DE102018110934B4 - Process for operationally safe, simplified activation of production test modes in safety-relevant electronic circuits for a vehicle occupant restraint system - Google Patents

Abstract

Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a vehicle occupant restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) from a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib (SQ) ,- wherein the integrated circuit (IC) comprises a first control line which is intended to drive a first control terminal (G1) of a first transistor (T1) and- wherein the first control line can be active or inactive and- wherein the integrated circuit ( IC) comprises a second control line which is intended to drive a second control connection (G2) of a second transistor (T2) and- wherein the second control line can be active or inactive and- wherein the integrated circuit (IC) comprises a third control line, the intended to drive a third control connection (G3) of a third transistor (T3) and- wherein the third control line can be active or inactive and- wherein the integrated circuit is provided for the first transistor (T1) and the second transistor (T2 ) and the third transistor (T3) are connected in series with the squib (SQ) and- wherein the ignition of the squib (SQ) in normal operation at least has the prerequisite that the first control line is active and the second control line is active and the third Control line is active- whereby a test of the first control line in the production test mode of the integrated safety-relevant electronic circuit (IC) should be possible, comprising the steps of- fulfilling a first precondition for activating the production test mode by transmitting a first message via a first interface (IF1);- determining that the production test mode due to the first precondition to activate the producti onstestmodus it requires that the first control line is NOT forcibly deactivated until the end of the activation of the production test mode;- deactivating the second control line of the second control terminal (G2) of the second transistor (T2) and locking an activation of the second control line at least until the end of the activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking an activation of the third control line at least until the end of the activation of the production test mode;- checking whether the deactivated control lines are deactivated;- fulfilling a second precondition for Activation of the production test mode by transmitting a second message via a second interface (IF2) which is different from the first interface (IF1);- Activation of the production test mode if at least one control line from the second or third control line device has been deactivated and if at least this control line is deactivated and if the first precondition is met and the second precondition is met and if it is determined based on the first precondition for activating the production test mode that the production test mode requires that the first control line is not forced to end of activation of production test mode.

Description

field of invention

A method for activating a production test mode for a safety-related electronic circuit and in particular a method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a vehicle occupant restraint system with a squib (SQ) is proposed.

General introduction

• • IEC 61511: Funktionale Sicherheit - für Sicherheitstechnische Systeme für die Prozessindustrie
• • IEC 61513: Kernkraftwerke - für Leittechnik für Systeme mit sicherheitstechnischer Bedeutung - Allgemeine Systemanforderungen
• • EN 50128: Bahnanwendungen - für Telekommunikationstechnik, Signaltechnik und Datenverarbeitungssysteme - für sicherheitsrelevante elektronische Systeme für die Signaltechnik
• • IEC 62061: Sicherheit von Maschinen - für die funktionale Sicherheit sicherheitsbezogener elektrischer, elektronischer und programmierbarer elektronischer Steuerungssysteme
• • ISO 26262: Road Vehicles - Funktionale Sicherheit für Automobile

Electronic systems and in particular integrated circuits are used in a wide variety of safety-related systems. Examples of relevant exemplary standards that such systems must meet depending on the application are (without claiming to be complete):

• • IEC 61511: Functional safety - for safety-related systems for the process industry
• • IEC 61513: Nuclear power plants - for control technology for systems with safety-related significance - general system requirements
• • EN 50128: Railway applications - for telecommunications technology, signaling technology and data processing systems - for safety-related electronic systems for signaling technology
• • IEC 62061: Safety of machinery - for the functional safety of safety-related electrical, electronic and programmable electronic control systems
• • ISO 26262: Road Vehicles - Functional safety for automobiles

Before the delivery of such safety-relevant electronic systems and during production, these systems must be fully tested for the functionality of all components. Their number can reach two-digit powers of ten in integrated circuits.

Therefore, special production test modes (test states of the electronic systems) are provided in order to be able to quickly and cost-effectively bring this component into all possible relevant states for each of the components of the electronic system to be tested and to be able to observe the reaction of this component in such a way that a good/bad - Statement regarding each parameter of this component to be checked is possible.

As a rule, therefore, these electronic systems cannot be operated in accordance with the specification in these production test modes and are therefore not safe. Due to a wide variety of influences, it is now possible for signals for activating the production test modes to be unintentionally activated during normal operation. In the simplest case, this can be caused by natural radioactivity or a failure of a sub-component of the electronic system. Such an event must therefore not become a security risk.

A production test implementation in safety-relevant products thus always harbors the potential for critical, safety-relevant errors in the event of unintentional activation of a production test mode in safety-relevant normal operation.

State of the art

An integrated circuit is described below as an electronic system. However, the proposed methodology can also be applied to any other electronic system.

There are countless methods of bringing integrated circuits into a production test mode (test state). In the simplest case, a connection is pulled to a specific level that is not normally operated at this level. Activation via specific memory locations of registers in a processor is also known, provided the integrated circuit has a processor. Testing via an IEEE-1149-compatible JTAG test interface and the test register of the associated JTAG test controller is particularly suitable because it is standardized.

