Device for the control of an active element of an occupant retention system in a vehicle

The invention relates to a device for controlling an active element of an occupant restraint system of a vehicle.

The closest prior art, <patcit id="pcit0001" dnum="US5182459A"><text>US 5,182,459</text></patcit> Discloses a control system for a vehicle safety device. It comprises two acceleration sensor circuits, an analog collision detection system, a digital collision detection system, and a threshold voltage generating circuit. An ignition path comprises an energizing reservoir and first to third transistors and an ignition pad.

The digital collision detection system comprises a microcomputer adapted to integrate and compare the difference between each of the output signals of the acceleration sensor circuits and a reference voltage with a threshold value. When both the integral values ​​exceed the threshold value, a low-level signal is output to the input of the third transistor, and even-level signals are output to drive the first and second transistors. If the integral value is not within a permissible range, the microcontroller prevents the collision detection signal from being output to the third transistor.

Occupant restraint systems of the prior art have a mechanical safing sensor installed in the central control unit of the occupant restraint system. The mechanical safing sensors, which are usually arranged in the control unit (ECU) of the restraint system, are difficult to test, slow and relatively expensive.

A safing concept with a safing function in the restraint system means that an unwanted triggering of the occupant restraint system is prevented in the event of a malfunction of the impact detection unit which has the sensors and the control device of the occupant restraint system. This has so far only been realized for the detection of a frontal impact or a side impact with subsequent activation of the front airbags or the side airbags. For the recognition of a roll-over with subsequent triggering of side airbags, curtains, etc., there is as yet no reliable safing concept.

The object of the invention is to provide an occupant restraint system with a cost-effective and safe safing concept.

The object of the invention is achieved by the features of the independent patent claim 1.

The advantage of the invention is that it is possible to save a safing sensor. For this purpose, the detection of a frontal impact is displaced by means of a safing sensor into the early crash satellite or sensor, which is preferably integrated in the front part of the vehicle, for example in the bumper and / or in the front engine compartment.

For the safing function in the detection of a side impact, the acceleration sensor is simultaneously used as a safing sensor in the Y direction, ie in the direction of the wheel axes transversely to the vehicle direction.

For the safing function in the detection of a roll-over state, at least one of the acceleration sensors which act in the y direction and in the z direction is simultaneously used as a safing sensor.

In a further embodiment, a plurality of involved sensors are present, which at the same time fulfill the function of safing sensors.

In order to evaluate the sensor signals, a control unit (ECU) with subsequent, multi-stage safety switches, for example consisting of a preamplifier with two transistors and a downstream safety transistor, is used for implementing a safing concept.

A safety switch is additionally provided in the ignition path, in which the ignition element, the energy store and the ignition switches are included. The ignition element can only be ignited if both the ignition switch (s) and the safety switch (s) are switched simultaneously. The safety transistor in the ignition path is controlled by a pre-amplifier which only turns the safety switch off when there is a sufficiently high acceleration.

The precursor consists of two switches, each receiving control signals from the control unit and only switching through when an impact is detected. The pre-stage switches are connected to each other in such a way that both input signals of the pre-stage switches detect tripping. In the event of a malfunction of the impact detection unit, one of the two input signals of the pre-stage switches is not activated so that the safety switch is not switched through and ignition of the ignition element can not take place. Thus, accidental ignition is prevented.

It can by the use of the pre-switch of the early crash satellite or roll-over sensor, simultaneously the Safing function take over.

The pre-stage switches are preferably designed discreetly, but they can also be embodied integrally. The safety switch is usually designed discretely.

A short circuit between the two inputs of the pre-stage switches results in a potential at the inputs which is close to the supply voltage or the ground and thus blocks at least one of the two pre-stage switches. This ensures that, in the event of a short circuit, the safety switch is interlocked between the inputs of the pre-stage switches. Likewise, interference to both inputs of the switches does not lead to a switching-on of the safety transistor.

The evaluation of the sensor signals and the activation of the ignition path or the ignition paths and the pre-stage switches is carried out by a control unit. The sensor signals are evaluated in the control unit by an evaluation unit which meets the algorithm for the ignition decision. Furthermore, a sensor signal is fed to a holding circuit which has different holding times depending on the function of frontal impact detection, side impact detection or roll-over detection. If the evaluation unit judges the ignition element to be ignited, the ignition transistors are switched through by means of a fire routine. Furthermore, the ignition decision is logically linked to the output of the holding element and the pre-stage switches. Only when the impact detection unit, which contains, for example, the sensors and the airbag control unit, as well as the safing function, can detect an impact, the squib can be ignited.

