DE102019101739A1 - Device with checking ability of an airbag ignition stage in operation - Google Patents

Abstract

The invention relates to a safety-relevant device for use in vehicles with a microcomputer (.mu.C), a microelectronic circuit (IC), a first SPI interface (MSPI), a second SPI interface (SSPI), a safety circuit (safety agent). (SA), a PS15 sensor connection (PSI5b) and a feedback function block (FbFkt) that can simulate a sensor (PSS). The safety circuit (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC). The feedback function block (FbFkt) and the sensor interface (PSI5B) and the switchover between them via the second data interface (SSPI) is controlled by the microcomputer (µC).

Description

Generic term

The invention relates to a method for checking a safety switch (T _ext ) in the ignition circuit of an airbag safety system during operation and for simultaneously checking the effective path from the sensor interface ( PSI5b ) until activation ( V _G ) of the safety _switch (T _ext ). However, the invention is not restricted to this application. It can be used in an analogous manner in similar applications, for example belt tensioner systems, etc. Parts of the invention have a more general character.

General introduction

Airbag systems are used to restrain passengers in the event of a collision. Since these are safety-relevant devices, these devices are preferably developed in accordance with the ISO 26262 standard. The probability of a dangerous malfunction must be reduced below a predetermined level. The disclosure presented here presents some measures that enable the system to be self-tested in operation. This creates an observability of an error, which limits the probability of a malfunction to the time between the occurrence and the visit to the workshop. In critical cases, the time limit between signaling and stopping is used.

If an airbag is triggered unintentionally while driving, serious injuries and even death of the occupants must be assumed. Therefore, a self-test must not increase the likelihood of such an incorrect triggering.

In particular, such airbag systems for igniting the ignition device of the explosive device for inflating the respective airbag have in addition to the two ignition transistors ( T ₁ , T ₂ ) an additional safety switch (T _ext ), which must also be activated for the ignition in order to further increase safety. According to ISO26262, it must be possible to check whether the safety switch (T _ext ) can actually perform its function. This is not solved in the prior art.

Object of the invention

The invention is therefore based on the object of providing a solution which enables reliable checking of the entire functional chain from the sensor interface (PSS) to the safety _switch (T _ext ).

This object is achieved by a device according to claim 1.

Solution of the task according to the invention

The solution to the problem is based on the 1 explained. The demands are decisive for the stress.

The device according to the invention is preferably divided into a micro-integrated electronic circuit (IC) and its exterior (EXT). The exemplary limit is in the exemplary 1 shown in dashed lines.

The core of the device is the ignition element ( SQ ), which is located outside (EXT) outside the micro-integrated electronic circuit (IC). In air bag systems, the ignition element ( SQ ) to detonate the explosive device for the deployment of the air bag.

The ignition chain consists of an external safety _switch (T _ext ), typically in the form of a MOS transistor or a similar semiconductor switch, and a first ignition transistor ( T ₁ ) and a second ignition transistor ( T ₂ ). The external safety _switch (T _ext ) is typically located outside (EXT). The first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are typically part of the micro-integrated electronic circuit (IC). The ignition element ( SQ ) is between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) arranged so that both must switch through to the ignition element ( SQ ) to activate and initiate the deployment of the air bag sack. In order to further increase safety, the external safety _switch (T _ext ) for this series connection consisting of the first ignition transistor ( T ₁ ), Ignition element ( SQ ) and second ignition transistor ( T ₂ ) also connected in series so that all three transistors ( T ₁ , T ₂ , T _ext ) must switch through in order to SQ ) to activate.

The chain of safety _switch (T _ext ), first ignition transistor ( T ₁ ), Ignition element ( SQ ) and second ignition transistor ( T ₂ ) is typically between the supply voltage line ( V _bat ), which is preferably at the supply voltage potential, and reference ground (GND).

The knot ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) is referred to below as V5 potential ( V ₅ ) designated.

The control electrodes of the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are controlled by a control circuit (CTR).

