Control device for personnel protection systems

Abstract

The present invention relates to a control device (ECU) for a personnel protection system (1), comprising as components thereof at least one main processor (μC) adapted to generate and output at least one actuation signal for at least one actuation member (5) of a personnel protection means (PS) of said personnel protection system (1), in response to actuation-related information; a central safety circuit (10) comprising a sub-processor (CPU) adapted to generate and output at least one release signal (DIS) for said at least one actuation member (5) of said personnel protection means (PS) in response to said actuation-related information; an integrated main system circuit (SBC) adapted to generate and output at least one drive control signal for actuating said at least one actuation member (5) of said personnel protection means (PS) in response to said at least one actuation signal and said at least one release signal (DIS); and at least one control device data bus (DCB) for communicating said main processor (μC) with other components of said control device (ECU). and a control unit (ECU) including at least one external bus interface (12) through which the main processor (μC) communicates with at least one external vehicle data bus (3), and at least one internal bus interface (14) connected to the at least one control unit data bus (SPI1), the operation-related information being transmittable via the at least one control unit data bus (SPI1) and / or the at least one external vehicle data bus (3), the at least one external bus interface (12) and the at least one internal bus interface (14) being configured to read data communicated via the at least one external vehicle data bus (3) or the at least one control unit data bus (SPI1), recognize the operation-related information, and transmit the operation-related information to the sub-processor (CPU) for evaluation.

Description

[Technical field]

[0001] The present invention relates to a control device for a personal protection system. [Background technology]

[0002] From the prior art, personal protection systems configured as airbag systems are known, which comprise a control device connected to a vehicle data bus, e.g. a CAN (Controller Area Network) data bus, a FlexRay data bus, etc. The connection to the vehicle data bus is made for diagnostic purposes, for optimising the behaviour and for transmitting sensor data from the airbag system to other vehicle systems, e.g. an ESP (Electronic Stability Program) system and / or an ABS (Antilock Brake System) system. The transmission of general data, such as date, time, temperature, speed, load, usage statistics, battery management, rain sensor, ESP / ABS interventions, to the control device of the airbag system is made for optimisation and recording purposes, but does not directly influence the actuation decision. The control device has non-volatile memory means, even in the event of a dead battery, so that in the event of a crash or other defined situation (near crash), in addition to the restraint system-specific data, also data from other vehicle systems, which contribute to the state and operation of the vehicle before, during and after the crash, are transmitted to the airbag system control device and stored. Furthermore, control devices for personnel protection systems are also known which, in addition to the main processor, use additional processors of lower performance for safety and / or authentication tasks for reasons of redundancy and diversity.

[0003] From DE 10 2007 012 463 A1 a control device and a method for controlling a personal protection means are known, whereby the personal protection means are controlled by a processor as a function of at least one sensor signal. Furthermore, a safety controller is provided, which releases the control as a function of the at least one sensor signal. A module reformats and supplies a bus signal originating from outside the control device with the at least one sensor signal to the safety controller. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] DE 102007012463 A1 Summary of the Invention [Means for solving the problem]

[0005] A control device for a personnel protection system having the features of independent claim 1 has the advantage that for the growing market of vehicles with driver assistance systems an optimized concept for a more powerful personnel protection system is provided, which can take into account not only driver assistance systems, e.g. by video, radar, LiDAR evaluation, etc., but also activation-relevant information of other systems, e.g. ESP and / or ABS systems, when deciding to activate personnel protection measures, e.g. airbags, belt tensioners, etc. Furthermore, embodiments of the control device can also perform other safety tasks, e.g. separation of high-voltage inductors for e-mobility up to 800 V.

[0006] In an embodiment of the control device, the central integrated safety circuit with the sub-processor can recognize more complex activation-related information of the read data by reading the data transmitted on the different vehicle data buses (LIN (Local Interconnect Network), CAN, CAN-FD (CAN with Flexible Data Rate), FLexRay, Ethernet, Bluetooth, etc.) and provide corresponding algorithms for evaluating the activation-related information. Based on the evaluation of the activation-related information, the central safety circuit can release full or partial access to the personnel protection means or group of personnel protection means so that the main processor can activate the released personnel protection means at the correct activation time. Also, during the start-up phase when the personnel protection system is not activated, the interaction of the main processor and the sub-processor of the central safety circuit can completely avoid the use of flash memories. The sub-processor of the central integrated safety circuit can perform safety-related plausibility checks on the data that the control device wants to be provided by the main processor on the corresponding vehicle data bus. Furthermore, by modifying the software, the safety concept of the personnel protection system can be easily adapted to future requirements.

