DE102018110937A1 - Method for the reliable simplified activation of production test modes in safety-relevant electronic circuits for pedestrian impact protection systems - Google Patents

Abstract

A method for activating a production test mode for a safety-related electronic circuit is proposed. Such a safety-relevant circuit may be, for example, an airbag ignition system or an ignition system for a pedestrian impact protection device. After fulfilling a first precondition for activating the production test mode, the transfer of the safety-related electronic circuit into a safe state, which can not be left by the production test, takes place. With the fulfillment of a second precondition for activating the production test mode, the production test mode is activated only if the first and second prerequisites for activating the production test mode are fulfilled and if the transfer of the at least one safety-related electronic circuit to the safe state has been carried out. For the test of the activability of unsafe states of signals, at least one subdevice is brought to a safe state, which means that an unsafe state of the signal to be tested can not lead to an unsafe state of the overall system. Preferably, more than one subsystem is brought into such a state. Most preferably, all subsystems are brought into such a safe state except for the subsystem to be tested.

Description

preamble

A method of activating a production test mode for a safety-related electronic circuit, and more particularly a method of activating a production test mode for an integrated safety-related electronic circuit ( IC ) for controlling a vehicle occupant restraint system with a squib ( SQ ) proposed.

General introduction

• • IEC 61511: Funktionale Sicherheit - für Sicherheitstechnische Systeme für die Prozessindustrie
• • IEC 61513: Kernkraftwerke - für Leittechnik für Systeme mit sicherheitstechnischer Bedeutung - Allgemeine Systemanforderungen
• • EN 50128: Bahnanwendungen - für Telekommunikationstechnik, Signaltechnik und Datenverarbeitungssysteme - für sicherheitsrelevante elektronische Systeme für die Signaltechnik
• • IEC 62061: Sicherheit von Maschinen - für die funktionale Sicherheit sicherheitsbezogener elektrischer, elektronischer und programmierbarer elektronischer Steuerungssysteme
• • ISO 26262: Road Vehicles - Funktionale Sicherheit für Automobile

Electronic systems and in particular integrated circuits are used in a wide variety of safety-relevant systems. Relevant exemplary standards that such systems have to meet, depending on the application, are, for example (without claiming to be complete here):

• • IEC 61511: Functional safety - for safety-related systems for the process industry
• • IEC 61513: Nuclear power plants - for control systems for safety-related systems - General system requirements
• • EN 50128: Railway applications - for telecommunications, signaling and data processing systems - for safety-related electronic signaling systems
• • IEC 62061: Safety of machinery - for the functional safety of safety-related electrical, electronic and programmable electronic control systems
• • ISO 26262: Road Vehicles - Functional safety for automobiles

Prior to the delivery of such safety-related electronic systems and during production, these systems must be fully tested for proper functioning of all components. Their number can reach in integrated circuits two-digit powers of ten.

Therefore, special production test modes (test states of the electronic systems) are provided in order to be able to quickly and cost-effectively bring this component into all possible relevant states for each of the components of the electronic system to be tested and to observe the response of that component such that a good / bad Statement with respect to each parameter to be tested this component is possible.

As a rule, therefore, these electronic systems in these production test modes are not compliant with specification and therefore not safe. Through various influences, it is now possible that signals for activating the production test modes are inadvertently activated during normal operation. In the simplest case, this can be done for example by natural radioactivity or a failure of a subcomponent of the electronic system. Therefore, such an event should not become a security risk.

A production test implementation in safety-relevant products thus always harbors the potential for critical, safety-relevant errors in the case of unintentional activation of a production test mode in safety-relevant normal operation.

State of the art

In the following, an electronic circuit will be described as an integrated circuit. However, the proposed methodology can be applied to any other electronic system.

There are countless methods of putting integrated circuits into a production test mode (test state). In the simplest case, a port is pulled to a certain level, which is not normally operated at that level. Also, activation via certain memory locations of registers of a processor is known, as long as the integrated circuit has a processor. Particularly well-suited, as standardized, is the test via an IEEE-1149 compatible JTAG test interface and the test registers of the associated JTAG test controller.

From the prior art, the multiple locking of test modes is known. This prior art is particularly known in the form of integrated circuits which are freely available on the market. Production test modes always have to be activated first. In order to achieve the necessary security, however, multiple locking is sometimes not enough. When the failure rates due to the circuit design are calculated, in certain cases, particularly in integrated circuits for controlling vehicle occupant restraint systems (airbags) or for controlling pedestrian impact protection systems, the likelihood of erroneously activating safety-related functions, such as the firing of an airbag or a pedestrian impact protection system, is necessary while driving, to lower even further in order to meet the requirements of the standards exemplified above. Such erroneous activation of safety-related functions can also be done, for example, by the accidental activation of a production test mode in normal operation.

