CONTROL UNIT AND METHOD FOR ACTIVATING A PERSONAL PROTECTION MEANS OF A VEHICLE

Abstract

A control unit for activating a personal protection device of a vehicle. The control unit includes a one-piece compute module, which includes a first area including a permanently wired processing structure and a second area including a programmable processing structure, the compute module being designed to carry out a processing instruction for activating the personal protection device in at least the second area.

Claims

1-13. (canceled)

14. A control unit for activating a personal protection device of a vehicle, the control unit comprising: a one-piece compute module, which includes a first area including a permanently wired processing structure and a second area including a programmable processing structure, the compute module being configured to carry out a processing instruction for activating the personal protection device in at least the second area.

15. The control unit as recited in claim 14, wherein the first and second areas of the compute module are implemented in different areas of a shared semiconductor component.

16. The control unit as recited in claim 14, further comprising: a memory unit, in which the processing instruction is storable, and after a startup of the control unit, is loadable into the second area of the compute module.

17. The control unit as recited in claim 14, further comprising: at least one communication interface configured to transfer data to a unit outside the control unit, the communication interface being contactable from the second area including the programmable processing structure and/or the communication interface not being contactable from the first area of the permanently wired processing structure of the communication interface.

18. The control unit as recited in claim 17, wherein the communication interface is a LIN bus interface, or a CAN bus interface, or a CAN FD bus interface, or a FlexRay bus interface.

19. The control unit as recited in claim 14, further comprising: a clock generator, which is formed or situated outside the compute module.

20. The control unit as recited in claim 19, wherein the clock generator is a quartz oscillator or includes a quartz oscillator.

21. The control unit as recited in claim 14, wherein the compute module is configured to carry out at least a part of the processing instruction in the first area.

22. The control unit as recited in claim 14, wherein the compute module is configured to activate an occupant protection device of the vehicle as the personal protection device, the occupant protection device being an airbag.

23. A method for preparing a startup of control units, the control units being for activating a personal protection device of a vehicle, the control unit including a one-piece compute module, which includes a first area including a permanently wired processing structure and a second area including a programmable processing structure, the compute module being configured to carry out a processing instruction for activating the personal protection device in at least the second area, the method comprising: storing a first processing instruction in a memory unit of a first of the control units and storing a second processing instruction different from the first processing instruction in a memory unit of a second of the control units.

24. A method for activating a personal protection device of a vehicle, the method comprising the following steps: reading out a processing instruction from a memory unit of a control unit, the control unit including a one-piece compute module, which includes a first area including a permanently wired processing structure and a second area including a programmable processing structure, the compute module being configured to carry out a processing instruction for activating the personal protection device in at least the second area; loading the processing instruction into the second area of the compute module; and carrying out the processing instruction in the second area of the compute module to activate the personal protection device of the vehicle.

25. A non-transitory machine-readable memory medium on which is stored a computer program for preparing a startup of control units, the control units being for activating a personal protection device of a vehicle, the control unit including a one-piece compute module, which includes a first area including a permanently wired processing structure and a second area including a programmable processing structure, the compute module being configured to carry out a processing instruction for activating the personal protection device in at least the second area, the computer program, when executed by a computer, causing the computer to perform the following: storing a first processing instruction in a memory unit of a first of the control units and storing a second processing instruction different from the first processing instruction in a memory unit of a second of the control units.

26. A non-transitory machine-readable memory medium on which is stored a computer program for activating a personal protection device of a vehicle, the computer program, when executed by a computer, causing the computer to perform the following steps: reading out a processing instruction from a memory unit of a control unit, the control unit including a one-piece compute module, which includes a first area including a permanently wired processing structure and a second area including a programmable processing structure, the compute module being configured to carry out a processing instruction for activating the personal protection device in at least the second area; loading the processing instruction into the second area of the compute module; and carrying out the processing instruction in the second area of the compute module to activate the personal protection device of the vehicle.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0028] FIG. 1 shows a vehicle including a control unit according to one exemplary embodiment of the present invention.

[0029] FIG. 2 shows a block diagram of an exemplary embodiment of the control unit in accordance with the present invention.

[0030] FIG. 3 shows a flowchart of a method for preparing a startup of control units according to a variant of the present invention.

[0031] FIG. 4 shows a flowchart of a method for activating a personal protection means of a vehicle according to one exemplary embodiment of the present invention.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

[0032] In the following description of advantageous exemplary embodiments of the present approach, identical or similar reference numerals are used for the elements shown in the various figures and that act similarly, a repeated description of these elements being omitted.

