Ignition device and ignition method for a vehicle restraint system

Abstract

Ignition device (1) for a vehicle restraint system, comprising an ignition electronics unit (10) which includes an evaluation and control circuit (12) and a plurality (n) of ignition circuits (ZK1, ZK2, ZKn) with an ignition element (ZP1, ZP2, ZPn), and a power supply (3) which supplies the activated ignition circuits (ZK1, ZK2, ZKn) with current (IG, I1, I2, In), wherein an evaluation and control unit (µC) receives and evaluates information from an accident sensor (9), wherein an ignition algorithm (ZA) of the evaluation and control unit (µC) classifies a detected accident depending on the evaluation and, depending on the classified accident, issues a corresponding firing command (µC_S) to the ignition electronics unit (10), which selects the ignition circuits assigned to the firing command (µC_S) from the plurality of ignition circuits (ZK1, ZK2, ZKn) is activated for a predetermined ignition time interval, wherein a monitoring circuit (14) is provided in each of the ignition circuits (ZK1, ZK2, ZKn),which monitors the ignition current (I1, I2, In) in the corresponding ignition circuit (ZK1, ZK2, ZKn), characterized in that the evaluation and control circuit (12) comprises at least one backup register (BU-R) in which a prioritization of the ignition circuits (ZK1, ZK2, ZKn) to be activated is stored in advance for at least one firing command (µC_S), wherein the evaluation and control circuit (12) evaluates information from the monitoring circuits (14) of the activated ignition circuits (ZK1, ZK2, ZKn) for fault detection, wherein, in the event of a detected fault, the evaluation and control circuit (12) reads the at least one backup register (BU-R) for the associated firing command (µC_S) and deactivates activated ignition circuits (ZK1, ZK2, ZKn) which have been assigned a low priority by the at least one backup register (BU-R). is, and the activated ignition circuits (ZK1, ZK2, ZKn), which are assigned a high priority by at least one backup register (BU-R),for the specified ignition time period, it continues to be supplied with the corresponding ignition current (I1, I2, In).

Description

The invention relates to an ignition device or ignition method for a restraint system of a vehicle according to the preamble of the independent claims. Ignition devices for vehicle restraint systems are known from the prior art. These devices include ignition electronics comprising an evaluation and control circuit, a plurality of ignition circuits with an ignition element, and a power supply that provides current to the activated ignition circuits. An evaluation and control unit receives and evaluates information from an accident sensor. An ignition algorithm within the evaluation and control unit classifies a detected accident into different crash types based on the evaluation. Depending on the classified accident or crash type, the algorithm issues a corresponding firing command to the ignition electronics, which then ignites the ignition circuits assigned to the firing command from among the plurality of ignition circuits for a predetermined ignition duration. Each ignition circuit also includes a monitoring circuit that monitors the ignition current in the corresponding ignition circuit. Such an ignition device for a vehicle restraint system is generally designed so that all known classified accident variants or crash types, even in the event of an interruption of the battery voltage supplied by the vehicle battery, can be powered by a reserve of energy from an independent power supply without recharging, and the intended restraint devices can be activated. In the event of an unexpected deviation from the known classified accident variants or the occurrence of faults in the independent power supply of the restraint system, there are measures in place to utilize the potentially still available battery voltage of the vehicle battery for the purpose of powering the restraint systems and also for providing the necessary ignition energy to activate the restraint devices. Commonly used ignition devices for a vehicle's restraint system utilize a battery supply, which remains active even in a crash, to maintain system operation and provide charging energy for the energy reserve. If a fault occurs in the energy reserve, such as an interruption or short circuit, the ignition energy can optionally be drawn from the battery supply if the voltage is sufficient. Since the vehicle voltage of a running engine is only between 13.5 and 16.5 V, this support is limited. These limitations become increasingly apparent with the growing number of ignition circuits in the vehicle, as more and more circuits are activated simultaneously to trigger the restraint system.Furthermore, ignition devices for a vehicle restraint system are known which, upon activation of the ignition circuits, can detect by monitoring the ignition currents in the individual ignition circuits whether the required current level, for example approximately 1.75 A, is reached over an ignition period of 0.5 to 0.7 ms. If this is not the case, because a sufficiently high supply voltage is no longer available from the energy reserve, then a lower current level, for example approximately 1.2 A, can be selected for the ongoing ignition process over an extended ignition period of, for example, approximately 2 ms. If even this reduced current level cannot be maintained, which can occur particularly with parallel multiple ignition of several ignition circuits, no further measures are currently provided for. German patent application DE 100 57 915 A1 discloses a device for controlling ignition circuits for a restraint system. Groups of ignition circuits can be blocked to disable the ignition circuits of individual airbags depending on an occupant classification. From the document DE 197 52 622 C1, an occupant protection system is known in which a plurality of ignition pills can be ignited separately from each other by different ignition impulses. Another possibility of igniting a plurality of ignition elements in an occupant protection system is known from DE 199 17 340 C1. Disclosure of the invention The ignition device for a vehicle restraint system according to independent claim 1 and the