[0007] An embodiment of the present invention provides a control device for a personnel protection system, the control device for the personnel protection system including as components at least one main processor configured to generate and output at least one activation signal for at least one operating member of a personnel protection means of the personnel protection system in response to activation-related information, a central safety circuit with a sub-processor configured to generate and output at least one release signal for at least one operating member of the personnel protection means in response to activation-related information, an integrated main system circuit configured to generate and output at least one drive control signal for activating at least one operating member of the personnel protection means in response to the at least one activation signal and the at least one release signal, and at least one control device data bus through which the main processor communicates with other components of the control device. The central safety circuit includes at least one external bus interface through which the main processor communicates with at least one external vehicle data bus, and at least one internal bus interface connected to the at least one control device data bus. The operation-related information is transmittable via at least one control device data bus and / or at least one external vehicle data bus, and the at least one external bus interface and the at least one internal bus interface are each configured to read data communicated via the at least one external vehicle data bus or the at least one control device data bus, recognize the operation-related information, and transmit the operation-related information to a sub-processor for evaluation.

[0008] In an embodiment of the control device according to the invention, the central integrated safety circuit, which includes at least one external bus interface for recognizing operation-relevant information in data from at least one vehicle bus system, can be adapted and adjusted according to requirements without taking into account the operation architecture for the personnel protection means in the integrated main system circuit. Additional sub-processors in the central safety circuit allow the evaluation of complex and different vehicle bus data. Similarly, complex safety algorithms for central sensors arranged in the control device and for peripheral sensors connected to the control device via the peripheral sensor interface can also be displayed via the software.

[0009] The protection measures considered are, for example, internal passenger protection measures such as airbags, belt tensioners, crash-resistant head restraints, and external pedestrian protection measures such as usable seat components such as side bolsters, roll bars, airbags, crash-resistant bonnets, etc. However, active protection measures such as, for example, braking interventions or driving dynamics control interventions are also considered. The term actuation control is used in the following to mean the activation of these protection measures. In the case of protection measures with pyrotechnic actuating elements, such as airbags, this means that a corresponding pyrotechnic charge is ignited by the passage of current. In the case of protection measures with electromagnetic actuating elements, such as, for example, roll bars, an electromagnetic device is activated by an activation current.

[0010] The operation-relevant information may be detected physical variables detected by various sensors such as acceleration sensors, air pressure sensors, structure-borne noise sensors, environmental sensors, or detected physical variables provided by other vehicle systems, such as the driving dynamics control system, the brake system, etc. Furthermore, variables derived from the detected physical variables are also possible, for example filtered acceleration signals or integrated acceleration signals may be evaluated as operation-relevant information.

[0011] The central safety circuit is understood below to be an integrated circuit module which comprises a sub-processor, at least one external bus interface, at least one internal bus interface and other components. The integrated main system circuit is understood below to be a so-called system-specific circuit module which, in addition to other components, comprises in particular various driver circuits for activating the personnel protection measures.

[0012] The measures and improvements recited in the dependent claims make it possible to advantageously improve the control device for a personal protection system as recited in the independent claim 1. It is particularly advantageous if the integrated main system circuit is further configured to generate at least one internal system voltage of the control device, which can provide, for example, a buffered supply voltage from an energy reserve and further supply voltages for the main processor, the central safety circuit and other components of the control device.

