DE102019101733B4 - Device for safeguarding the monitoring of an airbag ignition stage during operation - Google Patents

Abstract

Safety-relevant device for use in vehicles - with a microcomputer (µC) and - with a microelectronic circuit (IC) • with a first data interface and • with a second data interface and • with a safety circuit (safety agent) (SA) for monitoring of device functions, and • with a sensor interface and • with a feedback function block (FbFkt) that can simulate a sensor (PSS), and - the safety circuit (Safety Agent) (SA) via the first data interface (MSPI) through the microcomputer ( µC) is controlled and- the feedback function block (FbFkt) and the sensor interface (PSI5B) and the switching between these via the second data interface (SSPI) is controlled by the microcomputer (µC).

Description

Generic term

The invention is directed to a method for checking a safety switch (T _ext ) in the ignition circuit of an airbag safety system during operation and for simultaneously checking the effective path from the sensor interface (PSI5b) to the activation (V _G ) of the safety switch (T _ext ). However, the invention is not restricted to this application. It can be used in a similar way in similar applications, for example belt tensioner systems, etc. Parts of the invention are of a more general nature.

General introduction

Airbag systems are used in vehicles for restraint in the event of a collision. Since these are safety-relevant devices, these devices are preferred according to the standard ISO 26262 developed. Here, the probability of a dangerous malfunction must be reduced below a predetermined level. With the disclosure presented here, some measures are presented that enable a self-test of the system during operation. This makes it possible to observe a fault, which limits the probability of a malfunction to the time between the occurrence and the visit to the workshop. In critical cases, the time between signaling and stopping is limited.

If an airbag is accidentally deployed while driving, severe injuries and even possible death of the occupants must be assumed. Therefore, a self-test must not increase the likelihood of such an incorrect trip.

In particular, such airbag systems for igniting the ignition device of the explosive device to inflate the respective airbag have an additional safety switch (T _ext ) in addition to the two ignition transistors (T ₁ , T ₂ ), which must also be activated for ignition in order to further improve safety to increase.

From the DE 10 2010 028 544 A1 is a control unit for operating a safety system for a vehicle with a step-up converter, which is designed as a switching converter, and which converts an input voltage derived from a vehicle battery voltage into a higher charging voltage at its output, and with at least one energy reserve storage device, which by means of the charging voltage for the operation of the security system in a self-sufficient case is known. The technical teaching of the DE 10 2010 028 544 A1 is characterized in that at least one step-down converter is operated inverted to the step-up converter, the at least one step-down converter converting the charging voltage or a voltage output from the at least one energy reserve store downwards. Step-down and step-up converters are connected via two separate SPI interfaces ( 1 the DE 10 2010 028 544 A1 ) operated, which allows independent control.

From the WO 2004/087 468 A1 a control unit for a restraint system is known. According to the technical teaching of the WO 2004/087 468 A1 fed in via an existing diagnostic interface of the control unit, which configures all ignition circuits and the triggering algorithm for igniting all ignition circuits, and emulates such sensor values for a safety module that checks the sensor values independently of a processor in the control unit and then, if necessary, releases the ignition circuits depending on the check so that the safety module enables these ignition circuits.

In the sense of the ISO26262 it must be possible to check whether the safety _switch (T _ext ) can actually perform its function. This is not solved in the prior art.

Object of the invention

The invention is therefore based on the object of creating a solution which enables the entire functional chain to be reliably checked from the sensor interface (PSS) to the safety _switch (T _ext ).

This object is achieved by a device according to claim 1.

Solution of the problem according to the invention

The solution to the task is based on the 1 explained. The claim is decisive for the use.

• • mit einem Mikrorechner (µC) und
• • mit einer mikroelektronischen Schaltung (IC)
  • ◯ mit einer ersten Datenschnittstelle und
  • ◯ mit einer zweiten Datenschnittstelle und
  • ◯ mit einer Sicherheitsschaltung (Safety-Agent) (SA), zur Überwachung von Vorrichtungsfunktionen, und
  • ◯ mit einer Sensorschnittstelle und
  • ◯ mit einem Rückkopplungsfunktionsblock (FbFkt), der einen Sensor (PSS) simulieren kann, und
• • wobei die Sicherheitsschaltung (Safety-Agent) (SA) über die erste Datenschnittstelle (MSPI) durch den Mikrorechner (µC) gesteuert wird und
• • wobei der Rückkopplungsfunktionsblock (FbFkt) und die Sensorschnittstelle (PSI5B) und die Umschaltung zwischen diesen über die zweite Datenschnittstelle (SSPI) durch den Mikrorechner (µC) gesteuert wird.

What is claimed is a safety-relevant device for use in vehicles

• • with a microcomputer (µC) and
• • with a microelectronic circuit (IC)
  • ◯ with a first data interface and
  • ◯ with a second data interface and
  • ◯ with a safety circuit (safety agent) (SA) for monitoring device functions, and
  • ◯ with a sensor interface and
  • ◯ with a feedback function block (FbFkt) that can simulate a sensor (PSS), and
• • where the safety circuit (safety agent) (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC) and
• • whereby the feedback function block (FbFkt) and the sensor interface (PSI5B) and the switchover between these via the second data interface (SSPI) is controlled by the microcomputer (µC).

