable a control signal if it is in normal operation after a test phase the device detects the at least one drive signal to an activation path for to lock the at least one actuator.

Specifically, the invention relates to a circuit arrangement for controlling a safety device for a vehicle having at least one first switching means and at least one second switching means for activating at least one actuator of the safety device, a first control unit for controlling the at least one first switching means as a function of at least one input signal of the safety device, and a second control unit for controlling the at least one second switching means depending on at least one input signal of the safety device. The first control unit is for generating at least a first enable signal for the min at least one second switching means independently of the second control unit and the second control unit for generating at least one second enable signal for the at least one first switching means independently of the first control unit. A first logic operation is for forming an activation signal for the at least one first switching means depending on a control signal of the first control unit and the second enable signal and a second logical operation is for forming an activation signal for the at least one second switching means depending on a control signal of the second control unit and provided by the first enable signal. To activate the corresponding switching means so at least two enable signals from two independent control units are required at the same time. Independent here means that each control unit is self-contained and does not require any control signals from the other control unit to generate their release and control signals. This independent processing of one or more input signals substantially reduces the probability that, in the event of a malfunction of at least one of the two control units, an undesired activation of an actuator of the safety device occurs.

Preferably The first and second logical links each comprise a logical AND function. An AND function is for example a single transistor feasible and therefore cost-effective to implement.

Especially this is at least one input signal of the first control unit and the second control unit at least one sensor signal and the second Control unit is formed to the at least one second enable signal for the at least one first switching means depending on the at least one To generate sensor signal. A release takes place here after Detection of a sensor signal. This will be a particularly high Safety from unwanted Activations achieved an actuator of the safety device. The sensor signal can be obtained, for example, from an acceleration, pressure or other for Safety concerns in the vehicle used sensor come. For example As a result, in an airbag occupant protection system, an enable signal are generated only when an acceleration sensor signal occurs.

The first control unit is in a preferred embodiment trained for testing purposes at least one drive signal for to generate at least one sensor, the at least one input signal for the first and / or second control unit generated. The at least one Sensor can in this embodiment So stimulated to deliver an output signal, that as an input signal from the first and / or second control unit can be processed. This makes it possible to control the behavior and in particular to check the correct function of the two control units.

Especially the second control unit is designed to be the at least one Control signal of the first control unit for the at least one sensor to monitor and the at least one second enable signal and / or the at least one to deactivate a control signal if, after a test phase of the Device which detects at least one drive signal to a Activation path for the lock at least one actuator. During operation of the device for controlling the safety device can by the first control unit Functional tests performed become. Hereby make sure that an actuator does not respond to any Case is activated by the function tests. This is done hereby guaranteed that the second control unit, the at least one drive signal the first control unit monitors and optionally the activation path for locks the at least one actuator.

During one test phase conversely, the device must be ensured that the activation path is partially released to test as possible of the path to be able to. For this purpose, the second control unit is preferably designed to the at least one drive signal of the first control unit for the at least to monitor a sensor and disable the at least one second enable signal if she while a test phase the device detects the at least one drive signal to an activation path for partially release the at least one actuator.

In In a particularly preferred embodiment, the second control unit for the function check of the formed first control unit. The second control unit can For example, a monitoring unit as mentioned above form, which monitors the first control unit in their function. Such monitoring units are in many safety devices like occupant protection systems provided at least during an initialization phase of a control unit, the central control unit to check.

Furthermore, a basic algorithm for activating one or more actuators of the safety device can also be implemented in the second control unit as a function of the at least one input signal. It would be conceivable, for example, that an already existing monitoring unit, which is designed as a microprocessor, is further developed to the second control unit by its operating software is extended by functions for controlling the safety device. There are no extensive hardware changes are required because the customizations are limited to the software.

Around to accomplish that the two control units as possible synchronously drive the switching means, the first and second control unit are preferably designed to be especially during a Initialisierungshase the safety device event-controlled to synchronize each other. In this case, there is no command transfer between the two control units required for synchronization. Instead of which can be synchronized by events alone, the z. B. signal edges of certain test, test or status signals can.