ignition method for a vehicle restraint system according to independent claim 11 each have the advantage that, in the event of a detected fault, a clearly specified backup process is triggered and executed, which improves the ignition capability of the ignition device for a vehicle restraint system in the event of a fault. Embodiments of the present invention can advantageously improve the currently common parallel activation of multiple systems in the event of a fault, so that sufficient protection can still be achieved even in the event of a fault. Thus, for the various classifiable accident scenarios, or...Each crash type has a predefined backup strategy that prioritizes the ignition circuits to be activated for a detected crash type. This ensures that during an ongoing parallel activation with an insufficient current level, lower-priority ignition circuits are deactivated and reactivated later than higher-priority circuits, thereby increasing the current supply to the higher-priority circuits to the specified value. A hardware solution with predefined ignition circuit prioritization based on detected crash types is cost-effective. To achieve a sufficiently fast and cost-effective implementation of this prioritization, the ignition circuit prioritization for each classified crash type is predefined in hardware using a backup register. Embodiments of the present invention provide an ignition device for a vehicle restraint system, comprising ignition electronics including an evaluation and control circuit and a plurality of ignition circuits with an ignition element, and a power supply that provides current to the activated ignition circuits. An evaluation and control unit receives and evaluates information from an accident sensor, wherein an ignition algorithm of the evaluation and control unit classifies a detected accident based on the evaluation and, depending on the classified accident, issues a corresponding firing command to the ignition electronics, which activates the ignition circuits assigned to the firing command from the plurality of ignition circuits for a predetermined ignition time period. Each ignition circuit includes a monitoring circuit that monitors the ignition current in the corresponding ignition circuit.The evaluation and control circuit includes at least one backup register in which a prioritization of the ignition circuits to be activated is stored for at least one firing command. The evaluation and control circuit uses information from the monitoring circuits of the activated ignition circuits for fault detection. Furthermore, in the event of a detected fault, the evaluation and control circuit reads the at least one backup register for the corresponding firing command and deactivates activated ignition circuits assigned a low priority by the at least one backup register. It then continues to supply the activated ignition circuits assigned a high priority by the at least one backup register with the corresponding ignition current for the specified firing time. Furthermore, an ignition procedure for a vehicle restraint system is proposed. In this procedure, a plurality of activated ignition circuits, each with an ignition element, are powered by a single energy supply, and information from an accident sensor is received and evaluated. Depending on the evaluation, a detected accident is classified, and a corresponding fire command is issued. The ignition circuits assigned to this fire command, selected from the plurality of ignition circuits, are then activated for a predetermined ignition duration, with the ignition currents in these circuits being monitored. For at least one fire command, a prioritization of the ignition circuits to be activated is stored in advance in at least one backup register. Information on the monitored ignition currents of the activated ignition circuits is evaluated for fault detection.In the event of a detected fault, at least one backup register for the corresponding fire command is read out, and activated ignition circuits assigned a low priority by the backup register are deactivated, while activated ignition circuits assigned a high priority by the backup register continue to be supplied with the corresponding ignition current for the specified ignition time period. Depending on the backup strategy and the effectiveness of the restraint systems used for a specific classified accident or crash type, the programming of the associated backup register (at least one) initially determines which activated ignition circuits should remain activated with high priority for the entire ignition duration in the event of a fault, and which activated ignition circuits should be deactivated after the shortest possible time and reactivated with a delay to maintain the best possible protective effect even in the event of a fault. The backup register (at least one) only comes into play when an accident is detected with fault detection in multiple activated ignition circuits.If the triggering algorithm of the evaluation and control unit detects an accident or an unavoidable accident based on the evaluation of sensors that detect physical quantities such as acceleration, pressure, rotation, distance to the crash object, or radar and / or video signals, then a fire command is sent to the ignition electronics at the appropriate time. For safety reasons, this command can be built up using several consecutive SPI commands. Multiple fire commands can be configured for a classified accident or crash type, which can be issued sequentially at predefined times during the crash. Therefore, a prioritization can be stored in a corresponding backup register for all or at least some of the fire commands.Furthermore, classified crash types are conceivable for which no prioritization of the ignition circuits in the corresponding backup register is provided, because, for example, the number of ignition circuits to be activated in parallel is too small. For known fault conditions, such as the interruption of an energy reserve, this can reduce the voltage drop between the output stages of the ignition circuits and the vehicle's battery voltage, which can be caused, for example, by cables, connectors, circuit traces, reverse polarity protection, input filters, safety