Advantageous embodiments and further developments of the invention are set out in the dependent claims.

The invention is described with reference to the drawing with the accompanying drawings, in which: FIG <figref idrefs="f0001">FIGS</figref>,<figref idrefs="f0002">2</figref> and <figref idrefs="f0003">3</figref> Is explained.

Show it:<dl id="dl0001" compact="compact"><dt>FIG</dt><dd>A drive circuit having a first safing concept,</dd><dt>FIG</dt><dd>A drive circuit with a second safing concept, but not part of the invention, serves to explain a further embodiment of the invention shown in FIG <figref idrefs="f0001">FIG</figref> rectified circuit</dd><dt>FIG</dt><dd>A further drive circuit</dd></dl>

Elements having the same function and the same structure are identified by the same reference numerals in the <figref idrefs="f0001">FIGS</figref>, <figref idrefs="f0002">2</figref> and <figref idrefs="f0003">3</figref> Respectively.

<figref idrefs="f0001">FIG</figref> Shows a control arrangement for an active element, for example as ignition elements Z1, Z2, in which a control device 1 controls ignition paths with an active element as a function of sensor signals. Further, control unit 1 controls precursors R1, T12, T13 and R2, T22, T23, thereby ensuring that the active element Z1, Z2 can be activated only when both the impact detection unit and the safing- Function has detected a sufficiently high acceleration.

<figref idrefs="f0001">FIG</figref> Shows several sensors S1 to S5, the sensor signals of which are fed to the control device 1. The sensor S1 is designed as an early crash satellite and is arranged in the front region of the vehicle, preferably in the region of the bumper. As a result, a frontal impact is detected particularly early. The early crash satellite has an acceleration sensor which preferably detects movements in the direction of travel, ie in the X direction.

The sensor S2 is an acceleration sensor which detects movements in the X-direction, ie movements in the vehicle direction.

The sensor S3 is an acceleration sensor which detects movements or accelerations in the Z-direction, ie, movements of the vehicle in the vertical direction. Thus, in particular, roll-over situations are detected in conjunction with the rotary data sensor S5.

The sensor S4 is an acceleration sensor which detects movements of the vehicle in the Y direction, ie, movements transversely to the direction of travel of the vehicle. Thus, in particular, side impact situations are detected.

The sensor S5 is designed as a rotational speed sensor which detects an angular velocity and, derived therefrom, an angular acceleration about the longitudinal axis of the vehicle, ie in the X direction. Thereby roll-over states are detected, in particular in cooperation with the sensor S3 for the Z-direction.

In the control device 1, a first and a second evaluation unit 25, 35 are provided which evaluate the sensor signals and, according to predetermined algorithms, issue an ignition decision for the different ignition paths VCC, C1, T11, T15, Z1, T16 and VCC, Z2, T26. The active elements Z1, Z2 contained in the various ignition paths are, for example, ignition elements (squib) of front airbags, ignition elements of belt tensioners, ignition elements of side airbags, airbag curtains and other conceivable retractors of further restraint means.

The first evaluation unit 25 receives the sensor signals of the early-crash satellite S1 and of the acceleration sensor S2 in the X-direction. Depending on the time course of the sensor signals, a fire decision is made by means of an algorithm. This fire decision is passed on to a holding member 22 and a first activating unit 26, both of which are arranged in the control device 1.

The first activating unit 26 converts the fire decision and activates the two ignition switches T15, T16, which are connected downstream thereof, which are part of the first ignition path.

The switch below<ul><li>pre-stage switch,</li><li>Safety switch,</li><li>Ignition switch,</li></ul>Can be any controllable switches. Preferably, they are formed as bipolar transistors, field effect transistors, MOSFETs, or the like.