Especially the first control unit is designed to be event-driven Synchronizing to control at least one sensor, the at least an input signal for generates the first and second control units. So there will be one or stimulates several sensors from the first control unit in such a way that they provide output signals that are similar to the output signals or which may also occur during normal operation. Based These outputs can then be synchronized.

For example For example, the first control unit may be designed to be event-controlled Synchronizing a signal to drive the at least one sensor and the second control unit to generate the time until Receiving a status signal to measure and according to the synchronized measured time with the second control unit.

The second control unit is preferably designed to during a event-driven synchronization, the control signal for forming the activation signal for the at least second switching means and / or the second enable signal to disable. This avoids that during the expiration of a Synchronization process, for example due to a faulty Control and / or enable signal of the first control unit activation one or even more actuators of the safety device takes place.

Around to achieve a particularly high failure and failure safety, are the first and second control units separate components, d. H. "Physically" separate units, For example, two microcontroller or processors with each own housing.

As well can to increase failure and failure safety the at least one first switching means as a first component and the at least one second switching means be designed as a second separate component.

In a preferred embodiment the at least one first switching means is a transistor and the first component of an ASIC, which has a control logic for the at least having a first switching means. As a transistor, for example a power MOSFET are used over the load path the for the ignition an airbag squib required high currents can flow.

Farther can the first and second control units may be designed to handle the at least a first enable signal or the at least one second enable signal for one certain period of time and / or directly or temporally offset after detection of an input signal.

Around an activation of an actuator of the safety device during a Test or test phase to avoid, the first and second control unit are preferably designed such that a test one or more generating the at least one input signal Sensors only with locked at least a first or second switching means can be done. It is essential here that at least one of the switching means is disabled in order to switch through an activation path for the actuator to prevent.

In a preferred embodiment the invention is a basic algorithm in the first control unit for the function check of the implemented second control unit. This can make the failure safety the entire device will be further improved because not only a failure of the first, but also a failure of the second control unit, for example while a test phase can be detected.

The invention further relates to a method for controlling a safety device for a vehicle, in which a first and a second control unit of the safety device each receive at least one input signal and depending on the received at least one input signal at least a first switching means and at least one second switching means for activating at least one Control the actuator of the safety device. The first control unit generates at least one first enable signal for the at least one second switching means independently of the second control unit, and the second control unit generates at least one second enable signal for the at least one first switching means independently of the first control unit. By means of a first logical connection, an activation signal for the at least one first switching means is dependent on at least one control signal of the first control unit and on the at least one a second enable signal and by a second logic operation an activation signal for the at least one second switching means is formed depending on at least one control signal of the second control unit and the at least one first enable signal.

Preferably the first and second control units synchronize in an event-controlled manner especially during an initialization or test phase of Safety device to each other.

The first control unit controls for event-driven synchronization For example, at least one sensor, the at least one Input signal for generates the first and second control units.

In a preferred embodiment generates the first control unit for event-driven synchronization a signal for driving the at least one sensor and the second Control unit, measures the time until receipt of a status signal and synchronizes with the measured time duration the second control unit.

Around an activation of the at least one actuator of the device in particular while To prevent the synchronization, the second control unit while an event-driven synchronization, the control signal for forming the activation signal for disable the at least one second switching means and / or the second enable signal.

The first and second control unit can the at least one first enable signal or the at least one second Release signal for a certain period of time and / or offset directly or temporally after detection of an input signal.

Especially to lead the first and second control units perform a test of one or more of the at least one input signal generating sensors only when locked at least one first or second switching means.

Further Advantages and applications The present invention will become apparent from the following description in conjunction with the embodiments illustrated in the drawings.

In the description, in the claims, in the abstract and in the accompanying drawings the in the list below the reference numbers used terms and associated reference numerals used.

The drawings show in

1 a first embodiment of a circuit arrangement according to the invention;

2 an embodiment of a sequence of a test method in which an event-controlled synchronization of control and monitoring unit according to the invention takes place;

3 a second embodiment of a circuit arrangement according to the invention; and

4 an embodiment of an AND gate for use in a circuit arrangement according to the invention.

