DE102017110423B4 - Process for the reliable activation of production test modes in safety-relevant electronic circuits for a pedestrian impact protection system - Google Patents

Abstract

Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a passenger restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) for several integrated safety-related circuits for controlling a pedestrian impact protection system with a squib (SQ) , - the integrated circuit (IC) comprises a first control line which is provided to control a first control terminal (G1) of a first transistor (T1) and - the first control line can be active or inactive and - the integrated circuit ( IC) comprises a second control line, which is intended to control a second control connection (G2) of a second transistor (T2) and - wherein the second control line can be active or inactive and - wherein the integrated circuit (IC) comprises a third control line, the provided hen is to drive a third control terminal (G3) of a third transistor (T3) and - wherein the third control line can be active or inactive and - wherein the integrated circuit is provided so that the first transistor (T1) and the second transistor (T2 ) and the third transistor (T3) are connected in series with the squib (SQ) and - the firing of the squib (SQ) in normal operation has at least the prerequisite that the first control line is active and the second control line is active and the third Control line is active comprising the steps - fulfilling a first precondition for activating the production test mode; deactivating the first control line of the first control connection (G1) of the first transistor (T1) and locking an activation of the first control line at least until the end of the activation of the production test mode; Deactivating the second control line of the second control connection (G2) of the second transistor (T2) and V locking an activation of the second control line at least until the end of the activation of the production test mode; - deactivating the third control line of the third control connection (G3) of the third transistor (T3) and locking an activation of the first control line at least until the end of the activation of the production test mode; - fulfilling a second precondition for activating the production test mode; - activating the production test mode when all three control lines have been deactivated and when the first precondition is fulfilled and the second precondition is fulfilled.

Description

preamble

A method for activating a production test mode for a safety-relevant electronic circuit and in particular a method for activating a production test mode for an integrated safety-relevant electronic circuit ( IC ) to control a vehicle occupant restraint system with a squib ( SQ ) suggested.

General introduction

• • IEC 61511: Funktionale Sicherheit - für Sicherheitstechnische Systeme für die Prozessindustrie
• • IEC 61513: Kernkraftwerke - für Leittechnik für Systeme mit sicherheitstechnischer Bedeutung - Allgemeine Systemanforderungen
• • EN 50128: Bahnanwendungen - für Telekommunikationstechnik, Signaltechnik und Datenverarbeitungssysteme - für sicherheitsrelevante elektronische Systeme für die Signaltechnik
• • IEC 62061: Sicherheit von Maschinen - für die funktionale Sicherheit sicherheitsbezogener elektrischer, elektronischer und programmierbarer elektronischer Steuerungssysteme
• • ISO 26262: Road Vehicles - Funktionale Sicherheit für Automobile

Electronic systems and especially integrated circuits are used in a wide variety of safety-related systems. Relevant exemplary standards that such systems have to meet depending on the application are, for example (without claiming to be complete):

• • IEC 61511: Functional safety - for safety systems for the process industry
• • IEC 61513: Nuclear power plants - for control technology for systems with safety-related significance - general system requirements
• • EN 50128: Railway applications - for telecommunications technology, signal technology and data processing systems - for safety-relevant electronic systems for signal technology
• • IEC 62061: Safety of machines - for the functional safety of safety-related electrical, electronic and programmable electronic control systems
• • ISO 26262: Road Vehicles - Functional safety for automobiles

Prior to the delivery of such safety-related electronic systems and during production, these systems must be fully tested for proper functioning of all components. Their number can reach in integrated circuits two-digit powers of ten.

Therefore, special production test modes (test states of the electronic systems) are provided in order to be able to quickly and cost-effectively bring this component into all relevant states for each of the components of the electronic system under test and to observe the response of that component to a good / bad Statement with respect to each parameter to be tested this component is possible.

As a rule, therefore, these electronic systems in these production test modes are not compliant with specification and therefore not safe. Through various influences, it is now possible that signals for activating the production test modes are inadvertently activated during normal operation. In the simplest case, this can be done for example by natural radioactivity or a failure of a subcomponent of the electronic system. Therefore, such an event should not become a security risk.

A production test implementation in safety-relevant products thus always harbors the potential for critical, safety-relevant errors in the case of unintentional activation of a production test mode in safety-relevant normal operation.