As relevant patent literature can here, for example, the US 2014/0 039 764 A1 designating a pre-inspection method to inspect an air bag controller prior to shipment. Furthermore, the German patent application DE 10 2005 030 770 A1 Of particular importance, which indicates a method for controlling a safety device in the vehicle. In addition, here is the DE 198 28 432 A1 which describes the use of a safety switch in airbags per se as a particularly early disclosure of this protective mechanism. Likewise at this point is the DE 103 50 853 A1 named as relevant state of the art. The DE 103 50 853 A1 discloses unlocking an actuator in response to various control and enable signals.

All these writings have in common that they describe how, for example, by mutual locking and / or safety switch is ensured that there is no accidental triggering of an air bag. In quality engineering, however, such prevention is known as a containment measure for a problem that has already arisen before its manifestation as an error. However, the present disclosure is not intended, as the disclosures referred to above, to allow a safe test but to prevent inadvertent ingestion of a test condition. In the following description, therefore, it is expressly not about the safe testing of a safety-relevant integrated circuit, but about the safe assumption of a safe test state in which such a test can take place. This problem manifests itself in calculations in the context of functional safety so that the effort to reduce the probability of an erroneous activation of safety-relevant functions by an inadvertent activation of production test modes is significantly reduced by this approach.

Object of the invention

The invention is therefore based on the object to provide a solution that further reduces the likelihood of erroneously activating safety-related functions by accidental activation of production test modes.

This object is achieved by a method according to claim 1.

Solution of the problem of the invention

The starting point for the intended likelihood reduction is to increase the detection and signaling of potential, presumed inadvertent access to production test functions while increasing the likelihood of obtaining a predefined safe state in this case.

The basic idea of the proposed method is therefore to specify at least two entry conditions for the production test, but also to design the construction of the system such that a reliable functional state is already mandatory when the first entry conditions for the production test are met.

This method is based on the example of a schematically simplified airbag ignition system, as known from the prior art, with the aid of 1 explained. Such ignition circuits are also used in pedestrian impact protection systems.

The exemplary airbag ignition system AS becomes from the operating power network of the vehicle with the supply voltage VCC supplied in normal operation. This is an energy reserve in the form of a capacitor CE loaded and kept ready. This is used in case of failure of the supply voltage VCC by the consequences of an accident of the vehicle for maintaining the power supply of the airbag ignition system AS , A polarity reversal protection diode D1 prevents the feeding back of the energy reserve CE stored energy in the power grid of the vehicle. The airbag ignition system AS consists of a series connection of at least three transistors ( T1 . T2 . T3 ) and the squib SQ of the airbag, as well as the controller ST and the capacitor CE the energy reserve and the polarity reversal protection diode D1 , The squib SQ typically has a first port and a second port. The first of the three transistors ( T1 . T2 . T3 ) is a safety switching transistor T1 which is preferably provided only once and preferably outside the integrated circuit. The second transistor T2 is the so-called high-side switch, because he, when the safety switching transistor T1 is connected directly to the typically positive supply voltage VCC via the polarity reversal protection diode D1 connected is. The third transistor T3 is the so-called low-side switch, since it is directly connected to the typically negative supply voltage, the reference potential GND , connected is. Between the high-side switch, that is the second transistor T2 , and the low-side switch, so the third transistor T3 , is the squib SQ arranged, which supplies the gas for the explosive deployment of the airbag when ignited. For this, the squib must SQ be traversed by an electric current. So it is necessary all three transistors T1 . T2 . T3 to turn on at the same time ie to activate the primer SQ to ignite and unfold the airbag.

For example, in a pedestrian impact protection system, instead of deploying the airbag, the engine compartment door would be brought upwardly slightly angled through the explosive charge to reduce head impact forces upon collision with a pedestrian by extending the travel distance.

