CONTROL UNIT FOR A PERSONAL PROTECTION SYSTEM

Description

[0001] The invention relates to a control device for a personal protection system.

[0002] Personal protection systems designed as airbag systems are known from the prior art, with a control unit connected to a vehicle data bus, such as a CAN data bus, Flex-Ray data bus, etc. The connection to the vehicle data bus serves diagnostic purposes, behavior optimization, and the transmission of sensor data from the airbag system to other vehicle systems, such as an ESP system and / or ABS system. The transmission of general data such as date, time, temperature, speed, load; usage statistics; battery management; rain sensor; ESP / ABS interventions, etc., to the airbag system's control unit serves the purpose of optimization and documentation but has no direct influence on the deployment decision.Since the control unit has non-volatile memory capabilities even in the event of a battery failure, in the event of a crash or other defined situations (near-crashes), in addition to restraint system-specific data, data from other vehicle systems that contribute to the status of the vehicle and its operation before, during, and after the crash are transferred to the airbag system control unit for storage. Furthermore, control units for passenger protection systems are known that, in addition to a main processor, use an additional, lower-performance processor for security and / or authentication tasks for reasons of redundancy and diversity.

[0003] DE 10 2007 012 463 A1 discloses a control unit and a method for controlling personal protection devices. The personal protection devices are controlled by a processor depending on at least one sensor signal. Furthermore, a safety controller is provided, which enables the control depending on the at least one sensor signal. A module reformats a bus signal originating from outside a control unit, which contains the at least one sensor signal, for the safety controller and makes it available. Disclosure of the invention

[0004] The control unit for a passenger protection system with the features of independent patent claim 1 has the advantage of providing an optimized concept for even more powerful passenger protection systems for the growing market of vehicles with driver assistance systems. This concept is capable of considering trigger-relevant information from driver assistance systems, such as video analysis, radar analysis, LiDAR analysis, etc., but also from other systems, such as ESP and / or ABS systems, when deciding to trigger passenger protection devices, such as airbags, belt tensioners, etc. Furthermore, embodiments of the control unit can also perform other safety tasks, such as the isolation of high-voltage derivatives of electromobility up to 800V.

[0005] In embodiments of the control unit, a central integrated safety circuit with a secondary processor can detect more complex trigger-relevant information in the captured data by reading data transmitted on various vehicle data buses (LIN; CAN; CAN-FD; FLexRay, Ethernet; Bluetooth, etc.) and provide appropriate algorithms for evaluating the trigger-relevant information. Based on the evaluation of the trigger-relevant information, the central safety circuit can authorize full or partial access to personal protection equipment or groups of personal protection equipment for triggering, so that a main processor can trigger the enabled personal protection equipment at the exact time of activation.Furthermore, the interaction of the main processor and the secondary processor of the central safety circuit during a startup phase when the passenger protection system is not active can completely eliminate the use of flash memory. The secondary processor of the central integrated safety circuit can also perform safety-relevant plausibility checks for data that the control unit wants to provide via the main processor on a corresponding vehicle data bus. Furthermore, the safety concept of the passenger protection system can be easily adapted to future requirements by modifying the software.

[0006] Embodiments of the present invention provide a control unit for a personal protection system, which comprises as components at least one main processor, which is designed to generate and output at least one triggering signal for at least one triggering element of personal protection means of the personal protection system depending on triggering-relevant information, a central safety circuit with a secondary processor, which is designed to generate and output at least one release signal for the at least one triggering element of the personal protection means depending on the triggering-relevant information, an integrated main system circuit, which is designed to generate and output at least one control signal for triggering the at least one triggering element of the personal protection means depending on the at least one triggering signal and the at least one release signal, and at least one control unit data bus,via which the main processor communicates with the other components of the control unit. The central safety circuit comprises at least one external bus interface, via which the main processor communicates with at least one external vehicle data bus, and at least one internal bus interface, which is connected to the at least one control unit data bus. The trigger-relevant information can be transmitted via the at least one control unit data bus and / or the at least one external vehicle data bus, wherein the at least one external bus interface and the at least one internal bus interface are each designed to read the data communicated via the at least one external vehicle data bus or the at least one control unit data bus, to recognize the trigger-relevant information, and to additionally transmit it to the secondary processor for evaluation.

