Method for operating a reliable activation of at least one electronic component

Abstract

A method for operating at least one electronic component in a reliably activated system is disclosed, wherein a start-up procedure of the system is carried out, a decision logic device is activated, at least one temperature sensor is read by the decision logic device, the decision logic device checks, based on the measured temperature of the at least one temperature sensor, whether the at least one electronic component can be operated reliably activated, and if the temperature measured by the at least one temperature sensor is below a threshold value, an activation of the at least one electronic component is carried out by the decision logic device. Furthermore, a system is disclosed.

Description

Technical Field

[0001] The present invention relates to a method for reliably activating at least one electronic component in a system and a system for performing the method. Background Technology

[0002] In the automotive industry, various electronic components are used, particularly in control devices. These components are also used to perform applications critical to safety, such as driver assistance systems. To ensure trouble-free functioning, electronic components must operate within their specifications. Operation of components at temperatures exceeding specification limits is particularly critical, as self-heating can lead to further increases in operating temperature. Such electronic components can be, for example, microcontrollers or microprocessors.

[0003] In many applications, excessively high temperatures are only actually reached during operation. During operation, a software-based temperature sensor access can be achieved because the electronic components initially operate within specifications, and drift toward higher temperatures can be observed in real time.

[0004] However, the activation timing of some electronic components is particularly critical. For example, the placement of video control equipment installed in the windshield in hot, sunny locations can lead to excessively high temperatures because it cannot be cooled by either the vehicle's airflow or the air conditioning.

[0005] If an electronic component starts up at excessively high temperatures, it cannot be assumed that the component is functioning correctly beforehand, as the operation exceeds specifications. In the hypothetical "worst-case" scenario, the electronic component may continue to heat up and cause a functional failure that is critical to safety.

[0006] A known solution involves an electronic component attempting to read an electronically coupled temperature sensor, even when it is outside the specification, in order to then shut down. However, this solution lacks sufficient reliability for applications where safety is critical. Summary of the Invention

[0007] The objective of this invention can be viewed as proposing a method and a system that ensure reliable startup and operation of electronic components even under high ambient temperatures.

[0008] This task is solved using the technical solution of the present invention. Advantageous configurations of the present invention are derived from the description and accompanying drawings.

[0009] According to one aspect of the present invention, a method is provided for reliably activating at least one electronic component in a system.

[0010] In one step, the system startup process is performed. Here, the decision logic device is activated. At least one temperature sensor is read by the activated decision logic device. The decision logic device checks, based on the temperature measured by the at least one temperature sensor, whether at least one electronic component can be reliably activated. If a framework condition for the reliable operation of at least one electronic component is obtained, the at least one electronic component is activated by the decision logic device. Such a framework condition may in particular be a temperature below a threshold measured by the at least one temperature sensor.

[0011] For example, at least one electronic component can be a microcontroller, integrated circuit, etc.

[0012] For example, a typical temperature threshold within the core of an electronic component might be 125°C. This temperature must not be exceeded during the operation of the electronic component. This method prevents at least one electronic component from starting operation above the temperature threshold. Here, the decision logic device can determine, based on measured values, whether to turn on or disable at least one electronic component.

[0013] After the system is started, the decision logic device activates itself. This can be done, for example, by electrical start-up. Optionally, the decision logic device can perform various checks or tests. In particular, the decision logic device can perform temperature value checks, which can be obtained from one or more temperature sensors. Specifically, the decision logic device can check for faults in the temperature sensors and whether the temperature obtained from the temperature sensors exceeds a threshold.

[0014] Based on these checks, a decision can be made in the decision logic device: whether at least one electronic component can be activated. If yes, the electronic component is activated; otherwise, the method is repeated from an earlier step. From which step the method is repeated depends on which check criterion was violated. For example, if the measured temperature is too high, the temperature can be reread until it falls below a threshold. Similarly, if a fault has been identified in the temperature sensor, the system can be restarted.

[0015] By means of the method according to the invention, reliable startup of at least one electronic component can be achieved even at high temperatures. This can be performed safely and reliably even in the event of a temperature sensor failure, as a fault check of the temperature sensor is performed. Thus, in particular, a system conforming to the ISO 26262 standard can be realized.

[0016] According to one embodiment of the method, when the temperature measured by at least one temperature sensor exceeds a threshold, the activation of at least one electronic component is interrupted by a decision logic device until the measured temperature falls below the threshold. For example, if only the temperature measured by the temperature sensor is too high, this step is repeated until sufficient cooling is achieved. Thus, a waiting loop can be implemented in the method, which enables cooling of the electronic component. Preferably, the decision logic device can acquire and store the temperature change process, thereby enabling the acquisition of a cooling curve and the analysis of the temperature change process.