In this context, the prior art particularly includes DE 10 2007 044 345 A1 . DE 10 2005 030 770 A1 and the DE 10 2004 036 291 A1 known.

State of the art

An integrated circuit is described below as an electronic system. The proposed methodology can also be applied to any other electronic system.

There are countless methods of putting integrated circuits into a production test mode (test state). In the simplest case, a port is pulled to a certain level, which is not normally operated at that level. Also, activation via certain memory locations of registers of a processor is known, as long as the integrated circuit has a processor. Particularly well-suited, as standardized, is the test via an IEEE-1149 compatible JTAG test interface and the test registers of the associated JTAG test controller.

From the prior art, the multiple locking of test modes is known. This prior art is particularly known in the form of integrated circuits which are freely available on the market. Production test modes always have to be activated first. In order to achieve the necessary security, however, multiple locking is sometimes not enough. When the failure rates due to the circuit design are calculated, in certain cases, particularly in integrated circuits for controlling vehicle occupant restraint systems (airbags) or for controlling pedestrian impact protection systems, the likelihood of erroneously activating safety-related functions, such as the firing of an airbag or a pedestrian impact protection system, is necessary while driving, to lower even further in order to meet the requirements of the standards exemplified above. Such a faulty activation of safety-relevant functions can also be done, for example, by the accidental activation of a production test mode in normal normal operation.

Object of the invention

The invention is therefore based on the object to provide a solution that further reduces the likelihood of erroneously activating safety-related functions by accidental activation of production test modes.

This object is achieved by a method according to claim 1.

Solution of the problem of the invention

The starting point for the intended reduction in probability is to increase the detection and signaling of a potential, presumably unintentional access to production test functions and at the same time to increase the probability of achieving a predefined safe state in this case.

The basic idea of the proposed method is therefore to specify at least two entry conditions for the production test, but also to design the system in such a way that a safe functional state is already assumed when the first entry conditions for the production test are met.

This method is based on the example of a schematically simplified airbag ignition system, as known from the prior art, with the aid of 1 explained. Such ignition circuits are also used in pedestrian impact protection systems.

The exemplary airbag ignition system AS is generated from the vehicle's operating power system with the supply voltage VCC supplied in normal operation. This creates an energy reserve in the form of a capacitor CE charged and kept ready for use. This serves in the event of a fault in the supply voltage VCC by the consequences of an accident of the vehicle in order to maintain the energy supply of the airbag ignition system AS , A reverse polarity protection diode D1 prevents the energy in the energy reserve from being fed back CE stored energy in the vehicle's power grid. The airbag ignition system AS consists of a series connection of at least three transistors ( T1 . T2 . T3 ) and the squib SQ of the airbag, as well as the control ST and the capacitor CE the energy reserve and the reverse polarity protection diode D1 , The squib SQ usually has a first connection and a second connection. The first of the three transistors ( T1 . T2 . T3 ) is a safety switching transistor T1 , which is preferably provided only once and preferably outside the integrated circuit. The second transistor T2 is the so-called high-side switch, since it is when the safety switching transistor T1 is switched through, directly with the typically positive supply voltage VCC via the reverse polarity protection diode D1 connected is. The third transistor T3 is the so-called low-side switch, since it is directly connected to the typically negative supply voltage, the reference potential GND , connected is. Between the high-side switch, i.e. the second transistor T2 , and the low-side switch, i.e. the third transistor T3 , is the squib SQ arranged, which provides the gas for the explosive deployment of the airbag when ignited. This requires the squib SQ be traversed by an electric current. So all three transistors are necessary T1 . T2 . T3 to turn on simultaneously to activate the ignition lip SQ to ignite and deploy the airbag.

For example, in a pedestrian impact protection system, instead of deploying the airbag, the engine compartment door would be brought upwardly slightly angled through the explosive charge to reduce head impact forces upon collision with a pedestrian by extending the travel distance.

The activation of the first transistor T1 takes place by activating the first control connection G1 of the first transistor T1 ,

Activation of the second transistor T2 takes place by activating the second control connection G2 of the second transistor T2 ,

Activation of the third transistor T3 takes place by activating the third control terminal G3 of the third transistor T3 ,

Typically, the first transistor is located T1 outside the integrated circuit IC while the second transistor T2 and the third transistor T3 preferably part of the integrated circuit IC are. The squib SQ Of course, this is not part of the integrated circuit IC , Due to the required storage capacity is the capacitor CE the energy reserve also typically outside of the integrated circuit IC , A controller ST within the integrated circuit IC now supplies the control signals for the first control connection G1 of the first transistor T1 and for the second control terminal G2 of the second transistor T2 and for the third control terminal G3 of the third transistor T3 ,

• Fall A
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall B
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird NICHT unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall C
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird NICHT unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall D
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird NICHT unterbunden.