The technical teaching claimed here differs essentially from the state of the art in that the safety circuit (safety agent) (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC) and that the feedback function block (FbFkt) and the sensor interface (PSI5B) and the switching between them via the second data interface (SSPI) is controlled by the microcomputer (µC).

The device according to the invention is preferably subdivided into a micro-integrated electronic circuit (IC) and its outer space (EXT). The exemplary limit is in the exemplary 1 shown in dashed lines.

The core of the device is the ignition element (SQ), which is located in the exterior (EXT) outside the micro-integrated electronic circuit (IC). In air bag systems, the ignition element (SQ) is used to detonate the explosive device for the deployment of the air bag.

The ignition chain consists of an external safety _switch (T _ext ), typically in the form of a MOS transistor or a similar semiconductor switch, as well as a first ignition transistor (T ₁ ) and a second ignition transistor (T ₂ ). The external safety _switch (T _ext ) is typically located outside (EXT). The first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) are typically part of the micro-integrated electronic circuit (IC). The ignition element (SQ) is arranged between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ), so that both must switch through to activate the ignition element (SQ) and initiate the deployment of the air bag sack. To further increase safety, the external safety _switch (T _ext ) is also connected in series with this series circuit consisting of the first ignition transistor (T ₁ ), ignition element (SQ) and second ignition transistor (T ₂ ), so that all three transistors (T ₁ , T ₂ , text) to activate the ignition element (SQ).

The chain of safety _switch (T _ext ), first ignition transistor (T ₁ ), ignition element (SQ) and second ignition transistor (T ₂ ) is typically connected between the supply voltage line (V _bat ), which is preferably at supply voltage potential, and reference ground (GND).

The node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) is referred to below as V5 potential (V ₅ ).

The control electrodes of the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) are controlled by a control circuit (CTR).

A fifth resistor (R ₅ ) ensures that when the first safety _switch (T _ext ) is switched off, a sufficient, very low current (I ₅ ) from the supply voltage line (V _bat ) through a first voltage divider (R ₁ , R ₂ ) from a first resistor (R ₁ ) and a second resistor (R ₂ ) flows. The voltage divider consisting of the first resistor (R ₁ ) and the second resistor (R ₂ ) has the control signal (V _R ) as its output. The negative input of a transconductance amplifier (OTA) is connected to this control signal (V _R ). The fifth resistor (R ₅ ) ensures that the transconductance amplifier (OTA) still receives a usable control signal (V _R ) when the safety _switch (T _ext ) is open. The transconductance amplifier (OTA) then supplies an output current (I _G ) at its output (V _G ), which is based on the difference in the voltage value of the control signal (V _R ), which is the output signal of the voltage divider (R ₁ , R ₂ ) from the first resistor ( R ₁ ) and second resistor (R ₂ ) is dependent on a reference voltage (V _ref ). With the output current (I _G ) of the transconductance amplifier (OTA) generated in this way, a storage capacity (C ₁ ) at the output of the transconductance amplifier (OTA) is charged or discharged. In the example, a first connection of the storage capacity (C ₁ ) is connected to the output of the transconductance amplifier (OTA) and the second connection of the storage capacity (C ₁ ) is connected to a reference potential (here GND). A first switch (S ₁ ), which is typically a MOS transistor or the like, can connect the potential at the first connection of the storage capacitor (C ₁ ) to the control electrode of the safety switch (T _ext ). As a rule, the safety switch (T _ext ) has a parasitic gate-source capacitance, which is not shown here and which, when the first switch (S ₁ ) is open, the gate-source voltage of the safety switch (T _ext ) for a typically sufficient Time still holds. The first switch (S ₁ ) is in the example of 1 controlled by a microcomputer (µC) by means of an exemplary switch control signal (µC ₁ ). The output current (I _G ) of the transconductance amplifier (OTA) can be controlled by a safety circuit (SA), generally as " Safety Agent ", additionally and preferably controlled with higher priority. Preferably, the safety circuit (SA) can forcibly set the output current (I _G ) of the transconductance amplifier (OTA) in its output node (V _G ) to zero via a corresponding on / off signal (ON_REG) of the transconductance amplifier (OTA) and thereby the regulation switch off. The potential of the control electrode of the external safety _switch (T _ext ) is typically retained for a certain period of time, since the parasitic gate-source capacitance of the external safety _switch (T _ext ) between the control electrode of the external safety _switch (T _ext ) and the node ( V ₅ ) with V5 potential between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) still maintains the gate-source voltage for a short time.

The microintegrated circuit (IC) preferably has two SPI interfaces: a first SPI interface (MSPI) with a first SPI bus (SPI) for controlling the microcomputer within the microintegrated circuit (IC) and a second SPI interface ( SSPI) with a second SPI bus (SPI2 / PSI5d) for controlling the sensor interfaces within the micro-integrated circuit (IC).

The first SPI bus (SPI) is used to configure the micro-integrated circuit (IC) and to read and write the registers, etc.