The activation of the first transistor T1 takes place by activating the first control terminal G1 of the first transistor T1 ,

Activation of the second transistor T2 takes place by activating the second control terminal G2 of the second transistor T2 ,

Activation of the third transistor T3 takes place by activating the third control terminal G3 of the third transistor T3 ,

Typically, the first transistor is located T1 outside the integrated circuit IC while the second transistor T2 and the third transistor T3 preferably part of the integrated circuit IC are. The squib SQ Of course, this is not part of the integrated circuit IC , Due to the required storage capacity is the capacitor CE the energy reserve also typically outside of the integrated circuit IC , A controller ST within the integrated circuit IC now supplies the control signals for the first control connection G1 of the first transistor T1 and for the second control terminal G2 of the second transistor T2 and for the third control terminal G3 of the third transistor T3 ,

• Fall A
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall B
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird NICHT unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall C
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird NICHT unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall D
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird NICHT unterbunden.

It is now proposed that by activating a production test mode, here for example by the to the controller ST connected test mode activation line TM , one of the following four cases occurs:

• Case A
  • • The activation of the first control connection G1 of the first transistor T1 is stopped and
  • • the activation of the second control connection G2 of the second transistor T2 is stopped and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case B
  • • The activation of the first control connection G1 of the first transistor T1 is NOT prohibited and
  • • the activation of the second control connection G2 of the second transistor T2 is stopped and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case C
  • • The activation of the first control connection G1 of the first transistor T1 is stopped and
  • • the activation of the second control connection G2 of the second transistor T2 is NOT prohibited and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case D
  • • The activation of the first control connection G1 of the first transistor T1 is stopped and
  • • the activation of the second control connection G2 of the second transistor T2 is stopped and
  • • the activation of the third control connection G3 of the third transistor T3 is NOT prohibited.

Here, the term "active" for a control line for a control connection ( G1 . G2 . G3 ) one of the transistors ( T1 . T2 . T3 ) to understand that in normal operation the squib SQ ignites as soon as all three control lines of the three control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) Are "active".

Case A should be chosen for all test modes in which none of the three control lines of the three control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) should be tested.

Cases B, C and D allow the checking of the three control lines of the three control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) in the production test in a special production test mode without the likelihood of triggering the squib SQ to increase beyond a tolerable level in normal operation.

This makes it an essential feature of an airbag ignition system AS according to this proposal, if for the examination of a first connection α of the integrated circuit IC , for the connection of the first pole of the squib SQ is provided, a first production test mode is provided and for the test of a second connection β of the integrated circuit IC , for the connection of the second pole of the squib SQ a second test mode is provided and that in the first test mode the second port β opposite the reference potential GND is high impedance and that in the second test mode the first port α for the squib SQ opposite the connection ε for the safety switching transistor T1 is high impedance.

This means high impedance for the second transistor T2 that the resistance between the first port α for the squib SQ opposite the connection ε for the switching transistor T1 by a factor of at least 50 is smaller than the resistance of the second transistor T2 shows when the second control terminal G2 of the second transistor T2 is active.

This means high impedance for the third transistor T3 that the resistance between the second port β for the squib SQ and the reference potential GND by a factor of at least 50 smaller than the resistance of the third transistor T3 shows when the third control terminal G3 of the third transistor T3 is active.

However, experience has shown that it is not enough to G1 . G2 . G3 ) inactive. Rather, these lines store electrical charges. Therefore, even a faulty, dangerous state can still be taken in a transient switching. In the preparation of this proposal, it was therefore recognized that the control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) must be discharged for a safe state of the safety-related electronic circuit.

Therefore it is recommended to activate the production test mode only when the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) are actually disabled by unloading. For this purpose, a monitoring circuit may be provided which determines the actual state of the control lines of the control connections ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ).

It is thus a feature of this proposal that not only by fulfilling one of at least two conditions for the activation of the production test mode for an electronic system, the system already in a safe state, here by deactivating all three or at least two control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ), but that the assumption of this safe state is measured and verified and is activated only when the predetermined safe state is present. In the present case, this predetermined safe state by the discharge of all three or at least two control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ).

In case A

In case A, none of the control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) checked. The activation of the relevant production test mode, for example, by activating the test mode activation line TM initiated. For activating this production test mode in an airbag ignition system AS Therefore, all three control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) are disabled. The assumption of this safe state is in this case A then measured and verified that only in the presence of the predetermined safe state, in the form of the discharge of all three control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) the production test mode is activated.