Multiple locking of test modes is known from the prior art. This prior art is known in particular in the form of integrated circuits which are freely available on the market. Production test modes must always be activated first. In order to achieve the necessary security, multiple locking is sometimes not enough. When calculating failure rates based on circuit design, in certain cases, particularly integrated circuits used to control vehicle occupant restraint systems (airbags) or to control pedestrian impact protection systems, it is necessary to account for the probability of erroneous activation of safety-related functions, such as the deployment of an airbag or pedestrian impact protection system while driving, to be lowered even further in order to be able to meet the requirements of the standards mentioned above as examples. Such an erroneous activation of security-related functions can also be caused, for example, by the accidental activation of a product tion test mode in the intended normal operation.

As a relevant patent literature here, for example, the U.S. 2014/0 039 764 A1 which discloses a pre-inspection method for inspecting an air bag controller prior to shipment. Furthermore, the German patent application DE 10 2005 030 770 A1 of particular importance, which specifies a method for controlling a safety device in the vehicle. In addition, the DE 198 28 432 A1 be given, which describes the use of a safety switch in airbags per se as a particularly early disclosure of this protective mechanism. Likewise at this point DE 103 50 853 A1 named as relevant prior art. The DE 103 50 853 A1 discloses the unlocking of an actuator depending on various control and release signals.

What all of these documents have in common is that they describe how, for example, mutual locking and/or safety switches ensure that an air bag does not inadvertently trigger. In quality engineering, however, such prevention is known as a containment measure for a problem that has already arisen before it develops into an error. However, the present disclosure is not intended to enable a reliable test, like the aforementioned disclosures, but rather to prevent a test state from being accidentally assumed at all. The following description is therefore expressly not concerned with the safe testing of a safety-relevant integrated circuit, but with the safe assumption of a safe test state in which such a test can then take place. In calculations within the framework of functional safety, this problem manifests itself in such a way that the effort required to reduce the probability of occurrence of an incorrect activation of safety-relevant functions due to an accidental activation of production test modes is significantly reduced by this procedure.

object of the invention

The invention is therefore based on the object of creating a solution that further reduces the probability of erroneous activation of safety-related functions due to accidental activation of production test modes.

This object is achieved by a method according to claim 1, according to claim 2 or according to claim 3.

Solution of the problem of the invention

The claimed invention relates to a method for activating a production test mode for an integrated safety-related electronic circuit IC for controlling a vehicle occupant restraint system with a squib SQ or for at least one integrated safety-related electronic circuit IC from a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib SQ. According to the invention, the integrated circuit IC comprises a first control line, which is intended to drive a first control terminal G1 of a first transistor T1, and a second control line, which is intended to drive a second control terminal G2 of a second transistor T2, and a third control line , which is intended to drive a third control terminal G3 of a third transistor T3. The first control line and the second control line and the third control line can each be active or inactive. The first transistor T1 and the second transistor T2 and the third transistor T3 are connected in series with the squib SQ. According to the invention, the ignition of the squib SQ in normal operation has at least the prerequisite that the first control line is active and the second control line is active and the third control line is active, it being possible to test the first control line in the production test mode of the integrated safety-relevant electronic circuit IC. The method according to the invention includes the fulfillment of a first precondition for activating the production test mode by transmitting a first message via a first interface IF1. The inventive method includes determining that the production test mode requires that the first control line is NOT forcibly deactivated until the end of the activation of the production test mode due to the first precondition for activating the production test mode, and deactivating the second control line of the second control terminal G2 of the second transistor T2 and the locking of an activation of the second control line at least until the end of the activation of the production test mode or the deactivation of the third control line of the third control connection G3 of the third transistor T3 and the locking of an activation of the third control line at least until the end of the activation of the production test mode. The method according to the invention also includes checking whether the deactivated control lines are deactivated. The method according to the invention includes fulfilling a second precondition for activating the production test mode by transmitting a second message via a second interface IF2, which is different from the first interface IF1, and activating the production test mode if at least one control line was deactivated by the second or third control line and if at least this control line is deactivated and if the first precondition is met and the second precondition is met and if it is determined on the basis of the first precondition for activating the production test mode that the production test mode it requires that the first control line is not forcibly deactivated until the end of activation of the production test mode.

The starting point for the intended probability reduction is to increase the detection and signaling of a potential, presumably unintentional access to production test functions and at the same time to increase the probability of achieving a predefined safe state for this case.

The basic idea of the proposed method is to specify at least two entry conditions for the production test, but also to design the system in such a way that a safe functional state is assumed as soon as the first entry conditions for the production test are met.

This method is the example of a schematically simplified airbag ignition system, as is known from the prior art, with the help of 1 explained. Such ignition circuits are also used in pedestrian impact protection systems.