[0007] In embodiments of the control unit according to the invention, the central integrated safety circuit, which comprises at least one external bus interface for detecting trigger-relevant information in data from at least one vehicle bus system, can be adapted and aligned according to requirements without taking into account the trigger architecture for the personal protection equipment in the integrated main system circuit. The additional secondary processor in the central safety circuit enables the evaluation of complex and diverse vehicle bus data. Complex safety algorithms for central sensors arranged in the control unit or peripheral sensors connected to the control unit via peripheral sensor interfaces can also be implemented via software.

[0008] Personal protection devices can include, for example, internal occupant protection devices such as airbags, belt tensioners, crash-responsive headrests, insertable seat components such as side bolsters, roll bars, etc., as well as external pedestrian protection devices such as airbags, crash-responsive bonnets, etc. However, active personal protection devices such as braking interventions or vehicle dynamics control interventions are also conceivable. The term "actuation" refers below to the activation of these personal protection devices. This means that, for example, in personal protection devices with pyrotechnic triggering elements such as airbags, corresponding ignition charges are ignited by applying current. In personal protection devices with electromagnetic triggering elements such as roll bars, the electromagnetic device is activated by an activation current.

[0009] The trigger-relevant information can be recorded physical variables, which are acquired by various sensors, such as acceleration sensors, air pressure sensors, structure-borne sound sensors, environmental sensors, or provided by other vehicle systems, such as a vehicle dynamics control system or a braking system. In addition, variables derived from the recorded physical variables are also possible, so that, for example, a filtered acceleration signal or an integrated acceleration signal can be evaluated as trigger-relevant information.

[0010] The central safety circuit is defined below as an integrated circuit module that includes the secondary processor, at least one external bus interface, at least one internal bus interface, and other components. The main system integrated circuit is defined below as a so-called system ASIC module, which, among other components, includes, in particular, various driver circuits for activating the personal protection equipment.

[0011] The measures and further developments listed in the dependent claims enable advantageous improvements to the control device for a personal protection system specified in independent patent claim 1.

[0012] It is particularly advantageous that the integrated main system circuit is further configured to generate at least one internal system voltage of the control unit. For example, the integrated main system circuit can provide a supply voltage buffered from an energy reserve, as well as additional supply voltages for the main processor, the central safety circuit, and other components of the control unit.

[0013] In an advantageous embodiment of the control unit, at least one integrated system circuit can be present as a further component of the control unit and connected to the at least one control unit data bus. In this case, the at least one integrated system circuit can be designed to generate and output at least one further control signal for triggering at least one further triggering element of the personal protection equipment as a function of the at least one trigger signal and the at least one enable signal. Analogous to the integrated main system circuit, the at least one integrated system circuit can be designed as a system ASIC module, which comprises a wide variety of driver circuits for activating the further personal protection equipment. In contrast to the integrated main system circuit, the at least one integrated system circuit does not generate any internal system voltages for the control unit.By using the integrated main system circuit and additional integrated system circuits, different groups of personal protection devices can be easily formed and activated depending on different trigger-relevant information. Furthermore, the integrated main system circuit and / or the at least one integrated system circuit can each comprise at least one peripheral sensor interface designed to receive and process sensor signals from at least one peripheral sensor. The integrated main system circuit and / or the at least one integrated system circuit make the processed sensor signals available via the internal system data bus.

[0014] In a further advantageous embodiment of the control unit, the central safety circuit can comprise a flash memory-free storage device with at least one storage unit, which is designed to store an internal self-test program and / or a bootloader program and / or program code received from the main processor during system startup and to provide a working memory for the at least one secondary processor. For example, a first storage unit can be designed as volatile working memory, and a second storage unit can be designed as volatile program data memory, for example. A third storage unit can be designed as volatile program code memory, for example. In this case, program code can initially be transmitted in a secured manner from the main processor to the central safety circuit via the at least one control unit data bus.The transferred program code can be initially checked for correct content using an integrated self-test and locked against changes during operation. Cyclic checking of the program code is optionally possible. Program data can also be initially securely transmitted from the main processor to the central safety circuit via at least one control unit data bus. Similarly, the transferred program data can initially be checked for correct content using an integrated self-test and locked against changes during operation. Cyclic checking of the program data is optionally possible. In addition, a "bootloader" programmed as a built-in mask can be stored in another non-volatile memory unit. This bootloader, once started by the main processor, handles the transfer of the program code and program data to the memory device of the central safety circuit.