A fifth resistance ( R ₅ ) ensures that when the first safety _switch (T _ext ) is switched off, a sufficient, very low current ( I ₅ ) from the supply voltage line ( V _bat ) by a first voltage divider ( R ₁ , R ₂ ) from a first resistance ( R ₁ ) and a second resistor ( R ₂ ) flows. The voltage divider from the first resistor ( R ₁ ) and second resistance ( R ₂ ) has the control signal as output ( V _R ) on. The negative input of a transconductance amplifier (OTA) is connected to this control signal ( V _R ) connected. Through the fifth resistance ( R ₅ ) it is ensured that the transconductance amplifier (OTA) still has a usable control signal ( V _R ) receives when the safety _switch (T _ext ) is open. The transconductance amplifier (OTA) then delivers at its output ( V _G ) an output current ( I _G ), which is the difference between the voltage value of the control signal ( V _R ), which is the output signal of the voltage divider ( R ₁ , R ₂ from first resistance ( R ₁ ) and second resistance ( R ₂ ) to a reference voltage ( V _ref ) depends. With the output current generated in this way ( I _G ) of the transconductance amplifier (OTA) becomes a storage capacity ( C ₁ ) charged or discharged at the output of the transconductance amplifier (OTA). In the example, a first connection of the storage capacity ( C ₁ ) connected to the output of the transconductance amplifier (OTA) and the second connection of the storage capacity ( C ₁ ) with a reference potential (here GND). A first switch ( S ₁ ), which is typically a MOS transistor or the like, the potential at the first connection of the storage capacitance ( C ₁ ) to the control electrode of the safety _switch (T _ext ). As a rule, the safety switch (T _ext ) has a parasitic gate-source capacitance, which is not shown here and which is open when the first switch ( S ₁ ) the gate-source voltage of the safety _switch (T _ext ) still holds for a typically sufficient time. The first switch ( S ₁ ) in the example the 1 controlled by a microcomputer (µC) by means of an exemplary switch control signal (µC ₁ ). The output current ( I _G ) of the transconductance amplifier (OTA) can be replaced by a safety circuit ( SAT ), generally referred to as a "safety agent", can also be controlled with higher priority. The safety circuit ( SAT ) via a corresponding on / off signal (ON_REG) of the transconductance amplifier (OTA) the output current ( I _G ) of the transconductance amplifier (OTA) in its output nodes ( V _G ) forcibly set it to zero and thereby switch off the control. The potential of the control electrode of the external safety _switch (T _ext ) is typically retained for a certain time, since then the parasitic gate-source capacitance of the external safety _switch (T _ext ) between the control electrode of the external safety _switch (T _ext ) and the node ( V ₅ ) with V5 potential between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) the gate-source voltage is maintained for a short time.

The micro-integrated circuit (IC) preferably has two SPI interfaces: a first SPI interface (MSPI) with a first SPI bus (SPI) for controlling the microcomputer within the micro-integrated circuit (IC) and a second SPI interface ( SSPI) with a second SPI bus ( SPI2 / PSI5d ) for controlling the sensor interfaces within the micro-integrated circuit (IC).

The first SPI bus (SPI) is used to configure the micro-integrated circuit (IC) and to read and write the registers, etc.

The second SPI bus (SSPI) is used to control the data path of the sensors excluding the safety circuit ( SAT ) (Safety agent). The safety circuit ( SAT ) (Safety agent) according to the invention via a first different signal path ( CS , MSPI, SPI) from other signals ( CS , SPI) and modules (MSPI) controlled as the second signal path (SPI2 / PSI5d, SSPI, [CS2] or [SPI2 / PSI5d, SSPI, [SI3], FbFkt, [Diag], MUX]) of the sensors. The safety circuit ( SAT ) (Safety agent) is therefore only controlled via the first SPI interface (MSPI). The safety circuit ( SAT ) prefers to listen in on the communication only on the second SPI bus (SSPI) and compares the complete physical SPI data frame (English: SPI frame) and / or data frame sequences with the expected values and / or expected value sequences determined by the safety circuit (SA) .

The SA (and the rest of the circuit) is configured with the first SPI bus (SPI). Of the SAT in this case only receives the forwarding of decoded control signals.

A PSI5 sensor system (PSS) outside the micro-integrated circuit with a PSI5 sensor connection ( PSI5b ) is connected to the PSI5 interface (PSI5IF) via a multiplexer (MUX). The PSIS interface (PSI5IF) typically has several PSI5 sensor connection options. In the exemplary case of 1 this is an example of a first PSI5 sensor connection ( PSI5a ) and a second PSI5 sensor connection (PSISb). Additional sensor connections can also be provided. Using a multiplexer (MUX), the exemplary PSI5 signal ( PSI5b ) of the exemplary PSIS sensor (PSS) are replaced by a synthesized test signal from a feedback function block (FbFkt) simulating this sensor, which in the example of FIG 1 the multiplexer (MUX) by means of a switching signal ( Diag ) controls as an example. The feedback function block (FbFkt) is in the example of 1 over controlled the second SPI bus (SPI2, PSI5d) and the second SPI interface (SSPI). In this way, the microcomputer (µC) can simulate predefined test cases and check the reaction of the system within the micro-integrated circuit (IC).

The safety circuit ( SAT ) sends an ARM signal (ARM) to the microcomputer (µC), for example, when there are predefined boundary conditions when checking the PSIS interface, which then prompts the microcomputer (µC) to perform predetermined reactions.

The safety circuit (PA) allows the potential at the control electrode of the safety switch (T _ext ) to be regulated by the transconductance amplifier (OTA) via the on / off signal (ON_REG) of the transconductance amplifier (OTA) only under predetermined conditions.

Via a third control signal ( CS3 ) the microcomputer (µC) can control an analog-to-digital converter (ADC) via the first SPI bus (SPI) and the first SPI interface (MSPI) and typically read out its measured values. The analog-to-digital converter (ADC) can measure different nodes within the micro-integrated circuit (IC) by means of a second multiplexer (MUX2). In particular, it is proposed that the exit ( V _G ) of the transconductance amplifier (OTA) and the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) to make it measurable for the microcomputer with V5 potential.

The method proposed below can now be used to check whether the external safety _switch (T _ext ) can perform its function.