The second SPI bus (SSPI) is used to control the data path of the sensors excluding the safety circuit (SA) (safety agent). According to the invention, the safety circuit (SA) (safety agent) is controlled via a first signal path (CS, MSPI, SPI) made up of other signals (CS, SPI) and modules (MSPI) than the second signal path (SPI2 / PSI5d, SSPI) , [CS2] or [SPI2 / PSI5d, SSPI, [SI3], FbFkt, [Diag], MUX]) of the sensors. The safety circuit (SA) (safety agent) is therefore only controlled via the first SPI interface (MSPI). Incidentally, the safety circuit (SA) preferably only listens to the communication on the second SPI bus (SSPI) and compares the complete, physical SPI data frame (SPI frame) and / or data frame sequences with the expected values determined by the safety circuit (SA) and / or expected value sequences.

The first SPI bus (SPI) is used to configure the SA (and the rest of the circuit). In this case, the SA only receives the forwarding of decoded control signals.

A PSIS sensor system (PSS) with a PSI5 sensor connection (PSI5b) outside the micro-integrated circuit is connected to the PSI5 interface (PSI5IF) via a multiplexer (MUX). The PSI5 interface (PSI5IF) typically has several PSI5 sensor connection options. In the exemplary case of 1 these are, for example, a first PSIS sensor connection (PSI5a) and a second PSIS sensor connection (PSI5b). Further sensor connections can also be provided. By means of a multiplexer (MUX) the exemplary PSI5 signal (PSI5b) of the exemplary PSI5 sensor (PSS) can be replaced by a synthesized test signal from a feedback function block (FbFkt) simulating this sensor, which in the example of FIG 1 controls the multiplexer (MUX) by means of a switching signal (Diag) for example. The feedback function block (FbFkt) is used in the example of 1 controlled via the second SPI bus (SPI2, PSI5d) and the second SPI interface (SSPI). In this way, the microcomputer (µC) can simulate specified test cases and check the reaction of the system within the micro-integrated circuit (IC).

When checking the PSI5 interface, the safety circuit (SA) sends an ARM signal (ARM) to the microcomputer (µC), for example if predefined boundary conditions are present, which then causes it to react in a predetermined manner.

The safety circuit (PA) allows the potential at the control electrode of the safety switch (T _ext ) to be regulated by the transconductance amplifier (OTA) via the on / off signal (ON_REG) of the transconductance amplifier (OTA) only under predetermined conditions.

Using a third control signal (CS3), the microcomputer (µC) can control an analog-to-digital converter (ADC) via the first SPI bus (SPI) and the first SPI interface (MSPI) and typically read out its measured values. The analog-to-digital converter (ADC) can measure various nodes within the microintegrated circuit (IC) by means of a second multiplexer (MUX2). In particular, it is proposed to make the output (V _G ) of the transconductance amplifier (OTA) and the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) with V5 potential measurable for the microcomputer in this way .

The method proposed below can now be used to check whether the external safety _switch (T _ext ) can perform its function.

• • Messung des Potenzials am Ausgang (V_G) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC);
• • Messung des V5-Potenzials am Knoten (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁)über den Analog-zu-Digitalwandler (ADC);
• • Öffnen des ersten Schalters (S₁). Hierdurch beginnt der Sicherheitsschalter (T_ext) zu floaten. D.h. seine Anschlüsse folgen den Bewegungen des V5-Potenzials am Knoten (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁).
• • Einspeisen eines Teststroms (I_TST) mittels einer Teststromquelle (I_TST) in den Knoten (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁). Hierdurch verschiebt sich das V5 Potenzial des Knotens (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁);
• • Messung des V5-Potenzials am Knoten (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zugehörigen ersten V5-Spannungswertes;
• • Messung des Potenzials am Ausgang (V_G) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines ersten zugehörigen Regelspannungswertes;
• • Vergleich des Betrags des ersten V5-Spannungswertes mit dem Betrag des ersten Regelspannungswertes und Ermittlung eines ersten Vergleichsergebnisses;
• • Schließen auf einen Fehler, wenn der Betrag des ersten V5-Spannungswertes über dem Betrag des ersten Regelspannungswertes liegt; (Liegt die Reglerspannung, also der erste Regelspannungswert, beispielsweise bei 21,7V, so können je nach Konstruktion beispielsweise 19V für das V5-Potenzial in diesem Schaltzustand erwartet werden.)
• • Schließen des ersten Schalters (S₁);
• • Ggf. Abwarten einer Verzögerungszeit (T) zur Einregelung des V5-Potenzials durch den Transkonduktanzverstärker (OTA);
• • Messung des V5-Potenzials am Knoten (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zugehörigen zweiten V5-Spannungswertes;
• • Messung des Potenzials am Ausgang (V_G) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zweiten zugehörigen Regelspannungswertes;
• • Vergleich des Betrags des zweiten V5-Spannungswertes am Knoten (V₅) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁) gegen Bezugsmasse (GND) mit dem Betrag des zweiten Regelspannungswertes und Ermittlung eines zweiten Vergleichsergebnisses;
• • Schließen auf einen Fehler, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht. Der Toleranzbereich sollte in der Konstruktionsphase den jeweiligen Bedingungen der Anwendung angepasst werden. Dies kann beispielsweise durch Simulation kritischer Fälle geschehen. Mittels des Analog-zu-Digital-Wandlers (ADC) überprüft dann der Mikrorechner (µC), ob beispielsweise das Potenzial am Knoten V₅ gegen Bezugsmasse (GND) auf einen beispielhaften Zielwert 21,7V geregelt wurde.