[0013] In an advantageous embodiment of the control device, at least one integrated system circuit is provided as a further component of the control device and can be connected to the at least one control device data bus. Here, the at least one integrated system circuit can be configured to generate and output at least one further drive control signal for activating at least one further actuating member of the personnel protection means in response to the at least one activation signal and the at least one release signal. Similar to the integrated main system circuit, the at least one integrated system circuit can be configured as a system specific circuit module including various driver circuits for activating the further personnel protection means. Unlike the integrated main system circuit, the at least one integrated system circuit does not generate an internal system voltage for the control device. By using the integrated main system circuit and the further integrated system circuits, different groups of personnel protection means can be easily formed and activated in response to different activation related information. Furthermore, the integrated main system circuit and / or the at least one integrated system circuit may each include at least one peripheral sensor interface configured to receive and process sensor signals from at least one peripheral sensor. Here, the integrated main system circuit and / or the at least one integrated system circuit provide the processed sensor signal via the internal system data bus.

[0014] In another advantageous embodiment of the control device, the central safety circuit can include a flash-free memory device with at least one memory unit, which is configured to store an internal self-test program and / or a boot loader program and / or a program code received from the main processor at system startup and provide a working memory for at least one sub-processor. The first memory unit can be configured, for example, as a volatile working memory, and the second memory unit can be configured, for example, as a volatile program data memory. The third memory unit can be configured, for example, as a volatile program code memory. Here, the program code can be securely transmitted first from the main processor to the central safety circuit via at least one control device data bus. The transmitted program code is first checked for correctness of content by means of an integrated self-test and is locked against changes during operation. Optionally, a cyclical check of the program code is also possible. The program data can also be securely transmitted first from the main processor to the central safety circuit via at least one control device data bus. Similarly, the transmitted program data can also be first checked for correctness of content by means of an integrated self-test and is locked against changes during operation. Optionally, a cyclical check of the program data is also possible. Furthermore, a "boot loader" programmed as an embedded mask may be stored in a further non-volatile memory unit, which after being activated by the main processor, processes the transfer of program code and program data to the memory device of the central safety circuit.

[0015] In another advantageous embodiment of the control device, the at least one external bus interface may include a transceiver and a first read function. The transceiver may be configured to receive external data from at least one external vehicle data bus and forward it to the main processor and to receive internal data from the main processor and forward it to the at least one external vehicle data bus. The read function may be configured to read the external data and the internal data, recognize the operation-related information and forward it to the sub-processor. By integrating the at least one external bus interface with the transceiver in the central safety circuit, an external bus interface module in the control device may be omitted. If the vehicle has several different data buses for transmitting operation-related information, several external bus interfaces may be integrated in the central safety circuit. In addition, the central safety circuit may include a switch-off function configured to switch off the transceiver in the event of a defined bus error. This advantageously prevents the output of corrupted or erroneous data from the control device to the corresponding vehicle data bus.

[0016] In a further advantageous embodiment of the control device, the at least one external vehicle data bus can be a wired data bus, in particular a CAN data bus, a FlexRay data bus, a LIN data bus, an Ethernet data bus, or a wireless data bus, in particular a Bluetooth data bus. Corresponding physical transceivers for a direct connection to the respective vehicle data bus system can be integrated into the central safety circuit.

[0017] In another advantageous embodiment of the control device, the at least one internal bus interface can include a second reading function configured to read data on the at least one control device data bus, recognize operation-relevant information and transfer it to the sub-processor, so that the central safety circuit can read operation-relevant information contained in the sensor data of the peripheral sensors or the sensor data of a central sensor arranged in the control device and transmit it to the main processor via the at least one control device data bus.

[0018] In another advantageous embodiment of the control device, the central safety circuit can include a self-encrypting module configured to perform an authentication check of the recognized operation-related information redundantly with respect to the main processor, thereby enabling a redundant authenticity check of the recognized operation-related information in the integrated main system circuit, independent of the main processor.

[0019] In another advantageous embodiment of the control device, the central safety circuit may include an internal power supply device that may be configured to generate at least one internal supply voltage for the central safety circuit from a reverse polarity protected supply voltage and / or from a supply voltage buffered from the energy reserve. The internal power supply device may for example include a number of linear regulators each capable of generating and supplying an internal supply voltage to at least one external bus interface and / or at least one internal bus interface and / or a memory device and / or a sub-processor.

[0020] In another advantageous embodiment of the control device, the central safety circuit can include a sensor data filter module that can be configured to filter the operation-related information based on the sensor data according to configurable key data. By using such a sensor data filter module, an adaptation to data filters used in the field of personnel protection systems can be realized with a power-saving clock input to the sub-processor.