It is now proposed that by activating a production test mode, for example by activating the control system ST connected test mode activation line TM , one of the following four cases occurs:

• Case A
  • • The activation of the first control connection G1 of the first transistor T1 is prevented and
  • • the activation of the second control connection G2 of the second transistor T2 is prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case B
  • • The activation of the first control connection G1 of the first transistor T1 is NOT prevented and
  • • the activation of the second control connection G2 of the second transistor T2 is prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case C
  • • The activation of the first control connection G1 of the first transistor T1 is prevented and
  • • the activation of the second control connection G2 of the second transistor T2 is NOT prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case D
  • • The activation of the first control connection G1 of the first transistor T1 is prevented and
  • • the activation of the second control connection G2 of the second transistor T2 is prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is NOT prevented.

Here, the term "active" for a control line for a control connection ( G1 . G2 . G3 ) one of the transistors ( T1 . T2 . T3 ) to understand that in normal operation the squib SQ ignites as soon as all three control lines of the three control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) Are "active".

Case A should be selected for all test modes in which none of the three control lines of the three control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) should be checked.

Cases B, C and D enable the three control lines of the three control connections to be checked ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) in the production test in a special production test mode without the probability of triggering the squib SQ to increase beyond a tolerable level in normal operation.

It is an essential feature of an airbag ignition system AS according to this proposal if for testing a first connection α of the integrated circuit IC which is for the connection of the first pole of the squib SQ is provided, a first production test mode is provided and for testing a second connection β of the integrated circuit IC which is for the connection of the second pole of the squib SQ a second test mode is provided and that in the first test mode the second connection β compared to the reference potential GND is high impedance and that in the second test mode the first connection α for the squib SQ opposite the connection ε for the safety switching transistor T1 is high impedance.

This means high impedance for the second transistor T2 that the resistance between the first port α for the squib SQ opposite the connection ε for the switching transistor T1 by a factor of at least 50 is smaller than the resistance of the second transistor T2 shows when the second control terminal G2 of the second transistor T2 is active.

Here, high impedance means for the third transistor T3 that the resistance between the second connector β for the squib SQ and the reference potential GND by a factor of at least 50 is less than the resistance that the third transistor T3 shows when the third control connection G3 of the third transistor T3 is active.

Experience has shown, however, that it is not sufficient to G1 . G2 . G3 ) to be deactivated. Rather, these lines store electrical charges. Therefore, a faulty, dangerous state can still be assumed when switching on transiently. When drafting this proposal, it was therefore recognized that the control lines of the Control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) must be discharged for a safe state of the safety-relevant electronic circuit.

It is therefore recommended to only activate the production test mode when the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) are actually deactivated by unloading. For this purpose, a monitoring circuit can be provided which detects the actual state of the control lines of the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) determined.

It is thus a feature of this proposal that not only by fulfilling one of at least two conditions for the activation of the production test mode for an electronic system, the system already in a safe state, here by deactivating all three or at least two control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ), but that the assumption of this safe state is measured and verified and is activated only when the predetermined safe state is present. In the present case, this predetermined safe state by the discharge of all three or at least two control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ).

For case A

In case A, none of the control lines of the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) checked. The activation of the relevant production test mode is activated, for example, by activating the test mode activation line TM initiated. To activate this production test mode in an airbag ignition system AS , all three control lines of the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) can be deactivated. The assumption of this safe state is then measured and verified in this case A such that only when the predetermined safe state is present, in the form of the discharge of all three control lines of the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) the production test mode is activated.

In case B

In case B, the first control line of the first control terminal G1 of the first transistor T1 tested by the production test in this production test mode. The activation of this respective production test mode is, for example, by activating the test mode activation line TM initiated. For activation of the production test mode in an airbag ignition system AS Therefore, in this case, B should be the second control line of the second control terminal G2 of the second transistor T2 be deactivated and the third control line of the third control terminal G3 of the third transistor T3 be deactivated. The assumption of this safe state is then measured and verified in this case B so that only in the presence of the predetermined safe state, in the form of the discharge of the second control line of the second control terminal G2 of the second transistor T2 and the third control line of the third control terminal G3 of the third transistor T3 the production test mode is activated.