The exemplary airbag ignition system AS is supplied with the supply voltage VCC from the operating power supply system of the vehicle in normal operation. In this case, an energy reserve in the form of a capacitor CE is charged and kept ready for operation. This serves to maintain the energy supply of the airbag ignition system AS in the event of a disruption in the supply voltage VCC due to the consequences of an accident in the vehicle. A polarity reversal protection diode D1 prevents the energy stored in the energy reserve CE from being fed back into the vehicle's power supply system. The airbag ignition system AS consists of a series connection of at least three transistors (T1, T2, T3) and the squib SQ of the airbag, as well as the controller ST and the capacitor CE of the energy reserve and the reverse polarity protection diode D1. The squib SQ usually has a first connection and a second connection. The first of the three transistors (T1, T2, T3) is a safety switching transistor T1, which is preferably provided only once and preferably outside the integrated circuit. The second transistor T2 is the so-called high-side switch, since it is connected directly to the typically positive supply voltage VCC via the reverse polarity protection diode D1 when the safety switching transistor T1 is switched on. The third transistor T3 is the so-called low-side switch, since it is connected directly to the typically negative supply voltage, the reference potential GND. The squib SQ is arranged between the high-side switch, ie the second transistor T2, and the low-side switch, ie the third transistor T3, and supplies the gas for explosive deployment of the airbag when ignited. To do this, an electric current must flow through the SQ squib. It is therefore necessary to turn on all three transistors T1, T2, T3 simultaneously, i.e. to activate them, in order to fire the squib SQ and deploy the airbag.

For example, in a pedestrian impact protection system, instead of deploying the airbag, the bonnet would be tipped up slightly by the explosive charge to reduce the impact forces on a head in a pedestrian collision by increasing the travel distance.

The first transistor T1 is activated by activating the first control connection G1 of the first transistor T1.

The second transistor T2 is activated by activating the second control connection G2 of the second transistor T2.

The third transistor T3 is activated by activating the third control connection G3 of the third transistor T3.

Typically, the first transistor T1 is outside the integrated circuit IC, while the second transistor T2 and the third transistor T3 are preferably part of the integrated circuit IC. Of course, the squib SQ is not part of the integrated circuit IC. Because of the required storage capacity, the capacitor CE of the energy reserve is typically also located outside of the integrated circuit IC. A controller ST within the integrated circuit IC now supplies the control signals for the first control connection G1 of the first transistor T1 and for the second control connection G2 of the second transistor T2 and for the third control connection G3 of the third transistor T3.

• Fall A
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall B
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird NICHT unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall C
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird NICHT unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird unterbunden.
• Fall D
  • • Die Aktivierung des ersten Steueranschlusses G1 des ersten Transistors T1 wird unterbunden und
  • • die Aktivierung des zweiten Steueranschlusses G2 des zweiten Transistors T2 wird unterbunden und
  • • die Aktivierung des dritten Steueranschlusses G3 des dritten Transistors T3 wird NICHT unterbunden.

It is now proposed that by activating a production test mode, here for example by the test mode activation line TM connected to the controller ST, one of the following four cases occurs:

• Case A
  • • The activation of the first control terminal G1 of the first transistor T1 is prevented and
  • • the activation of the second control terminal G2 of the second transistor T2 is prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• case B
  • • The activation of the first control connection G1 of the first transistor T1 is NOT prevented and
  • • the activation of the second control terminal G2 of the second transistor T2 is prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• Case C
  • • The activation of the first control terminal G1 of the first transistor T1 is prevented and
  • • the activation of the second control terminal G2 of the second transistor T2 is NOT prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is prevented.
• case D
  • • The activation of the first control terminal G1 of the first transistor T1 is prevented and
  • • the activation of the second control terminal G2 of the second transistor T2 is prevented and
  • • the activation of the third control connection G3 of the third transistor T3 is NOT prevented.

The term "active" for a control line for a control connection (G1, G2, G3) of one of the transistors (T1, T2, T3) is to be understood in such a way that in normal operation the squib SQ fires as soon as all three control lines of the three control connections ( G1, G2, G3) of the transistors (T1, T2, T3) are "active".

Case A should be selected for all test modes in which none of the three control lines of the three control connections (G1, G2, G3) of the transistors (T1, T2, T3) are to be tested.

Cases B, C and D allow the three control lines of the three control connections (G1, G2, G3) of the transistors (T1, T2, T3) to be checked in the production test in a special production test mode without the probability of triggering of the squib SQ in normal operation increase to a tolerable level.

It is therefore an essential feature of an airbag ignition system AS according to this proposal if a first production test mode is provided for testing a first connection α of the integrated circuit IC, which is provided for connecting the first pole of the squib SQ, and for the test a second connection β of the integrated circuit IC, which is provided for connecting the second pole of the squib SQ, a second test mode and that in the first test mode the second connection β has a high impedance relative to the reference potential GND and that in the second test mode the first connection α for the squib SQ has a high resistance compared to the connection ε for the safety switching transistor T1.

In this case, high-impedance means for the second transistor T2 that the resistance between the first connection α for the squib SQ relative to the connection ε for the switching transistor T1 is smaller by a factor of at least 50 than the resistance that the second transistor T2 exhibits when the second control connection G2 of the second transistor T2 is active.

In this case, high resistance means for the third transistor T3 that the resistance between the second connection β for the squib SQ and the reference potential GND is lower by a factor of at least 50 than the resistance that the third transistor T3 shows when the third control connection G3 of the third transistor T3 is active.