1 shows a circuit arrangement in a control unit 1 a vehicle safety device such as an airbag passenger protection system is used. The circuit arrangement comprises a safety device 2 , a control unit 3 (first control unit, master μP), a monitoring unit 5 (second control unit, slave μP) and a power supply 8th , To the control unit 1 are one or more sensors 10 . 1.1 connected, which are for example acceleration sensors (central acceleration sensor 10 and satellite sensors 1.1 ) and input signals for the first and second control units 3 respectively. 5 deliver.

A Control unit is preferably as a microprocessor with a triggering algorithm or formed as an ASIC, the flow control and / or implemented a simple evaluation or signal processing unit Has.

The power supply 8th generates an ignition voltage from an on-board voltage, which is used to ignite an actuator 7 serves to the control unit 1 , more precisely to the safety device 2 connected. The ignition voltage becomes a capacitor 8.1 (Energy storage) an activation path (thick line) of the safety device 2 supplied to load this. The in the capacitor 8.1 stored energy can, if necessary, via a second switching means 6 a control 4 of the actuator 7 the safety device 2 be supplied.

The activation path of the safety device 2 includes next to the energy storage 8.1 and the second switching means 6 first switching means 4.1 and 4.2 , which are part of the control here 4 are. The first switching means 4.1 and 4.2 For safety reasons, they can be redundant and, for example, integrated in an ASIC together with a control logic. The actuator 7 , which may be, for example, an ignition means for inflating an airbag or for triggering a Gurtstrammers or automatic rollover protection bar, is to the Ansteue tion 4 connected and between the two first switching means 4.1 and 4.2 connected.

The switching means 6 . 4.1 . 4.2 and the actuator 7 are connected in series. Ignition of the activation path of the safety device 2 in the case of an accident, such as a head-on collision or a rollover process, therefore takes place by the simultaneous closing of all in the activation path of the safety device 2 located switching means 4.1 . 4.2 and 6 , In this case, the capacitor discharges 8.1 via the activation path, ie via the switching means 6 . 4.1 and 4.2 and the actuator 7 on earth. During the discharge process, such a high electric current flows through the actuator 7 in that it is activated, e.g. B. in the case of a squib ignition occurs.

Activation requires both enable and enable signals from the control and monitoring units 3 respectively. 5 to be generated. The first switching means 4.1 and 4.2 the control 4 become authoritative by the control unit 3 and the second switching means 6 becomes relevant from the monitoring unit 5 activated by means of activation signals. Furthermore, to activate the corresponding switching means 4.1 . 4.2 . 6 each time at least two release signals required simultaneously to the activation signals, each of the control unit 3 or the monitoring unit 5 be generated independently of each other. It should be noted that the control unit 3 and the monitoring unit 5 are each independently functional, especially in SW program sequence or in the program flow of the algorithm for activation decision. In particular, in the monitoring unit 5 implemented a basic algorithm, which also like that in the control unit 3 implemented algorithm to activate the actuator 7 based on input signals 1.2 and 3.2 the sensors 1.1 respectively. 10 is set up. The independent input signals 3.2 and 1.2 from the independent sensors 10 respectively. 1.1 So both are from the control unit 3 as well as the monitoring unit 5 processed, so by both units 3 and 5 independently control and enable signals are generated in parallel.

The generation of control signals and enable signals by the control and monitoring unit will now be described below 3 respectively. 5 and their interaction when activating the actuator 7 explained.

The control unit 3 generated depending on the input signals 1.2 and or 3.2 a total of three control signals, a master control signal and two slave control signals for the two first switching means 4.1 and 4.2 , as well as a first enable signal (master control line 6.0.1 for the second switching means 6 ), which with a control signal (slave control line 6.0.2 for the second switching means 6 ) of the monitoring unit 5 is logically linked. The master control signal of the control unit 3 is via a master control line 4.0.1 an AND gate 11 fed to it with a second, via a slave control line 4.0.2 from the monitoring unit 5 received enable signal logically linked. The output signal of the AND gate 11 controls two more AND gates 13 and 14 , each via a control line 4.1.1 respectively. 4.2.1 Switching signals for the switching means 4.1 respectively. 4.2 from the control unit 3 receive. Due to the logical link through the AND gate 13 and 14 become the first switching means 4.1 and 4.2 only activated, ie closed, if in each case both input signals of each of the AND gates 13 and 14 are logically HIGH. This is the case when the control lines 4.1.1 and 4.2.1 logical HIGH signals and at the same time the output signal of the AND gate 11 logical is HIGH. The latter is again the case when the master control line 4.0.1 and the slave control line 4.0.2 each lead a logical HIGH signal. As a result, a decision of the monitoring unit flows 5 in the activation decision of the control unit 3 for the switching means 4.1 and 4.2 with a. The AND gates 13 and 14 are together with the first switching means 4.1 and 4.2 in the control 4 included, for example, integrated on an ASIC.