[0015] In a further advantageous embodiment of the control unit, the at least one external bus interface can comprise a transceiver and a first read-along function. The transceiver can be designed to receive external data from the at least one external vehicle data bus and forward it to the main processor, and to receive internal data from the main processor and forward it to the at least one external vehicle data bus. The read-along function can be designed to read the external data and the internal data and to identify the trigger-relevant information and forward it to the secondary processor. By integrating the at least one external bus interface with transceiver into the central safety circuit, additional external bus interface modules in the control unit can be dispensed with.If the vehicle has several different data buses over which trigger-relevant information is transmitted, several external bus interfaces can be integrated into the central safety circuit. Additionally, the central safety circuit can include a shutdown function designed to deactivate the transceiver in the event of defined bus errors. This advantageously prevents corrupt or incorrect data from the control unit from being output to the corresponding vehicle data bus.

[0016] In a further advantageous embodiment of the control unit, the at least one external vehicle data bus can be a wired data bus, in particular a CAN data bus, a FlexRay data bus, a LIN data bus, or an Ethernet data bus, or a wireless data bus, in particular a Bluetooth data bus. Corresponding physical transceivers can be integrated into the central safety circuit for direct connection to the respective vehicle data bus system.

[0017] In a further advantageous embodiment of the control unit, the at least one internal bus interface can comprise a second read-along function, which can be configured to read the data on the at least one control unit data bus and to identify the trigger-relevant information and forward it to the secondary processor. This allows the central safety circuit to also read the trigger-relevant information contained in the sensor data of the peripheral sensors or in the sensor data of the central sensors arranged in the control unit and to transmit it to the main processor via the at least one control unit data bus.

[0018] In a further advantageous embodiment of the control unit, the central security circuit can comprise a self-contained crypto module, which can be configured to perform an authentication check of the detected trigger-relevant information redundantly to the main processor. This enables a redundant authenticity check of the detected trigger-relevant information in the integrated main system circuit, independent of the main processor.

[0019] In a further advantageous embodiment of the control unit, the central safety circuit can comprise an internal power supply, which can be designed to generate at least one internal supply voltage for the central safety circuit from a reverse-polarity protected supply voltage and / or from an energy reserve buffered supply voltage. The internal power supply can, for example, comprise several linear regulators, each of which generates an internal supply voltage and can make it available to the at least one external bus interface and / or the at least one internal bus interface and / or the memory device and / or the secondary processor.

[0020] In a further advantageous embodiment of the control unit, the central safety circuit can comprise a sensor data filter module, which can be designed to filter the trigger-relevant information based on sensor data according to predefined key data. By using such a sensor data filter module, an adaptation to the data filters used in personal protection systems can be implemented with a power-saving clock speed, which is used for the secondary processor.

[0021] In a further advantageous embodiment of the control unit, the central safety circuit can comprise a control circuit, which can be designed to control a central safety semiconductor switch in order to adapt a trigger voltage for the at least one trigger element to the requirements of the at least one trigger element in a linear or clocked manner. For example, the trigger voltage can be adjusted before and / or during triggering in order to reduce losses in the driver circuits of the personal protection equipment via a fast pulse width modulation (PWM) interface. This also includes the possibility of incorporating a novel central fast high-current buck regulator with a short-term load of 40 amperes and a high level of efficiency into the trigger path. The control circuit can preferably be controlled and activated by the main processor.