However, experience has shown that it is not sufficient to switch the control lines (G1, G2, G3) to inactive. Rather, these lines store electrical charges. Therefore, a faulty, dangerous state can still be assumed in the event of a transient switch-on. When this proposal was being worked out, it was therefore recognized that the control lines of the control connections (G1, G2, G3) of the transistors (T1, T2, T3) must be discharged for a safe state of the safety-relevant electronic circuit.

It is therefore recommended to only activate the production test mode when the control connections (G1, G2, G3) of the transistors (T1, T2, T3) are actually deactivated by discharging. For this purpose, a monitoring circuit can be provided which monitors the actual status of the control lines of the control terminals (G1, G2, G3) of the transistors (T1, T2, T3) are determined.

It is therefore a feature of this proposal that not only by fulfilling one of at least two conditions for activating the production test mode for an electronic system, the system is already in a safe state, here by deactivating all three or at least two control lines of the control connections (G1 , G2, G3) of the transistors (T1, T2, T3), but that the taking of this safe state is measured and verified and is only activated when the predetermined safe state is present. In the present case, this predetermined safe state is characterized by the discharge of all three or at least two control lines of the control connections (G1, G2, G3) of the transistors (T1, T2, T3).

For case A

In case A, none of the control lines of the control connections (G1, G2, G3) of the transistors (T1, T2, T3) are checked. The activation of the relevant production test mode is initiated, for example, by activating the test mode activation line TM. To activate this production test mode in an airbag ignition system AS, all three control lines of the control connections (G1, G2, G3) of the transistors (T1, T2, T3) should therefore be deactivated. In this case A, the assumption of this safe state is then measured and verified in such a way that only when the predetermined safe state is present, in the form of the discharge of all three control lines of the control terminals (G1, G2, G3) of the transistors (T1, T2, T3) the production test mode is activated.

For case B

In case B, the first control line of the first control connection G1 of the first transistor T1 is tested by the production test in this production test mode. The activation of this relevant production test mode is initiated, for example, by activating the test mode activation line TM. To activate the production test mode in an airbag ignition system AS, in this case B the second control line of the second control connection G2 of the second transistor T2 should be deactivated and the third control line of the third control connection G3 of the third transistor T3 should be deactivated. In this case B, the assumption of this safe state is then measured and verified in such a way that only when the predetermined safe state is present, in the form of the discharge of the second control line of the second control connection G2 of the second transistor T2 and the third control line of the third control connection G3 of the third Transistor T3 the production test mode is activated.

For the case C

In case C, the second control line of the second control connection G2 of the second transistor T2 is tested by the production test in this production test mode. The activation of this relevant production test mode is initiated, for example, by activating the test mode activation line TM. To activate the production test mode in an airbag ignition system AS, in this case C the first control line of the first control connection G1 of the first transistor T1 should be deactivated and the third control line of the third control connection G3 of the third transistor T3 should be deactivated. In this case C, the assumption of this safe state is then measured and verified in such a way that only when the predetermined safe state is present, in the form of the discharge of the first control line of the first control connection G1 of the first transistor T1 and the third control line of the third control connection G3 of the third Transistor T3, the production test mode is activated.

For the case D

In case D, the third control line of the third control connection G3 of the third transistor T3 is tested by the production test in this production test mode. The activation of the relevant production test mode is initiated, for example, by activating the test mode activation line TM. To activate this production test mode in an airbag ignition system AS, the first control line of the first control connection G1 of the first transistor T1 should therefore be deactivated in this case D and the second control line of the second control connection G2 of the second transistor T2 should be deactivated. In this case D, the assumption of this safe state is then measured and verified in such a way that only when the predetermined safe state is present, in the form of the discharge of the first control line of the first control connection G1 of the first transistor T1 and the second control line of the second control connection G2 of the second Transistor T2 the production test mode is activated.

If a condition for entering the production test mode has already been activated, the safety-relevant electronic circuit can generate an error message or keep it ready, which can be displayed.

• In einem ersten Schritt wird eine erste Vorbedingung zur Aktivierung des Produktionstestmodus erfüllt. Dies erfolgt durch Übermittlung einer ersten Anforderung über eine erste Schnittstelle an die Vorrichtung. Beispielsweise kann dies mittels einer Programmierung eines ersten Testregisters der zu testenden sicherheitsrelevanten elektronischen Schaltung in einer JTAG-Testschnittstelle dieser zu testenden sicherheitsrelevanten elektronischen Schaltung erfolgen.

In this document, the following method is used for activating a production test mode for a safety-related electronic circuit or proposed for at least one safety-related electronic circuit (IC) from several safety-related circuits:

• In a first step, a first precondition for activating the production test mode is met. This is done by transmitting a first request to the device via a first interface. For example, this can be done by programming a first test register of the safety-relevant electronic circuit to be tested in a JTAG test interface of this safety-relevant electronic circuit to be tested.

With this step, the safety-relevant electronic circuit to be tested should be automatically transferred to a safe state that cannot be left by the production test. This is the second step. However, this must not be sufficient to activate the production test mode of the safety-relevant electronic circuit.