The monitoring unit 5 generated depending on the input signals 1.2 and or 3.2 a control signal for the second switching means 6 , This master control signal is sent via the slave control line 6.0.2 an AND gate 12 fed to this signal with the first, via the master control line 6.0.1 supplied enable signal of the control unit 3 logically linked. Only if both signals are logically HIGH, also the output signal of the AND-gate becomes 12 logical high and closes the second switching means 6 , In the activation decision of the monitoring unit 5 for the second switching means 6 So flows a decision of the control unit 3 with a.

For safety reasons, this is the first switching means 4.1 and 4.2 independent and physically separate second switching means 6 relevant to the monitoring unit 5 activated (the first enable signal from the control unit 3 however, can prevent activation) for a fail-safe function. Such a fail-safe function means that there is an error or failure in the control unit 1 , in particular in one or more of the units 3 . 4 or 5 , to no activation of the actuator 7 may come. A failure should be done "safely" in such a way that the entire safety device can not trigger incorrectly desired triggering in the event of an error of essential importance, especially in the case of any error such as in the ASIC 4 that is the first switching means 4.1 . 4.2 contains, or also any error in the control unit 3 , By the decoupled or physically independent paths in the activation path as well as by the decoupled or physically separate paths in the generation of drive signals for the first switching means 4.1 and 4.2 on the one hand and 6 On the other hand, it should be safely avoided that there may be an undesirable false triggering of the safety device.

In particular, the safety idea underlying the fail-safe function also includes the case where the control unit 3 does not have the ability, by means of an interface communication or by means of a port connection for command transmission to the monitoring unit 5 a command sequence to send, so with the help of or by a detour via the monitoring unit 5 indirectly a faulty activation of the second switching means 6 and / or all located in the activation path switching means 4.1 . 4.2 and 6 from the control unit 3 can be initiated.

The second switching means 6 can in the activation path of the safety device 2 relevant to the monitoring unit 5 to be activated. Furthermore, there is between the physically separated units 5 and 3 no way that from the control unit 3 via the monitoring unit 5 an activation of the second switching means 6 can be initiated exclusively and independently of the other unit. Therefore implemented next to the control unit 3 also the monitoring unit 5 a basic algorithm so that z. B. in the case of a crash or rollover a trigger request of the vehicle safety device 1 depending on one or more input signals 1.2 and 3.2 from the sensors 1.1 and 10 can be implemented by both the first switching means 4.1 and 4.2 , the control unit 3 are assigned, as well as the second switching means 6 , that of the surveillance unit 5 is assigned, can be closed simultaneously and the activation path for activating the actuator 7 unlock.

If the monitoring unit 5 is designed as a special logic circuit in the form of an ASIC or a low-cost microprocessor, the possibilities of individual testing with finely graduated evaluation options are limited in part, so that certain monitoring functions of the control unit 3 should be assigned. This task separation, especially in time-critical tests of the switching means 6 . 4.1 . 4.2 the safety device 2 in which partly both the monitoring unit 5 as well as the control unit 3 involved, that requires between the two units 3 . 5 a certain synchronization exists, so that the timing of the test with the resulting short-term results and status information (status line 8.2 ) can be evaluated. The synchronization problem to be solved therefore, as described below with reference to 2 is described in particular occurs in the event that the control unit 3 performs a test or monitoring function at which the test is performed by the monitoring unit 5 is initiated, in particular the examination of the second switching means 6 as the control unit 3 , due to the lack of opportunity to initialize the test the exact test time (closing operation of the second switching means 6 ) does not set itself.