[0022] In a further advantageous embodiment of the control unit, the central safety circuit can comprise at least one readable parallel interface, which can be configured to output the at least one enable signal. This provides an expandable option for partially or completely enabling the personal protection equipment. The enable can be achieved, for example, by specifying a suitable level and / or by transmitting a suitable, safe serial enable word and optionally comparing it.

[0023] In a further advantageous embodiment of the control unit, the central safety circuit can comprise at least one analog interface designed to receive or output at least one analog signal. Such an analog interface can be used, for example, to read switching states or locking states or to control warning lights.

[0024] Embodiments of the invention are illustrated in the drawings and explained in more detail in the following description. In the drawings, like reference numerals designate components or elements that perform the same or similar functions.

[0025] Short description of the drawings Fig. 1 shows a schematic block diagram of an embodiment of a control device according to the invention for a personal protection system. Fig. 2 shows a schematic block diagram of a power supply of the control device according to the invention for a personal protection system from Fig. 1 . Fig. 3 bis 7 each show a schematic block diagram of embodiments of a central integrated safety circuit of the control device according to the invention for a personal protection system from Fig. 1 and 2 . Embodiments of the invention

[0026] As from Fig. 1 bis 7 As can be seen, the illustrated embodiments of a control unit ECU according to the invention for a personal protection system 1 comprise as components at least one main processor µC, which, depending on triggering-relevant information, generates and outputs at least one triggering signal for at least one triggering element 5 of personal protection means PS of the personal protection system 1, a central integrated safety circuit 10 with a secondary processor CPU, which, depending on the triggering-relevant information, generates and outputs at least one release signal DIS for the at least one triggering element 5 of the personal protection means PS, an integrated main system circuit SBC, which, depending on the at least one triggering signal and the at least one release signal DIS, generates and outputs at least one control signal for triggering the at least one triggering element 5 of the personal protection means PS, and at least one control unit data bus SPI1,via which the main processor µC communicates with the other components of the ECU. The central integrated safety circuit 10 comprises at least one external bus interface 12, via which the main processor µC communicates with at least one external vehicle data bus 3, and at least one internal bus interface 14, which is connected to the at least one control unit data bus SPI1. The trigger-relevant information can be transmitted via the at least one control unit data bus SPI1 and / or the at least one external vehicle data bus 3. Furthermore, the at least one external bus interface 12 and the at least one internal bus interface 14 each read the data communicated via the at least one external vehicle data bus 3 or the at least one control unit data bus SPI1, recognize the trigger-relevant information, and additionally transmit it to the secondary processor CPU for evaluation.

[0027] As from Fig. 1 As can be further seen, at least one integrated system circuit CMP1, CMPn is present as a further component of the control unit ECU and is connected to the at least one control unit data bus SPI1. The at least one integrated system circuit CMP1, CMPn generates at least one further control signal for triggering at least one further triggering element 5 of the personal protection device PS as a function of the at least one trigger signal and the at least one release signal DIS and outputs this.

[0028] As from Fig. 1 As can further be seen, the control unit ECU in the illustrated embodiment comprises, in addition to the integrated main system circuit SBC, n further integrated system circuits, of which a first integrated system circuit CMP1 and an nth integrated system circuit CMPn are shown as examples. Both the integrated main system circuit SBC and the further integrated system circuits CMP1, CMPn are each implemented as ASIC components (ASIC: Application-Specific Integrated Circuit). To activate assigned personal protection equipment PS, the integrated main system circuit SBC in the illustrated embodiment comprises a driver circuit (not further specified) with a trigger element 5 implemented as an ignition element ZE.In order to activate additional assigned personal protection devices PS, the first integrated system circuit CMP1 in the exemplary embodiment shown comprises a driver circuit (not further specified) with a triggering element 5 designed as the first ignition element ZE1. In order to activate additional assigned personal protection devices PS, the nth integrated system circuit CMPn in the exemplary embodiment shown comprises a driver circuit (not further specified) with a triggering element 5 designed as the nth ignition element ZEn. By using the integrated main system circuit SBC and the additional integrated system circuits CMP1, CMPn, different groups of personal protection devices PS can be easily formed and activated depending on different trigger-relevant information.