Only the fulfillment of a second precondition to activate the production test mode as a third step enables the final activation step. In this third step, the second precondition for activating the production test mode is fulfilled. This is done again by transmitting a second request to the device via the first interface. For example, this can be done by programming a second test register of the safety-relevant electronic circuit to be tested in said JTAG test interface of this safety-relevant electronic circuit to be tested. The second test register must be different from the first test register. However, a complete separation of the activation paths is preferred. In the case of complete separation, the second precondition for activating the production test mode is also fulfilled in this third step, but with better security. This is done again by transmitting a second request, but now via a second interface to the device, which is different from the first interface.

This fulfillment of a second precondition can, for example, be a special combination of voltage levels at different terminals (the terminals represent an interface here) or a software command via another interface etc.

The electrical connections of the safety-relevant electronic circuit (IC) to be tested can be considered as interfaces (IF1, IF2), with the signaling taking place, for example, via special voltage and/or current levels or temporal sequences and combinations thereof, and/or data interfaces, such as e.g. SPI bus interfaces, or sensor interfaces, such as PSI5 or DSI3 interfaces or other appropriate interfaces into consideration. The only important thing here is that the first precondition and the second precondition do not have to be fulfilled via unequal interfaces, as a result of which increased security against inadvertently adopting an unsafe state is achieved.

The final step is to activate the production test mode if the first and second preconditions for activating the production test mode are met and if the transfer of the safety-relevant electronic circuit to the safe state has been carried out as a step.

In a recommended variant of the method, it is proposed to signal the fulfillment of the first precondition to the user. As a result, this user is made aware of the critical state of the system and can react. The variant of the method therefore includes the step of signaling a faulty state or attempting to signal a faulty state. This can also involve the provision of information about this faulty state. This can happen, for example, in a register of a processor or by changing the logical state of a connection of the safety-relevant electronic circuit.

In a further recommended variant of the method, it is again proposed to explicitly check whether the safe state has been reached by means of a special measurement. This variant therefore includes the additional step of checking the safety-relevant electronic circuit to determine whether the safe state has been successfully assumed. The safety-relevant electronic circuit can also be influenced from the outside. If the safety-relevant electronic circuit controls the control connection of a transistor, the transistor can bring the corresponding connection of the safety-relevant electronic circuit into an unsafe state, for example if its control connection is electrically charged. This can be recognized by such a step and thus ultimately prevented. The final step of activating the production test mode is therefore modified in such a way that the production test mode is only activated if the first and second preconditions for activating the production test mode are met and if the transfer of the safety-relevant electronic circuit to the safe state has been carried out and if now In addition, the review reveals that the security electronic circuit is actually in this safe state.

Of course, it must also be possible to test safety-relevant sub-devices of the safety-relevant electronic circuit to ensure that they can assume an unsafe state required by the specification. In the case of the control lines for the said airbag transistors, this means that it must be possible to check that they can be activated. A variant of the method for these cases is therefore proposed here.

This is a method for activating a production test mode for a safety-related electronic circuit or for at least one safety-related electronic circuit of several safety-related circuits, which is a safety device, and in which it is to be checked whether a first sub-device is brought into an unsafe state as intended can be. In order for this to be possible, the safety-relevant electronic circuit must be designed in such a way that the safety function of this first sub-device is secured again by at least one second sub-device and is preferably secured again by a third sub-device. In the case of said airbag circuit of the 1 For example, the control line for the first transistor T1 can be checked as the first sub-device to determine whether it can be activated. Since all three transistors (T1, T2, T3) must be switched through to fire the squib, the second transistor T2 and the third transistor T3 still protect the squib SQ twice in this case by being inactive during the test, i.e are high impedance.

The first step is again the fulfillment of a first precondition for activating the production test mode. In contrast to the case described above, however, the first partial device is not forcibly transferred to the safe state, since this must be explicitly possible for the production test in this production test mode and should be checked.

Therefore, as a second step, the second sub-device is transferred to a safe state, which cannot be left by the production test until the end of the production test.

As a third step, the third partial device is transferred to a safe state, which cannot be left by the production test until the end of the production test.

As a fourth step, a second precondition for activating the production test mode is fulfilled again.

The second, third, and fourth step can be performed in any chronological order after the first step.

The fifth step is to check whether the safe state has been assumed by the second sub-device. The sixth step is to check whether the safe state has been assumed by the third sub-device. The fifth step follows the second step in time. The sixth step follows the third step in time.

The final step of activating the production test mode takes place after all other steps, however, only if the first and second preconditions for activating the production test mode are met and if the transitions of the first, second and third sub-devices to their respective safe states have been carried out as a step and the first, second and third sub-devices are actually in their respective safe states.

• Es handelt sich bei dem vorgeschlagenen Verfahren dann um ein Verfahren zur Aktivierung eines Produktionstestmodus für eine integrierte sicherheitsrelevante elektronische Schaltung IC zur Steuerung eines Fahrzeuginsassenrückhaltesystems mit einer Zündpille SQ oder für mindestens eine integrierte sicherheitsrelevante elektronische Schaltung IC von mehreren integrierten sicherheitsrelevanten Schaltungen zur Steuerung eines Fahrzeuginsassenrückhaltesystems mit einer Zündpille SQ.