Furthermore, the synchronization problem can be solved by the described test of the second switching means 6 is integrated in the test or working sequence in time such that a synchronization of the two units 3 and 5 can be done by a previous independent test, in which both the control unit 3 as well as the monitoring unit 5 involved respectively both the control unit 3 as well as the monitoring unit 5 the initialization signal 3.1 ' for testing or the result thereof in the form of an output signal 3.2 ' can capture.

• – sofern sie nach der erfolgten Selbsttestphase der Schaltungsanordnung ein Ansteuersignal 3.1 erkennt, mindestens für eines der der Überwachungseinheit 5 zugänglichen Schaltmittel 6, 4.1, 4.2 ein Sperrsignal erzeugt, und/oder eine vorgesehene Freigabe nicht erteilt, und/oder ein bereits erteiltes Freigabesignal 6.0.2, 4.0.2 zurücknimmt, bzw.
• – sofern sie während der Selbsttestphase der Schaltungsanordnung ein Ansteuersignal 3.1 erkennt, mindestens für eines der der Überwachungseinheit 5 zugänglichen Schaltmittel 6, 4.1, 4.2 ein Freigabesignal 6.0.2, 4.0.2 erzeugt.

Like in the 1 shown and in the description of 2 explained in more detail here is the test of the sensor 10 used. To initialize the test is in the initialization phase of the controller 1 the vehicle safety device, a control signal for initialization of the sensor test by means of the control line 3.1 from the control unit 3 to the sensor to be checked 10 transfer. By means of test pulse generation via the control line 3.1 for testing the sensor 10 consists of the monitoring unit 5 the possibility of closing the other switching means 6 so that by monitoring the status or level of the test pulse generation by the monitoring unit 5 A logical differentiation can be made by the monitoring unit 5

• - If they after the successful self-test phase of the circuit a drive signal 3.1 detects, at least for one of the monitoring unit 5 accessible switching means 6 . 4.1 . 4.2 generates an inhibit signal, and / or does not grant an envisaged enable, and / or an already issued enable signal 6.0.2 . 4.0.2 withdraws, resp.
• - Provided they during the self-test phase of the circuit a drive signal 3.1 detects, at least for one of the monitoring unit 5 accessible switching means 6 . 4.1 . 4.2 a release signal 6.0.2 . 4.0.2 generated.

2 shows a test procedure in which the synchronization of the control unit 3 (Master μP) and the monitoring unit 5 (Slave μP) to each other during the critical sequentially performed switch checks the safety device is not done by means of a direct command transmission via data communication, but instead event-controlled according to the invention, in particular based on events that occur during the initialization phase.

In the test procedure is both the control unit 3 (Master μP) as well as the monitoring unit 5 (Slave μP) integrated. This is done by the control unit 3 (Master μP) by means of the control line 3.1 a control signal 3.1 ' generated for initialization of the sensor test. Thereupon appears at the exit 3.2 (BA output) of the sensor 10 an output signal 3.2 ' , The initialization of the test can be done here, as in 2 shown both edge-triggered and event-triggered. The control line 3.1 More specifically, the initialization signal sent over it 3.1 ' For sensor testing, the monitoring unit 5 (Slave μP) supplied at the input, whereupon this received the initialization signal as a synchronization signal 16 used to after a delay time .DELTA.t 9 the first switching means 6 for testing purposes for a defined time period 17 from Z. B. × μsec close. That of the monitoring unit 5 initiated closing of the first switching means 6 causes an evaluable change, ie an evaluable result signal 8.2 ' with a duration 18 from Z. B. also about .mu.sec, in particular a potential change, the status information 8.2 ' the control unit 3 for evaluation is supplied. The control unit polls for this 3 , For example, via a so-called capture input input, in a predetermined tolerance range 9.1 from Z. B. several ms after the status information 8.2 '' at its capture input input and decides from the detected signal whether the check was correct or incorrect. For example, it evaluates if the expected status information 8.2 '' in the tolerance range 9.1 with the right length of time 19 , ie pulse duration, appears. A match becomes a criterion of a correct switch check as well as a timing of the work sequences / operating frequencies of the two units involved in the test 3 and 5 scored. An exact synchronization between the at the test of the first switching means 6 involved units 3 and 5 Among other things, it is also necessary because, for reasons of safety, the test time, for example, in the 100 microsec area or the closing time of the first switching means 6 is very low, since the closing time is chosen to be less than the critical time required to activate the test equipment (actuator 7 ) is needed.