[0021] In another advantageous embodiment of the control device, the central safety circuit can include a control circuit, which can be configured to drive the central safety semiconductor switch in order to adapt the operating voltage for the at least one actuating member in a linear or clocked manner to the requirements of the at least one actuating member. Via a fast pulse width modulation interface (PWM interface), the operating voltage can be adapted, for example, before and / or during actuation, in order to reduce losses in the driver circuit of the personnel protection means. This also includes the possibility of installing a new style central fast high current step-down regulator with a short-term load of 40 amperes and a high efficiency of the trigger path. The control circuit can preferably be driven and started by the main processor.

[0022] In another advantageous embodiment of the control device, the central safety circuit can include at least one read-back parallel interface, which can be configured to output at least one release signal. This results in an extensible partial or complete release of the personnel protection means. Release can be effected, for example, by appropriate level setting and / or by transmitting an appropriate safe serial release word and an optional comparison.

[0023] In a further advantageous embodiment of the control device, the central safety circuit can comprise at least one analog interface which is arranged to receive or output at least one analog signal, via which, for example, switching and locking states can be read or warning lamps can be activated.

[0024] Exemplary embodiments of the invention are illustrated in the drawings and explained in detail in the following description, in which the same reference numbers indicate components or elements performing the same or similar functions. [Brief description of the drawings]

[0025] [Figure 1]1 is a schematic block diagram of one embodiment of a control device for a personnel protection system according to the present invention; [Diagram 2] FIG. 2 is a schematic block diagram of a power supply unit for a control device for the personal protection system of the present invention of FIG. 1; [Diagram 3] FIG. 3 is a schematic block diagram of an embodiment of a central integrated safety circuit of a control device for the personnel protection system of the present invention of FIGS. 1 and 2; [Figure 4] FIG. 3 is a schematic block diagram of an embodiment of a central integrated safety circuit of a control device for the personnel protection system of the present invention of FIGS. 1 and 2; [Diagram 5] FIG. 3 is a schematic block diagram of an embodiment of a central integrated safety circuit of a control device for the personnel protection system of the present invention of FIGS. 1 and 2; [Figure 6] FIG. 3 is a schematic block diagram of an embodiment of a central integrated safety circuit of a control device for the personnel protection system of the present invention of FIGS. 1 and 2; [Figure 7] FIG. 3 is a schematic block diagram of an embodiment of a central integrated safety circuit of a control device for the personnel protection system of the present invention of FIGS. 1 and 2; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0026] As can be seen from Figures 1 to 7, the illustrated embodiment of the control device ECU for a personnel protection system 1 according to the present invention comprises as components at least one main processor μC for generating and outputting at least one activation signal for at least one actuating member 5 of the personnel protection means PS of the personnel protection system 1 in response to activation-related information, a central integrated safety circuit 10 with a sub-processor CPU for generating and outputting at least one release signal DIS for at least one actuating member 5 of the personnel protection means PS in response to activation-related information, an integrated main system circuit SBC for generating and outputting at least one drive control signal for actuating the at least one actuating member 5 of the personnel protection means PS in response to the at least one activation signal and the at least one release signal DIS, and at least one control device data bus SPI1 via which the main processor μC communicates with other components of the control device ECU. Here, the central integrated safety circuit 10 includes at least one external bus interface 12 through which the main processor μC communicates with at least one external vehicle data bus 3, and at least one internal bus interface 14 connected to at least one control device data bus SPI1, and operation-related information can be transmitted via the at least one control device data bus SPI1 and / or the at least one external vehicle data bus 3. Furthermore, the at least one external bus interface 12 and the at least one internal bus interface 14 respectively read data communicated via the at least one external vehicle data bus 3 or the at least one control device data bus SPI1, recognize the operation-related information, and additionally transmit the operation-related information to the sub-processor CPU for evaluation.

[0027] As can further be seen from figure 1, at least one integrated system circuit CMP1, CMPn is present as a further component of the control unit ECU and is connected to the at least one control unit data bus SPI1, whereby the at least one integrated system circuit CMP1, CMPn generates and outputs at least one further actuation signal for actuating at least one further actuating member 5 of the personnel protection means PS in response to the at least one actuating signal and the at least one release signal DIS.