In case B

In case B, the first control line of the first control terminal G1 of the first transistor T1 tested by the production test in this production test mode. The activation of this respective production test mode is, for example, by activating the test mode activation line TM initiated. For activation of the production test mode in an airbag ignition system AS Therefore, in this case, B should be the second control line of the second control terminal G2 of the second transistor T2 be deactivated and the third control line of the third control terminal G3 of the third transistor T3 be deactivated. The assumption of this safe state is then measured and verified in this case B so that only in the presence of the predetermined safe state, in the form of the discharge of the second control line of the second control terminal G2 of the second transistor T2 and the third control line of the third control terminal G3 of the third transistor T3 the production test mode is activated.

In case C

In the case C becomes the second control line of the second control terminal G2 of the second transistor T2 tested by the production test in this production test mode. The activation of this respective production test mode is, for example, by activating the test mode activation line TM initiated. For activation of the production test mode in an airbag ignition system AS Therefore, in this case, C should be the first control line of the first control terminal G1 of the first transistor T1 be deactivated and the third control line of the third control terminal G3 of the third transistor T3 be deactivated. The assumption of this safe state is then measured and verified in this case C so that only in the presence of the predetermined safe state, in the form of the discharge of the first control line of the first control terminal G1 of the first transistor T1 and the third control line of the third control terminal G3 of the third transistor T3 Activated production test mode.

For the case D

In case D, the third control line of the third control terminal G3 of the third transistor T3 tested by the production test in this production test mode. The activation of the relevant production test mode, for example, by activating the test mode activation line TM initiated. For activating this production test mode in an airbag ignition system AS Therefore, in this case D should be the first control line of the first control terminal G1 of the first transistor T1 be deactivated and the second control line of the second control terminal G2 of the second transistor T2 be deactivated. The assumption of this safe state is then measured and verified in this case D so that only in the presence of the predetermined safe state, in the form of the discharge of the first control line of the first control terminal G1 of the first transistor T1 and the second control line of the second control terminal G2 of the second transistor T2 the production test mode is activated.

If a condition for taking the production test mode is already activated, the safety-relevant electronic circuit can generate or keep ready an error message that can be displayed.

In this document, the following method is used for activating a production test mode for a safety-related electronic circuit or for at least one safety-relevant electronic circuit ( IC ) proposed by several safety-related circuits:

In a first step, a first precondition for activating the production test mode is fulfilled. This is done by transmitting a first request to the device via a first interface. For example, this can be done by means of programming a first test register of the safety-relevant electronic circuit to be tested in a JTAG test interface of this safety-relevant electronic circuit to be tested.

The safety-relevant electronic circuit to be tested should automatically be brought into a safe state by this step, which can not be left by the production test. This is the second step. However, this may not be sufficient for activating the production test mode of the safety-relevant electronic circuit.

Only the fulfillment of a second precondition for activating the production test mode as a third step enables the final activation step. In this third step, the second precondition for activating the production test mode is fulfilled. This is done again by transmitting a second request to the device via the first interface. For example, this can be done by means of programming a second test register of the safety-relevant electronic circuit to be tested in said JTAG test interface of this safety-relevant electronic circuit to be tested. The second test register must be different from the first test register. However, a complete separation of the activation paths is preferred. In the case of complete separation, in this third step, the second precondition for activating the production test mode but also with better protection is fulfilled. This is done again by transmitting a second request but now via a second interface to the device, which is different from the first interface.

This fulfillment of a second precondition can be, for example, a specific combination of voltage levels at different terminals (the terminals represent an interface here) or a software command via another interface etc.

As interfaces ( IF1 . IF2 ) the electrical connections of the safety-relevant electronic circuit to be tested ( IC ), wherein the signaling takes place, for example, on particular voltage and / or current levels or time sequences and combinations thereof, and / or data interfaces, such as SPI bus interfaces, or sensor interfaces, such as PSI5 or DSI3 interfaces or corresponding other interfaces. The important thing is that the first precondition and the second precondition do not have to be met via unequal interfaces, whereby an increased security against accidental assumption of an insecure state is achieved.

The final step is to activate the production test mode when the first and second prerequisites for activating the production test mode are met and when the transfer of the production test mode is completed safety-related electronic circuit in the safe state was performed as a step.

In a recommended variant of the method, it is proposed to signal the fulfillment of the first precondition to the user. As a result, this user is aware of the critical state of the system and can respond. The method variant therefore comprises the step of signaling a faulty state or attempting to signal a faulty state. This can also be the provision of information about this faulty state. This can for example be done in a register of a processor or by changing the logic state of a terminal of the safety-related electronic circuit.