As a first possibility of such a method, a method with the following steps is proposed:

• • Measurement of the potential at the output (V _G ) of the transconductance amplifier (OTA) via the analog-to-digital converter (ADC);
• • Measurement of the V5 potential at the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) via the analog-to-digital converter (ADC);
• • Open the first switch (S ₁ ). This causes the safety _switch (T _ext ) to float. This means that its connections follow the movements of the V5 potential at the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ).
• • Feeding a test current (I _TST ) by means of a test current source (I _TST ) into the node (V ₅ ) between the safety switch (T _ext ) and the first ignition transistor (T ₁ ). This shifts the V5 potential of the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ );
• • Measurement of the V5 potential at the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) via the analog-to-digital converter (ADC) and determination of an associated first V5 voltage value;
• • Measurement of the potential at the output (V _G ) of the transconductance amplifier (OTA) via the analog-to-digital converter (ADC) and determination of a first associated control voltage value;
• • Comparison of the magnitude of the first V5 voltage value with the magnitude of the first control voltage value and determination of a first comparison result;
• • Inferring that there is a fault if the magnitude of the first V5 voltage value is greater than the magnitude of the first control voltage value; (If the controller voltage, i.e. the first control voltage value, is 21.7V, for example, 19V can be expected for the V5 potential in this switching state, depending on the design.)
• • Closing the first switch (S ₁ );
• • If necessary, waiting for a delay time (T) to regulate the V5 potential by the transconductance amplifier (OTA);
• • Measurement of the V5 potential at the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) via the analog-to-digital converter (ADC) and determination of an associated second V5 voltage value;
• • Measurement of the potential at the output (V _G ) of the transconductance amplifier (OTA) via the analog-to-digital converter (ADC) and determination of a second associated control voltage value;
• • Comparison of the amount of the second V5 voltage value at the node (V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) against reference ground (GND) with the amount of the second control voltage value and determination of a second comparison result;
• • Conclusion of an error if the magnitude of the second V5 voltage value differs from the magnitude of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or more than +/- 10% and / or more than +/- 25%. The tolerance range should be adapted to the respective conditions of the application in the design phase. This can be done, for example, by simulating critical cases. The microcomputer (μC) then uses the analog-to-digital converter (ADC) to check whether, for example, the potential at node V _{5 has been} regulated to an exemplary target value of 21.7V with respect to reference ground (GND).

The most general variant of the safety circuit (SA) (Safety Agent) listens to the SPI communication between the microcomputer (µC) and the micro-integrated circuit (IC) on the SPI buses (SPI, SPI2). In the preferred implementation, however, the safety circuit (SA) (safety agent) listens to the SPI communication between the microcomputer (μC) and the micro-integrated circuit (IC) only on the second SPI bus (SPI2). The corresponding connections are in 1 not shown. The decisions are made by the safety circuit (SA) (safety agent) in an analogous manner and independently of the rest of the circuit, whereby the safety circuit (SA) (safety agent) is able to determine expected values and expected value sequences and to use them with the Compare done in the integrated circuit. A test state must be specially activated so that the safety circuit prevents faulty triggering through a self-test.

The advantage of simulating the sensor (PSS) using the feedback function block (FbFkt) is that the circuit can be tested without a connected sensor (PSS) or external components without violating the safety requirements.

In this context, reference is made to the disclosed property right registrations DE 10 2018 107 449 A1 , DE 10 2018 107 452 A1 , DE 10 2018 107 438 A1 , DE 10 2018 107 441 A1 , DE 10 2018 107 446 A1 and DE 10 2018 107 448 A1 as well as the undisclosed property right registrations 10 2018 107 451.4 and 10 2018 107 455.7, which are fully part of the disclosure.

Advantage of the invention

The method presented here and the corresponding device allow the simulation of permissible and faulty sensor behavior by emulating the sensor interface, whereby the output of the transconductance amplifier (OTA) can be evaluated during operation without the ignition device (SQ) being able to ignite. Furthermore, a safe function test of the safety _switch (T _ext ) during operation is possible at the same time. Since two different data paths are used, the effective path can be checked completely without causing accidental triggering by a single fault in the circuit.