[0017] According to another embodiment of the method, a self-test is performed by the decision logic device. This allows the correct functional capability of the decision logic device to be checked. For example, this can be achieved by checking the temperature or by performing electrical measurements on key relevant areas of the decision logic device and subsequently comparing them with expected values.

[0018] According to another embodiment of the method, an electronic test of at least one component is performed by a decision logic device. This measure allows for the determination of, for example, the resistance or capacitance of at least one electronic component, through the decision logic device to rule out, for example, short circuits or other faults in the printed circuit board.

[0019] According to another embodiment of the method, a decision logic device checks whether at least one temperature sensor is faulty. This check can be achieved, in particular, by using one or more additional temperature sensors. Thus, the fault-free functionality of the temperature sensors can be ensured through redundant arrangement of the temperature sensors.

[0020] According to another embodiment of the method, when the decision logic device determines that at least one temperature sensor is faulty, the decision logic device either restarts the system or generates a fault report. If the temperature sensor is faulty, the decision logic device can restart the system. If the fault is not avoided after restarting, it is preferable to generate a fault report and, for example, send the fault report to an output unit.

[0021] According to another embodiment of the method, when the measured temperature exceeds a first threshold but falls below a second threshold, at least one electronic component is activated in an energy-saving mode via a decision logic device. Therefore, an additional intermediate step for the temperature threshold can be defined, allowing the electronic component to function within its specified range; however, depending on the self-heating of the electronic component, this intermediate step may be rapidly exceeded in time. By forcing an energy-saving mode, self-heating can be reduced, and long-term operation of the electronic component within its specified limits can be achieved.

[0022] According to an alternative configuration, this energy-saving mode is not absolutely necessary. The normal operating mode or so-called "full power mode" can also be used if the self-heating of the component is sufficiently low, even in normal operating mode or the so-called "full power mode." If the electronic component is activated, it can access the internal temperature sensor within specifications, and thus take appropriate countermeasures before exceeding specification limits.

[0023] According to another embodiment of the method, when performing the check through the decision logic device, the self-heating of at least one electronic component is taken into account.

[0024] A particularly advantageous feature is the thermal coupling configuration of the temperature sensor and electronic components, which allows the temperature sensor to exhibit a significantly higher self-heating capability compared to the electronic components. This self-heating of the temperature sensor can be especially superior to the self-heating of the components in so-called "low-power modes." This is particularly easy to achieve when the temperature sensor is integrated into the decision logic device. In this case, the thermal threshold for system activation can be directly determined from the temperature measurement of the internal temperature sensor of the decision logic device.

[0025] According to another aspect of the invention, a system for performing the method according to the invention is provided. The system includes at least one electronic component and at least one decision logic device for checking and activating the at least one electronic component, wherein if a reliable operating framework condition for the at least one electronic component exists, the at least one electronic component can be activated by the decision logic device upon system startup. Thus, the framework condition for the reliable operation of the component can be checked and ensured by the decision logic device before activating the at least one electronic component. Therefore, it is particularly possible to ensure that the at least one electronic component operates within its specified limits, and the security of the system can be improved.

[0026] According to one embodiment of the system, the decision logic device is electronically connected to at least one internal temperature sensor. Therefore, the decision logic device can have an internal temperature sensor that can be directly and reliably connected. For example, such a decision logic device can be configured as an integrated circuit or a control loop that uses the temperature sensor to control a mechanical or electronic relay to activate electronic components.

[0027] According to another embodiment of the system, the decision logic device is electronically connected to at least one external temperature sensor. As an alternative to or supplement to the internal temperature sensor, the decision logic device may be coupled to at least one additional external temperature sensor. The decision logic device and the temperature sensor are preferably designed for temperatures higher than the limiting temperature of the electronic components. For example, the limiting temperature may be at least 150°C.

[0028] Furthermore, other configurations of temperature sensors can be used. For example, the decision logic device may include two or more internal temperature sensors. The decision logic device may also access multiple external temperature sensors. In particular, redundant use of temperature sensors can avoid erroneous temperature measurements. Multiple high-quality temperature sensors can be reliably verified relative to each other, as these temperature sensor pits can measure relatively similar temperatures. Therefore, alternative or additional monitoring or protection for temperature sensors can also exist in the system, which avoids redundant use of temperature sensors.

[0029] Furthermore, it is advantageous that the decision logic device is connected to at least one component via a communication connection and can therefore transmit temperature values ​​to the component.