[0033] FIG. 1 shows a vehicle 100 including a control unit 105 according to one exemplary embodiment of the approach presented here. Control unit 105 includes a one-piece compute module 110 which is manufactured, for example, as a semiconductor component on a shared substrate. Compute module 110 includes a first area 115 including a permanently wired processing structure and a second area 120 including a programmable processing structure. For example, second area 120 is implemented as a microprocessor core, whereas first area 115 is implemented as an ASIC element or ASIC structure. Furthermore, the control unit includes a memory unit 125, in which, for example, a program and/or a processing instruction 127 is stored for activating a personal protection means 130, for example, an airbag. Program and/or processing instruction 127 may be loaded, for example, after startup of control unit 105 from memory unit 125 into second area 120. For example, first area 115 may be designed as a memory controller, which carries out the readout of the processing instruction from memory unit 125 and carries out or at least supervises the loading of processing instruction 127 into second area 120. Alternatively or additionally, first area 115 may also be designed to carry out complex operations which are required according to one or multiple commands in processing instruction 127 to be able to establish a presence of a triggering criterion for activating a personal protection means 130.

[0034] To trigger personal protection means (i.e., device) 130, which is designed here, for example, in the form of a driver airbag situated in a steering wheel 135, according to those criteria corresponding to processing instruction 127, sensor signals 145 of a vehicle sensor 150 are read in with the aid of a communication interface 140, which may be designed, for example, as a LIN, CAN, CAN FD, and/or FlexRay interface, and loaded, for example, into second area 120 including the programmable processor structure. Sensor signals 145 may be radar signals for this purpose if vehicle sensor 150 is designed as a radar sensor, these sensor signals 145 then representing, for example, the approach, a velocity, a distance, or the like of an external vehicle (not shown in FIG. 1) to vehicle 100.

[0035] In FIG. 1, for the sake of clarity, only signals from a single vehicle sensor 150 are plotted for this purpose, which are evaluated in control unit 105. However, for those skilled in the art it is obvious that sensor signals 145 may also contain data from multiple vehicle sensors, which may also detect different physical parameters, for example.

[0036] In second area 120 of compute module 110, these sensor signals 145 are then processed using processing instruction 127 loaded from memory unit 125 and checked for the presence of certain triggering criteria for personal protection means 130. During such an evaluation, for example, it may occur that complex numeric or algorithmic operations are to be carried out, which may be carried out efficiently and rapidly in a permanently wired processing structure, as is implemented, for example, in first area 115 of compute module 110. For this purpose, for example, a part of sensor signals 145 or intermediate results from the processing of sensor signals 145 may be transferred into first area 115, further processed there, and subsequently the obtained results may be transferred back into second area 120. In this way, the presence of certain triggering criteria in sensor signals 145 may be checked very efficiently. If it is established, for example, in compute module 110 that the triggering criteria for activating personal protection means 130 are met, a corresponding trigger signal 155 may be transferred, for example, from second area 120 via communication interface 140 to personal protection means 130, so that this personal protection means 130 is activated, for example, the airbag unfolds.

[0037] To be able to operate particularly precisely, control unit 105 includes a clock generator 160, which is situated outside compute module 110 and is designed, for example, as a quartz oscillator. Clock generator 160 generates a clock signal 165 here, which is used as the basis of the signal processing in first area 115 and/or second area 120 of compute module 110 or communication interface 140. The use of such an external clock generator 160 outside compute module 110 offers the advantage here that components which are very precise, robust, and have long-term stability such as the quartz oscillator may be used to provide clock signal 165. In this way, it is ensured that the processing of sensor signals 145 in first area 115 and/or second area 120 may be carried out with high precision.

[0038] In a further exemplary embodiment, communication interface 140 and/or memory unit 125 may also be applied or embedded on or in the substrate in which one-piece compute module 110 is also implemented. In this way, in one manufacturing process, not only compute module 110, but also communication interface 140 and/or memory unit 125 may be manufactured, which enables further simplification in the manufacturing of control unit 105.

[0039] In summary, it may be noted that modern airbag systems use system basis chips (SBC), in which, in addition to the complete voltage supply in operation and autonomy with central RESET supervision, further functional blocks such as LIN transceiver; PSI-IF, switch/Hall sensor IF, high/low ignition output stages, safety controller (watchdog, redundant plausibility check of crash signals), and LED high-side/low-side drivers are integrated.

[0040] One goal of the approach presented here is to supplement the SBC as control unit 105 with a μC-core (for example, in the form of second area 120) and suitable communication controllers such as LIN, CAN, CAN FD (ISO 11898-1:2015), and optionally FlexRay (V2.1), for example, in the form of communication interface 140.