[0028] As can be further seen from FIG. 1, the control unit ECU shown in the illustrated embodiment includes, in addition to the integrated main system circuit SBC, n further integrated system circuits, of which a first integrated system circuit CMP1 and an n-th integrated system circuit CMPn are shown by way of example. Here, the integrated main system circuit SBC and the further integrated system circuits CMP1, CMPn are each configured as an application specific integrated circuit module (ASIC: Application Specific Integrated Circuit). In order to activate the associated personal protection means PS, the integrated main system circuit SBC in the illustrated embodiment includes a driver circuit, not described in detail, having an actuating member 5 configured as an ignition member ZE. In order to activate the associated further personal protection means PS, the first integrated system circuit CMP1 in the illustrated embodiment includes a driver circuit, not described in detail, having an actuating member 5 configured as a first ignition member ZE1. The n-th integrated system circuit CMPn in the illustrated embodiment includes a driver circuit, not described in detail, having an actuating member 5 configured as an n-th ignition member ZEn, in order to activate the associated further personal protection means PS. By using the integrated main system circuit SBC and the further integrated system circuits CMP1, CMPn different groups of personnel protection means PS can easily be formed and activated in response to different activation related information.

[0029] Furthermore, the integrated main system circuit SBC and the further integrated system circuits CMP1, CMPn each include at least one peripheral sensor interface 7, which in the illustrated embodiment of the control unit ECU receives and processes sensor signals from at least one peripheral sensor 9. In the illustrated embodiment, the peripheral sensor interface 7 is configured as a PSI5 interface PSI51, PSI5m, PSI511, PSI51k, PSI5n1, PSI5nl, respectively. As can further be seen from Fig. 1, the integrated main system circuit SBC is connected to m sensors 9, of which only two sensors 9 are shown, via m PSI5 interfaces PSI51, PSI5m, of which the first PSI5 interface PSI51 and the m-th PSI5 interface PSI5m are shown. Furthermore, the first integrated system circuit CMP1 is connected to k sensors 9, of which only two sensors 9 are shown, via k PSI5 interfaces PSI511, PSI51k, of which in the illustrated embodiment a first PSI5 interface PSI511 and a k-th PSI5 interface PSI51k are shown. Furthermore, the n-th integrated system circuit CMPn is connected to l sensors 9, of which only two sensors 9 are shown, via l PSI5 interfaces PSI5n1, PSI5lk, of which in the illustrated embodiment a first PSI5 interface PSI5n1 and an l-th PSI5 interface PSI5nl are shown.

[0030] As can be further seen from Fig. 2, the filter block FB receives the on-board power supply voltage UB and supplies a reverse-polarity protected supply voltage VBat, which is applied to the central integrated safety circuit 10, the integrated main system circuit SBC and the further integrated system circuits CMP1, CMPn. Furthermore, the filter block FB supplies the integrated main system circuit SBC with a further supply voltage VZP, from which the integrated main system circuit SBC generates further internal system voltages VS, a bundle of which is exemplarily shown and labelled in Fig. 2. These internal system voltages VS are used, for example, to supply the internal sensors S1, Sn, the main processor μC (core, memory, ADC, interfaces such as SPI) of the control device ECU, to supply interfaces of internal data buses (not shown) of the further integrated system circuits CMP1, CMPn 14 connected to the internal control device data bus SPI1, and also to supply at least one internal bus interface 14 and at least one external bus interface 12 of the central integrated safety circuit 10. Depending on the flexible voltage regulator concept of the central integrated safety circuit 10, the required supply voltages can also be generated within the respective components of the control device ECU. A further supply voltage VZP is also supplied to the external interface 12 of the central safety circuit 10. Furthermore, the filter block FB supplies an auxiliary voltage VH, which supplies the ignition current to the central safety semiconductor SH. Additionally or alternatively, the safety semiconductor SH may be supplied with an energy reserve VER. As can be further seen from FIG. 2, the safety semiconductor SH supplies the integrated main system circuit SBC and the integrated system circuits CMP1, CMPn with an operating voltage VFIRE, which is used by the corresponding driver circuit to activate the actuating member 5. Furthermore, the integrated main system circuit SBC generates a supply voltage VAS, buffered by the energy reserve VER, for the central safety circuit 10 and the integrated system circuits CMP1, CMPn. As can be further seen from FIG. 2, the control device can be woken up by a wake-up function.For this purpose, the level converter 4 converts the external wake-up signal WAKE, represented for example by a level change, into a corresponding voltage level and applies it to the external interface 12 in the central safety circuit 10. The external interface 12 then outputs a corresponding release signal INH to the central integrated safety circuit 10.