In case C

In case C, the second control line of the second control terminal G2 of the second transistor T2 tested by the production test in this production test mode. The activation of this respective production test mode is, for example, by activating the test mode activation line TM initiated. For activation of the production test mode in an airbag ignition system AS Therefore, in this case, C should be the first control line of the first control terminal G1 of the first transistor T1 be deactivated and the third control line of the third control terminal G3 of the third transistor T3 be deactivated. The assumption of this safe state is then measured and verified in this case C so that only in the presence of the predetermined safe state, in the form of the discharge of the first control line of the first control terminal G1 of the first transistor T1 and the third control line of the third control terminal G3 of the third transistor T3 Activated production test mode.

For the case D

In case D, the third control line becomes the third control connection G3 of the third transistor T3 checked by the production test in this production test mode. The activation of the relevant production test mode is activated, for example, by activating the test mode activation line TM initiated. To activate this production test mode in an airbag ignition system AS , D should therefore be the first control line of the first control connection in this case G1 of the first transistor T1 be deactivated and the second control line of the second control connection G2 of the second transistor T2 be deactivated. The assumption of this safe state is then measured and verified in this case D in such a way that only when the predetermined safe state is present, in the form of the discharge of the first control line of the first control connection G1 of the first transistor T1 and the second control line of the second control connection G2 of the second transistor T2 the production test mode is activated.

If a condition for taking the production test mode is already activated, the safety-relevant electronic circuit can generate or keep ready an error message that can be displayed.

This document describes the following method for activating a production test mode for a safety-relevant electronic circuit or for at least one safety-relevant electronic circuit ( IC ) proposed by several safety-relevant circuits:

In a first step, e.g. by programming a test register in a JTAG test interface, a first precondition for activating the production test mode is met.

This step should automatically bring the safety-relevant electronic circuit to be tested into a safe state that cannot be left by the production test. This is the second step. However, this must not be sufficient to activate the production test mode of the safety-relevant electronic circuit.

Only when a second precondition for activating the production test mode is fulfilled as a third step does the final activation step become possible. This fulfillment of a second precondition can be, for example, a special combination of voltage levels at different connections or a software command via another interface or the writing of a different test register etc.

The final step is to activate the production test mode when the first and second preconditions for activating the production test mode are met and when the safety-relevant electronic circuit has been converted to the safe state as a step.

In a recommended variant of the method, it is proposed to signal the fulfillment of the first precondition to the user. As a result, this user is aware of the critical state of the system and can respond. The method variant therefore comprises the step of signaling a faulty state or attempting to signal a faulty state. This can also be the provision of information about this faulty state. This can for example be done in a register of a processor or by changing the logic state of a terminal of the safety-related electronic circuit.

In another recommended variant of the method, it is again proposed to explicitly check whether the safe state has been reached by means of a special measurement. This variant therefore includes the additional step of checking the safety-relevant electronic circuit to determine whether the safe state has been successfully assumed. The safety-relevant electronic circuit can also be influenced from the outside. If the safety-relevant electronic circuit controls the control connection of a transistor, the transistor, if, for example, its control connection is electrically charged, can bring the corresponding connection of the safety-relevant electronic circuit into an unsafe state. Such a step can identify this and ultimately prevent it. The final step of activating the production test mode is therefore modified in such a way that the production test mode is only activated if the first and second preconditions for activating the production test mode are met and if the safety-relevant electronic circuit has been transferred to the safe state and if now in addition, the check reveals that the safety-relevant electronic circuit is actually in this safe state.

Of course, safety-relevant sub-devices of the safety-relevant electronic circuit must also be able to be tested so that they can assume an unsafe condition as required by the specification. In the case of the control lines of said airbag transistors, this means that it must be possible to check that they can be activated. It is therefore proposed here a variant of the method for these cases.