switches, etc., thereby increasing the current in the high-priority ignition circuits. The term "ignition electronics" can be understood here as an electrical hardware circuit comprising several ignition circuits and an evaluation and control circuit, preferably implemented as an ASIC (application-specific integrated circuit) and extended by at least one additional backup register. This backup register can, for example, be programmed and locked by the evaluation and control unit during the initialization phase of the ignition device for a vehicle restraint system. For monitoring purposes, its contents can be read cyclically and / or monitored by a checksum check. The backup register contains a specification of how to proceed with regard to optimizing the ignition capability of the ignited circuits in the event of a fault, based on detected accident or crash types.Furthermore, the evaluation and control circuitry of the ignition electronics can incorporate a programmable time delay for the ignition circuits with low priority. This time delay can be set uniformly for all ignition circuits or individually for each one. For example, the time delay can be specified with a time resolution of 100 µs within a range of 0 to 3,100 µs and stored in a corresponding delay time register. In this context, the term "evaluation and control unit" can be understood as an electrical device, such as a control unit, particularly an airbag control unit, which processes or evaluates acquired sensor signals. The evaluation and control unit can have at least one interface, which may be implemented in hardware and / or software. In the case of a hardware implementation, the interfaces may, for example, be part of a so-called system ASIC, which incorporates various functions of the evaluation and control unit. However, it is also possible that the interfaces are separate integrated circuits or consist at least partially of discrete components. In the case of a software implementation, the interfaces may be software modules that are present, for example, on a microcontroller alongside other software modules.A computer program product with program code stored on a machine-readable medium such as semiconductor memory, hard disk memory or optical memory, and used to perform the evaluation when the program is executed by the evaluation and control unit, is also advantageous. For the purposes of this document, an accident sensor is understood to be an assembly comprising at least one sensor element that directly or indirectly detects a physical quantity or a change in a physical quantity and preferably converts it into an electrical sensor signal. This can be achieved, for example, by emitting and / or receiving acoustic and / or electromagnetic waves, and / or by using a magnetic field or the change in a magnetic field, and / or by receiving satellite signals, such as a GPS signal. Optical sensor elements are also possible, which may include, for example, a photographic plate and / or a fluorescent surface and / or a semiconductor that detects the impact or intensity, wavelength, frequency, angle, etc., of the received wave. Similarly, an acoustic sensor element is conceivable, such as an ultrasonic sensor element, a high-frequency sensor element, a radar sensor element, or a sensor element that reacts to a magnetic field, such as a Hall sensor element, a magnetoresistive sensor element, or an inductive sensor element that registers changes in a magnetic field, for example, via the voltage generated by magnetic induction. In this case, for example, a sensor element can determine the change in position within a specific time window, and the evaluation and control unit can then calculate a velocity and / or acceleration from this data. Furthermore, acceleration sensors, pressure sensors, touch sensors, and / or gyroscopes of varying sensitivities can be used and evaluated.Other calculable physical quantities include mass, rotational speed, force, energy and / or other conceivable quantities, such as the probability of a specific event occurring. The measures and further developments listed in the dependent claims enable advantageous improvements to the ignition device for a vehicle restraint system specified in independent claim 1 and to the ignition method for a vehicle restraint system specified in independent claim 11. A particular advantage is that the evaluation and control circuit can detect the fault if a predetermined number of monitoring circuits indicate that the ignition current in the associated activated ignition circuit has not reached a predetermined value. In a further advantageous embodiment of the ignition device, each individual monitoring circuit can have a counter that can increment its value at predetermined time intervals if the monitored ignition current exceeds a predetermined minimum current. This enables a particularly simple and cost-effective implementation of the information acquisition for the individual monitoring circuits. For example, after an initial period following activation of the associated ignition circuits, the evaluation and control circuit can read the counter values ​​of the monitoring circuits of the activated ignition circuits. This initial period can be much shorter than the predetermined ignition intervals and greater than or equal to the period of a clock signal that defines the time interval for the counter.The first time interval can be selected, for example, between 25 µs and 100 µs, and the period of the clock signal can be set to, for example, 25 µs. Furthermore, after the predefined ignition time intervals of the activated ignition circuits with high priority have elapsed, the evaluation and control circuit can read the counter values ​​of the monitoring circuits of the activated ignition circuits with high and low priority. In a further advantageous embodiment of the ignition device, the evaluation and control circuit can reactivate the deactivated low-priority ignition circuits for the specified ignition time interval after a delay period has elapsed. The duration of the delay period for each ignition circuit can be stored in a delay register. Preferably, the delay period can correspond to the specified ignition time interval of the activated high-priority ignition circuits. Furthermore, after