The control device 1 also contains a holding unit which preferably holds a change in the signal of the early-crash satellite S1 for a predetermined time duration. This time period is preferably about 100 ms. The holding unit has the reference sign 21. The output of the holding unit 21 is connected via an inverter 23 to the input B12 of the pre-stage switch T12 of a preliminary stage R1, T12, T13. Furthermore, the output of the first holding unit 21 is connected to the input of an AND element 24, the second input of which is connected to the second holding element 22. The output of the AND gate is connected to the input B13 of the pre-stage switch T13 of the pre-amplifier R1, T12, T13.

The subassemblies, eg the evaluation units 25, 35, the holding units 21, 22, 31, 32, 33, etc., arranged in the control unit 1, denote functional subunits which can be depicted in hardware and / or implemented by software processes in the control unit 1 .

The pre-amplifier R1, T12, T13 has two pre-stage switches T12, T13, the switching-through branches of which are connected in series. One end of the branch branch of the second pre-stage switch T13 is connected to the ground and the other end to the one branch branch of the sub-stage transistor T12. The other end of the bypass branch of the substage transistor T12 is connected to the supply voltage VCC via a resistor R1. The node between the resistor R1 and the first pre-stage switch T12 is connected to the input B11 of the first safety transistor T11, which is part of the first firing path C1, T11, T15, Z1, T16. The first ignition path is formed as a series circuit of the first energy storage device, the switching branch of the first safety switch T11, the switching branch of the first ignition switch T15, the active element Z1 and the switching branch of the second ignition switch T16. The first energy storage device C1 has a predetermined energy which is sufficient to ignite the active element, preferably an ignition element of a restraining means. In this case, multiple ignitions of one active element or several active elements Z1 can be triggered as a function of the fire routine of the first activating unit 26. The circuit necessary for charging the first energy storage device C1 is not shown for simplifying the illustration.

The ignition switches T15, T16 and the safety switch T11 are preferably arranged on an ASIC module. The pre-stage transistors T12 and T13 are preferably designed discretely in order to increase the intrinsic safety of the system.

The series connection of the two ignition switches T15, T16 and the first safety switch T11 ensures that the active element Z1 only switches through when all three switches T11, T15, T16 are connected through (convolution).

The intrinsic safety of the system is additionally increased by activating the safety switch T11 from the precursor R1, T12, T13. For example, if the first safety transistor T11 is a p-channel MOS FET transistor, then it only switches through when both the pre-stage switches T12 and T13 are conductive. If only one of the pre-stage transistors T12, T13 is not switched through, the potential of the input B11 of the first safety transistor T11 will assume the potential of the supply voltage VCC via the resistor R1, thus blocking the first safety transistor.

This provides additional redundancy in the system to increase safety with regard to accidental ignition.

The first and second pre-stage transistors T12, T13 are designed, for example, as a pnp or npn transistor.

If, for example, a short circuit occurs between the inputs and B12 and B13 of the pre-stage switches T12, T13, the outputs of the control unit 1 are designed in such a way that the potential is either in the vicinity of the ground GND or the supply voltage VCC so that at least one of the two Pre-stage switches T12, T13 and thus the first safety switch T11 is blocked.

If both acceleration sensors S1, S2 function, then all switches T12, T13, T11, T15 and T16 are blocked in the non-tripping condition, so that the active element Z1 is not triggered.

If a front-impact occurs in the case of operating sensors S1, S2, the early-crash satellite S1 of the control unit 1 reports slightly earlier than the acceleration sensor in the X-direction S2, the impact since the early-crash satellite S1 is in the front part The vehicle or the rear impact detection in the rear part of the vehicle. The temporal offset of the sensor signals is, for example, 50 ms. The first evaluation unit 25 detects an impact and activates the fire flag in the second holding unit 22 and activates the ignition routine in the first activating unit, whereby the two ignition switches T15 and T16 are switched through. The Early-Crash-Satellite S1 serves at the same time as a safing sensor, which is at the input of the impact detection unit responsible for the safing function.

In the event of a faulty sensor, a faulty evaluation unit 25, a faulty activation unit 26 or a faulty ignition switch T1, T15, the active element Z1 is prevented from being triggered.

In the case of a front impact with the early-crash satellite S1 functioning, the sensor signal is passed to a holding unit 21 which gives an activation signal for a predetermined duration at its output. For the predefined time duration (100 ms), the pre-stage transistor T12 is controlled via the inverter 23 and switched through. The second pre-stage switch T13 is also switched through when the activation signals of the first holding unit 21 and of the second holding unit 22 give an enable signal via the AND gate 24, which in the present case is HIGH level.