[0029] In addition, the integrated main system circuit SBC and the further integrated system circuits CMP1, CMPn in the illustrated embodiment of the control unit ECU each comprise at least one peripheral sensor interface 7, which receives and processes sensor signals from at least one peripheral sensor 9. In the illustrated embodiment, the peripheral sensor interfaces 7 are each designed as PS15 interfaces PSI51, PSI5m, PSI511, PSI51k, PSI5n1, PSI5nl. As can be seen from Fig. 1 As can further be seen, the integrated main system circuit SBC in the illustrated embodiment is connected to m sensors 9, of which only two sensors 9 are shown, via m PSI5 interfaces PSI51, PSI5m, of which a first PSI5 interface PSI51 and an m-th PSI5 interface PSI5m are shown. In addition, the first integrated system circuit CMP1 in the illustrated embodiment is connected to k sensors 9, of which only two sensors 9 are shown, via k PSI5 interfaces PSI511, PSI51k, of which a first PSI5 interface PSI511 and a k-th PSI5 interface PSI51k are shown. Furthermore, the n-th integrated system circuit CMPn in the illustrated embodiment is connected to I sensors 9, of which only two sensors 9 are shown, via I PSl5 interfaces PSI5n1, PSI5lk, of which a first PSI5 interface PSI5n1 and an I-th PSl5 interface PSI5nl are shown.

[0030] As from Fig. 2 As can be seen further, a filter block FB receives an on-board network voltage UB and provides a reverse-polarity protected supply voltage VBat, which is applied to the central integrated safety circuit 10, the integrated main system circuit SBC, and the further integrated system circuits CMP1, CMPn. In addition, the filter block FB provides the integrated main system circuit SBC with a further supply voltage VZP, from which the integrated main system circuit SBC generates further internal system voltages VS, of which Fig. 2 by way of example, a bundle of internal system voltages VS is shown and labeled. These internal system voltages VS are used, for example, to supply voltage to internal sensors S1, Sn of the ECU control unit, the main processor µC (core, memory, ADC, interfaces such as SPI, etc.), and to supply the interfaces of the internal data bus(es) not shown in the further integrated system circuits CMP1, CMPn 14, which are connected to the internal ECU data bus SPI1, and also to supply the at least one internal bus interface 14 and the at least one external bus interface 12 of the central integrated safety circuit 10. Depending on a flexible voltage regulator concept of the central integrated safety circuit 10, the required supply voltages can also be generated internally in the respective components of the ECU control unit.The additional supply voltage VZP is also provided to the external interface 12 in the central safety circuit 10. Furthermore, the filter block FB provides an auxiliary voltage VH, which provides a trigger current for a central safety semiconductor SH. Additionally or alternatively, the safety semiconductor SH can be supplied by an energy reserve VER. As can be seen from . Fig. 2 As can be further seen, the safety semiconductor SH provides the integrated main system circuit SBC and the integrated system circuits CMP1, CMPn with a trigger voltage VFIRE, which is used by the corresponding driver circuits to activate the trigger elements 5. Furthermore, the integrated main system circuit SBC generates a supply voltage VAS, buffered by the energy reserve VER, for the central safety circuit 10 and the integrated system circuits CMP1, CMPn. As can be seen from Fig. 2 As can be seen further, the control unit can be activated via a wake-up function. For this purpose, a level converter 4 converts an external wake-up signal WAKE, which is represented, for example, by a level change, into a corresponding voltage level, which is applied to the external interface 12 in the central safety circuit 10. The external interface 12 then outputs a corresponding enable signal INH to the central integrated safety circuit 10.

[0031] As from Fig. 1 As can further be seen, the internal control unit data bus SPI1 in the illustrated embodiment is designed as an SPI data bus (SPI: Serial Peripheral Interface), wherein the main processor µC as bus master allocates the control unit data bus SPI1 for data transmission to a component coupled to the control unit data bus SPI1 via corresponding selection signals CX_X (Chip Select). In the illustrated embodiment, these components connected to the control unit data bus SPI1 also include n central sensors S1, Sn, of which a first sensor S1 and an nth sensor Sn are shown as examples. The at least one external vehicle data bus 3 is designed as a CAN data bus in the illustrated embodiment. In addition, other suitable wired data buses or wireless data buses can also be connected to the central safety circuit 10.