the specified ignition time intervals of the activated low-priority ignition circuits have elapsed, the evaluation and control circuit can read the counter values ​​of the monitoring circuits of the activated high- and low-priority ignition circuits. The evaluation and control circuit can also store the read counter values ​​of the monitoring circuits in a counter register.The recorded counter readings can be advantageously used for later analysis and reconstruction of the ignition process. In an advantageous embodiment of the ignition method, when classifying the detected accident as crash types, for example, a frontal impact, a frontal impact with right side overlap, a frontal impact with left side overlap, a right side impact, a left side impact, a rear impact, or a rollover can be distinguished. In a further advantageous embodiment of the ignition method, the counter reading of a counter in each ignition circuit can be read and evaluated as information about the monitored ignition currents. This counter reading is incremented at predetermined time intervals if the monitored ignition current exceeds a predetermined minimum current. This allows for the detection of a fault, for example, if the sum of the counter readings of the monitored ignition currents falls below a predetermined value after a predetermined initial time interval. This initial time interval can be significantly shorter than the predetermined ignition intervals and greater than or equal to the period of a clock signal that defines the time interval for the counter. For example, the initial time interval can be selected between 25 µs and 100 µs, and the period of the clock signal can be set to 25 µs. In a further advantageous embodiment of the ignition method, the deactivated ignition circuits with low priority can be re-ignited after a delay time window has elapsed for the specified ignition time period. Exemplary embodiments of the invention are shown in the drawing and are explained in more detail in the following description. In the drawing, identical reference numerals denote components or elements that perform the same or analogous functions. Brief description of the drawings Fig. 1 shows a schematic representation of an embodiment of an ignition device according to the invention for a vehicle restraint system. Fig. 2 shows a schematic representation of an embodiment of an ignition circuit of the ignition device according to the invention for a vehicle restraint system from Fig. 1. Fig. 3 shows a flowchart of an embodiment of an ignition method according to the invention for a vehicle restraint system. Embodiments of the invention As can be seen from Fig. 1 and Fig. 2, the illustrated embodiment of an ignition device 1 according to the invention for a restraint system of a vehicle comprises an ignition electronics 10, which includes an evaluation and control circuit 12 and a plurality n of ignition circuits ZK1, ZK2, ZKn each with an ignition element ZP1, ZP2, ZPn, and a power supply 3, which supplies the activated ignition circuits ZK1, ZK2, ZKn with current IG, I1, I2, In. An evaluation and control unit µC receives and evaluates information from an accident sensor 9, whereby an ignition algorithm ZA of the evaluation and control unit µC classifies a detected accident depending on the evaluation and, depending on the classified accident, issues a corresponding fire command µC_S to the ignition electronics 10, which activates the ignition circuits assigned to the fire command µC_S from the majority of ignition circuits ZK1, ZK2, ZKn for a specified ignition time period.Each of the ignition circuits ZK1, ZK2, and ZKn is equipped with a monitoring circuit 14, which monitors the ignition current I1, I2, and In in the corresponding ignition circuit ZK1, ZK2, and ZKn. The evaluation and control circuit 12 includes at least one backup register BU-R, in which a prioritization of the ignition circuits ZK1, ZK2, and ZKn to be activated is stored in advance for at least one firing command µC_S. The evaluation and control circuit 12 evaluates information from the monitoring circuits 14 of the activated ignition circuits ZK1, ZK2, and ZKn for fault detection.In addition, in the event of a detected fault, the evaluation and control circuit 12 reads the at least one backup register BU-R for the associated fire command µC-S and deactivates activated ignition circuits ZK1, ZK2, ZKn, which are assigned a low priority by the at least one backup register BU-R, and continues to supply the activated ignition circuits ZK1, ZK2, ZKn, which are assigned a high priority by the at least one backup register BU-R, with the corresponding ignition current I1, I2, In for the specified ignition time period. Figure 2 shows the hardware of a first ignition circuit ZK1, which is integrated n times in an ignition electronics unit 10 implemented as an ASIC, as can be seen in Figure 1. The ignition electronics unit 10 comprises, for example, 16 or more ignition circuits ZK1, ZK2 to ZK16 and an evaluation and control circuit 12, which includes additional programmable registers such as a backup register BU-R, an ignition current register FC-R, an ignition time register FT-R, a monitoring current register MR, a counter register ZR, and a delay time register VR. These registers are programmed and locked by the evaluation and control unit µC during an initialization phase of the system. For control purposes, the contents can be read cyclically and / or monitored by a checksum check. The backup register BU-R contains a setting for how to proceed for detected classified accident types or...The procedure to be followed in the event of a fault is to optimize the ignition capability of the ignited ignition circuits ZK1, ZK2, and ZKn. When classifying the detected accident, crash types can be distinguished, for example, as a frontal impact, a frontal impact with right side overlap, a frontal impact with left side overlap, a right side impact, a left side impact, a rear impact, or a rollover. Furthermore, a programmable delay period is stored in the delay time register VR of the evaluation and control circuit 12. This delay period defines, in the event of a fault, the time interval after which an ignition circuit that has been deactivated after activation is