Features of the invention

The basis of the invention is a device for igniting a squib (SQ) which is provided and suitable for carrying out the method described below for checking the function of a safety _switch (T _ext ). It is a device with a microelectronic circuit (IC), with an ignition element (SQ), with a first ignition transistor (T ₁ ), with a second ignition transistor (T ₂ ), with a safety _switch (T _ext ), which has a control input (V _G2 ), with a fifth resistor (R ₅ ), with a node (V ₅ ), with a supply voltage line (V _bat ) and with a reference ground (GND). The supply voltage line (V _bat ) and the reference ground (GND) supply the device with electrical energy. The fifth resistor (R ₅ ) may or may not be part of the microelectronic circuit (IC). The microelectronic circuit typically includes a transconductance amplifier (OTA) with an output (V _G ), a control signal (V _R ), a control signal generation network (R ₁ , R ₂ ), which is preferably a first voltage divider from a first resistor (R ₁ ) and a second resistor (R ₂ ) with the control signal (V _R ) as its output, a storage capacitance (C ₁ ), a first switch (S ₁ ), a reference voltage (V _ref ), a test current source (I _TST ), a node ( V ₅ ) and means (ADC, MUX2) for detecting the potential at the node (V ₅ ) and for detecting the potential at the output (V _G ) of the transconductance amplifier (OTA). The means for detecting the potential at the node (V ₅ ) and for detecting the potential at the output (V _G ) of the transconductance amplifier (OTA) is preferably an analog-to-digital converter (ADC) which is connected via a multiplexer (MUX2) can detect different potentials within the microelectronic circuit (IC) and which can be controlled and read out by an external microcomputer (µC). The safety switch (T _ext ) and the first ignition transistor (T ₁ ) and the ignition element (SQ) and the second ignition transistor (T ₂ ) are connected in series. The ignition element (SQ) is connected between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ). The safety _switch (T _ext ) and the first ignition transistor (T ₁ ) are connected to one another via a common node (V ₅ ). The ignition element (SQ) is preferably located outside the microelectronic circuit (IC). The safety _switch (T _ext ) is preferably located outside the microelectronic circuit (IC). The first ignition transistor (T ₁ ) is part of the microelectronic circuit (IC). The second ignition transistor (T ₂ ) is part of the microelectronic circuit (IC). The safety _switch (T _ext ) and the ignition element (SQ) and the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) are arranged in series in a common ignition current path. The ignition element (SQ) is arranged in the common ignition current path between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ). To ignite the ignition element (SQ), the safety switch (T _ext ) and the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) must be switched on, ie switched on, at the same time. The safety _switch (T _ext ) and the first ignition transistor (T ₁ ) and the ignition element (SQ) and the second ignition transistor (T ₂ ) form an ignition chain. The term ignition chain refers to the serial connection. This ignition chain is connected between the supply voltage line (V _bat ) and reference ground (GND). The node (V ₅ ) is located between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ). The fifth resistor (R ₅ ) feeds an electrical current (I ₅ ) into the node (V ₅ ) when the first safety _switch (T _ext ) is switched off, which ensures the operability of the control signal generation network (R ₁ , R ₂ ) in this state. The control signal generating network (R ₁ , R ₂ ) forms the control signal (V _R ) as a function of the voltage between the node (V ₅ ) and the reference potential (GND). This control signal (V _R ) is a first input signal of the transconductance amplifier (OTA). The reference voltage (V _ref ) is a second input signal of the transconductance amplifier (OTA). The first connection of the storage capacity (C ₁ ) is connected to the output (V _G ) of the transconductance amplifier (OTA) and integrates the output current (I _G ) of the transconductance amplifier (OTA) minus the leakage currents. The storage capacity (C ₁ ) can also be a network of components with a capacitive or integrating effect, which at least at times behaves functionally similar to an ideal capacity. The first switch (S ₁ ) is suitable and / or provided to connect the output (V _G ) of the transconductance amplifier (OTA) with the To connect the control input of the safety _switch (T _ext ). The test current source (I _TST ) can feed a test current (I _TST ) into the node (V ₅ ), preferably initiated by a controller (CTR) or an external microcomputer (μC).

In addition to these features, the invention also includes a structuring of the data communication that is necessary to prevent activation due to a data error. This structuring has a more general character. This partial invention relates to a safety-relevant device for use in vehicles, in particular an airbag ignition system with a microcomputer (µC), a microelectronic circuit (IC), a first data interface, in particular with a first SPI interface (MSPI), a second data interface, in particular with a second SPI interface (SSPI), a safety circuit (safety agent) (SA), for monitoring device functions, with a sensor interface, in particular a PSI5 sensor connection (PSI5b), and with a feedback function block (FbFkt) that has a sensor (PSS) can simulate. The safety circuit (Safety Agent) (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC). The feedback function block (FbFkt) and the sensor interface (PSI5B) and the switchover between these are controlled by the microcomputer (µC) via the second data interface (SSPI). In a further embodiment of this partial invention, the safety circuit (safety agent) (SA) can influence the output signal at the output (V _G ) of the transconductance amplifier (OTA). This allows the safety circuit to rule out incorrect ignition when the system is tested.

The invention further comprises a method according to the invention for checking the functionality of a safety _switch (T _ext ) in an airbag ignition system. For this, the airbag ignition system must have a safety _switch (T _ext ) with a control electrode (V _G2 ), a first ignition transistor (T ₁ ), a second ignition transistor (T ₂ ), an ignition element (SQ), a transconductance amplifier (OTA) with an output (V _G ) and a first switch (S ₁ ).