By means of this event-controlled or controlled by events during the initialization phase synchronization of the control unit 3 to the monitoring unit 5 and / or vice versa, especially during the critical sequential switching means tests of the safety device 2 , a possibility is created in which the synchronization of the control unit 3 to the monitoring unit 5 does not have to be done by means of a direct command transmission via data communication, but independent of a communication and / or command transmission of the control unit 3 to the monitoring unit 5 and / or vice versa on the basis of an interface and / or a port connection takes place.

3 shows a representation of a control device of the vehicle safety device according to the invention, similar to the in 1 illustrated arrangement in which a locking function is implemented by hardware. Because of the test pulse generation for testing the sensors 10 via the monitoring computer 5 indirectly the possibility exists, a closure of the first switching means 6 Generating can be testing the sensors 10 in the initialization phase or during active operation of the vehicle safety device 1 only be activated when the second switching means 4.1 . 4.2 the safety device 2 are in a locked state. The locking of the switching means 4.1 and 4.2 the safety device 2 This can either be done via software routines or independently of the software routines by a hardware circuit. The hardware circuit can, for. B. by a logic or selection circuit such as a flip-flop with Q and inverted Q output 5.1 be implemented. The flip-flop 5.1 Ensures that a simultaneous activation of the test pulse generation as well as the activation of the power stage switch 4.1 . 4.2 the safety device 2 is excluded.

After a system startup, after releasing a LOW-active system reset signal 15 takes place, the Q output of the flip-flop leads 5.1 a LOW signal. The Q output is over the line 4.0.2 with an input of the AND gate 11 connected. As a result, the second switching means 4.1 and 4.2 blocked. Since the Q-cross output carries a HIGH signal at this time, the control unit can 3 a control signal for initializing the sensor test to the corresponding input of the sensor 10 invest. After completion of this test sequence, the monitoring unit 5 (Slave μP) via the set input the flip-flop 5.1 to change the output signals at the Q and Q cross output. As a result, from this point on the switching means 4.1 . 4.2 be activated if necessary; the initialization of the sensor test by the control signal of the control unit 3 is but not given anymore.

4 shows an implementation of the function of an AND gate for the AND gates 11 - 14 in the 1 and 3 shown circuit arrangements which requires a low circuit complexity. This in 4 The AND gate shown above can be implemented by means of a single pnp bipolar transistor which mimics a logical AND function. In this circuit, the output of the AND gate is formed by the collector of the transistor. A HIGH signal at the output is generated when the control unit 3 a HIGH signal at the emitter of the transistor and at the same time the monitoring unit 5 generates a LOW signal at the transistor base.

1

control unit

1.1

satellite sensor

1.2

Signal output of the satellite sensor 1.1

2

safety device

3

control unit

3.1

control line for initializing the sensor test

3.1 '

initialization for sensor testing

3.2

Signal output of the sensor 10

3.2 '

Acceleration sensor output

4

ASIC

4.0.1

Master control line for the switching means 4.1 and 4.2

4.0.2

Slave control line for the switching means 4.1 and 4.2

4.0.3

Control line for the switching means 4.1 and 4.2

4.1

first Switching means of the activation path

4.1.1

Control line for the switching means 4.1

4.2

first Switching means of the activation path

4.2.1

Control line for the switching means 4.2

5

monitoring unit

5.1

Set-reset flip-flop

6

second Switching means of the activation path

6 '

Control signal for second switching means 6

6.0.1

Master control line for the second switching means 6

6.0.2

Slave control line for the second switching means 6

6.0.3

Control line for the second switching means 6

7

ignition means

8th

power adapter

8.1

capacitor

8.2

Status line

8.2 '

status signal

8.2 ''

Status signal at the input of the control unit 3

9

Delay time Δt

9.1

tolerance

10

sensor

11-14

AND gate

15

System Reset

16

Synchronization signal for monitoring unit 5

17

Signal duration of the control signal 6 '

18

Signal duration of the status signal 8.2 '

19

Signal duration of the status signal 8.2 ''

Claims (19)