In the case of an airbag control, this procedure now looks like this:

• The proposed method is then a method for activating a production test mode for an integrated safety-relevant electronic circuit IC for controlling a vehicle occupant restraint system with a squib SQ or for at least one integrated safety-relevant electronic circuit IC from a plurality of integrated safety-relevant circuits for controlling a vehicle occupant restraint system with a Squib SQ.

In this case, the integrated circuit IC comprises a first control line, which is provided for driving a first control connection G1 of a first transistor T1. The first control line can be active or inactive. In this case, the integrated circuit IC comprises a second control line, which is provided for driving a second control connection G2 of a second transistor T2. The second control line can be active or inactive. The integrated circuit IC includes a third control line which is intended to drive a third control connection G3 of a first transistor T3. The third control line can be active or inactive. The integrated circuit is typically provided so that the first transistor T1 and the second transistor T2 and the third transistor T3 are connected in series with the squib SQ. The ignition of the squib SQ has in the Nor malbetrieb at least on condition that the first control line is active and the second control line is active and the third control line is active.

The first step of the proposed method consists again in the fulfillment of a first precondition for activating the production test mode.

In a second step, the first control line of the first control connection G1 of the first transistor T1 is deactivated and activation of the first control line is locked at least until the end of the activation of the production test mode.

In a third step, the second control line of the second control connection G2 of the second transistor T2 is deactivated and activation of the second control line is locked at least until the end of the activation of the production test mode.

In a fourth step, the third control line of the third control connection G3 of the third transistor T3 is deactivated and activation of the third control line is locked at least until the end of the activation of the production test mode.

The first step usually precedes the second, third, and fourth steps. The second, third and fourth steps are independent of each other and are preferably carried out in parallel. Other orders of the second, third and fourth steps are possible.

Typically, after the execution of the previous four steps, a second precondition for activation of the production test mode is fulfilled as a fifth step.

The production test mode is activated as the last step in time after all previous five steps, but only if all steps for deactivating all three control lines have been carried out and if the first precondition and the second precondition are fulfilled.

In one variant of the method, after the step of fulfilling a first precondition for activating the production test mode, the additional step of providing information about a faulty state by the integrated circuit IC takes place.

In a further variant of the method, after each step of deactivating one of the control lines of the control terminals (G1, G2, G3) of the transistors (T1, T2, T3) for the control line concerned, a check is carried out to determine whether the control line concerned is actually deactivated. This can be done, for example, by evaluating the potential of the relevant control line. In the example above, three control lines are provided for the three transistors. There should therefore preferably be three checks for deactivation: one for each control line.

These checks are preferably always carried out after the respective control line has been deactivated, but in any order among themselves.

During this time or after, but after the first precondition has been met, a second precondition for activation of the production test mode is met.

The last step of activating the production test mode takes place after all steps only if all three control lines have been deactivated and if all three control lines are actually deactivated and if the first precondition and the second precondition are met.

If the first control line is now to be able to be checked as part of the production test of the safety-relevant integrated circuit IC, then the deactivation of the first control line and thus also its checking are omitted. The final step of activating the production test mode follows in this case when the second and third control lines have already been deactivated and when only the second and third control lines are deactivated and when the first precondition is met and the second precondition is met. However, an additional execution condition for the activation is that the selected production test mode requires this possible activation of the first control line. If it can be determined based on the first precondition for activating the production test mode that the production test mode requires that the first control line is not forcibly deactivated until the end of the activation of the production test mode, the activation can take place. In this respect, this modified procedure also includes the determination of this need for this production test mode. This step is preferably performed when the first precondition is met or immediately thereafter.

If the second control line is now to be able to be checked as part of the production test of the safety-relevant integrated circuit IC, then the deactivation of the second control line and thus also its checking are omitted. The remaining steps are modified in an analogous manner compared to the basic procedure.

If the third control line is now to be able to be tested as part of the production test of the safety-relevant integrated circuit IC, then the third control line does not have to be deactivated and thus also checked. The remaining steps are modified in an analogous manner compared to the basic procedure.

The 2 shows an implementation of the test mode activation line (TM). The device parts 2 are preferably part of the controller (ST). In the example of 2 is via a first data bus (DB1), which must be analog, digital, serial or otherwise suitable for signaling, to a first interface (IF1) of the integrated circuit (IC) for assuming a desired test state of the integrated circuit (IC). signaled the first message to fulfill the first precondition for activating the production test mode. Furthermore, via a second data bus (DB2), which must also be analog, digital, serial or otherwise suitable for signaling, to a second interface (IF2) of the integrated circuit (IC) for assuming a desired test state of the integrated circuit (IC ) signals a second message to fulfill the second precondition for activation of the production test mode. If the first interface (IF1) receives said first message for fulfilling the first precondition for activating the production test mode via the first data bus (DB1), it activates a first test request signal (TRQ1). Receives in the example 2 the second interface (IF2) sends said second message to fulfill the second precondition for activating the production test mode via the second data bus (DB2) so it activates a second test request signal (TRQ2). After the integrated circuit (IC) has been reset by switching it on or for other reasons and in normal operation, the first test request signal (TRQ1) and the second test request signal (TRQ2) are preferably not active. If both the first test request signal (TRQ1) and the second test request signal (TRQ2) are active at the same time, the requested activation of the production test mode takes place via a test mode signal (tstm). If only one of the two test request signals (TRQ1, TRQ2) is active and the other test request signal (TRQ1, TRQ2) is not active, the integrated circuit (IC) is forced to assume a safe state in this example via a blocking signal (blk).