[0030] According to another embodiment of the system, the decision logic device is configured as an integrated circuit, a microcontroller, or a power management integrated circuit (PMIC). Thus, the decision logic device can perform a wide range of regulation and inspection tasks, and can, for example, analyze temperature characteristics.

[0031] The solution according to the invention has the following additional advantages:

[0032] Provide a reliable external sensor for the component, which may be configured as two redundant temperature sensors, for example.

[0033] A decision logic device that reads the external temperature and determines whether to activate at least one electronic component.

[0034] This allows the electronic components to operate in a so-called "low-power" mode, thereby enabling the electronic components to access internal or external temperature sensors.

[0035] At least one electronic component has an internal temperature sensor and an external temperature sensor thermally coupled to a decision logic device that is sequentially matched. The external temperature sensor is particularly used to ensure the operation of the internal temperature sensor. This enables safe and reliable startup of the system under all temperature conditions. Attached Figure Description

[0036] Preferred embodiments of the invention are further illustrated below with reference to highly simplified schematic diagrams.

[0037] This is shown here:

[0038] Figure 1 A schematic flowchart of the method according to the present invention is shown;

[0039] Figure 2 A schematic diagram of a system according to an embodiment of the present invention is shown;

[0040] Figure 3 The possible states of the system and the possible transitions between these states are shown.

[0041] In the accompanying drawings, the same structural elements are represented by the same reference numerals. Detailed Implementation

[0042] Figure 1 A schematic flowchart of method 1 according to an embodiment of the present invention is shown.

[0043] In step 2, system 3 is started. In another step 4, decision logic device 5 is activated. Then, decision logic device 5 performs several checks 6. In particular, decision logic device 5 checks 6 whether the temperature of at least one electronic component 7 is within the specifications of that component 7. Based on the checks of decision logic device 5, evaluation 8 is performed. In evaluation 8, decision logic device 5 determines whether to activate electronic component 7 or repeat steps 2, 4, and 6 of the method. For example, if the temperature determined by decision logic device 5 is below a defined threshold, electronic component 7 can be started. Otherwise, it waits until the framework conditions for electronic component 7 are met or a fault report is generated.

[0044] When starting system 2 in a thermally homogenized environment, while following... Figure 1 Under the conditions shown, the temperature measured by the external temperature sensor is higher than the temperature of electronic component 7 (modulus tolerance). Therefore, during system 3 startup, the threshold can be determined as: the specification limit of electronic component 7 minus the tolerance and the maximum self-heating of electronic component 7.

[0045] Figure 2 A schematic diagram of a system 3 according to an embodiment of the present invention is shown. The system 3 has an electronic component 7 configured as a microprocessor or microcontroller. Component 7 is coupled to a decision logic device 5 via a communication connection 12. Furthermore, an activation connection 14 is arranged between the decision logic device 5 and component 7, through which the decision logic device 5 can activate the electronic component 7. The communication connection 12 can be used for data exchange—particularly temperature measurement. For example, through the communication connection, temperature values ​​from temperature sensors 16 and 18 can be transmitted from the decision logic device 5 to component 7 at regular time intervals. The activation connection 14 can, for example, be a power supply line.

[0046] The decision logic unit 5 has an internal temperature sensor 16. To ensure redundancy, the decision logic unit 5 is coupled to an additional external temperature sensor 18. The decision logic unit 5 can read and analyze the measured values ​​of these two temperature sensors 16 and 18, or at least use them for regulation.

[0047] For example, at least one electronic component 7 can implement a reliability model across all accessible temperature values. This can be used not only to improve temperature estimation but also for fault identification. If a fault is detected in sensors 16, 18, an appropriate response is taken by component 7. For example, fault storage or even transition to a safe state can be performed.

[0048] Figure 3 An overview of the possible states of system 3 and the possible transitions between these states is shown. In particular, the various temperature rollback levels are shown.

[0049] It may be advantageous to define different temperature rollback levels Z1, Z2, and Z3 for system 3. For example, the following states or rollback levels could be defined:

[0050] Z1: Only decision logic device 5 is activated;

[0051] Z2: At least one electronic component 7 is activated in energy-saving mode;

[0052] Z3: At least one electronic component 7 is in normal operation.