• • Messung des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC);
• • Messung des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ ) über den Analog-zu-Digitalwandler (ADC);
• • Öffnen des ersten Schalters (S₁ ). Hierdurch beginnt der Sicherheitsschalter (T_ext) zu floaten. D.h. seine Anschlüsse folgen den Bewegungen des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ ).
• • Einspeisen eines Teststroms (i_TST ) mittels einer Teststromquelle (I_TST ) in den Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ ). Hierdurch verschiebt sich das V5 Potenzial des Knotens (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ );
• • Messung des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ ) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zugehörigen ersten V5-Spannungswertes;
• • Messung des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines ersten zugehörigen Regelspannungswertes;
• • Vergleich des Betrags des ersten V5-Spannungswertes mit dem Betrag des ersten Regelspannungswertes und Ermittlung eines ersten Vergleichsergebnisses;
• • Schließen auf einen Fehler, wenn der Betrag des ersten V5-Spannungswertes über dem Betrag des ersten Regelspannungswertes liegt; (Liegt die Reglerspannung, also der erste Regelspannungswert, beispielsweise bei 21,7V, so können je nach Konstruktion beispielsweise 19V für das V5-Potenzial in diesem Schaltzustand erwartet werden.)
• • Schließen des ersten Schalters (S₁ );
• • Ggf. Abwarten einer Verzögerungszeit (T) zur Einregelung des V5-Potenzials durch den Transkonduktanzverstärker (OTA);
• • Messung des V5-Potenzials am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ ) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zugehörigen zweiten V5-Spannungswertes;
• • Messung des Potenzials am Ausgang (V_G ) des Transkonduktanzverstärkers (OTA) über den Analog-zu-Digitalwandler (ADC) und Ermittlung eines zweiten zugehörigen Regelspannungswertes;
• • Vergleich des Betrags des zweiten V5-Spannungswertes am Knoten (V₅ ) zwischen dem Sicherheitsschalter (T_ext) und dem ersten Zündtransistor (T₁ ) gegen Bezugsmasse (GND) mit dem Betrag des zweiten Regelspannungswertes und Ermittlung eines zweiten Vergleichsergebnisses;
• • Schließen auf einen Fehler, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht. Der Toleranzbereich sollte in der Konstruktionsphase den jeweiligen Bedingungen der Anwendung angepasst werden. Dies kann beispielsweise durch Simulation kritischer Fälle geschehen. Mittels des Analog-zu-Digital-Wandlers (ADC) überprüft dann der Mikrorechner (µC), ob beispielsweise das Potenzial am Knoten V₅ gegen Bezugsmasse (GND) auf einen beispielhaften Zielwert 21,7V geregelt wurde.

The first possibility of such a method is a method with the following steps:

• • Measurement of the potential at the output ( V _G ) of the transconductance amplifier (OTA) via the analog-to-digital converter (ADC);
• • Measurement of the V5 potential at the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) via the analog-to-digital converter (ADC);
• • opening the first switch ( S ₁ ). This causes the safety _switch (T _ext ) to float. Ie its connections follow the movements of the V5 potential at the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ).
• • feeding a test current ( i _TST ) using a test power source ( I _TST ) in the knot ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ). This shifts the V5 potential of the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ );
• • Measurement of the V5 potential at the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) via the analog-to-digital converter (ADC) and determination of an associated first V5 voltage value;
• • Measurement of the potential at the output ( V _G ) the transconductance amplifier (OTA) via the analog-to-digital converter (ADC) and determining a first associated control voltage value;
• • Comparison of the amount of the first V5 voltage value with the amount of the first control voltage value and determination of a first comparison result;
• • infer an error if the amount of the first V5 voltage value is greater than the amount of the first control voltage value; (If the regulator voltage, i.e. the first regulating voltage value, is, for example, 21.7 V, depending on the design, 19 V for the V5 potential can be expected in this switching state, for example.)
• • Close the first switch ( S ₁ );
• • Possibly. Waiting for a delay time (T) for regulating the V5 potential by the transconductance amplifier (OTA);
• • Measurement of the V5 potential at the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) via the analog-to-digital converter (ADC) and determination of an associated second V5 voltage value;
• • Measurement of the potential at the output ( V _G ) of the transconductance amplifier (OTA) via the analog-to-digital converter (ADC) and determination of a second associated control voltage value;
• • Comparison of the amount of the second V5 voltage value at the node ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) against reference mass (GND) with the amount of the second control voltage value and determination of a second comparison result;
• Conclusion of an error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates more than +/- 10% and / or more than +/- 25%. The tolerance range should be in the design phase of the respective conditions of the application be adjusted. This can be done, for example, by simulating critical cases. The microcomputer (µC) then uses the analog-to-digital converter (ADC) to check whether, for example, the potential at the node V ₅ against reference ground (GND) was regulated to an exemplary target value of 21.7V.

The safety circuit ( SAT ) (Safety Agent) listens in the most general variant to the SPI communication between the microcomputer (µC) and the micro-integrated circuit (IC) on the SPI buses (SPI, SPI2). However, in the preferred implementation, the safety circuit ( SAT ) (Safety Agent) the SPI communication between the microcomputer (µC) and the microintegrated circuit (IC) only on the second SPI bus (SPI2). The corresponding connections are in 1 not shown. The decisions are made by the safety circuit ( SAT ) (Safety agent) in an analogous manner and independently of the rest of the circuit, which means that the safety circuit ( SAT ) (Safety Agent) is able to determine expected values and expected value sequences and to compare them with what is happening in the integrated circuit. A test state must be activated specifically so that the safety circuit prevents incorrect triggering by a self-test.