It is a method for activating a production test mode for a safety-relevant electronic circuit or for at least one safety-relevant electronic circuit of several safety-relevant circuits, which is a safety device, and in which it is to be checked whether a first sub-device has been brought into an unsafe state as intended can be. In order for this to be possible, the safety-relevant electronic circuit must be designed in such a way that the safety function of this first sub-device is secured again by at least one second sub-device and is preferably secured again by a third sub-device. In the case of said airbag circuit the 1 can, for example, the control line for the first transistor T1 be checked as the first sub-device whether it can be activated. Since all three transistors ( T1 . T2 . T3 ) must be switched through, secure the second transistor T2 and the third transistor T3 the squib SQ in this case still double because they are inactive during the test, i.e. they are high-impedance.

The first step is again to fulfill a first prerequisite for activating the production test mode. The first sub-device is now in Contrary to the case described above, however, it is not transferred into the safe state forcibly, since this must be explicitly possible and tested for the production test in this production test mode.

Therefore, the second step is to bring the second sub-device into a safe state, which cannot be left by the production test until the end of the production test.

The third step is to transfer the third subdevice to a safe state that can not be exited by the production test until the end of the production test.

The fourth step is again to meet a second precondition for activating the production test mode.

The second, third and fourth steps can be carried out in any order after the first step.

The fifth step is to check whether the safe state has been taken by the second part device. As a sixth step, the check is made as to whether the safe state was taken by the third sub-device. The fifth step follows after the second step. The sixth step follows after the third step.

However, the final step of activating the production test mode after all other steps now only occurs when the first and second prerequisites for activating the production test mode are met and when the transitions of the first, second and third subdevices to their respective safe states have been performed as a step and The first, second and third subdevices are actually in their respective safe states.

This procedure now looks like this in the case of an airbag control:

The proposed method is then a method for activating a production test mode for an integrated safety-related electronic circuit IC for controlling a vehicle occupant restraint system with a squib SQ or for at least one integrated safety-related electronic circuit IC of a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib SQ ,

The integrated circuit IC includes a first control line, which is provided for this purpose, a first control connection G1 of a first transistor T1 driving. The first control line can be active or inactive. The integrated circuit IC includes a second control line, which is provided for this purpose, a second control connection G2 of a second transistor T2 driving. The second control line can be active or inactive. The integrated circuit IC comprises a third control line, which is provided for a third control connection G3 of a first transistor T3 driving. The third control line can be active or inactive. The integrated circuit is typically provided for the first transistor T1 and the second transistor T2 and the third transistor T3 in series with the squib SQ are switched. The ignition of the squib SQ has at least the prerequisite in normal operation that the first control line is active and the second control line is active and the third control line is active.

The first step of the proposed method is again to fulfill a first prerequisite for activating the production test mode.

In a second step, the deactivation of the first control line of the first control terminal G1 of the first transistor T1 and locking activation of the first control line at least until the end of activation of the production test mode.

In a third step, the deactivation of the second control line of the second control terminal G2 of the second transistor T2 and locking an activation of the second control line at least until the end of activation of the production test mode.

In a fourth step, the deactivation of the third control line of the third control terminal G3 of the third transistor T3 and locking an activation of the third control line at least until the end of activation of the production test mode.

The first step usually precedes the second, third and fourth step. The second, third and fourth steps are independent of one another and are preferably carried out in parallel. Other orders of the second, third and fourth steps are possible.

Typically, following the execution of the previous four steps, the fulfillment of a second prerequisite for activating the production test mode will follow in a fifth step.

The last step in time after all the previous five steps is to activate the Production test mode, but only if all steps for deactivating all three control lines have been performed and if the first precondition and the second precondition are met.

In a variant of the method, after the step of fulfilling a first precondition for activating the production test mode, the additional step of providing information about a faulty state is carried out by the integrated circuit IC ,

In a further variant of the method, one of the control lines of the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) for the control line concerned, check whether the control line in question is really deactivated. This can be done, for example, by evaluating the potential of the control line in question. In the example above, three control lines are provided for the three transistors. Three checks for deactivation should therefore preferably be provided: one for each control line.

These checks are preferably carried out after the deactivation of the respective control line, but among themselves in any order.

During or after this, but after the fulfillment of the first precondition, a second precondition for activating the production test mode is fulfilled.

The last step of activating the production test mode takes place after all the steps only if all three control lines have been deactivated and if all three control lines are actually deactivated and if the first precondition and the second precondition are met.