In a further recommended variant of the method, it is again proposed to explicitly check the assumption of the safe state by special measurement. Therefore, this variant includes the additional step of checking the safety-related electronic circuit on whether the safe state is successfully taken. In this case, the safety-relevant electronic circuit can also be influenced from outside. If the safety-relevant electronic circuit controls the control terminal of a transistor, the transistor, for example, if its control terminal is electrically charged, can bring the corresponding terminal of the safety-relevant electronic circuit into an unsafe state. This can be detected by such a step and thus ultimately prevented. The final step of activating the production test mode is therefore modified such that the activation of the production test mode occurs only when the first and second prerequisites for activating the production test mode are met and when the safety-related electronic circuit has been transitioned to the safe state and if now In addition, the check reveals that the safety-relevant electronic circuit is actually in this safe state.

Of course, safety-relevant sub-devices of the safety-relevant electronic circuit must also be able to be tested so that they can assume an unsafe condition as required by the specification. In the case of the control lines of said airbag transistors, this means that it must be possible to check that they can be activated. It is therefore proposed here a variant of the method for these cases.

This is a method for activating a production test mode for a safety-relevant electronic circuit or for at least one safety-relevant electronic circuit of a plurality of safety-relevant circuits, which is a safety device, and in which it is to be checked whether a first sub-device has been brought into an unsafe state as intended can be. In order for this to be possible, the safety-relevant electronic circuit must be constructed such that the safety function of this first sub-device is again secured by at least one second sub-device and is again secured by a third sub-device. In the case of said airbag circuit the 1 For example, the control line for the first transistor T1 be checked as the first sub-device to see if it can be activated. Since for firing the squib all three transistors ( T1 . T2 . T3 ) must be switched through, secure the second transistor T2 and the third transistor T3 the squib SQ in this case, still twice, that they are inactive during the test, so high impedance.

The first step is again to fulfill a first prerequisite for activating the production test mode. However, in contrast to the case described above, the first sub-device is not forcibly transferred to the secure state since this must be explicitly possible and tested for the production test in this production test mode.

Therefore, as a second step, the transfer of the second subdevice to a safe state, which can not be exited by the production test until the end of the production test, follows.

The third step is to transfer the third subdevice to a safe state that can not be exited by the production test until the end of the production test.

As a fourth step, the fulfillment of a second precondition for activating the production test mode takes place again.

The second, third and fourth steps can be performed in any time order after the first step.

The fifth step is to check whether the safe state has been taken by the second part device. As a sixth step, the check is made as to whether the safe state was taken by the third sub-device. The fifth step follows after the second step. The sixth step follows after the third step.

The final step of activating the production test mode is after all other steps however, only if the first and second prerequisites for activating the production test mode are met and if the transfers of the first, second and third subdevices to their respective safe states have been performed as a step and the first, second and third subdevices are indeed in their respective safe ones States are located.

This procedure now looks like this in the case of an airbag control:

The proposed method is then a method for activating a production test mode for an integrated safety-related electronic circuit IC for controlling a vehicle occupant restraint system with a squib SQ or for at least one integrated safety-related electronic circuit IC of a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib SQ ,

The integrated circuit IC comprises a first control line, which is provided to a first control terminal G1 a first transistor T1 head for. The first control line can be active or inactive. The integrated circuit IC comprises a second control line, which is provided to a second control terminal G2 a second transistor T2 head for. The second control line can be active or inactive. The integrated circuit IC comprises a third control line, which is provided to a third control terminal G3 a first transistor T3 head for. The third control line can be active or inactive. The integrated circuit is typically provided for the first transistor T1 and the second transistor T2 and the third transistor T3 in series with the squib SQ are switched. The ignition of the squib SQ has in normal operation, at least the condition that the first control line is active and the second control line is active and the third control line is active.

The first step of the proposed method is again to fulfill a first prerequisite for activating the production test mode.

In a second step, the deactivation of the first control line of the first control terminal G1 of the first transistor T1 and locking activation of the first control line at least until the end of activation of the production test mode.

In a third step, the deactivation of the second control line of the second control terminal G2 of the second transistor T2 and locking an activation of the second control line at least until the end of activation of the production test mode.

In a fourth step, the deactivation of the third control line of the third control terminal G3 of the third transistor T3 and locking an activation of the third control line at least until the end of activation of the production test mode.

The first step usually precedes the second, third and fourth steps. The second, third and fourth steps are independent of each other and are preferably carried out in parallel. Other orders of the second, third and fourth steps are possible.