The advantage of simulating the sensor (PSS) using the feedback function block (FbFkt) is that the circuit can be tested without a connected sensor (PSS) or external components without violating the safety requirements.

In this context, refer to the German patent applications DE 10 2018 107 449.2 , DE 10 2018 107 451.4 , DE 10 2018 107 452.2 , DE 10 2018 107 455.7 , DE 10 2018 107 438.7 , DE 10 2018 107 441.7 , DE 10 2018 107 446.8 and DE 10 2018 107 448.4 referenced, which are all part of this disclosure.

Advantage of the invention

The method presented here and the corresponding device allow the simulation of permissible and faulty sensor behavior by emulating the sensor interface, the output of the transconductance amplifier (OTA) being able to be evaluated during operation without causing the ignition device ( SQ ) can come. Furthermore, a safe function check of the safety _switch (T _ext ) is possible during operation. Since two different data paths are used, the effective path can be checked completely without causing an accidental triggering by a single fault in the circuit.

Features of the invention

The invention is based on a device for igniting a squib ( SQ ), which is provided and suitable for carrying out the method described later for checking the function of a safety _switch (T _ext ). It is a device with a microelectronic circuit (IC), with an ignition element ( SQ ), with a first ignition transistor ( T ₁ ), with a second ignition transistor ( T ₂ ), with a safety _switch (T _ext ) that has a control input ( V _G2 ) with a fifth resistor ( R ₅ ), with a knot ( V ₅ ), with a supply voltage line ( V _bat ) and with a reference ground (GND). The supply voltage line ( V _bat ) and the reference ground (GND) supply the device with electrical energy. The fifth resistance ( R ₅ ) may or may not be part of the microelectronic circuit (IC). The microelectronic circuit typically comprises a transconductance amplifier (OTA) with one output ( V _G ), a control signal ( V _R ), a control signal generation network ( R ₁ , R ₂ ), which preferably a first voltage divider made of a first resistor ( R ₁ ) and a second resistor ( R ₂ ) with the control signal ( V _R ) as its output is a storage capacity ( C ₁ ), a first switch ( S ₁ ), a reference voltage ( V _ref ), a test power source ( I _TST ), a knot ( V ₅ ) and means (ADC, MUX2) for detecting the potential at the node ( V ₅ ) and to record the potential at the output ( V _G ) of the transconductance amplifier (OTA). With the means for detecting the potential at the node ( V ₅ ) and to record the potential at the output ( V _G ) of the transconductance amplifier (OTA) is preferably an analog-to-digital converter (ADC), which can detect various potentials within the microelectronic circuit (IC) via a multiplexer (MUX2) and which can be detected by an external microcomputer (µC) can be controlled and read out. The safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second Ignition transistor ( T ₂ ) are connected in series. The ignition element ( SQ ) is between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) switched. The safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) are over a common node ( V ₅ ) connected with each other. The ignition element ( SQ ) is preferably located outside the microelectronic circuit (IC). The safety _switch (T _ext ) is preferably located outside the microelectronic circuit (IC). The first ignition transistor ( T ₁ ) is part of the microelectronic circuit (IC). The second ignition transistor ( T ₂ ) is part of the microelectronic circuit (IC). The safety _switch (T _ext ) and the ignition element ( SQ ) and the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) are arranged in series in a common ignition current path. The ignition element ( SQ ) is in the common ignition current path between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) arranged. For ignition of the ignition element ( SQ ) the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) switched on at the same time, ie switched on. The safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) form an ignition chain. The term ignition chain refers to the serial connection. This ignition chain is between the supply voltage line ( V _bat ) and reference ground (GND). The knot ( V ₅ ) is located between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ). The fifth resistance ( R ₅ ) feeds in the knot ( V ₅ ) an electrical current when the first safety _switch (T _ext ) is switched off ( I ₅ ) what the workability of the control signal generation network ( R ₁ , R ₂ ) in this state. The control signal generation network ( R ₁ , R ₂ ) forms depending on the voltage between the node ( V ₅ ) and the reference potential (GND) the control signal ( V _R ). This control signal ( V _R ) is a first input signal of the transconductance amplifier (OTA). The reference voltage ( V _ref ) is a second input signal of the transconductance amplifier (OTA). The storage capacity ( C ₁ ) is with its first connection to the output ( V _G ) of the transconductance amplifier (OTA) and integrates the output current ( I _G ) of the transconductance amplifier (OTA) minus the leakage currents. With the storage capacity ( C ₁ ) it can also be a network of components with a capacitive or integrating effect, which at least temporarily behaves similar to an ideal capacitance. The first switch ( S ₁ ) is suitable and / or provided for the output ( V _G ) of the transconductance amplifier (OTA) to the control input of the safety _switch (T _ext ). The test power source ( I _TST ) can preferably be initiated by a controller (CTR) or an external microcomputer (µC) a test current ( i _TST ) in the knot ( V ₅ ) feed.