[0031] As can be further seen from Fig. 1, the internal control device data bus SPI1 in the illustrated embodiment is configured as an SPI data bus (SPI: Serial Peripheral Interface), and the main processor μC as bus master provides the control device data bus SPI1 for data transmission to the components coupled to the control device data bus SPI1 via corresponding selection signals CX_X (chip select). In the illustrated embodiment, these components connected to the control device data bus SPI1 also include n central sensors S1, Sn, of which a first sensor S1 and an n-th sensor Sn are shown by way of example. The at least one external vehicle data bus 3 is configured as a CAN data bus in the illustrated embodiment. Furthermore, other suitable wired or wireless data buses may be connected to the central safety circuit 10.

[0032] Various embodiments of the central integrated safety circuits 10, 10A, 10B, 10C, 10D, 10E will now be described with reference to Figs. As can be further seen from Figs. 3-7, the central integrated safety circuits 10, 10A, 10B, 10C, 10D, 10E in the illustrated embodiment each include a flash-free memory device 16 with three memory units 16.1, 16.2, 16.3 and two control circuits 16.4, 16.5 for the three memory units 16.1, 16.2, 16.3. The first control circuit controls the first memory unit 16.1, which provides a working memory for the sub-processor CPU. The second control circuit 16.5 controls the second memory unit 16.2, which stores a mask-programmed internal self-test program and a mask-programmed boot loader program. The second control circuit 16.5 also controls the third memory unit 16.3, which stores program data received from the main processor μC at system startup. Furthermore, the central integrated safety circuit 10, 10A, 10B, 10C, 10D, 10E comprises an internal data bus SPI2, also configured as an SPI data bus (SPI: Serial Peripheral Interface), to which the sub-processor CPU and a further set of interfaces 20, including at least one read-back parallel interface 11, at least one analog interface 21 and an internal bus interface 14, are connected. The at least one read-back parallel interface 11 and the at least one analog interface 21 are controlled by a further control circuit 24. Here, the at least one read-back parallel interface is used to output at least one disabling signal DIS. That is to say, in the illustrated example of the central safety circuit 10, there are n read-back parallel interfaces 11 for the n integrated system circuits CMP1 and one read-back parallel interface 11 for the integrated main system circuit SBC.Furthermore, n analog interfaces 21 are provided for receiving analog signals GPIO from or outputting to k analog components AK1, AK2, AKn, of which three analog components AK1, AK2, AKn are shown by way of example in Fig. 1. To be able to establish various data connections, the central integrated safety circuit 10, 10A, 10B, 10C, 10D, 10E has a data coupling field 22, which is connected to the internal data bus SPI2 of the safety circuit 10, 10A, 10B, 10C, 10D, 10E, to the sub-processor CPU, to the memory device 16 and to the external bus interface 12.

[0033] As can be seen from Fig. 3 to Fig. 6, the external bus interface 12 includes a transceiver TR1 which receives external data RxD from at least one external vehicle data bus 3 via the bus lines CANH, CANL and transfers it to the main processor μC and receives internal data TxD from the main processor μC and transfers it to the bus lines CANH, CANL of at least one external vehicle data bus 3, and a first reading function CAN-FD which reads the external data RxD and the internal data TxD, recognizes the operation-related information and transfers it to the sub-processor CPU. In the illustrated embodiment, the vehicle only includes a vehicle data bus 3 configured as a CAN bus. Alternatively, the vehicle data bus 3 may be configured as a FlexRay data bus, or a LIN data bus, or an Ethernet data bus. Of course, additionally or alternatively, a wireless data bus, such as for example a Bluetooth data bus, may also be used. In case of multiple vehicle data buses 3, the central integrated safety circuit 10 has an external bus interface 12 corresponding to at least the vehicle data buses 3, via which interface the operation-related information is transmitted.