reactivated. This delay period can be selected uniformly for all ignition circuits ZK1, ZK2, and ZKn, or it can be individually specified for each ignition circuit ZK1, ZK2, and ZKn.The delay time register VR is implemented, for example, as a 5-bit register or as an nx 5-bit register, in which a time delay between 0 and 3,100 µs can be set with a time resolution of 100 µs. As can be seen in Fig. 2, the illustrated ignition circuit ZK1 comprises a current-controlled high-side power output stage HS1 and a current-limited low-side power output stage LS1. The ignition circuit ZK1 serves to activate a pyrotechnic ignition element ZP1, which is connected to the high-side power output stage HS1 and the low-side power output stage LS1 via an ignition cable. As can be seen in Figures 1 and 2, the ignition electronics 10 are powered via a central safety switch or voltage regulator 7 and a reverse polarity protection diode D2 from an energy reserve ER. The energy reserve ER is charged to a supply voltage VER above the vehicle's battery voltage UB via a charging circuit 5, which is protected by another reverse polarity protection diode D1 and includes a boost converter. An additional supply path is also provided, which runs to the battery voltage UB via the central safety switch or voltage regulator 7 and another reverse polarity protection diode D3. This additional supply path, like the charging circuit 5, is protected from ground at the battery voltage UB by a bidirectional transient voltage suppressor diode (TVS). The high-side power output stage HS1 and the low-side power output stage LS1 of the individual ignition circuits ZK1, ZK2, ZKn can be directly locked or unlocked by the evaluation and control unit (µC) via corresponding initial control signals S-HS1-UN and S_LS1_UN. The initial control signals S-HS1-UN and S_LS1_UN for the UNLOCK state of the n high-side power output stages HS1 and the n low-side power output stages LS1 can be stored in corresponding registers, each with n bits, which can be programmed by the evaluation and control unit (µC). The individual high-side power output stages HS1 and low-side power output stage LS1 are each equipped with a programmable ignition time span, which is stored in a corresponding ignition time register FT-R and is individually initially programmed for each pair of output stages by the evaluation and control unit µC.To avoid inductive shutdown transients in the respective ignition circuits ZK1, ZK2, ZKn, a time interval of 100 µs is added to the programmed ignition time interval for the respective low-side power output stage LS1 in the illustrated embodiment. The actual control of the high-side power output stage HS1 and the low-side power output stage LS1 of the individual ignition circuits ZK1, ZK2, ZKn is achieved via corresponding second control signals S_HS1_ON, S_LS1_ON. The second control signals S_HS1_ON, S_LS1_ON for the ON position of the n high-side power output stages HS1 and the n low-side power output stages LS1 can be stored in corresponding registers, which have n bits and can be programmed by the evaluation and control unit µC. The control current level of the trigger currents I1, I2, In of each high-side power output stage HS1 is defined by programming a reference current IZ_REF1, which is stored in a trigger current register FC-R for the individual trigger currents I1, I2, In. This reference current IZ_REF1 generates a voltage drop across a reference resistor RZ_REF. In the illustrated embodiment, each high-side power output stage HS1 consists, for example, of 40 discrete transistors (e.g., N-channel MOSFETs) or area components, which are divided into a main section TP1 with 39 discrete transistors or area components and a sampling section TS1 with one discrete transistor or area component. The sampling section TS1 includes a sampling resistor R_SENSE.If, for example, the high-side power output stage HS1 delivers a regulated trigger current I1 of 1.44 A, then a control current IR of (39 / 40 x 1.44 A) = 1.404 A flows in the main section TP1, and a sampling current of (1 / 40 x 1.44 A) = 36 mA flows in the sampling section TS1. The sampling resistor R_SENSE of the sampling section TS1 and the reference resistor RZ_REF are both connected to a power supply of the high-side power output stage HS1. The voltage drop caused by the reference current IZ_REF1 across the reference resistor RZ_REF relative to the power supply of the high-side power output stage HS1 is fed to a control amplifier Reg1 at its inverting input.If the sampling resistor R_SENSE corresponds to the reference resistor RZ_REF, and a drain tap of the sampling section TS1 is connected to a non-inverting input of the control amplifier Reg1, then a common GATE connection of the high-side power output stage HS1 can be controlled by an output of the control amplifier Reg1 such that a sampling current IS through the sampling resistor R_SENSE and the sampling section TS1 matches the reference current IZ_REF1 in the reference branch. In the illustrated embodiment, the reference current IZ_REF1 has a value of 36 mA, which corresponds to a controlled trigger current of 1.44 A. The level of a monitoring current IMon_Ref1 for monitoring the ignition current I1 in the high-side power output stage HS1 is defined by programming the monitoring current IMon_Ref1, which is stored in a monitoring current register MR for the individual ignition currents I1, I2, and In. This monitoring current IMon_Ref1 generates a voltage drop across a monitoring reference resistor RMon_REF relative to the power supply, which is applied to an inverting input of a comparator Comp1. Additionally, the drain tap of the sampling unit TS1 is connected to a non-inverting input of the comparator Comp1.If the monitoring reference resistor RMon_REF corresponds to the sampling resistor R_SENSE, then an output of comparator Comp1 starts a connected counter Z1 via a START / STOP counting signal when the trigger current I1, represented by the sampling current IS, exceeds a predefined monitoring value, which is represented by the monitoring current IMon_Ref1. If the sampling current IS, representing the trigger current I1, is less than the predefined monitoring value represented by the monitoring current IMon_Ref1, then the output of