In addition to these features, the invention also includes a structuring of the data communication that is necessary to prevent activation due to a data error. This structuring has a more general character. This partial invention relates to a safety-relevant device for use in vehicles, in particular an airbag ignition system with a microcomputer (μC), a microelectronic circuit (IC), a first data interface, in particular with a first SPI interface (MSPI), a second data interface, especially with a second SPI interface (SSPI), a safety circuit (Safty Agent) ( SAT ), for monitoring device functions, with a sensor interface, in particular a PS15 sensor connection ( PSI5b ), and with a feedback function block (FbFkt) that can simulate a sensor (PSS). The safety circuit (Safty agent) ( SAT ) is controlled via the first data interface (MSPI) by the microcomputer (µC). The feedback function block (FbFkt) and the sensor interface (PSI5B) and the switchover between them is controlled via the second data interface (SSPI) by the microcomputer (µC). In a further form of this partial invention, the safety circuit (Safty agent) ( SAT ) the output signal at the output ( V _G ) of the transconductance amplifier (OTA). In this way, the safety circuit can rule out faulty ignition when testing the system.

The invention further comprises a method according to the invention for checking the functionality of a safety _switch (T _ext ) in an airbag ignition system. The airbag ignition system must have a safety _switch (T _ext ) with a control electrode ( V _G2 ), a first ignition transistor ( T ₁ ), a second ignition transistor ( T ₂ ), an ignition element ( SQ ), a transconductance amplifier (OTA) with one output ( V _G ) and a first switch ( S ₁ ) include.

• • (1) Start
• • (2) Messung des Potenzials am Ausgang (V_G );
• • (3) Messung des V5-Potenzials des Knotens (V5);
• • (4) Öffnen des ersten Schalters (S₁ );
• • (5) Einspeisen eines zusätzlichen Teststroms (i_TST ) in den Knoten (V5);
• • (6) Messung des V5-Potenzials am Knoten (V5) und Ermittlung eines zugehörigen ersten V5-Spannungswertes;
• • (7) Messung des Potenzials am Ausgang (VG) des Transkonduktanzverstärkers (OTA) und Ermittlung eines ersten zugehörigen Regelspannungswertes;
• • (8) Vergleich des Betrags des ersten V5-Spannungswertes mit dem Betrag des ersten Regelspannungswertes und Ermittlung eines ersten Vergleichsergebnisses;
• • (9) Schließen auf einen Fehler, wenn der Betrag des ersten V5-Spannungswertes über dem Betrag des ersten Regelspannungswertes liegt.
• • (10) Schließen auf eine Fehlerfreiheit, wenn der Betrag des ersten V5-Spannungswertes unter dem Betrag des ersten Regelspannungswertes liegt oder um nicht mehr als ein vorgegebener Toleranzwert von dem Betrag des ersten Regelspannungswertes abweicht, was im Sinne dieser Offenlegung noch als ein unter dem Betrag des ersten Regelspannungswertes liegen bewertet wird.
• • (11) Ende.

The first switch ( S ₁ ) the output ( V _G ) of the transconductance amplifier (OTA) with the control electrode ( V _G2 ) of the safety _switch (T _ext ) and can disconnect such a connection. The safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) and the ignition element ( SQ ) and the second ignition transistor ( T ₂ ) are connected in series. The ignition element ( SQ ) is between the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) switched. The safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) are over a common node ( V ₅ ) connected with each other. The procedure (see example 2nd ) includes at least the steps:

• • (1) start
• • (2) Measuring the potential at the output ( V _G );
• • (3) measurement of the V5 potential of the node ( V5 );
• • (4) opening the first switch ( S ₁ );
• • (5) feeding an additional test current ( i _TST ) in the knot ( V5 );
• • (6) measurement of the V5 potential at the node ( V5 ) and determination of an associated first V5 voltage value;
• • (7) Measurement of the potential at the output (VG) of the transconductance amplifier (OTA) and Determining a first associated control voltage value;
• • (8) comparison of the amount of the first V5 voltage value with the amount of the first control voltage value and determination of a first comparison result;
• • (9) Inference of an error if the amount of the first V5 voltage value is greater than the amount of the first control voltage value.
• • (10) Conclusion that the amount of the first V5 voltage value is less than the amount of the first control voltage value or does not deviate from the amount of the first control voltage value by more than a predetermined tolerance value, which in the sense of this disclosure is still less than that The amount of the first control voltage value is evaluated.
• • (11) end.

• • (12) Schließen des ersten Schalters (S₁ );
• • (13) Optionales Abwarten einer Verzögerungszeit (T) zur Einregelung des V5-Potenzials durch den Transkonduktanzverstärker (OTA);
• • (14) Messung des V5-Potenzials am Knoten (V5) und Ermittlung eines zugehörigen zweiten V5-Spannungswertes;
• • (15) Messung des Potenzials am Ausgang (VG) des Transkonduktanzverstärkers (OTA) und Ermittlung eines zweiten zugehörigen Regelspannungswertes;
• • (16) Vergleich des Betrags des zweiten V5-Spannungswertes mit dem Betrag des zweiten Regelspannungswertes und Ermittlung eines zweiten Vergleichsergebnisses;
• • (17) Schließen auf einen Fehler, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht.
• • (18) Schließen auf eine Fehlerfreiheit, wenn der Betrag des zweiten V5-Spannungswertes von dem Betrag des zweiten Regelspannungswertes um nicht mehr als +/-1% und/oder mehr als +/-2% und/oder mehr als +/-5% und/oder mehr als +/-10% und/oder mehr als +/-25% abweicht.
• • (11) Ende (nicht zusätzlich).