The two holding units 21, 22 are preferably edge-controlled, that is to say only with a predefined and defined change in the respective input signals is an activation signal output for a predetermined duration. In a further embodiment, the holding unit 21, 22 is triggered as soon as a respective predetermined threshold is exceeded. If, for example, a defect occurs in the early crash sensor, then the output of the holding unit 21 is activated for a predetermined period of time immediately after the system is switched on. After this time the output is deactivated (not ENABLE). Since the second holding unit 22 has a deactivated output (not enable) during this time period, the second pre-stage transistor T13 is not switched through. Although the first pre-stage transistor T12 has been activated for a predetermined period of time, in this case by a low-level signal, the first safety switch T11 remains blocked.

The defective early-crash satellite S1 does not change its state in an impact in such a way that the first holding unit 21 is activated at its output. If now the acceleration sensor S2 detects the impact in the X direction in conjunction with the first evaluation unit 25, the two ignition switches T15 and T16 are activated via the fire routine in the first activation unit 26. On the other hand, the pre-stage switches T12, T13 are blocked since the first holding unit 21 is not active at its output. Thus, the first safety switch T11 blocks, whereby no current can flow through the first ignition path and the active element Z1 is not triggered.

The pre-stage switches T12 and T13 only switch both when the activation signals at the outputs of the first and second holding units 21, 22 are active in a predetermined time window. The time window in the exemplary embodiment is about 50 ms.

If the acceleration sensor S2 is partially defective in the X direction and / or the fire decision in the first evaluation unit 25 is incorrect, the two ignition switches T15 and T16 are possibly activated via the fire routine. However, it is unlikely that the fire decision of the first evaluation unit 25 occurs in a timed manner in the predetermined time window in order to switch through both the pre-stage switches T12, T13. The holding element 21 is not activated here, so that the transistor T11 is not closed and thus the ignition element Z1 is not triggered.

This results in a control arrangement for frontal crash detection with high intrinsic safety.

In the lower part of the <figref idrefs="f0001">FIG</figref> A second ignition path C2, T21, T25, Z2, T26 and a second precursor R2, T22, T23 are shown which correspond in their construction and function to the first ignition path and the first precursor.

Furthermore, a second evaluation unit 35 is arranged in the control unit to which the sensor signals of the sensors S3, S4, S5 are supplied. The second evaluation unit 35 includes an algorithm which makes a fire decision for the active element Z2 as a function of the input signals of the sensors. The fire decision is passed to a second activating unit 36 ​​and a fifth holding unit 33, which has a holding time of preferably about 1 second. The second activating unit 36 ​​prepares the fire decision and relays corresponding signals to the ignition switch T25, T26. The acceleration sensors S3 and S4 detecting in the z- and y-directions act on a third holding unit 31, which preferably has a duration duration of about 1 second.

The sensor signals of the acceleration sensor S4 are also supplied to a fourth holding unit 32, which is arranged in the control unit 1 and preferably has a duration of 100 ms.

The combination of the three sensors S3, S4, S5 enable the second evaluation unit 35 to recognize a side impact and a roll-over as a function of the sensor signals, and corresponding ignition elements, for example, the side airbag, Over curtains or other restraint systems.

In principle, the safing concept functions like the concept already explained for the recognition of a frontal impact with subsequent activation of the front airbags. The three sensors S3, S4, S5 simultaneously operate as safing sensors. To activate the ignition element Z2, both the elements preceding the holding elements 31 and 32 must detect a sufficiently high acceleration, as well as the algorithm in the evaluation unit 35 to detect an impact or roll-over. The output signals of the third and fourth holding units 31, 32 are linked to one another via an OR element 39. The output signal of the OR gate 39 is supplied via an inverter 37 to the third pre-stage switch 22 of the preceding stage and an AND circuit 38 which receives the fire flag of the fifth holding unit 33 as the second output. The output of the AND gate 38 is supplied to the fourth pre-stage switch T23.

By reversing the two pre-stage switches T22, T23, a time window of about 1 second is generated during a roll-over event, which is specified by the two evaluation units 31 and 33.

In the event of a side impact, only the sensor S4 is activated in the y direction, so that in this case the time window for switching the two pre-stage switches T22, T23 and the subsequent switching of the second safety switch T21 from the holding units 32 and 33 is predetermined .