comparator Comp1 stops the connected counter Z1 via the START / STOP counting signal. In the illustrated embodiment, a control target value of 1.44 A is specified for the trigger current I1. For the monitoring value, a current value of, for example, 1.2 A is specified.Therefore, in the illustrated embodiment, the monitoring current IMon_Ref1 has a value of 30 mA in order to achieve the desired monitoring value of (30 mA / 36 mA) x (1.44A) = 1.2 A. In the initial state after resetting the ignition electronics 10 following power-on or via a software reset triggered by the evaluation and control unit (µC), the ignition circuits ZK1, ZK2, and ZKn are set to high priority in the backup register BU-R. Based on the backup strategy and the effectiveness of the restraint devices used for a specific accident type, the corresponding backup register BU-R is initially programmed to determine which of the activated ignition circuits ZK1, ZK2, and ZKn remain activated with high priority in the event of a fault, and which of the activated ignition circuits ZK1, ZK2, and ZKn are deactivated and reactivated with a delay to ensure the best possible protection even in the event of a fault. Thus, a prioritization is defined and stored for each ignition circuit ZK1, ZK2, and ZKn depending on the classified accident type. In the illustrated embodiment, the evaluation and control unit (µC) programs the ignition timing, the magnitude of the ignition currents I1, I2, In, the monitoring current IMon_Ref1, and the reference current IZ_REF1, as well as the delay time for the high-side power output stage HS1 and the low-side power output stage LS1 of the individual ignition circuits ZK1, ZK2, ZKn. It also programs the prioritization of the individual ignition circuits ZK1, ZK2, ZKn in the event of a fault for the classified accident types. For programming the ignition timing and ignition currents, a 5-bit xn register can be used, for example, which, with a time / current resolution of 100 µs / 100 mA, allows a time range of 0 to 3,100 µs and a current range of 0 to 3,100 mA for representing the ignition timing and ignition current. In simplified terms, the ignition time intervals and the ignition currents can be combined to form an ignition mode.To simplify, the delay time period can be set uniformly for all ignition circuits ZK1, ZK2, ZKn. If the ignition algorithm ZA of the evaluation and control unit µC detects an accident or an unavoidable accident based on the evaluation of sensors from the accident sensor system 9, the evaluation and control unit µC sends a fire command µC_S to the ignition electronics 10 at the appropriate time. For safety reasons, the ignition command is generally structured using several consecutive SPI commands. In the first SPI command, the corresponding backup register BU-R is selected depending on the detected classified accident type. In the second SPI command, the low-side power output stages LS1 of the ignition circuits ZK1, ZK2, ZKn, or all low-side power output stages LS1 relevant to the detected accident type are enabled. In a third SPI command, the high-side power output stages HS1 of the ignition circuits ZK1, ZK2, ZKn or all high-side power output stages HS1 relevant for the detected accident type are enabled.In a fourth SPI command, the low-side power output stages LS1 of the ignition circuits ZK1, ZK2, and ZKn relevant for the detected accident type are activated. In a fifth SPI command, the high-side power output stages LS1 of the ignition circuits ZK1, ZK2, and ZKn relevant for the detected accident type are activated. Contrary to the fire command's instructions, ignition circuits ZK1, ZK2, and ZKn assigned a low priority in the selected backup register BU-R, whose associated restraint devices have a lower effectiveness or lesser impact on occupant safety for the detected accident type, are aborted by deactivating the corresponding high-side power output stage HS1 and the corresponding low-side power output stage LS1 if a fault is detected.The fault is detected when the ignition current monitoring devices 14 register current values ​​lower than the specified monitoring current value in a predetermined number of consecutive current measurements after the ignition current timer has been started, in a predetermined number of ignition circuits ZK1, ZK2, ZKn, or in all ignition circuits ZK1, ZK2, ZKn. In this case, a central problem can be identified: the supply of ignition energy at the required voltage level for setting or regulating the ignition current I1, I2, In in the activated ignition circuits ZK1, ZK2, ZKn. In the illustrated embodiment, four consecutive current measurements are evaluated. Of course, more or fewer than four consecutive current measurements can also be evaluated. In the illustrated embodiment, the counter value ZS1 of a counter Z1 in each ignition circuit ZK1, ZK2, ZKn is read and evaluated as information about the monitored ignition currents I1, I2, In. This counter value is incremented at predefined time intervals of, for example, 25 µs if the monitored ignition current I1, I2, In exceeds a predefined monitoring current value. By additionally evaluating the dynamic ignition current measurement with a sampling rate of, for example, 40 kHz in all ignition circuits ZK1, ZK2, ZKn, the "fault case" can be easily detected and stored. This evaluation involves querying the counter Z1 of all activated ignition circuits ZK1, ZK2, ZKn for their counter value ZS1 after a predefined number of ignition current samples (here, four) at the specified times (25 µs, 50 µs, 75 µs, 100 µs).A fault can thus be detected if the sum of the counter readings ZS1 of the monitored ignition currents I1, I2, In falls below a predefined value or is equal to "zero" after a predetermined initial time period. After reading, the recorded counter readings ZS1 of the monitoring circuits 14 are stored in a counter register ZR. To ensure the activation of the high-priority ignition circuits ZK1, ZK2, and ZKn, the low-priority ignition circuits ZK1, ZK2, and ZKn are first deactivated, depending on the accident type and according to the assigned backup register BU-R. By deactivating the activated low-priority ignition circuits ZK1, ZK2, and ZKn, the total power supply current IG and the individual ignition