A refined process (see example 3rd ), which is based on the method described immediately above, includes the additional steps:

• • (12) Close the first switch ( S ₁ );
• • (13) optional waiting for a delay time (T) for regulating the V5 potential by the transconductance amplifier (OTA);
• • (14) Measurement of the V5 potential at the node ( V5 ) and determination of an associated second V5 voltage value;
• • (15) measurement of the potential at the output (VG) of the transconductance amplifier (OTA) and determination of a second associated control voltage value;
• • (16) comparison of the amount of the second V5 voltage value with the amount of the second control voltage value and determination of a second comparison result;
• (17) Infer an error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5 % and / or more than +/- 10% and / or more than +/- 25% deviates.
• • (18) Inference that the amount of the second V5 voltage value does not deviate from the amount of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or more than +/- 10% and / or more than +/- 25% deviates.
• • (11) end (not additional).

The basis of the invention thus consists of a method for igniting a squib, which is initially characterized by some technical features.

A first and a second ignition transistor ( T ₁ ; T ₂ ), a safety _switch (T _ext ), a transconductance amplifier (OTA) and a resistor ( R ₅ ) again, which are crucial for the invention. The transconductance amplifier (OTA) has an additional output ( V _G ), the safety switch (T _ext ) has a control electrode and is connected in series with the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) and the ignition element ( SQ ), the connection between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) over a knot ( V ₅ ) he follows.

In addition, the resistance ( R ₅ ) between the supply potential and the nodes ( V ₅ ) switched.

After isolating the control electrode of the safety _switch (T _ext ) from the output ( V _G ) and the subsequent feeding of a test current ( i _TST ) in the knot ( V ₅ ) a measurement of the potential at the output ( V _G ) of the transconductance amplifier (OTA) which means that a first control voltage value is determined.

The measurement of a V5 potential at the node ( V ₅ ) then provides a first V5 voltage value. The control electrode of the safety _switch (T _ext ) is then connected to the output ( V _G ) connected.

The next step is to measure the V5 potential at the node ( V ₅ ), which results in the determination of a second V5 voltage value. In addition, the potential at the output is measured ( V _G ) of the transconductance amplifier (OTA) instead. This in turn determines a second control voltage value.

An error is always concluded if the amount of the first V5 voltage value is greater than the amount of the first control voltage unit. An error is also concluded if, after determining a comparison result between the second V5 voltage value and the second control voltage value, a deviation of more than +/- 1% and / or more than +/- 2% and / or more than + / -5% and / or more than +/- 10% and / or more than +/- 25% occurs.

In a second method, which is technically characterized in that a first and a second ignition transistor ( T ₁ ; T ₂ ), a safety _switch (T _ext ), a transconductance amplifier (OTA) and a resistor ( R ₅ ) available. The transconductance amplifier (OTA) has an additional output ( V _G ), of the Safety switch (T _ext ) has a control electrode and is connected in series with the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) and the ignition element ( SQ ), the connection between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) over a knot ( V ₅ ) he follows.

In addition, the resistance ( R ₅ ) between the supply potential and the nodes ( V ₅ ) switched.

After isolating the control electrode of the safety _switch (T _ext ) from the output ( V _G ) and the subsequent feeding of a test current ( i _TST ) in the knot ( V ₅ ) the potential at the output is measured ( V _G ) of the transconductance amplifier (OTA) and the determination of a first control voltage value.

The measurement of a V5 potential at the node ( V ₅ ) then provides a first V5 voltage value. An error is always concluded if the amount of the first V5 voltage value is greater than the amount of the first control voltage unit.

In a third method, which is technically characterized in that a first and a second ignition transistor ( T ₁ ; T ₂ ), a safety _switch (T _ext ), a transconductance amplifier (OTA) and a resistor ( R ₅ ) available. The transconductance amplifier (OTA) has an additional output ( V _G ), the safety switch (T _ext ) has a control electrode and is connected in series with the first ignition transistor ( T ₁ ) and the second ignition transistor ( T ₂ ) and the ignition element ( SQ ), the connection between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) over a knot ( V ₅ ) he follows.

In addition, the resistance ( R ₅ ) between the supply potential and the nodes ( V ₅ ) switched.

The control electrode of the safety _switch (T _ext ) is connected to the output ( V _G ) connected.

The next step is to measure the V5 potential at the node ( V ₅ ) which results in the determination of a second V5 voltage value. In addition, the potential at the output is measured ( V _G ) of the transconductance amplifier (OTA) instead. This in turn determines a second control voltage value.

An error is always concluded if the amount of the first V5 voltage value is greater than the amount of the first control voltage value. An error is also concluded if, after determining a comparison result between the second V5 voltage value and the second regulator voltage value, a deviation of more than +/- 1% and / or more than +/- 2% and / or more than + / -5% and / or more than +/- 10% and / or more than +/- 25% occurs.

Figure list

• 1 shows schematically simplified a proposed device.
• 2nd shows the basic procedure for testing the safety _switch (T _ext ).
• 3rd shows the refined procedure for testing the safety _switch (T _ext ).