Should now the first control line in the context of the production test of the safety-related integrated circuit IC can be checked so eliminates the deactivation of the first control line and thus their review. The last step of activating the production test mode in this case follows when the second and third control lines have already been deactivated and when only the second and third control lines are deactivated and when the first precondition is satisfied and the second precondition is met. In addition, as an execution condition for the activation, the selected production test mode requires this possible activation of the first control line. If, on the basis of the first prerequisite for activating the production test mode, it can be determined that the production test mode requires that the first control line not be deactivated until the end of the activation of the production test mode, the activation can take place. As such, this modified method also includes determining this need for this production test mode. This step is preferably carried out with the fulfillment of the first precondition or immediately thereafter.

Now the second control line should be part of the production test of the safety-related integrated circuit IC can be checked, the deactivation of the second control line and thus its checking is not necessary. The remaining steps are modified in an analogous manner to the basic process.

Should now the third control line in the context of the production test of the safety-related integrated circuit IC can be checked so eliminates the deactivation of the third control line and thus their review. The remaining steps are modified analogously to the basic method.

Advantage of the invention

The advantage is the secure locking of a safety-related function (e.g., blockage of an airbag ignition circuit) in the event of a potentially inadvertently occurring first entry condition for a production test mode. A simple example of such an error would be e.g. erroneous software access to a processor register intended to initiate the production test mode during normal operation.

All functions of an integrated circuit are usually tested in the production test IC changed or controlled. This has the potential to violate security goals in an uncontrolled manner. Even with multiple interlocks, there can be latent errors here, which can be avoided by immediate blocking of critical states and a display option.

list of figures

• 1 shows the embodiment of a one-stage airbag ignition stage.

LIST OF REFERENCE NUMBERS

α

first connection of the squib SQ ;

β

second connection of the squib SQ ;

ε

Connection of the integrated circuit for the first transistor T1 ;

AS

Airbag ignition system (it can also be another ignition system, for example for a pedestrian impact protection system);

CE

Condenser of energy reserve;

D1

reverse polarity protection;

G1

first control terminal of the first transistor T1 ;

G2

second control connection of the second transistor T2 ;

G3

third control terminal of the third transistor T3 ;

GND

Reference potential;

IC

integrated circuit;

ST

Control;

SQ

Squib that deploys the airbag when a predetermined electrical current is passed through it;

T1

first transistor (safety switching transistor);

T2

second transistor (high-side switch);

T3

third transistor (low-side switch);

TM

Test mode enable line. This should only become active if there are two prerequisites for activating a production test mode. It is particularly advantageous if this test mode activation line consists of preferably two lines, which in different ways and via the safety-related integrated circuit IC which both have to become active. This redundancy can further increase security;

VCC

Supply voltage.

Claims (9)

Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a passenger restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) for several integrated safety-related circuits for controlling a pedestrian impact protection system with a squib (SQ) . - The integrated circuit (IC) comprises a first control line, which is intended to control a first control connection (G1) of a first transistor (T1) and - The first control line can be active or inactive and - The integrated circuit (IC) comprises a second control line, which is provided to control a second control connection (G2) of a second transistor (T2) and - The second control line can be active or inactive and - The integrated circuit (IC) comprises a third control line, which is provided to control a third control terminal (G3) of a third transistor (T3) and - The third control line can be active or inactive and - The integrated circuit is provided so that the first transistor (T1) and the second transistor (T2) and the third transistor (T3) are connected in series with the squib (SQ) and - The ignition of the squib (SQ) in normal operation has at least the prerequisite that the first control line is active and the second control line is active and the third control line is active comprising the steps - fulfill a first precondition for activating the production test mode; - Deactivating the first control line of the first control connection (G1) of the first transistor (T1) and locking an activation of the first control line at least until the end of the activation of the production test mode; - Deactivating the second control line of the second control connection (G2) of the second transistor (T2) and locking an activation of the second control line at least until the end of the activation of the production test mode; - Deactivating the third control line of the third control connection (G3) of the third transistor (T3) and locking an activation of the first control line at least until the end of the activation of the production test mode; - fulfilling a second precondition for activating the production test mode; - Activate the production test mode when all three control lines have been deactivated and when the first precondition is met and the second precondition is met. Method according to Claim 1 - comprising the steps - providing information about a faulty state by the integrated circuit (IC); Method according to Claim 1 - comprising the steps - checking whether the first control line is deactivated; - Check if the second control line is deactivated; - Check if the third control line is deactivated; - contrary to Claim 1 : Enable the production test mode if all three control lines have been disabled and if all three Control lines are disabled and when the first precondition is met and the second precondition is met. Method according to Claim 1 in which a check of the first control line in the production test mode of the integrated safety-related electronic circuit (IC) should be possible, comprising the steps of - determining that the production test mode due to the first prerequisite for activation of the production test mode requires that the first control line NOT necessarily until the end the activation of the production test mode is deactivated, and then deviating from the Claim 1 no deactivation of the first control line of the first control terminal (G1) of the first transistor (T1) and no locking of an activation of the first control line, as in Claim 1 described, done; - Check if the second control line is deactivated; - Check if the third control line is deactivated; - Deviating from Claim 1 : Activating the production test mode when the second and third control lines have been deactivated and when the second and third control lines are disabled and the first precondition is met and the second precondition is met and if it is determined by the first prerequisite for activating the production test mode that the Production test mode requires that the first control line not necessarily be deactivated until the end of activation of the production test mode. Procedure according to Claim 1 , - a test of the second control line in the production test mode of the integrated safety-relevant electronic circuit (IC) should be possible comprising the steps - determining that the production test mode requires that the second control line does NOT necessarily end until the end due to the first precondition for activating the production test mode the activation of the production test mode is deactivated, which then differs from Claim 1 no deactivation of the second control line of the second control connection (G2) of the second transistor (T2) and no locking of an activation of the second control line, as in Claim 1 described, done; - Check whether the first control line is deactivated; - Check whether the third control line is deactivated; - Notwithstanding Claim 1 : Activate the production test mode when the first and third control lines have been deactivated and when the first and third control lines have been deactivated and when the first precondition has been met and the second precondition has been met and if it is determined based on the first precondition for activating the production test mode that the Production test mode it requires that the second control line is not forcibly deactivated until the end of the activation of the production test mode. Method according to Claim 1 in which a check of the third control line in the production test mode of the integrated safety-related electronic circuit (IC) should be possible, comprising the steps of - determining that the production test mode due to the first prerequisite for activation of the production test mode requires that the third control line NOT necessarily until the end the activation of the production test mode is deactivated, in which case deviating from Claim 1 no deactivation of the third control line of the third control terminal (G3) of the third transistor (T3) and no locking of an activation of the first control line, as in Claim 1 described, done; - Check if the first control line is deactivated; - Check if the second control line is deactivated; Fulfillment of a second precondition for activating the production test mode; - Deviating from Claim 1 : Activating the production test mode when the first and second control lines have been deactivated and when the first and second control lines are deactivated and the first precondition is met and the second precondition is satisfied and it is determined from the first condition for activating the production test mode that the Production test mode requires that the third control line not necessarily be deactivated until the end of activation of the production test mode. Procedure according to the Claims 4 and 5 - A test of the first control line in a first production test mode of the integrated safety-relevant electronic circuit (IC) should be possible and - whereby a test of the second control line in a second production test mode of the integrated safety-relevant electronic circuit (IC) should be possible comprising the steps - activation of the first production test mode by the method according to Claim 4 ; - Activation of the second production test mode by the method after Claim 5 ; - The first production test mode is different from the second production test mode and - The first production test mode cannot be activated when the second production test mode is active and - The second production test mode cannot be activated when the first production test mode is active. Method according to the Claims 4 and 6 - In which a test of the first control line in a first production test mode of the integrated safety-related electronic circuit (IC) should be possible and - a test of the third control line in a second production test mode of the integrated safety-related electronic circuit (IC) should be possible comprising the steps - Activate of the first production test mode by the method Claim 4 ; Activating the second production test mode by the method of Claim 6 ; wherein the first production test mode is different from the second production test mode and wherein the first production test mode can not be activated when the second production test mode is active and wherein the second production test mode can not be activated when the first production test mode is active. Method according to the Claims 5 and 6 - In which a test of the second control line in a first production test mode of the integrated safety-related electronic circuit (IC) should be possible and - a test of the third control line in a second production test mode of the integrated safety-related electronic circuit (IC) should be possible comprising the steps - Activate of the first production test mode by the method Claim 5 ; Activating the second production test mode by the method of Claim 6 ; wherein the first production test mode is different from the second production test mode and wherein the first production test mode can not be activated when the second production test mode is active and wherein the second production test mode can not be activated when the first production test mode is active.

Images