currents I1, I2, and In in the activated high-priority ignition circuits ZK1, ZK2, and ZKn can be increased to reach or exceed the specified minimum current value and ensure reliable triggering of the ignition elements ZP1, ZP2, and ZPn in the high-priority ignition circuits ZK1, ZK2, and ZKn. After the specified delay period has elapsed, the low-priority firing circuits are reactivated for the specified firing time, provided they were included in the original fire command. This means that the firing electronics 10 do not independently decide to activate firing circuits ZK1, ZK2, and ZKn. The low-priority firing circuits ZK1, ZK2, and ZKn are activated as requested by the independent evaluation and control unit (µC). In the event of a fault, however, this activation is delayed unless the fire command was canceled by the evaluation and control unit (µC) during the delay period. Upon expiry of the ignition time interval of the high-priority ignition circuits ZK1, ZK2, ZKn, the counter value ZS1 of the counters Z1 of the individual ignition circuits ZK1, ZK2, ZKn is copied to the counter register ZR and saved. Additionally, after the predefined ignition time intervals of the activated low-priority ignition circuits ZK1, ZK2, ZKn have elapsed, the counter values ​​ZS1 of the monitoring circuits 14 of the activated high- and low-priority ignition circuits ZK1, ZK2, ZKn are read and saved in the counter register ZR. The counter register ZR now contains the complete documentation of how long current flowed above the monitoring threshold in each ignition circuit ZK1, ZK2, ZKn. As can be further seen from Fig. 3, in the illustrated embodiment of the ignition method 100 according to the invention for a vehicle restraint system, a prioritization of the ignition circuits ZK1, ZK2, ZKn to be activated for each fire command is stored in a backup register BU-R in step S100. In step S110, information from an accident sensor 9 is received and evaluated. In step S120, the detected accident is classified. In step S130, the corresponding fire command for the detected classified accident is issued, and in step S140, the ignition circuits ZK1, ZK2, ZKn assigned to the fire command are activated. In step S150, the ignition currents I1, I2, In in the activated ignition circuits ZK1, ZK2, ZKn are monitored, and in step S160, information on the monitored ignition currents I1, I2, In is evaluated for fault detection. In the event of a detected error, at least one backup register BU-R is read in step S160.In step S180, the activated ignition circuits ZK1, ZK2, ZKn are deactivated again; these circuits are assigned a low priority by at least one backup register BU-R. In step S190, the activated ignition circuits ZK1, ZK2, ZKn, which are assigned a high priority by the backup register BU-R, continue to be supplied with the corresponding ignition current I1, I2, In. After a delay period has elapsed, the deactivated ignition circuits with low priority are reactivated for the specified ignition time interval. The delay time intervals for the individual ignition circuits ZK1, ZK2, ZKn are stored in a delay time register VR. This allows the delay time interval to correspond to the specified ignition time interval of the activated ignition circuits ZK1, ZK2, ZKn with high priority. These measures are only taken in the event of a fault. The cause could be an interruption in the connections of the energy reserve ER, indicated by corresponding lightning bolts in Fig. 1. In this case, only the battery voltage or the vehicle's electrical system voltage of 13 V to 16 V is available. In the following example, the evaluation and control unit (µC) detects a frontal impact situation. For the detected frontal impact situation, five seatbelt pretensioners, a driver's seatbelt airbag, a passenger's seatbelt airbag, the first stage of a driver's airbag, and the first stage of a passenger's airbag are to be activated at a calculated time after the start of the impact. This results in a total of nine parallel ignition circuit activations.In the event of a fault, for this detected frontal impact type, the backup register BU-R specifies, for example, that four seatbelt pretensioners, the first stage of the driver's airbag, and the first stage of the passenger airbag are assigned high priority. One of the seatbelt pretensioners, the driver's seatbelt airbag, and the passenger's seatbelt airbag have been assigned low priority. Therefore, in the event of a fault, of the nine ignition circuits ZK1, ZK2, and ZKn that are to be activated in parallel, only six are assigned high priority and three are assigned low priority (Crash).

Claims

Ignition device (1) for a vehicle restraint system, comprising an ignition electronics unit (10) which includes an evaluation and control circuit (12) and a plurality (n) of ignition circuits (ZK1, ZK2, ZKn) with an ignition element (ZP1, ZP2, ZPn), and a power supply (3) which supplies the activated ignition circuits (ZK1, ZK2, ZKn) with current (IG, I1, I2, In), wherein an evaluation and control unit (µC) receives and evaluates information from an accident sensor (9), wherein an ignition algorithm (ZA) of the evaluation and control unit (µC) classifies a detected accident depending on the evaluation and, depending on the classified accident, issues a corresponding firing command (µC_S) to the ignition electronics unit (10), which selects the ignition circuits assigned to the firing command (µC_S) from the plurality of ignition circuits (ZK1, ZK2, ZKn) is activated for a predetermined ignition time interval, wherein a monitoring circuit (14) is provided in each of the ignition circuits (ZK1, ZK2, ZKn),which monitors the ignition current (I1, I2, In) in the corresponding ignition circuit (ZK1, ZK2, ZKn), characterized in that the evaluation and control circuit (12) comprises at least one backup register (BU-R) in which a prioritization of the ignition circuits (ZK1, ZK2, ZKn) to be activated is stored in advance for at least one firing command (µC_S), wherein the evaluation and control circuit (12) evaluates information from the monitoring circuits (14) of the activated ignition circuits (ZK1, ZK2, ZKn) for fault detection, wherein, in the event of a detected fault, the evaluation and control circuit (12) reads the at least