Typically, following the execution of the previous four steps, the fulfillment of a second prerequisite for activating the production test mode will follow in a fifth step.

Activation of the production test mode takes place as the last step after all the preceding five steps, but only if all steps for deactivating all three control lines have been carried out and if the first precondition and the second precondition are fulfilled.

In a variant of the method, after the step of fulfilling a first precondition for activating the production test mode, the additional step of providing information about a faulty state by the integrated circuit takes place IC ,

In a further variant of the method, after each step of the deactivation of one of the control lines of the control terminals ( G1 . G2 . G3 ) of the transistors ( T1 . T2 . T3 ) for the affected control line in each case the check whether the relevant control line is really disabled. This can be done, for example, by evaluating the potential of the relevant control line. In the above example, three control lines are provided for the three transistors. Thus, preferably three checks for deactivation should be provided: One for each control line.

These checks are preferably always after the deactivations of the respective control line but with each other in any order.

During or after this, but after the fulfillment of the first precondition, a second precondition for activating the production test mode is fulfilled.

The last step of activating the production test mode occurs after all steps only if all three control lines have been deactivated and if all three control lines are actually deactivated and if the first precondition and the second precondition are fulfilled.

Should now the first control line in the context of the production test of the safety-related integrated circuit IC can be checked so eliminates the deactivation of the first control line and thus their review. The last step of activating the production test mode in this case follows when the second and third control lines have already been deactivated and when only the second and third control lines are deactivated and when the first precondition is satisfied and the second precondition is met. In addition, as an execution condition for the activation, the selected production test mode requires this possible activation of the first control line. If, on the basis of the first prerequisite for activating the production test mode, it can be determined that the production test mode requires that the first control line not be deactivated until the end of the activation of the production test mode, the activation can take place. As such, this modified method also includes determining this need for this production test mode. This step is preferably carried out with the fulfillment of the first precondition or immediately thereafter.

Should now the second control line within the production test of the safety-related integrated circuit IC can be checked so eliminates the deactivation of the second control line and thus their review. The remaining steps are modified analogously to the basic method.

Should now the third control line in the context of the production test of the safety-related integrated circuit IC can be checked so eliminates the deactivation of the third control line and thus their review. The remaining steps are modified analogously to the basic method.

The 2 shows an embodiment of the test mode activation line ( TM ). The device parts of 2 are preferably part of the controller ( ST ). In the example of 2 is via a first data bus ( DB1 ), which must be analogue, digital, serial or otherwise suitable for signaling, to a first interface ( IF1 ) of the integrated circuit ( IC ) for assuming a desired test state of the integrated circuit ( IC ) signals a first message to fulfill the first condition for activating the production test mode. Furthermore, via a second data bus ( DB2 ), which must also be analog, digital, serial or otherwise suitable for signaling, to a second interface ( IF2 ) integrated circuit ( IC ) for assuming a desired test state of the integrated circuit ( IC ) signals a second message to fulfill the second prerequisite for activating the production test mode. Receives the first interface ( IF1 ) said first message to fulfill the first condition for activating the production test mode over the first data bus ( DB1 ) it activates a first test request signal ( TRQ1 ). Receives in the example of the 2 the second interface ( IF2 ) said second message to fulfill the second prerequisite for activating the production test mode via the second data bus ( DB2 ) it activates a second test request signal ( TRQ2 ). After resetting the integrated circuit ( IC ) by switching on or for other reasons and in normal operation, the first test request signal ( TRQ1 ) and the second test request signal ( TRQ2 ) not active. If both the first test request signal ( TRQ1 ) and at the same time the second test request signal ( TRQ2 ), the requested activation of the production test mode takes place via a test mode signal ( Tstm ). Is only one of the two test request signal ( TRQ1 . TRQ2 ) and the other test request signal ( TRQ1 . TRQ2 ) is not active, then for the integrated circuit ( IC ) taking a safe state in this example via a blocking signal ( blk ) enforced. Of course, it is conceivable to use more than two preconditions. Are both test request signals ( TRQ1 . TRQ2 ), the blocking signal ( blk ) are not set to allow the test of safety-relevant non-safe, specification-compliant states. Are both test request signals ( TRQ1 . TRQ2 ) is not active, the blocking signal ( blk ) also not be set active in order to allow the test of safety-relevant non-safe, specification-compliant states.

Advantage of the invention

The advantage is the secure locking of a safety-related function (e.g., blockage of an airbag ignition circuit) in the event of a potentially inadvertently occurring first entry condition for a production test mode. A simple example of such an error would be e.g. erroneous software access to a processor register intended to initiate the production test mode during normal operation.