Circuit arrangement for controlling a safety device ( 2 ) for a vehicle comprising: a) at least one first switching means ( 4.1 . 4.2 ) and at least one second switching means ( 6 ) for activating at least one actuator ( 7 ) of the safety device ( 2 ), b) a first control unit ( 3 ) for controlling the at least one first switching means ( 4.1 . 4.2 ) depending on at least one input signal ( 1.2 . 3.2 ) of the safety device ( 2 ), and c) a second control unit ( 5 ) for controlling the at least one second switching means ( 6 ) depending on at least one input signal ( 1.2 . 3.2 ) of the safety device ( 2 ), d) the first control unit ( 3 ) for generating at least one first control signal ( 4.0.1 ) for the first switching means ( 4.1 . 4.2 ) and at least one first enable signal ( 6.0.1 ) for the at least one second switching means ( 6 ) independently of the second control unit ( 5 ) and e) the second control unit ( 5 ) for generating at least one second control signal ( 6.0.2 ) for the second switching means ( 6 ) as well as at least one second enable signal ( 4.0.2 ) for the at least one first switching means ( 4.1 . 4.2 ) independently of the first control unit ( 3 ), and f) a first logical link ( 11 ) for forming a first activation signal ( 4.0.3 ) for the at least one first switching means ( 4.1 . 4.2 ) depending on the at least one first control signal ( 4.0.1 ) of the first control unit ( 3 ) and at least one second enable signal ( 4.0.2 ) and g) a second logical link ( 12 ) for forming an activation signal ( 6.0.3 ) for the at least one second switching means ( 6 ) depending on at least one second control signal ( 6.0.2 ) of the second control unit ( 5 ) and at least one first enable signal ( 6.0.1 ) of the first control unit ( 3 ) are provided. h), characterized in that at least one of the control units ( 3 ) is designed in order to test purposes during a test phase at least one test drive signal ( 3.1 ) which generates at least one test input signal ( 1.2 . 3.2 ) for the first and / or second control unit ( 3 . 5 i) during which a trigger is suppressed during the test phase and j) at least one of the control units ( 5 ) is formed to the at least one drive signal ( 3.1 ) of the first control unit ( 3 ) for the at least one sensor ( 1.1 . 10 ) and the at least one second enable signal ( 4.0.2 ) and / or the at least one control signal ( 6.0.2 ) if, after a test phase during normal operation of the device, the at least one drive signal ( 3.1 ) to provide an activation path for the at least one actuator ( 7 ) to lock. Circuit arrangement according to Claim 1, characterized in that at least one of the control units ( 5 ) is formed to the at least one drive signal ( 3.1 ) of the first control unit ( 3 ) for the at least one sensor ( 1.1 . 10 ) and the at least one second enable signal ( 4.0.2 ) if, during a test phase of the device, the at least one drive signal ( 3.1 ) to provide an activation path for the at least one actuator ( 7 ) partially release. Circuit arrangement according to one of the preceding claims, characterized in that the first and second control unit ( 3 . 5 ) are designed to be event-controlled, in particular during an initialization or test phase of the safety device ( 2 ) to synchronize with each other. Circuit arrangement according to Claim 3, characterized in that the first control unit ( 3 ) is adapted to at least one sensor for event-controlled synchronization ( 1.1 . 10 ), the at least one input signal ( 1.2 . 3.2 ) for the first and / or second control unit ( 3 . 5 ) generated. Circuit arrangement according to Claim 4, characterized in that the first control unit ( 3 ) is further adapted for the event-controlled synchronization, a signal for driving the at least one sensor ( 1.1 . 10 ) and the second control unit ( 5 ), the duration ( 9 ) until receipt of a status signal ( 8.2 ) and according to the measured time ( 9 ) with the second control unit ( 5 ) to synchronize. Circuit arrangement according to one of claims 3 to 5, characterized in that the second control unit ( 5 ) is designed in order to control the control signal during an event-controlled synchronization ( 6.0.2 ) for forming the activation signal ( 6.0.3 ) for the at least second switching means ( 6 ) and / or the second enable signal ( 4.0.2 ). Circuit arrangement according to one of the preceding claims, characterized in that the first and second control unit ( 3 . 