[0041] Furthermore, the corresponding transceiver may also be optionally integrated in the SBC, the SBC being able to obtain, in addition to the present SPI monitoring, the monitoring capacity of vehicle buses LIN, CAN, CAN FD, FlexRay (safety architecture). However, only the main airbag/safety control unit μC or processor has read and write access to the corresponding buses, which is implemented, for example, in second area 120 and may be supplied with data with the condition (ASIL>=C) via the corresponding accessible transceiver, which may also optionally be able to assist SLEEP systems.

[0042] The monitoring of the fast communication buses at up to 10 Mb/s may be implemented particularly well by using a quartz-stable integrated oscillator as the time base for SBC 105. The use of a μC-core (microcontroller core) in the form of second area 120 of compute module 110 together with an SBC program such as processing instruction 127, stored in a mask ROM or programmable FLASH including parameterization such as memory unit 125 by the main airbag/safety control units μC or processor in SRAM such as second area 120, enables particularly flexible diagnosis, supervision, and signal processing of personal protection means 130, such as an airbag system here, for example, and of the SBC as control unit 105.

[0043] The flexibility and performance of the SBC or control unit 130 is significantly increased, for example, by μC-core 120, over the presently used HW state machines, as are implemented, for example, in first area 115 including the permanently wired processing structure. The present safety controller of the SBC with restriction to SPI—monitoring of the central sensor data (for example sensor signals 145) or indirectly the PSI sensor and switch/Hall sensor data becomes, for example, due to the monitoring function of the communication interface such as communication interface 140 (buses), the safety controller of all relevant data as sensor signals 145. Data are to be mentioned here, for example, as sensor signals 145 of vehicle sensors 150 of the passenger compartment sensing (IR camera), seat occupancies, etc., and the pre-crash detection (radar). The safety controller is thus, for example, capable of giving access to safety-relevant actuators (ignition circuits, LEA actuators, motor-driven belt tensioners, emergency braking systems, . . . ) as personal protection means 130 even before the crash time (T.sub.0) if the required criteria are met.

[0044] By using an independent quartz-stable SBC time base and not, as before, a relatively inaccurate RC clock, for example, the watchdog function, the redundant SBC crash signal assessment, and/or the switching regulator frequency may be executed significantly more precisely. In particular, for example, the quartz-stable time base of the SBC enables relevant data of fast communication buses 140 (up to 10 Mb/s) such as CAN, CAN FD, FlexRay to be supervised independently.

[0045] Further SBCs or SCCs may also be coupled on synchronously by providing a master SBC (ECLK), without, for example, independent quartz oscillators being required in the slave devices (dependent components).

[0046] This redundant, diverse assessment of communication data, in particular for devices (also sensors) of the interior sensing or the pre-crash detection, expands, for example, the previous SCON functionality of the HW state-based present SBC. The additional DISABLE functionality of the actuators and devices controllable via communication buses takes place in that, for example, the transmit (write) access of the main μC or processor to the communication bus is withdrawn, for example, if the enable criteria of the expanded SCON function of the SBC are not met. This may be carried out, for example, by splitting the activation message into partial messages.

[0047] For example, if the SBC recognizes a first partial message without existing release, for example, the transceiver is blocked (DISABLE) or the transmit line T×D line of the transceiver to the main μC or processor is interrupted by the expanded SCON.

[0048] Instead of the previously used logic state machine, for example, a μC-core ( 16/32) bit is integrated as second area 120, for example, by ARM into the system ASIC. The overall diagnostic software of the ignition circuits including supply voltage and safety semiconductor check, the PSI sensor IF and sensor check, the AIO LED driver (optionally including PWM control) check, the external switch/Hall sensor IF check, the energy reserve check, the communication transceiver check, the voltage supervision of external ECU supply lines, and a large number of SBC internal voltages (external KL30, KL15, VZP internal VUP, VER, VAS, VSYNC, VST50, VST33, VCORE, VREFi, AlNi, AlOi, VHi, Zkpi, Zkmi, PSli) is executed, for example, corresponding to the program code such as processing instruction 127, or stored, for example, in a mask ROM as memory unit 125 or optionally in a programmable FLASH memory as memory unit 125.

[0049] The parameterization may be carried out, for example, by data exchange between main airbag μC and the SBC-SRAM. The time base is formed, for example, by an integrated oscillator circuit including external quartz, to enable the stability and accuracy requirements for connecting fast communication controllers.

[0050] The PLL circuit including frequency divider is used, for example, for synthesizing the required SBC internal frequencies for μC-core, the clocked SBC assemblies, the switching regulator frequencies, the required digital filters, and the output of an SBC-based external clock signal (ECLK), for coupling on (cascading) further SBCs or expansion components (system companion chips (SCC)).

[0051] The timer watchdog is used, for example, for checking the time base of a separate main μC or processor in an airbag/safety control unit. This check may be executed, for example, on the basis of the quartz-accuracy time base of the SBC significantly more accurately (<=1%) than using the present RC oscillators (<15%) in the HW-SBCs.