[0034] As can be further seen from Figures 3 to 7, the internal bus interface 14 includes a second read function unit SPI_MON, which reads data on at least one control device data bus SPI1, recognizes operation-related information, and transfers it to the sub-processor CPU via the internal data bus SPI2.

[0035] As can be further seen from FIG. 3, the illustrated first embodiment of the central safety circuit 10A includes an internal power supply 18 which generates three internal supply voltages V1, V2, V3 for the central safety circuit 10 from a reverse polarity protected supply voltage VBAT and a supply voltage VAS buffered from an energy reserve VER. Here, the first supply voltage V1 is supplied to the transceiver TR1 as a buffered supply voltage VCC via a first external buffer memory P1. The second internal supply voltage V2 and the third supply voltage are supplied to the interface group and the external bus interface. Furthermore, the third supply voltage V3 is supplied to the sub-processor CPU as a buffered internal supply voltage VCPU via a second buffer memory P2. Additionally, the third supply voltage V3 is supplied to the memory device 16 as a buffered internal supply voltage VMEM via a third buffer memory P3.

[0036] As can be further seen from Fig. 4, the illustrated second embodiment of the central safety circuit 10B includes a self-encryption module 17 which performs an authentication check of the recognized operation-related information redundantly to the main processor μC. As can be further seen from Fig. 4, the encryption module 17 receives the operation-related information from the first reading function CAN-FD and the second reading function SPI_MON. The authenticated operation-related information is then transmitted to the sub-processor CPU via the data binding field 22.

[0037] As can be further seen from Fig. 5, the illustrated third embodiment of the central security circuit 10C includes a sensor data filter module 19 that filters operation-related information based on sensor data according to configurable key data. In a non-illustrated embodiment of the central security circuit 10C with a sensor data filter module 19, the encryption module 7 is not included.

[0038] As can be further seen from Fig. 6, the illustrated fourth embodiment of the central safety circuit 10D includes a switch-off function 13 which switches off the transceiver TR1 in the event of a defined bus error, whereby the switch-off function 13 is authorized and driven by the main processor μC via the control device data bus SPI1 and the internal bus interface 14. The switch-off function 13 can be used independently of the use of the encryption module 17 and / or the sensor data filter module 19.

[0039] As can be further seen from FIG. 7, the illustrated fifth embodiment of the central safety circuit 10E comprises a further control circuit 24 which drives the central safety semiconductor switch SH in order to adapt the operating voltage VFIRE for the at least one actuating member 5 to the requirements of the at least one actuating member 5 in a linear or clocked manner. For this purpose, the further control circuit 24 receives corresponding current measurement signals, such as, for example, the current voltage values ​​of the auxiliary voltage VH and / or the energy reserve VER, and a target signal for the operating voltage to be set, and outputs corresponding control signals to the central safety semiconductor switch SH. Here, the driving control of the central safety semiconductor switch SH can be initiated by the main processor μC via the control device data bus SPI1. The further control circuit 24 of the central safety semiconductor switch SH can be used independently of the use of the encryption module 17 and / or the sensor data filter module 19 and / or the switch-off function 13.

Claims

1. A control unit (ECU) for a personal protection system (1), comprising: at least one main processor (μC) configured to generate and output at least one actuation signal for at least one actuation member (5) of a personnel protection means (PS) of said personnel protection system (1) in response to actuation-related information; a central safety circuit (10) comprising a sub-processor (CPU) adapted to generate and output at least one release signal (DIS) for said at least one actuating member (5) of said personnel protection means (PS) in response to said actuation-related information; an integrated main system circuit (SBC) configured to generate and output at least one drive control signal for actuating said at least one actuating member (5) of said personnel protection means (PS) in response to said at least one actuating signal and said at least one release signal (DIS); at least one control unit data bus (SPI1) through which said main processor (μC) communicates with other components of said control unit (ECU); In the case where said central safety circuit (10) comprising at least one external bus interface (12) through which said main processor (μC) communicates with at least one external vehicle data bus (3) and at least one internal bus interface (14) connected to said at least one control device data bus (SPI1); the operation-related information can be transmitted via the at least one control device data bus (SPI1) and / or via the at least one external vehicle data bus (3); the at least one external bus interface (12) and the at least one internal bus interface (14) are respectively configured to read data communicated via the at least one external vehicle data bus (3) or the at least one control device data bus (SPI1), recognize the operation-related information, and transmit the operation-related information to the sub-processor (CPU) for evaluation. Control unit (ECU).