[0032] The following are based on Fig. 3 bis 7 various embodiments of the central integrated safety circuit 10, 10A, 10B, 10C, 10D, 10E are described.

[0033] As from Fig. 3 bis 7 As can be further seen, the central integrated security circuit 10, 10A, 10B, 10C, 10D, 10E in the illustrated embodiments each comprises a flash memory-free storage device 16 with three storage units 16.1, 16.2, 16.3 and two control circuits 16.4, 16.5 for the three storage units 16.1, 16.2, 16.3. A first control circuit controls a first storage unit 16.1, which provides a working memory for the secondary processor CPU. A second control circuit 16.5 controls a second storage unit 16.2, in which a mask-programmed internal self-test program and a mask-programmed bootloader program are stored. In addition, program code received from the main processor µC during system startup is stored in the second storage unit 16.2. In addition, the second control circuit 16.5 controls a third memory unit 16.3, in which program data received from the main processor µC at system start-up are stored.Furthermore, the central integrated safety circuit 10, 10A, 10B, 10C, 10D, 10E comprises an internal data bus SPI2, which is also implemented as an SPI data bus (SPI: Serial Peripheral Interface). The secondary processor CPU and another interface group 20, which includes at least one readable parallel interface 11 and at least one analog interface 21, as well as the internal bus interface 14, are connected to the internal data bus SPI2. The at least one readable parallel interface 11 and the at least one analog interface 21 are controlled by a further control circuit 24. The at least one readable parallel interface is used to output the at least one enable signal DIS.This means that in the illustrated embodiment of the central safety circuit 10, there are n readable parallel interfaces 11 for the n integrated system circuits CMP1, CMPn and one readable parallel interface 11 for the integrated main system circuit SBC. In addition, there are n analog interfaces 21 for receiving analog signals GPIO from the k analog components AK1, AK2, AKn, of which . Fig. 1 three analog components AK1, AK2, AKn are shown as examples, or to output to the k analog components AK1, AK2, AKn. In order to be able to establish various data connections, the central integrated safety circuit 10, 10A, 10B, 10C, 10D, 10E has a data switching matrix 22, which is connected to the internal data bus SPI2 of the safety circuit 10, 10A, 10B, 10C, 10D, 10E, the secondary processor CPU, the memory device 16, and the external bus interface 12.

[0034] As from Fig. 3 bis 6 As can further be seen, the external bus interface 12 comprises a transceiver TR1, which receives external data RxD via the bus lines CANH, CANL from the at least one external vehicle data bus 3 and forwards it to the main processor µC and receives internal data TxD from the main processor µC and forwards it to the bus lines CANH, CANL of the at least one external vehicle data bus 3, and a first read-along function CAN-FD, which reads the external data RxD and the internal data TxD and recognizes the trigger-relevant information and forwards it to the secondary processor CPU. In the illustrated embodiment, the vehicle only comprises the vehicle data bus 3 implemented as a CAN bus. Alternatively, the vehicle data bus 3 can be implemented as a Flex-Ray data bus or as a LIN data bus or as an Ethernet data bus. Of course, wireless data buses, such as a Bluetooth data bus, can also be used additionally or alternatively.In embodiments of the control unit ECU according to the invention not shown, the vehicle comprises more than just one vehicle data bus 3. In the case of several vehicle data buses 3, the central integrated safety circuit 10 has corresponding external bus interfaces 12 at least for the vehicle data buses 3, via which trigger-relevant information is transmitted.

[0035] As from Fig. 3 bis 7 As can be seen further, the internal bus interface 14 comprises a second read-along function SPI_MON, which reads the data on the at least one control unit data bus SPI1 and recognizes the trigger-relevant information and forwards it to the secondary processor CPU via the internal data bus SPI2.