Reference list

1

Procedural step 1 : Begin;

2nd

Procedural step 2nd : Measurement of the potential at the output ( V _G );

3rd

Procedural step 3rd : Measurement of the V5 potential of the node ( V5 );

4th

Procedural step 4th : Opening the first switch ( S ₁ );

5

Procedural step 5 : Feeding an additional test current ( i _TST ) in the knot ( V5 );

6

Procedural step 6 : Measuring the V5 potential at the node ( V5 ) and determination of an associated first V5 voltage value;

7

Procedural step 7 : Measurement of the potential at the output (VG) of the transconductance amplifier (OTA) and determination of a first associated control voltage value;

8th

Procedural step 8th : Comparison of the amount of the first V5 voltage value with the amount of the first control voltage value and determination of a first comparison result;

9

Procedural step 9 : Infer an error if the amount of the first V5 voltage value is greater than the amount of the first control voltage value;

10th

Procedural step 10th : Inference that there is no error if the amount of the first V5 voltage value is less than the amount of the first control voltage value or does not deviate from the amount of the first control voltage value by more than a predetermined tolerance value, which in the sense of this disclosure is still less than the amount of the first Control voltage values are evaluated;

11

Procedural step 11 : The End;

12th

Procedural step 12th : Close the first switch ( S ₁ );

13

Procedural step 13 : Optional waiting for a delay time (T) for regulating the V5 potential by the transconductance amplifier (OTA);

14

Procedural step 14 : Measuring the V5 potential at the node ( V5 ) and determination of an associated second V5 voltage value;

15

Procedural step 15 : Measurement of the potential at the output (VG) of the transconductance amplifier (OTA) and determination of a second associated control voltage value;

16

Procedural step 16 : Comparison of the amount of the second V5 voltage value with the amount of the second control voltage value and determination of a second comparison result;

17th

Procedural step 17th : Infer an error if the amount of the second V5 voltage value differs from the amount of the second control voltage value by more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates more than +/- 10% and / or more than +/- 25%;

18th

Procedural step 18th : Inferior to an error-free state if the amount of the second V5 voltage value differs from the amount of the second control voltage value by no more than +/- 1% and / or more than +/- 2% and / or more than +/- 5% and / or deviates more than +/- 10% and / or more than +/- 25%;

ADC

Analog-to-digital converter;

POOR

Arm signal from the safety circuit to the microcomputer (µC);

C ₁

Storage capacity;

CS

first control signal to control the safety circuit ( SAT ) via the first SPI interface (MSPI) and the first SPI bus (SPI) by the microcomputer (µC);

CS2

second control signal for controlling the PSIS interface (PSI5IF) via the second SPI interface (SSPI) and the second SPI bus ( SPI2 / PSI5d ) by the microcomputer (µC);

CS3

third control signal for controlling the analog-to-digital converter (ADC) via the first SPI interface (MSPI) and the first SPI bus (SPI) by the microcomputer (µC);

CTR

Control circuit;

Diag

Switching signal;

EXT

Exterior of the micro-integrated electronic circuit;

FbFkt

Feedback function block;

GND

Reference mass;

I ₅

Current through the fifth resistor ( R ₅ );

IC

micro-integrated electronic circuit;

I _G

Output current of the transconductance amplifier (OTA);

I _TST

Test power source;

i _TST

Test current of the test current source ( I _TST );

µC

Microcomputer;

µC1

Control line with the microcomputer (µC) the first switch ( S ₁ ) controls;

MSPI

first SPI interface on the first SPI bus (SPI), which here, for example, connects the non-sensor part of the microintegrated circuit (IC) to the microcomputer (µC) and makes it controllable;

MUX

Multiplexer;

ON_REG

On / off signal for the transconductance amplifier;

OTA

Transconductance amplifier. When switched on, the transconductance amplifier delivers an output current ( I _G ), which is proportional to the voltage difference at its two inputs (+, -). The transconductance amplifier can be switched on and off via an on-off signal (ON_REG). When switched off, the transconductance amplifier delivers an output current ( I _G ) which is essentially zero except for parasitic currents;

PSI5a

first PS15 sensor connection;

PSI5b

second PS15 sensor connection;

PSISIF

PSIS interface;

PSS

PSIS sensor system;

R ₁

first resistor, the part of the first voltage divider ( R ₁ , R ₂ ) is;

R ₂

second resistor, the part of the first voltage divider ( R ₁ , R ₂ ) is;

R ₃

third resistance;

R ₄

fourth resistance;

R ₅

fifth resistance;

S ₁

first switch. The first switch is exemplified in 1 drawn microcomputer (µC) controlled via an associated control line (µC ₁ ).

SAT

Safety circuit (Safty agent);

SI3

fourth control signal for controlling the feedback function block (FbFkt) via the second SPI interface (SSPI) and the second SPI bus ( SPI2 / PSI5d ) by the microcomputer (µC);

SPI

first SPI bus. Instead of an SPI bus, other data bus standards can also be used.

SPI2 / PSI5d

second SPI bus. Instead of an SPI bus, other data bus standards such as PS15 can also be used.