2. 2. Control unit (ECU) according to claim 1, characterized in that said integrated main system circuit (SBC) is further adapted to generate at least one internal system voltage (VS, VAS) of said control unit (ECU).

3. At least one integrated system circuit (CMP1, CMPn) is provided as a further component of the control unit (ECU), connected to said at least one control device data bus (SPI1); said at least one integrated system circuit (CMP1, CMPn) is adapted to generate and output at least one further actuation control signal for actuating at least one further actuating member (5) of said personnel protection means (PS) in response to said at least one actuation signal and said at least one release signal (DIS); 2. A control device (ECU) according to claim 1.

4. 4. The control device (ECU) according to claim 3, characterized in that the integrated main system circuit (SBC) and / or the at least one integrated system circuit (CMP1, CMPn) each comprise at least one peripheral sensor interface (7) configured to receive and process sensor signals from at least one peripheral sensor (9).

5. The central safety circuit (10) includes a non-flash memory device (16) having at least one memory unit (16.1, 16.2, 16.3), The memory device (16) stores internal self-test programs and / or boot loader programs and / or program codes received from the main processor (μC) at system startup; configured to provide a working memory for said at least one sub-processor (CPU); 2. A control device (ECU) according to claim 1.

6. 2. The control device (ECU) according to claim 1, characterized in that the at least one external bus interface (12) includes a transceiver (TR1) configured to receive external data (RxD) from the at least one external vehicle data bus (3) and transfer it to the main processor (μC) and to receive internal data (TxD) from the main processor (μC) and transfer it to the at least one external vehicle data bus (3), and a first reading function (CAN-FD) configured to read the external data (RxD) and the internal data (TxD), recognize the operation-related information, and transfer it to the sub-processor (CPU).

7. 7. Control unit (ECU) according to claim 6, characterized in that the central safety circuit (10) comprises a switch-off function (13) configured to switch off the transceiver (TR1) in case of a defined bus error.

8. 2. Control unit (ECU) according to claim 1, characterized in that the at least one external vehicle data bus (3) is a wired data bus, in particular a CAN data bus, a FlexRay data bus, a LIN data bus, an Ethernet data bus, or a wireless data bus, in particular a Bluetooth data bus.

9. 2. The control device (ECU) according to claim 1, characterized in that said at least one internal bus interface (14) includes a second read function (SPI_MON) configured to read data on said at least one control device data bus (SPI1), recognize said operation-related information and transfer it to said sub-processor (CPU).

10. 2. The control device (ECU) according to claim 1, characterized in that the central safety circuit (10) includes a self-encryption module (17) configured to perform an authentication check of the recognized operation-related information redundantly with respect to the main processor (μC).

11. 2. Control device (ECU) according to claim 1, characterized in that the central safety circuit (10) comprises an internal power supply device (18) configured to generate at least one internal supply voltage (V1, V2, V3) for the central safety circuit (10) from a reverse polarity protected supply voltage (VBAT) and / or from a supply voltage (VAS) buffered from an energy reserve (VER).

12. 2. The control device (ECU) according to claim 1, characterized in that the central safety circuit (10) comprises a sensor data filter module (19) configured to filter the operation-related information based on sensor data according to configurable key data.

13. 2. Control device (ECU) according to claim 1, characterized in that the central safety circuit (10) comprises a control circuit (15) configured to drive a central safety semiconductor switch (SH) in order to adapt an operating voltage (VFIRE) for the at least one actuating member (5) to the requirements of the at least one actuating member (5) in a linear or clocked manner.

14. 2. Control unit (ECU) according to claim 1, characterized in that said central safety circuit (10) comprises at least one read-back parallel interface (11) adapted to output said at least one release signal.

15. Control unit (ECU) according to claim 1, characterized in that the central safety circuit (10) comprises at least one analog interface (21) arranged to receive or output at least one analog signal.

Images