• • (1) Start
• • (2) Messung des Potenzials am Ausgang (V_G);
• • (3) Messung des V5-Potenzials des Knotens (V5);
• • (4) Öffnen des ersten Schalters (S₁);
• • (5) Einspeisen eines zusätzlichen Teststroms (I_TST) in den Knoten (V5);
• • (6) Messung des V5-Potenzials am Knoten (V5) und Ermittlung eines zugehörigen ersten V5-Spannungswertes;
• • (7) Messung des Potenzials am Ausgang (VG) des Transkonduktanzverstärkers (OTA) und Ermittlung eines ersten zugehörigen Regelspannungswertes;
• • (8) Vergleich des Betrags des ersten V5-Spannungswertes mit dem Betrag des ersten Regelspannungswertes und Ermittlung eines ersten Vergleichsergebnisses;
• • (9) Schließen auf einen Fehler, wenn der Betrag des ersten V5-Spannungswertes über dem Betrag des ersten Regelspannungswertes liegt.
• • (10) Schließen auf eine Fehlerfreiheit, wenn der Betrag des ersten V5-Spannungswertes unter dem Betrag des ersten Regelspannungswertes liegt oder um nicht mehr als ein vorgegebener Toleranzwert von dem Betrag des ersten Regelspannungswertes abweicht, was im Sinne dieser Offenlegung noch als ein unter dem Betrag des ersten Regelspannungswertes liegen bewertet wird.
• • (11) Ende.

The first switch (S ₁ ) can electrically connect the output (V _G ) of the transconductance amplifier (OTA) to the control electrode (V _G2 ) of the safety switch (T _ext ) and can disconnect such a connection. The safety switch (T _ext ) and the first ignition transistor (T ₁ ) and the ignition element (SQ) and the second ignition transistor (T ₂ ) are connected in series. The ignition element (SQ) is connected between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ). The safety _switch (T _ext ) and the first ignition transistor (T ₁ ) are connected to one another via a common node (V ₅ ). The procedure (see example 2 ) comprises at least the following steps:

• • (1) Start
• • (2) Measurement of the potential at the output (V _G );
• • (3) measurement of the V5 potential of the node (V5);
• • (4) opening the first switch (S ₁ );
• • (5) feeding an additional test current (I _TST ) into the node (V5);
• • (6) measurement of the V5 potential at the node (V5) and determination of an associated first V5 voltage value;
• • (7) measurement of the potential at the output (VG) of the transconductance amplifier (OTA) and determination of a first associated control voltage value;
• • (8) Comparison of the amount of the first V5 voltage value with the amount of the first control voltage value and determination of a first comparison result;
• • (9) Conclusion of an error if the magnitude of the first V5 voltage value is greater than the magnitude of the first control voltage value.
• • (10) Conclusion that there is no error if the amount of the first V5 voltage value is below the amount of the first control voltage value or does not deviate from the amount of the first control voltage value by more than a specified tolerance value, which in the sense of this disclosure is still considered to be below the The amount of the first control voltage value is evaluated.
• • (11) end.

• • (12) Schließen des ersten Schalters (S₁);
• • (13) Optionales Abwarten einer Verzögerungszeit (T) zur Einregelung des V5-Potenzials durch den Transkonduktanzverstärker (OTA);
• • (14) Messung des V5-Potenzials am Knoten (V5) und Ermittlung eines zugehörigen zweiten V5-Spannungswertes;
• • (15) Messung des Potenzials am Ausgang (VG) des Transkonduktanzverstärkers (OTA) und Ermittlung eines zweiten zugehörigen Regelspannungswertes;
• • (16) Vergleich des Betrags des zweiten V5-Spannungswertes mit dem Betrag des zweiten Regelspannungswertes und Ermittlung eines zweiten Vergleichsergebnisses;
• • (17) Schließen auf einen Fehler, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht.
• • (18) Schließen auf eine Fehlerfreiheit, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um nicht mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht.
• • (11) Ende (nicht zusätzlich).

A refined procedure (see example 3 ), which is based on the procedure described immediately above, includes the additional steps:

• • (12) closing the first switch (S ₁ );
• • (13) Optional waiting for a delay time (T) for regulating the V5 potential by the transconductance amplifier (OTA);
• • (14) Measurement of the V5 potential at the node (V5) and determination of an associated second V5 voltage value;
• • (15) measurement of the potential at the output (VG) of the transconductance amplifier (OTA) and determination of a second associated control voltage value;
• • (16) comparison of the magnitude of the second V5 voltage value with the magnitude of the second control voltage value and determination of a second comparison result;
• • (17) Inferring an error if the magnitude of the second V5 voltage value differs from the magnitude of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5 % and / or more than +/- 10% and / or more than +/- 25%.
• • (18) Inferring that there is no error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by no more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or more than +/- 10% and / or more than +/- 25%.
• • (11) end (not additional).

The basis of the invention thus consists of a method for igniting a squib, which is initially characterized by a few technical features.

A first and a second ignition transistor (T ₁ ; T ₂ ), a safety _switch (T _ext ), a transconductance amplifier (OTA) and a resistor (R ₅ ) are found in a first method, which are decisive for the invention. The transconductance amplifier (OTA) also has an output (V _G ), the safety switch (T _ext ) has a control electrode and is connected in series with the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) and the ignition element (SQ ), the connection between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) being made via a node (V ₅ ).