[0053] The third state Z3 can also have other sub-states, which have different power characteristics of component 7. Transition (From Z1 to Z2) has already been Figure 1 The description corresponds to activation 10 of component 7. Transition (Z2 to Z3) occur under normal conditions where overheating is not present. Therefore, after reading the internal (and external) temperature values, component 7 must conclude that normal operation is possible and there is no critical temperature sensor malfunction. Alternatively, the transition... It can directly enter state Z3. If component 7 is detected to be approaching its temperature limit in normal mode Z3 (still within the specification), a transition occurs. Even in "low-power mode," a transition will occur if the specification limits are threatened. In an optimally designed system 3, optional transitions should not occur. But if a transition exists Then the transition Theoretically, it can be triggered by component 7 or decision logic device 5. If decision logic device 5 detects that the temperature is too high, it can trigger a transition. If the transition is triggered by component 7 or Advantageously, the communication connection 12 can be used to transmit signals for high-temperature shutdown. Thus, component 7 can be indirectly disabled via the decision logic device 5.

[0054] If a transition has already been generated The high-temperature shutdown signal has the advantage that the decision logic device 5 cannot re-enter the normal startup procedure because it failed due to the hysteresis caused by the recently diagnosed overheating. Alternatively, the decision logic device 5 can wait for cooling, either by waiting for a certain period of time or by observing the cooling process. The time-dependent characteristics of the temperature can be easily achieved using a timer.

[0055] The following methods may be advantageous here:

[0056] When the decision logic device 5 receives a high-temperature shutdown signal through the communication connection 12, it stores the internal values ​​of the temperature sensors 16 and 18.

[0057] Based on the stored values, the decision logic device 5 determines a threshold (e.g., below 3K), from which the component 7 can be restarted;

[0058] The decision logic device checks whether the value is below a certain threshold. If it is below the threshold, the normal startup procedure or method 1 is re-executed.

Claims

1. A method (1) for operating at least one electronic component (7) in a reliably activated system (3), the electronic component (7) being used to execute a safety-relevant application for a driver assistance system, the method comprising the following steps: A start-up procedure (2) of the system (3) is carried out, a decision logic device (5) is activated (4), at least one temperature sensor (16, 18) is read (6), a check (8) is carried out by the decision logic device (5) on the basis of the measured temperature of the at least one temperature sensor (16, 18) whether the at least one electronic component (7) can be activated reliably, if the temperature measured by the at least one temperature sensor (16, 18) is below a threshold value, the at least one electronic component (7) is activated (10) by the decision logic device (5), wherein, when the measured temperature exceeds a first threshold value and is below a second threshold value, the at least one electronic component (7) is activated by the decision logic device (5) in an energy-saving mode, wherein, in the energy-saving mode, a high-temperature shutdown signal for switching off the at least one electronic component (7) is generated by the decision logic device (5) if it is recognized that the specification limits of the at least one electronic component (7) are threatened, wherein, after activation of the electronic component (7) in full-power mode, a transition from full-power mode to energy-saving mode first occurs if it is recognized that the temperature of the electronic component (7) is close to the specification limits but still within the specification limits, wherein, if the specification limits are threatened even in energy-saving mode, a high-temperature shutdown signal for switching off the at least one electronic component (7) is generated, wherein the high-temperature shutdown signal is not generated directly in full-power mode.

2. The method of claim 1, wherein, When the measured temperature of the at least one temperature sensor (16, 18) exceeds the threshold value, the activation of the at least one electronic component (7) is interrupted by the decision logic device (5) until the measured temperature is below the threshold value.

3. The method of claim 1 or 2, wherein, A self-test is carried out by the decision logic device (5).

4. The method of claim 1 or 2, wherein, An electronic test of the at least one electronic component (7) is carried out by the decision logic device (5).

5. The method of claim 1 or 2, wherein, It is checked by the decision logic device (5) whether the at least one temperature sensor (16, 18) has a fault.

6. The method of claim 5, wherein, When it is determined by the decision logic device (5) that the at least one temperature sensor (16, 18) has a fault, a restart of the system (3) or a fault report is generated by the decision logic device (5).

7. The method of claim 1 or 2, wherein, When the check (6, 8) is carried out by the decision logic device (5), the self-heating of the at least one electronic component (7) is taken into account.

8. A system for operating a reliable activation of at least one electronic component (7), the system being for carrying out the method (1) according to any one of the preceding claims, the system having at least one electronic component (7) and at least one decision logic device (5) for the check (6, 8) and for making (10) the activation of the at least one electronic component (7), wherein, If there are framework conditions for the reliable operation of the at least one electronic component (7), the at least one electronic component (7) can be activated by the decision logic device (5) at system start-up (2).

9. The system of claim 8, wherein, The decision logic device (5) is in electronic connection with at least one internal temperature sensor (16).

10. The system of claim 8 or 9, wherein, The decision logic device (5) is in electronic connection with at least one external temperature sensor (18).

11. The system of claim 8 or 9, wherein, The decision logic device (5) is configured as an integrated circuit, a microcontroller or a power management integrated circuit.

Images