5 ) are separate components. Circuit arrangement according to one of the preceding claims, characterized in that the at least one first switching means ( 4.1 . 4.2 ) as a first component ( 4 ) and the at least one second switching means ( 6 ) is formed as a second separate component. Circuit arrangement according to claim 8, characterized in that the at least one first switching means ( 4.1 . 4.2 ) is a transistor and the first device is an ASIC having a drive logic ( 13 . 14 ) for the at least one first switching means ( 4.1 . 4.2 ) having. Circuit arrangement according to one of the preceding claims, characterized in that the first and second control unit ( 3 . 5 ) are formed to receive the at least one first enable signal ( 6.0.1 ) or the at least one second enable signal ( 4.0.2 ) for a certain period of time and / or directly or temporally offset after detection of an input signal ( 3.2 ) to create. Circuit arrangement according to one of the preceding claims, characterized in that the first and second control unit ( 3 . 5 ) are designed such that a test of one or more of the at least one input signal ( 1.1 . 10 ) generating sensors only when at least one first or second switching means ( 4.1 . 4.2 . 6 ). Circuit arrangement according to one of the preceding claims, characterized in that in the first control unit ( 3 ) a basic algorithm for checking the function of the second control unit ( 5 ) is implemented. Method for controlling a safety device ( 2 ) for a vehicle having a circuit arrangement according to one of the preceding claims, in which a first and a second control unit ( 3 . 5 ) of the safety device at least one input signal ( 1.2 . 3.2 ) and depending on the received at least one input signal ( 1.2 . 3.2 ) at least a first switching means ( 4.1 . 4.2 ) and at least one second switching means ( 6 ) for activating at least one actuator ( 7 ) of the safety device ( 2 ), characterized in that the first control unit ( 3 ) at least a first enable signal ( 6.0.1 ) for the at least one second switching means ( 6 ) independently of the second control unit ( 5 ) and the second control unit ( 5 ) at least one second enable signal ( 4.0.2 ) for the at least one first switching means ( 4.1 . 4.2 ) independently of the first control unit ( 3 ) and that by a first logical link ( 11 ) an activation signal ( 4.0.3 ) for the at least one first Switching means ( 4.1 . 4.2 ) depending on at least one control signal ( 4.0.1 ) of the first control unit ( 3 ) and at least one second enable signal ( 4.0.2 ) and a second logical link ( 12 ) an activation signal ( 6.0.3 ) for the at least one second switching means ( 6 ) depending on at least one control signal ( 6.0.2 ) of the second control unit ( 5 ) and at least one first enable signal ( 6.0.1 ) are formed. Method according to claim 13, characterized in that the first and second control units ( 3 . 5 ) event-controlled, in particular during an initialization or test phase of the safety device ( 2 ) synchronize with each other. Method according to claim 14, characterized in that the first control unit ( 3 ) for event-controlled synchronization at least one sensor ( 1.1 . 10 ), which controls the at least one input signal ( 1.2 . 3.2 ) for the first and second control units ( 3 . 5 ) generated. Method according to claim 15, characterized in that the first control unit ( 3 ) for event-controlled synchronization, a signal for actuating the at least one sensor ( 1.1 . 10 ) and the second control unit ( 5 ), the duration ( 9 ) until receipt of a status signal ( 8.2 ) and measured according to the measured time ( 9 ) with the second control unit ( 5 ) synchronized. Method according to one of claims 13 to 16, characterized in that the second control unit ( 5 ) during an event-driven synchronization the control signal ( 6.0.2 ) for forming the activation signal ( 6.0.3 ) for the at least one second switching means ( 6 ) and / or the second enable signal ( 4.0.2 ) disabled. Method according to one of claims 13 to 17, characterized in that the first and second control unit ( 3 . 5 ) the at least one first enable signal ( 6.0.1 ) or the at least one second enable signal ( 4.0.2 ) for a certain period of time and / or directly or temporally offset after detection of an input signal ( 3.2 ) produce. Method according to one of claims 13 to 18, characterized in that the first and second control unit ( 3 . 5 ) a test of one or more of the at least one input signal ( 1.1 . 10 ) generating sensors only when at least one first or second switching means ( 4.1 . 4.2 . 6 ) carry out.