[0036] As from Fig. 3 As can further be seen, the illustrated first embodiment of the central safety circuit 10A comprises an internal voltage supply 18, which generates three internal supply voltages V1, V2, V3 for the central safety circuit 10 from the reverse polarity protected supply voltage VBAT and from the supply voltage VAS buffered from the energy reserve VER. A first supply voltage V1 is provided to the transceiver TR1 as a supply voltage VCC buffered via a first external buffer memory P1. A second internal supply voltage V2 and a third supply voltage are provided to the interface group 20 and the external bus interface. In addition, the third supply voltage V3 is made available to the secondary processor CPU as an internal supply voltage VCPU buffered via a second buffer memory P2.In addition, the third supply voltage V3 is made available to the memory device 16 as an internal supply voltage VMEM buffered via a third buffer memory P3.

[0037] As from Fig. 4 As can be seen further, the illustrated second embodiment of the central security circuit 10B comprises an autonomous crypto module 17, which, redundant to the main processor µC, carries out an authentication check of the detected trigger-relevant information. Fig. 4 As can be seen further, the crypto module 17 receives the trigger-relevant information from the first CAN-FD read-only function and from the second SPI_MON read-only function. The authenticated trigger-relevant information is then transmitted to the secondary processor CPU via the data switching matrix 22.

[0038] As from Fig. 5 As can be further seen, the illustrated third embodiment of the central safety circuit 10C comprises a sensor data filter module 19, which filters the trigger-relevant information based on sensor data according to predeterminable key data. In a not-illustrated embodiment of the central safety circuit 10C with a sensor data filter module 19, this does not include a crypto module 7.

[0039] As from Fig. 6 As can be further seen, the illustrated fourth embodiment of the central safety circuit 10D includes a shutdown function 13, which shuts down the transceiver TR1 in the event of defined bus errors. The shutdown function is authorized by the main processor µC via the control unit data bus SPI1 and the internal bus interface 14. The shutdown function 13 can be used independently of the use of the crypto module 17 and / or the sensor data filter module 19.

[0040] As from Fig. 7As can further be seen, the illustrated fifth embodiment of the central safety circuit 10E comprises a further control circuit 24, which controls the central safety semiconductor switch SH in order to adapt the trigger voltage VFIRE for the at least one trigger element 5 in a linear or clocked manner to the requirements of the at least one trigger element 5. For this purpose, the further control circuit 24 receives corresponding current measurement signals, such as current voltage values ​​of the auxiliary voltage VH and / or the energy reserve VER as well as a target signal of the trigger voltage to be set, and outputs corresponding control signals to the central safety semiconductor switch SH. In this case, the control of the central safety semiconductor switch SH can be activated by the main processor µC via the control unit data bus SPI1.The further control circuit 24 for the central safety semiconductor switch SH can be used independently of the use of the crypto module 17 and / or the sensor data filter module 19 and / or the shutdown function 13.

Claims

1. Control unit (ECU) for a personal protection system (1), which comprises as components at least one main processor (µC), which is designed to generate and output, on the basis of trigger-relevant information, at least one trigger signal for at least one trigger element (5) of personal protection means (PS) of the personal protection system (1), a central safety circuit (10) having a secondary processor (CPU), which is designed to generate and output, on the basis of the trigger-relevant information, at least one enable signal (DIS) for the at least one trigger element (5) of the personal protection means (PS), an integrated main system circuit (SBC), which is designed to generate and output, on the basis of the at least one trigger signal and the at least one enable signal (DIS), at least one activation signal for triggering the at least one trigger element (5) of the personal protection means (PS), and at least one control unit data bus (SPI1), via which the main processor (µC) communicates with the other components of the control unit (ECU), the central safety circuit (10) comprising at least one external bus interface (12), via which the main processor (µC) communicates with at least one external vehicle data bus (3), and at least one internal bus interface (14), which is connected to the at least one control unit data bus (SPI1), the trigger-relevant information being able to be transmitted via the at least one control unit data bus (SPI1) and / or the at least one external vehicle data bus (3), and each of the at least one external bus interface (12) and the at least one internal bus interface (14) being designed to monitor-read the data communicated via the at least one external vehicle data bus (3) or the at least one control unit data bus (SPI1) and to recognize the trigger-relevant information and additionally transmit said information to the secondary processor (CPU) for evaluation, characterized in that at least one integrated system circuit (CMP1, CMPn) is present as a further component of the control unit (ECU) and is connected to the at least one control unit data bus (SPI1), the at least one integrated system circuit (CMP1, CMPn) being designed to generate and output, on the basis of the at least one trigger signal and the at least one enable signal (DIS), at least one further activation signal for triggering at least one further trigger element (5) of the personal protection means (PS).