SSPI

second SPI interface on the second SPI bus (SPI2 / PSI5), which connects the sensor part of the micro-integrated circuit (IC) with the microcomputer (µC) as an example;

SQ

Ignition element;

T ₁

first ignition transistor;

T ₂

second ignition transistor;

T _ext

Safety switch.

V ₅

Knot ( V ₅ ) between the safety _switch (T _ext ) and the first ignition transistor ( T ₁ ) with V5 potential;

V _bat

Supply voltage line, which is typically at supply voltage potential;

V _G

Output of the transconductance amplifier (OTA);

V _G2

Control input of the safety _switch (T _ext );

V _R

Control signal. The control signal is preferably the output signal of the first voltage divider ( R ₁ , R ₂ );

V _ref

Reference voltage;

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102018107449 [0027]
• DE 102018107451 [0027]
• DE 102018107452 [0027]
• DE 102018107455 [0027]
• DE 102018107438 [0027]
• DE 102018107441 [0027]
• DE 102018107446 [0027]
• DE 102018107448 [0027]

Claims (1)

Device for igniting a squib (SQ), which is provided and suitable for carrying out a method for _checking the function of a safety _switch (T _ext ) - with a microelectronic circuit (IC) and - with an ignition element (SQ) and - with a first ignition transistor (T ₁ ) and - with a second ignition transistor (T ₂ ) and - with a safety _switch (T _ext ) with a control input (V _G2 ) and - with a fifth resistor (R ₅ ) and - with a node (V ₅ ) and - with a supply voltage line (V _bat ) and - with a reference ground (GND) and - with a microcomputer (µC) and - with a microelectronic circuit (IC) • with a first data interface, in particular a first SPI interface (MSPI), and • with a second data interface, in particular a second SPI interface (SSPI), and • with a safety circuit (safety agent) (SA), for monitoring device functions, and • with a sensor interface, in particular one of a PS15 sensor connection (PSI5b), and • with a feedback function block (FbFkt), which can simulate a sensor (PSS), and - the supply voltage line (V _bat ) and the reference ground (GND) supply the device with electrical energy and - whereby the fifth resistor (R ₅ ) may or may not be part of the microelectronic circuit (IC) and - wherein the microelectronic circuit • a transconductance amplifier (OTA) with an output (V _G ) and • a control signal (V _R ) and • a control signal generation network (R ₁ , R ₂ ) and • a storage capacity (G _L ) and • a first switch (S ₁ ) and • a reference voltage (V _ref ) and • a test current source (I _TST ) and • a node (V ₅ ) and • Means (ADC, MUX2) for detecting the potential at the node (V ₅ ) and for detecting the potential at the output (V _G ) of the transconductance amplifier (OTA) and - wherein the safety _switch (T _ext ) and the first ignition transistor (T ₁ ) and the igniter ent (SQ) and the second ignition transistor (T ₂ ) are connected in series and - the ignition element (SQ) is connected between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) and - the safety switch (T _ext ) and the first ignition transistor (T ₁ ) are connected to one another via a common node (V ₅ ) and - the ignition element (SQ) is located outside the microelectronic circuit (IC) and - the safety _switch (T _ext ) is located outside the microelectronic Circuit (IC) is located and - the first ignition transistor (T ₁ ) is part of the microelectronic circuit (IC) and - the second ignition transistor (T ₂ ) is part of the microelectronic circuit (IC) and - the safety _switch (T _ext ) and the ignition element (SQ) and the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) are arranged in series in a common ignition current path and - wherein the ignition element (SQ) in the common n ignition current path is arranged between the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) and - wherein for ignition of the ignition element (SQ) the safety _switch (T _ext )) and the first ignition transistor (T ₁ ) and the second ignition transistor (T ₂ ) turned on, that is, switched on, and - and the safety switch (T _ext ) and the first ignition transistor (T ₁ ) and the ignition element (SQ) and the second ignition transistor (T ₂ ) form an ignition chain and - the Ignition chain is connected between the supply voltage line (V _bat ) and the reference ground (GND) - the node (V ₅ ) being located between the safety switch (T _ext ) and the first ignition transistor (T ₁ ) and - the fifth resistor (R ₅ ) _feeds an electrical current (I ₅ ) into the node (V ₅ ) when the first safety _switch (T _ext ) is switched off and - the control signal generation network depending on the voltage between the node (V ₅ ) and the Reference potential (GND) forms the control signal (V _R ); - The control signal (V _R ) is a first input signal of the transconductance amplifier (OTA) and - wherein the reference voltage (V _ref ) is a second input signal of the transconductance amplifier (OTA) and - wherein the storage capacity (C ₁ ) with its first connection to the Output (V _G ) of the transconductance amplifier (OTA) is connected and - the first switch (S ₁ ) being suitable and / or provided for connecting the output (V _G ) of the transconductance amplifier (OTA) to the control input of the safety switch (T _ext ) to connect and - the test current source (I _TST ) can feed a test current (i _TST ) into the node (V ₅ ). - the safety circuit (SA) is controlled via the first data interface (MSPI) by the microcomputer (µC) and - the feedback function block (FbFkt) and the sensor interface (PSI5B) and the switchover between them via the second data interface ( SSPI) is controlled by the microcomputer (µC). - The safety circuit (SA) can influence the output signal at the output (V _G ) of the transconductance amplifier (OTA).

Images