The acceleration sensor S4 in the y-direction outputs two different signals, which serve on the one hand for the detection of a roll-over state and on the other hand for the detection of a side impact. Correspondingly, the two different sensor signals are fed to the two holding units 31 and 32.

<figref idrefs="f0002">FIG</figref> Shows a circuit arrangement for recognizing crash situations and for triggering ignition elements, which essentially extend to the circuit arrangement <figref idrefs="f0001">FIG</figref> Respectively.

In contrast to the circuit arrangement too <figref idrefs="f0001">FIG</figref> is in <figref idrefs="f0002">FIG</figref> The control unit 1 <figref idrefs="f0001">FIG</figref> Divided into two sub-units, the main control unit 2 and the safety control unit 3.

This subdivision, which is also hardware-related, increases the intrinsic safety of the system. The evaluation units 25, 35 and the activating units 26, 36 are contained in the main control unit 2. The safety control unit 3 contains all safety functions which are used to drive the precursors R1, T12, T13 and R2, T22, T23. The different holding units 21, 31, 32 and corresponding linking elements (OR, AND elements and inverters) are thus contained in the safety control unit 3. It would also be conceivable to remove the holding units 22, 33<figref idrefs="f0001">FIG</figref> In the safety control unit 3 and provide corresponding connections between the main control unit 2 and the safety control unit 3. The sensor signals of the acceleration or rotation speed sensors S1 to S5 are respectively fed into the corresponding function blocks of the main control unit 2 and the safety control unit 3.

By dividing the control unit 1 into a main control unit 2 and a safety control unit 3, a structure is created by which a faulty operation from a hardware unit or software unit leads to a non-triggering of the corresponding active units Z2, Z1.

In a further embodiment, the resistors R1 and R2 of the two precursors are not connected to the supply voltage Vcc, as shown in FIGS <figref idrefs="f0001">FIGS</figref> and <figref idrefs="f0002">2</figref> , But are respectively connected to the first and second energy storage devices C1, C2, which each have an ignition potential. This ensures that the safety transistor T11 or T21, which is in the form of a p-channel or pnp, reliably blocks, independently of the potential difference between the supply voltage Vcc and the ignition potential of the energy storage device C1 or C2, with corresponding control by the corresponding preliminary stage.

In <figref idrefs="f0003">FIG</figref> A drive circuit is shown which extends from <figref idrefs="f0001">FIG</figref> In that the circuit in the region of the precursors R1, T12, T13 and R2, T22, T23 are designed differently. On the basis of the upper precursor R1, T12, T13, the change is shown by way of example.

The output of the inverter 23 is connected to a further inverter 54 via an output pin of the control unit 1. The output of the further inverter 54 is connected to the control input (base / gate) of a pre-stage switch T52. The output of the AND element 24 is connected to the control input (base / gate) of a further pre-stage switch T53 via an output pin of the control unit 1. The intermediate branch of the pre-stage switch T52 is connected on the emitter side or on the source side to the potential of the ignition capacitor C1 and on the collector side or on the drain side to the control input of the safety transistor T11 and an end of the resistor R5.

The through branch of the pre-stage switch T53 is connected on the emitter side or on the source side to the ground GND and on the collector side or on the drain side to the other end of the resistor R5.

The safety switch T11 switches only when the pre-stage switch T52 is high-impedance, ie its bypass branch is blocked, and the pre-stage switch T53 is switched through. For this purpose, the inputs of the pre-stage switches T52 and T53 must be set to HIGH and thus the output pins of the inverter 23 and the AND element 24 must be set to LOW or HIGH. The control input of the safety switch T11 is then pulled against ground, as a result of which the safety switch T11, which is designed as a p-channel MOSFET transistor, passes through.

All other three possible state combinations at the input of the two pre-stage switches T52, T53 lead to the blocking of the safety transistor T11. Thus, in the event of a short-circuit between the two output pins mentioned or an in-phase disturbance influence on the two output pins, the safety transistor T11 is always blocked.

In a further embodiment, the precursors according to <figref idrefs="f0002">FIG</figref> By which in the <figref idrefs="f0003">FIG</figref> shown <figref idrefs="f0002">FIG</figref> replaceable.