In addition, the resistor (R ₅ ) is connected between the supply potential and the node (V ₅ ).

Thus, after isolating the control electrode of the safety switch (T _ext ) from the output (V _G ) and then feeding a test current (I _TST ) into the node (V ₅ ), a measurement of the potential at the output (V _G ) of the transconductance amplifier (OTA ) which have the consequence that a first control voltage value is determined.

The measurement of a V5 potential at the node (V ₅ ) then provides a first V5 voltage value. The control electrode of the safety _switch (T _ext ) is then connected to the output (V _G ).

The next step is again a measurement of the V5 potential at the node (V ₅ ), which results in the determination of a second V5 voltage value. In addition, the potential is measured at the output (V _G ) of the transconductance amplifier (OTA). This in turn determines a second control voltage value.

It is always concluded that there is a fault if the amount of the first V5 voltage value is above the amount of the first control voltage set. An error is also concluded if, after a comparison result has been determined between the second V5 voltage value and the second control voltage value, a deviation of more than +/- 1% and / or more than +/- 2% and / or more than + / -5% and / or more than +/- 10% and / or more than +/- 25% occurs.

In a second method, which is technically characterized in that a first and a second ignition transistor (T ₁ ; T ₂ ), a safety _switch (T _ext ), a transconductance amplifier (OTA) and a resistor (R ₅ ) are present. The transconductance amplifier (OTA) also has an output (V _G ), the safety switch (T _ext ) has a control electrode and is connected in series with the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) and the ignition element (SQ ), the connection between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) being made via a node (V ₅ ).

In addition, the resistor (R ₅ ) is connected between the supply potential and the node (V ₅ ).

After isolating the control electrode of the safety switch (T _ext ) from the output (V _G ) and then feeding a test current (I _TST ) into the node (V ₅ ), the potential at the output (V _G ) of the transconductance amplifier (OTA) is measured and the determination of a first control voltage value.

The measurement of a V5 potential at the node (V ₅ ) then provides a first V5 voltage value. It is always concluded that there is a fault if the amount of the first V5 voltage value is above the amount of the first control voltage set.

In a third method which is technically characterized in that a first and a second ignition transistor (T ₁ ; T ₂ ), a safety _switch (T _ext ), a transconductance amplifier (OTA) and a resistor (R ₅ ) are present. The transconductance amplifier (OTA) also has an output (V _G ), the safety switch (T _ext ) has a control electrode and is connected in series with the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) and the ignition element (SQ ), the connection between the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) being made via a node (V ₅ ).

In addition, the resistor (R ₅ ) is connected between the supply potential and the node (V ₅ ).

The control electrode of the safety _switch (T _ext ) is connected to the output (V _G ).

The next step is a measurement of the V5 potential at the node (V ₅ ), which results in the determination of a second V5 voltage value. In addition, the potential is measured at the output (V _G ) of the transconductance amplifier (OTA). This in turn determines a second control voltage value.

An error is always concluded if the magnitude of the first V5 voltage value is greater than the magnitude of the first control voltage value. It is also concluded that there is an error if, after determining a comparison result between the second V5 voltage value and the second regulator voltage value, there is a deviation of more than +/- 1% and / or more than +/- 2% and / or more than + / -5% and / or more than +/- 10% and / or more than +/- 25% occurs.

• 1 zeigt schematisch vereinfacht eine vorschlagsgemäße Vorrichtung.
• 2 zeigt das grundlegende Verfahren zur Prüfung des Sicherheitsschalters (T_ext ).
• 3 zeigt das verfeinerte Verfahren zur Prüfung des Sicherheitsschalters (T_ext ).

List of figures

• 1 shows schematically simplified a proposed device.
• 2 shows the basic procedure for testing the safety switch ( T _ext ).
• 3 shows the refined procedure for testing the safety switch ( T _ext ).

List of reference symbols

1

Process step 1 : Begin;

2

Process step 2 : Measurement of the potential at the output ( V _G );

3

Process step 3 : Measurement of the V5 potential of the node ( V5 );

4th

Process step 4th : Opening the first switch ( S ₁ );

5

Process step 5 : Feeding in an additional test current ( I _TST ) in the node ( V5 );

6

Process step 6th : Measurement of the V5 potential at the node ( V5 ) and determining an associated first V5 voltage value;

7th

Process step 7th : Measurement of the potential at the output ( VG ) of the transconductance amplifier ( OTA ) and determining a first associated control voltage value;

8th

Process step 8th : Comparison of the magnitude of the first V5 voltage value with the magnitude of the first control voltage value and determination of a first comparison result;

9

Process step 9 : Inferring a fault if the magnitude of the first V5 voltage value is above the magnitude of the first control voltage value;

10

Process step 10 : Inferring that the first V5 voltage value is free of errors if the amount of the first V5 voltage value is below the amount of the first control voltage value or does not deviate from the amount of the first control voltage value by more than a specified tolerance value, which in the sense of this disclosure is still considered to be below the amount of the first Control voltage values are evaluated;

11

Process step 11 : The End;