one backup register (BU-R) for the associated firing command (µC_S) and deactivates activated ignition circuits (ZK1, ZK2, ZKn) which have been assigned a low priority by the at least one backup register (BU-R). is, and the activated ignition circuits (ZK1, ZK2, ZKn), which are assigned a high priority by at least one backup register (BU-R),for the specified ignition time period, it continues to be supplied with the corresponding ignition current (I1, I2, In). Ignition device (1) according to claim 1, characterized in that the evaluation and control circuit (12) detects the fault case when a predetermined number of monitoring circuits (14) indicate that the ignition current (I1, I2, In) in the associated activated ignition circuit (ZK1, ZK2, ZKn) has not reached a predetermined value. Ignition device (1) according to claim 1 or 2, characterized in that the individual monitoring circuits (14) each have a counter (Z1) which increases its counter value (ZS1) at predetermined time intervals when the monitored ignition current (I1, I2, In) is greater than a predetermined monitoring current value. Ignition device (1) according to claim 3, characterized in that the evaluation and control circuit (12) reads the counter values ​​(ZS1) of the monitoring circuits (14) of the activated ignition circuits (ZK1, ZK2, ZKn) after a first time interval following the activation of the associated ignition circuits (ZK1, ZK2, ZKn), wherein the first time interval is much shorter than the specified ignition time intervals and longer than a period of a clock signal (FC_CLK) which specifies the time interval for the counter (Z1). Ignition device (1) according to claim 4, characterized in that the evaluation and control circuit (12) reads the counter values ​​(ZS1) of the monitoring circuits (14) of the activated ignition circuits (ZK1, ZK2, ZKn) with high and low priority after the predetermined ignition time intervals of the activated ignition circuits (ZK1, ZK2, ZKn) have elapsed. Ignition device (1) according to one of claims 1 to 5, characterized in that the evaluation and control circuit (12) reactivates the deactivated ignition circuits (ZK1, ZK2, ZKn) with low priority for the specified ignition time span after the expiry of a delay time window. Ignition device (1) according to claim 6, characterized in that a duration of the delay time window for the individual ignition circuits (ZK1, ZK2, ZKn) is stored in a delay time register (VR). Ignition device (1) according to claim 6 or 7, characterized in that the delay time window corresponds to the predetermined ignition time span of the activated ignition circuits (ZK1, ZK2, ZKn) with high priority. Ignition device (1) according to one of claims 6 to 8, characterized in that the evaluation and control circuit (12) reads the counter values ​​(ZS1) of the monitoring circuits (14) of the activated ignition circuits (ZK1, ZK2, ZKn) with high and low priority after the predetermined ignition time intervals of the activated ignition circuits (ZK1, ZK2, ZKn) with low priority have elapsed. Ignition device (1) according to one of claims 4 to 9, characterized in that the evaluation and control circuit (12) saves the read counter values ​​(ZS1) of the monitoring circuits (14) in a counter register (ZR). Ignition method (100) for a vehicle restraint system, wherein a plurality (n) of activated ignition circuits (ZK1, ZK2, ZKn) with an ignition element (ZP1, ZP2, ZPn) are supplied with current (IG, I1, I2, In) by a power supply (3) and information from an accident sensor (9) is received and evaluated, wherein, depending on the evaluation, a detected accident is classified and, depending on the classified accident, a corresponding fire command (µC_S) is issued and the ignition circuits assigned to the fire command (µC_S) from the plurality of ignition circuits (ZK1, ZK2, ZKn) are activated for a predetermined ignition time interval, wherein the ignition currents (I1, I2, In) in the ignition circuits (ZK1, ZK2, ZKn) are monitored, characterized in that, for at least one fire command (µC_S), a backup register is stored in advance. (BU-R) stores a prioritization of the ignition circuits to be activated (ZK1, ZK2, ZKn), with information on the monitored ignition currents (I1, I2,The values ​​of the activated firing circuits (ZK1, ZK2, ZKn) are evaluated for fault detection, whereby in the event of a detected fault, the at least one backup register (BU-R) for the associated firing command (µC_S) is read and activated firing circuits (ZK1, ZK2, ZKn) assigned a low priority by the at least one backup register (BU-R) are deactivated, and the activated firing circuits (ZK1, ZK2, ZKn) assigned a high priority by the at least one backup register (BU-R) continue to be supplied with the corresponding firing current (I1, I2, In) for the specified firing time period. Ignition method (100) according to claim 11, characterized in that when classifying the detected accident as crash types, a frontal impact or a frontal impact with right side overlap or a frontal impact with left side overlap or a right side impact or a left side impact or a rear impact or a rollover are distinguished. Ignition method (100) according to claim 11 or 12, characterized in that, as information on the monitored ignition currents (I1, I2, In), a counter reading (ZS1) of a counter (Z1) in the respective ignition circuit (ZK1, ZK2, ZKn) is read and evaluated, which is increased at predetermined time intervals if the monitored ignition current (I1, I2, In) is greater than a predetermined monitoring current value. Ignition method (100) according to claim 13, characterized in that the fault is detected when a sum of the counter readings (ZS1) of the monitored ignition currents (I1, I2, In) is below a predetermined value after a predetermined first time interval, wherein the first time interval is much shorter than the predetermined ignition time intervals and is greater than or equal to a period of a clock signal (FC_CLK) which specifies the time interval for the counter (Z1). Ignition method (100) according to one of claims 11 to 14, characterized in that after the expiry of a delay time window the deactivated ignition circuits (ZK1, ZK2, ZKn) are reactivated with low priority for the specified ignition time interval.

Images