In the production test usually all functions of an integrated circuit IC changed or controlled. This holds the potential Uncontrolled violation of security goals. Even with multiple locking, there may be latent errors that are avoided by immediate blocking of critical states as well as a display capability.

list of figures

• 1 shows the embodiment of a single-stage airbag ignition stage.
• 2 shows an embodiment of the test mode activation line ( TM ).

LIST OF REFERENCE NUMBERS

α

first connection of the squib SQ;

β

second port of the squib SQ;

ε

Connecting the integrated circuit for the first transistor T1;

AS

Airbag ignition system (it may also be another ignition system, for example a pedestrian impact protection system);

blk

Blocking signal. The blocking signal (blk) preferably forces the integrated circuit (IC) to take a safe state. For example, the first transistor, the safety switching transistor (T1) is preferably disabled when the blocking signal is active. Other measures such as the blocking of the other transistors (T2, T3) are conceivable in the case of an active blocking signal. If both test request signals (TRQ1, TRQ2) are active, then the blocking signal can not be set active in order to allow the test of safety-relevant non-safe, specification-compliant states. If both test request signals (TRQ1, TRQ2) are not active, the blocking signal (blk) can likewise not be set active in order to allow the test of safety-relevant non-safe, specification-compliant states.

CE

Capacitor of the energy reserve;

D1

reverse polarity protection;

DB1

first data bus. It may also be, for example, a signal with a fixed level, which is placed in the case of a production test at a predetermined voltage or current level;

DB2

second data bus. It may also be, for example, a signal with a fixed level, which is placed in the case of a production test at a predetermined voltage or current level;

IF1

first interface. It can be a serial or parallel interface or any other connection of the integrated circuit (IC).

IF2

second interface. It can be a serial or parallel interface or any other connection of the integrated circuit (IC).

G1

first control terminal of the first transistor T1;

G2

second control terminal of the second transistor T2;

G3

third control terminal of the third transistor T3;

GND

Reference potential;

IC

integrated circuit;

ST

Control;

SQ

A squib that deployes the airbag when flowed through with a predetermined electrical current;

T1

first transistor (safety switching transistor);

T2

second transistor (high-side switch);

T3

third transistor (low-side switch);

TM

Test mode enable line. This should only be active if two

Prerequisites for activating a production test mode. It is particularly advantageous if this test mode activation line consists of preferably two lines which are routed in different ways via the safety-related integrated circuit IC and which must both become active. This redundancy can further increase security;

TRQ1

first test request signal. If, for example, the first interface (IF1) receives a first message to fulfill the first prerequisite for activating the production test mode via the first data bus (DB1), it preferably activates the first test request signal. After resetting the integrated circuit (IC) by turning it on or for other reasons and In normal operation, the first test request signal is preferably not active.

TRQ2

second test request signal. For example, if the second power up interface (IF2) receives a second message to fulfill the second prerequisite for activating the production test mode via the second data bus (DB2), it preferably activates the second test request signal. After resetting the integrated circuit (IC) by or for other reasons and in normal operation, the second test request signal is preferably not active.

Tstm

Test mode signal. The test mode signal is preferably not active during normal operation. If both the first test request signal (TRQ1) and the second test request signal (TRQ2) are active at the same time, the requested activation of the production test mode takes place via the activation of the test mode signal.

VCC

Supply voltage.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2014/0039764 A1 [0010]
• DE 102005030770 A1 [0010]
• DE 19828432 A1 [0010]
• DE 10350853 A1 [0010]

Claims (6)

Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a passenger restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) of several integrated safety-relevant circuits for controlling a pedestrian impact protection system with a squib (SQ) . - wherein the integrated circuit (IC) comprises a first control line, which is intended to control a first control terminal (G1) of a first transistor (T1) and - Wherein the first control line can be active or inactive and - Wherein the integrated circuit (IC) comprises a second control line, which is intended to control a second control terminal (G2) of a second transistor (T2) and - Wherein the second control line can be active or inactive and - Wherein the integrated circuit (IC) comprises a third control line, which is intended to control a third control terminal (G3) of a third transistor (T3) and - Where the third control line can be active or inactive and - wherein the integrated circuit is provided so that the first transistor (T1) and the second transistor (T2) and the third transistor (T3) are connected in series with the squib (SQ) and - Wherein the ignition of the squib (SQ) in normal operation has at least the condition that the first control line is active and the second control line is active and the third control line is active, comprising the steps Fulfilling a first precondition for activating the production test mode by transmitting a first message via a first interface (IF1); Deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking activation of the first control line at least until the end of activation of the production test mode or deactivating the second control line of the second control terminal (G2) of the second transistor (T2) and Locking activation of the second control line at least until the end of activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking activation of the first control line at least until the end of activation of the production test mode; Fulfilling a second prerequisite for activating the production test mode by transmitting a second message via a second interface (IF2) different from the first interface (IF1); Activating the production test mode if at least one control line of the three control lines has been deactivated and if the first precondition is fulfilled and the second precondition is fulfilled. Method according to Claim 1 comprising the step of - providing information about a faulty state by the integrated circuit (IC). Method according to Claim 1 comprising the steps of - checking whether the previously deactivated control lines are deactivated; - Different from activating the production test mode after Claim 1 now activating the production test mode when a control line of the three control lines has been deactivated and when at least this control line of the three control lines is deactivated and when the first precondition is satisfied and the second precondition is fulfilled. Method according to Claim 1 in which a test of the first control line in the production test mode of the integrated safety-related electronic circuit (IC) should be possible deviating from Claim 1 not comprising the steps - deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking activation of the first control line at least until the end of activation of the production test mode or deactivating the second control line of the second control terminal (G2) of the second transistor ( T2) and locking an activation of the second control line at least until the end of the activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking activation of the first control line at least until the end of activation of the production test mode; comprising the steps of - determining that the production test mode requires that the first control line NOT be forcibly disabled until the end of activation of the production test mode due to the first prerequisite for activating the production test mode; Disabling the second control line of the second control terminal (G2) of the second transistor (T2) and locking activation of the second control line at least until the end of activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and Locking activation of the third control line at least until the end of activation of the production test mode; - Check if deactivated control lines are deactivated; Activating the production test mode if at least one control line has been deactivated by the second or third control line and if at least this control line is deactivated and if the first precondition is satisfied and the second precondition is fulfilled and if it is determined on the basis of the first precondition for activating the production test mode, the production test mode requires that the first control line not be forcibly disabled until the end of activation of the production test mode. Method according to Claim 1 in which a test of the second control line in the production test mode of the integrated safety-relevant electronic circuit (IC) should be possible deviating from Claim 1 not comprising the steps - deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking activation of the first control line at least until the end of activation of the production test mode or deactivating the second control line of the second control terminal (G2) of the second transistor ( T2) and locking an activation of the second control line at least until the end of the activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking activation of the first control line at least until the end of activation of the production test mode; comprising the steps of - determining that the production test mode requires that the second control line NOT be forcibly disabled until the end of activation of the production test mode due to the first prerequisite for activating the production test mode; Deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking activation of the first control line at least until the end of activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and Locking activation of the third control line at least until the end of activation of the production test mode; - Check whether the deactivated control lines are deactivated; Activating the production test mode if at least one control line has been deactivated by the first or third control line and if at least this control line is deactivated and if the first precondition is fulfilled and the second precondition is satisfied and if it is determined on the basis of the first precondition for activating the production test mode, that the production test mode requires that the second control line not necessarily be deactivated until the end of activation of the production test mode. Method according to Claim 1 in which a test of the third control line in the production test mode of the integrated safety-related electronic circuit (IC) should be possible deviating from Claim 1 not comprising the steps - deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking activation of the first control line at least until the end of activation of the production test mode or deactivating the second control line of the second control terminal (G2) of the second transistor ( T2) and locking an activation of the second control line at least until the end of the activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking activation of the first control line at least until the end of activation of the production test mode; comprising the steps of - determining that the production test mode, based on the first prerequisite for activating the production test mode, requires that the third control line NOT be forcibly disabled until the end of activation of the production test mode; Deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking activation of the first control line at least until the end of activation of the production test mode or deactivating the second control line of the second control terminal (G2) of the second transistor (T2) and Locking activation of the second control line at least until the end of activation of the production test mode; - Check whether the deactivated control lines are deactivated; Activating the production test mode if at least one control line has been deactivated by the second or third control line and if at least this control line is deactivated and if the first precondition is fulfilled and the second precondition is fulfilled and if it is determined on the basis of the first precondition for activating the production test mode, that the production test mode requires that the third control line not be forcibly disabled until the end of activation of the production test mode.

Images