12

Process step 12 : Closing the first switch ( S ₁ );

13

Process step 13 : Optional waiting for a delay time (T) to regulate the V5 potential by the transconductance amplifier ( OTA );

14th

Process step 14th : Measurement of the V5 potential at the node ( V5 ) and determining an associated second V5 voltage value;

15th

Process step 15th : Measurement of the potential at the output ( VG ) of the transconductance amplifier ( OTA ) and determining a second associated control voltage value;

16

Process step 16 : Comparison of the magnitude of the second V5 voltage value with the magnitude of the second control voltage value and determination of a second comparison result;

17th

Process step 17th : Conclusion of an error if the magnitude of the second V5 voltage value differs from the magnitude of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates by more than +/- 10% and / or more than +/- 25%;

18th

Process step 18th : Inferring that there is no error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by no more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates more than +/- 10% and / or more than +/- 25%;

ADC

Analog-to-digital converter;

POOR

Arm signal from the safety circuit to the microcomputer ( µC );

C ₁

Storage capacity;

CS

first control signal to control the safety circuit ( SA ) via the first SPI interface ( MSPI ) and the first SPI bus ( SPI ) through the microcomputer ( µC );

CS2

second control signal for controlling the PSI5 interface ( PSI5IF ) via the second SPI interface ( SSPI ) and the second SPI bus ( SPI2 / PSI5d ) through the microcomputer ( µC );

CS3

third control signal for controlling the analog-to-digital converter ( ADC ) via the first SPI interface ( MSPI ) and the first SPI bus ( SPI ) through the microcomputer ( µC );

CTR

Control circuit;

Diag

Switching signal;

EXT

External space of the micro-integrated electronic circuit;

FbFkt

Feedback function block;

GND

Reference ground;

I ₅

Current through the fifth resistor ( R ₅ );

IC

micro-integrated electronic circuit;

I _G

Output current of the transconductance amplifier ( OTA );

I _TST

Test current source;

I _TST

Test current of the test current source ( I _TST );

µC

Microcomputer;

µC1

Control line with that of the microcomputer ( µC ) the first switch ( S ₁ ) controls;

MSPI

first SPI interface on the first SPI bus ( SPI ), which here exemplify the non-sensor part of the micro-integrated circuit ( IC ) with the microcomputer ( µC ) connects and makes it controllable through it;

MUX

Multiplexer;

ON_REG

On / off signal for the transconductance amplifier;

OTA

Transconductance amplifier. When switched on, the transconductance amplifier supplies an output current ( I _G ), which is proportional to the voltage difference at its two inputs (+, -). Via an on-off signal ( ON_REG ) the transconductance amplifier can be switched on and off. The transconductance amplifier supplies an output current when switched off ( I _G ), which is essentially zero except for parasitic currents;

PSI5a

first PSI5 sensor connection;

PSI5b

second PSI5 sensor connection;

PSI5IF

PSI5 interface;

PSS

PSI5 sensor system;

R ₁

first resistor, the part of the first voltage divider ( R ₁ , R ₂ ) is;

R ₂

second resistor, the part of the first voltage divider ( R ₁ , R ₂ ) is;

R ₃

third resistance;

R ₄

fourth resistance;

R ₅

fifth resistance;

S ₁

first switch. The first switch is represented by the example in 1 marked microcomputer ( µC ) via an associated control line ( µC ₁ ) controlled.

SA

Safety circuit (safety agent);

SI3

fourth control signal for controlling the feedback function block ( FbFkt ) via the second SPI interface ( SSPI ) and the second SPI bus ( SPI2 / PSI5d ) through the microcomputer ( µC );

SPI

first SPI bus. Instead of an SPI bus, other data bus standards can also be used.

SPI2 / PSI5d

second SPI bus. Instead of an SPI bus, other data bus standards such as PSI5 can also be used.

SSPI

second SPI interface on the second SPI bus (SPI2 / PSI5), which here is an example of the sensor part of the micro-integrated circuit ( IC ) with the microcomputer ( µC ) connects;

SQ

Ignition element;

T ₁

first ignition transistor;

T ₂

second ignition transistor;

T _ext

Safety switch.

V ₅

Node ( V ₅ ) between the safety switch ( T _ext ) and the first ignition transistor ( T ₁ ) with V5 potential;

V _asked

Supply voltage line, which is typically at supply voltage potential;

V _G

Output of the transconductance amplifier ( OTA );

V _G2

Control input of the safety switch ( T _ext );

V _R

Control signal. The control signal is preferably the output signal of the first voltage divider ( R ₁ , R ₂ );

V _ref

Reference voltage;

Claims (1)

Safety-relevant device for use in vehicles - with a microcomputer (µC) and - with a microelectronic circuit (IC) • with a first data interface and • with a second data interface and • with a safety circuit (safety agent) (SA) for monitoring device functions, and • with a sensor interface and • with a feedback function block (FbFkt) that can simulate a sensor (PSS), and - The safety circuit (Safety Agent) (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC) and - The feedback function block (FbFkt) and the sensor interface (PSI5B) and the switching between these via the second data interface (SSPI) is controlled by the microcomputer (µC).

Images