[0052] The operating software controls, for example, the data exchange with the main airbag μC via the SPI interface, the monitoring SPI (read only), for example, communication interfaces 140 LIN, CAN FD, CAN, optionally FlexRay (read only), the external switches and Hall sensor IF, and, for example, the PSI-IF to external sensors or sensor buses.

[0053] The data exchange via SPI includes, for example, the expanded watchdog functionality to check the foreground and the background tasks of the main ECU μC/processor, the continuous status exchange for system supervision, and the error handling by the main ECU μC.

[0054] The provision of the SBC-detected PSI sensor data, the switch and Hall sensor data via SPI to the main μC is used, for example, for the comprehensive crash/event recognition in its main algorithm.

[0055] The information acquisition via the monitoring SPI is used, for example, for the redundant evaluation of SPI-based data (for example, ECU central sensor system) and, for example, for detecting all sensor data placed by SBCs or SCCs on the SPI.

[0056] The redundant evaluation of SPI-based airbag sensor data and relevant communication interface-based data on the interior situation ((IR) camera) or on the precrash situation (radar), . . . , forms, for example, the new software safety controller of the SBC, which in the normal state blocks the ignition output stages and ignores fire commands of the main μC/processor if the evaluation does not meet certain settable release criteria. These release criteria may be designed very flexibly, for example, in an SBC including μC-core (complete release .Math. partial release) and in addition to crash situations (T.sub.0) also includes releases before (T.sub.0).

[0057] Via status lines (DISABLE line), for example, cascaded SBC or SCC may be coupled to the release decision of the master SBC. In addition to the classical ignition circuits, for example, certain communication-based safety relevant assemblies (reversible belt tensioner, emergency brake devices, . . . ) may also be activated by the safety controller of the SBC as personal protection means 130, for example, only by the main μC processor of the airbag/safety control unit if the monitored communication interface-based messages correspond to the release criteria of the redundant SBC evaluation.

[0058] The protective measure against a finally acting activation of a safety-relevant assembly controlled via a communication interface may also be carried out, for example, by interrupting the (transmit lines) T×D lines from the main μC to transceivers via switchable gates with the aid of suitable DISABLE lines of the SBC. Furthermore, an SBC DISABLE intervention on the transceiver is also possible.

[0059] For this purpose, for example, the activation messages of the main μC/processor may be split into partial steps. If the SBC recognizes, for example, by supervising communication bus 140, activation partial messages to safety-relevant assemblies without a release for this assembly being present in the SBC, for example, blocking of the further required parts of the activation message takes place.

[0060] FIG. 2 shows a block diagram of an exemplary embodiment of control unit 105. Control unit 105 includes here a first area 115, which includes a permanently wired processing structure. First area 115 is designed in the exemplary embodiment shown in FIG. 2, for example, as a memory controller 200, which controls or supervises a readout of processing instruction 127 from a memory unit 125 designed as a SRAM, mask ROM, or FLASH and loads it with the aid of a system bus 210 via a bridge element 215 into second area 120 including the programmable processing structure, which is designed here as a microcontroller core (μC-core). Second area 120 may receive sensor signals 145 via communication interface 140 and process the commands according to processing instruction 127. If sensor signals 145 now correspondingly become triggering criteria, in second area 120 or in μC-core, triggering of personal protection means 130 may be activated with the aid of trigger signal 155 via a trigger circuit 220 of communication interface 140, which is then implemented by a trigger control circuit 225. Furthermore, a clock generator 160 in the form of a quartz oscillator may also be provided, which provides a clock signal 165 for the operation of first area 115, second area 120, memory unit 125, and/or communication interface 140.

[0061] FIG. 3 shows a flowchart of an exemplary embodiment of a method 300 for preparing a startup of control units according to a variant presented here. Method 300 includes a step 310 of storing a first processing instruction in a memory unit of a first of the control units and storing a second processing instruction different from the first processing instruction in a memory unit of a second of the control units.

[0062] FIG. 4 shows a flowchart of an exemplary embodiment of a method 400 for activating a personal protection means of a vehicle, method 400 including a step 410 of reading out a processing instruction from a memory unit of a control unit according to a variant presented here and loading the processing instruction into the second area of the compute module. Furthermore, method 400 includes a step 420 of carrying out the processing instruction in the second area of the compute module to activate the personal protection means of the vehicle.

[0063] If an exemplary embodiment includes an “and/or” linkage between a first feature and a second feature, this is to be read to mean that the exemplary embodiment according to one specific embodiment includes both the first feature and the second feature and according to another specific embodiment includes either only the first feature or only the second feature.