2. Control unit (ECU) according to Claim 1, characterized in that the integrated main system circuit (SBC) is also designed to generate at least one internal system voltage (VS, VAS) of the control unit (ECU).

3. Control unit (ECU) according to Claim 1, characterized in that each of the integrated main system circuit (SBC) and / or the at least one integrated system circuit (CMP1, CMPn) comprises at least one peripheral sensor interface (7) designed to receive and process sensor signals from at least one peripheral sensor (9).

4. Control unit (ECU) according to one of Claims 1 to 3, characterized in that the central safety circuit (10) comprises a flash-memory free memory device (16) having at least one memory unit (16.1, 16.2, 16.3) designed to store an internal self-test program and / or a bootloader program and / or program code received from the main processor (µC) at system startup and to provide a main memory for the at least one secondary processor (CPU).

5. Control unit (ECU) according to one of Claims 1 to 4, characterized in that the at least one external bus interface (12) comprises a transceiver (TR1), which is designed to receive external data (RxD) from the at least one external vehicle data bus (3) and forward said data to the main processor (µC) and to receive internal data (TxD) from the main processor (µC) and forward said data to the at least one external vehicle data bus (3), and a first monitor-read function (CAN-FD), which is designed to monitor-read the external data (RxD) and the internal data (TxD) and to recognize the trigger-relevant information and forward said information to the secondary processor (CPU).

6. Control unit (ECU) according to Claim 5, characterized in that the central safety circuit (10) comprises a shutdown function (13) designed to switch off the transceiver (TR1) in the event of defined bus errors.

7. Control unit (ECU) according to one of Claims 1 to 6, characterized in that the at least one external vehicle data bus (3) is a wired data bus, in particular a CAN data bus or a FlexRay data bus or a LIN data bus or an Ethernet data bus, or a wireless data bus, in particular a Bluetooth data bus.

8. Control unit (ECU) according to one of Claims 1 to 7, characterized in that the at least one internal bus interface (14) comprises a second monitor-read function (SPI_MON) designed to monitor-read the data on the at least one control unit data bus (SPI1) and to recognize the trigger-relevant information and forward said information to the secondary processor (CPU).

9. Control unit (ECU) according to one of Claims 1 to 8, characterized in that the central safety circuit (10) comprises an autonomous crypto module (17) designed to perform an authentication test on the recognized trigger-relevant information redundantly with respect to the main processor (µC).

10. Control unit (ECU) according to one of Claims 1 to 9, characterized in that the central safety circuit (10) comprises an internal power supply (18) designed to generate at least one internal supply voltage (V1, V2, V3) for the central safety circuit (10) from a reverse-polarity protected supply voltage (VBAT) and / or from an energy reserve (VER) buffered supply voltage (VAS).

11. Control unit (ECU) according to one of Claims 1 to 10, characterized in that the central safety circuit (10) comprises a sensor data filter module (19) designed to filter the sensor-data based trigger-relevant information according to predetermined key data.

12. Control unit (ECU) according to one of Claims 1 to 11, characterized in that the central safety circuit (10) comprises a control circuit (15) designed to activate a central safety semiconductor switch (SH) in order to match a trigger voltage (VFIRE) for the at least one trigger element (5) to requirements of the at least one trigger element (5) in linear or cyclic fashion.

13. Control unit (ECU) according to one of Claims 1 to 12, characterized in that the central safety circuit (10) comprises at least one readable parallel interface (11) designed to output the at least one enable signal.

14. Control unit (ECU) according to one of Claims 1 to 13, characterized in that the central safety circuit (10) comprises at least one analogue interface (21) designed to receive or output at least one analogue signal.