Of course it is conceivable to use more than two preconditions. If both test request signals (TRQ1, TRQ2) are active, the blocking signal (blk) cannot be set to be active in order to allow testing of safety-related, non-safe, specification-compliant states. If both test request signals (TRQ1, TRQ2) are not active, the blocking signal (blk) cannot be set to be active either, in order to allow testing of safety-relevant, non-safe, specification-compliant states.

advantage of the invention

The advantage lies in the secure locking of a safety-relevant function (e.g. blocking an airbag ignition circuit) in the event of a potentially unintentionally occurring first entry condition for a production test mode. A simple example of such an error would be erroneous software access to a processor register during normal operation that is actually intended for initiating the production test mode.

All functions of an integrated circuit IC are usually changed or controlled in the production test. This has the potential to violate security goals in an uncontrolled manner. Latent errors can also be present with multiple interlocks, which can be avoided by directly blocking critical states and by providing a display option.

character list

• 1 shows the exemplary embodiment of a single-stage airbag ignition stage.
• 2 shows an implementation of the test mode activation line (TM).

Reference List

a

first connection of the squib SQ;

β

second connection of the squib SQ;

e

Connection of the integrated circuit for the first transistor T1;

AS

Airbag ignition system (It can also be another ignition system, for example for a pedestrian protection system);

blk

blocking signal. The blocking signal (blk) preferably forces the integrated circuit (IC) to assume a safe state. For example, the first transistor, the safety switching transistor (T1), is preferably blocked when the blocking signal is active. Other measures such as blocking the other transistors (T2, T3) are conceivable in the event of an active blocking signal. If both test request signals (TRQ1, TRQ2) are active, the blocking signal cannot be set to be active in order to allow the testing of safety-related, non-safe, specification-compliant states. If both test request signals (TRQ1, TRQ2) are not active, the blocking signal (blk) cannot be set to be active either, in order to allow testing of safety-relevant, non-safe, specification-compliant states.

CE

Power Reserve Capacitor;

D1

reverse polarity protection diode;

DB1

first data bus. It can also be a signal with a fixed level, for example, which is set to a predetermined voltage or current level in the case of a production test;

DB2

second data bus. It can also be a signal with a fixed level, for example, which is set to a predetermined voltage or current level in the case of a production test;

IF1

first interface. It can be a serial or parallel interface or any other integrated circuit (IC) connector.

IF2

second interface. It can be a serial or parallel interface or any other integrated circuit (IC) connector.

G1

first control connection of the first transistor T1;

G2

second control connection of the second transistor T2;

G3

third control connection of the third transistor T3;

GND

reference potential;

IC

integrated circuit;

ST

Steering;

SQ

squib that deploys the air bag when passed with a predetermined electric current;

T1

first transistor (safety switching transistor);

T2

second transistor (high-side switch);

T3

third transistor (low side switch);

TM

Test mode activation line. This should only be able to become active if there are two preconditions for activating a production test mode. It is particularly advantageous if this test mode activation line preferably consists of two lines which are routed in different ways over the safety-relevant integrated circuit IC and which both have to become active. This redundancy can further increase security;

TRQ1

first test request signal. For example, if the first interface (IF1) receives a first message for fulfilling the first precondition for activating the production test mode via the first data bus (DB1), it preferably activates the first test request signal. After the integrated circuit (IC) has been reset by switching it on or for other reasons and in normal operation, the first test request signal is preferably not active.

TRQ2

second test request signal. For example, if the second interface (IF2) receives a second message to fulfill the second precondition for activating the production test mode via the second data bus (DB2), it preferably activates the second test request signal. After the integrated circuit (IC) has been reset by switching it on or for other reasons and in normal operation, the second test request signal is preferably not active.

tstm

test mode signal. The test mode signal is preferably not active in normal operation. If both the first test request signal (TRQ1) and the second test request signal (TRQ2) are active at the same time, the requested activation of the production test mode takes place via the activation of the test mode signal.

VCC

supply voltage.

Claims (3)

Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a vehicle occupant restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) from a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib (SQ) , - wherein the integrated circuit (IC) comprises a first control line which is intended to drive a first control terminal (G1) of a first transistor (T1) and - wherein the first control line can be active or inactive and - wherein the integrated circuit (IC) comprises a second control line which is intended to drive a second control terminal (G2) of a second transistor (T2) and - wherein the second control line can be active or inactive and - wherein the integrated circuit (IC) comprises a third control line which is intended to drive a third control terminal (G3) of a third transistor (T3) and - wherein the third control line can be active or inactive and - Wherein the integrated circuit is provided for the purpose that the first transistor (T1) and the second transistor (T2) and the third transistor (T3) are connected in series with the squib (SQ) and - The ignition of the squib (SQ) in normal operation has at least the prerequisite that the first control line is active and the second control line is active and the third control line is active - It should be possible to check the first control line in the production test mode of the integrated safety-relevant electronic circuit (IC) comprising the steps - Fulfillment of a first precondition for activating the production test mode by transmitting a first message via a first interface (IF1); - determining that due to the first precondition for activating the production test mode, the production test mode requires that the first control line is NOT forcibly deactivated until the end of the activation of the production test mode; - deactivating the second control line of the second control terminal (G2) of the second transistor (T2) and locking an activation of the second control line at least until the end of the activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking activation of the third control line at least until the end of the activation of the production test mode; - check if the disabled control lines are disabled; - Fulfilling a second precondition for activating the production test mode by transmitting a second message via a second interface (IF2) which is different from the first interface (IF1); - Activation of the production test mode if at least one control line of the second or third control line has been deactivated and if at least this control line is deactivated and if the first precondition is met and the second precondition is met and if it is determined based on the first precondition that the production test mode is activated, that the production test mode requires that the first control line is not forcibly deactivated until the end of the activation of the production test mode. Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a vehicle occupant restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) from a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib (SQ) , - wherein the integrated circuit (IC) comprises a first control line which is intended to drive a first control connection (G1) of a first transistor (T1) and - wherein the first control line can be active or inactive and - wherein the integrated circuit ( IC) comprises a second control line which is intended to drive a second control connection (G2) of a second transistor (T2) and - wherein the second control line can be active or inactive and - wherein the integrated circuit (IC) comprises a third control line, the to is provided to drive a third control terminal (G3) of a third transistor (T3) and - wherein the third control line can be active or inactive and - wherein the integrated circuit is provided for the purpose that the first transistor (T1) and the second Transistor (T2) and the third transistor (T3) are connected in series with the squib (SQ) and - the ignition of the squib (SQ) in normal operation at least has the prerequisite that the first control line is active and the second control line is active and the third control line is active - it should be possible to test the second control line in the production test mode of the integrated safety-relevant electronic circuit (IC), comprising the steps - fulfillment of a first precondition for activating the production test mode by transmitting a first message via a first interface (IF1) ; - determining that due to the first precondition for activating the production test mode, the production test mode requires that the second control line is NOT forcibly deactivated until the end of the activation of the production test mode; - deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking an activation of the first control line at least until the end of the activation of the production test mode or deactivating the third control line of the third control terminal (G3) of the third transistor (T3) and locking an activation of the third control line at least until the end of the activation of the production test mode; - check if the disabled control lines are disabled; - Fulfilling a second precondition for activating the production test mode by transmitting a second message via a second interface (IF2) which is different from the first interface (IF1); - Activation of the production test mode if at least one control line of the first or third control line has been deactivated and if at least this control line is deactivated and if the first precondition is met and the second precondition is met and if it is determined based on the first precondition that the production test mode is activated, that the production test mode requires that the second control line is not forcibly deactivated until the end of the activation of the production test mode. Method for activating a production test mode for an integrated safety-related electronic circuit (IC) for controlling a vehicle occupant restraint system with a squib (SQ) or for at least one integrated safety-related electronic circuit (IC) from a plurality of integrated safety-related circuits for controlling a vehicle occupant restraint system with a squib (SQ) , - wherein the integrated circuit (IC) comprises a first control line which is intended to drive a first control connection (G1) of a first transistor (T1) and - wherein the first control line can be active or inactive and - wherein the integrated circuit ( IC) comprises a second control line which is intended to drive a second control connection (G2) of a second transistor (T2) and - wherein the second control line can be active or inactive and - wherein the integrated circuit (IC) comprises a third control line, the to is provided for driving a third control connection (G3) of a third transistor (T3) and - wherein the third control line can be active or inactive and - wherein the integrated circuit is provided for the purpose that the first transistor (T1) and the second transistor (T2 ) and the third transistor (T3) are connected in series with the squib (SQ) and - the ignition of the squib (SQ) in normal operation at least as a prerequisite that the first control line is active and the second control line is active and the third control line is active - it should be possible to test the third control line in the production test mode of the integrated, safety-relevant electronic circuit (IC), comprising the steps - fulfilling a first precondition for activating the production test mode by transmitting a first message via a first interface (IF1); - determining that due to the first precondition for activating the production test mode, the production test mode requires that the third control line is NOT forcibly deactivated until the end of the activation of the production test mode; - deactivating the first control line of the first control terminal (G1) of the first transistor (T1) and locking an activation of the first control line at least until the end of the activation of the production test mode or deactivating the second control line of the second control terminal (G2) of the second transistor (T2) and locking activation of the second control line at least until the end of the activation of the production test mode; - check if the disabled control lines are disabled; - Fulfilling a second precondition for activating the production test mode by transmitting a second message via a second interface (IF2) which is different from the first interface (IF1); - activation of the production test mode if at least one of the second or third control line has been deactivated and if at least this control line is deactivated and if the first precondition is met and the second precondition is met and if due the first precondition for activation of the production test mode is determined that the production test mode requires that the third control line is not forcibly deactivated until the end of the activation of the production test mode.

Images