A vehicle lamp intelligent control system with functional safety design
By introducing functional safety design into the intelligent vehicle lighting control system, monitoring the faults of each module and taking reset and redundancy measures, the safety hazards of the vehicle lighting system are solved, and higher reliability and safety are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- DEEPAL AUTOMOBILE NANJING RESEARCH INSTITUTE CO LTD
- Filing Date
- 2023-06-28
- Publication Date
- 2026-05-29
AI Technical Summary
Existing intelligent vehicle lighting control systems lack functional safety design, resulting in a high risk of system failure and random failures. This could lead to drivers not being able to see the road clearly or receiving incorrect information, increasing the risk of traffic accidents.
A functional safety control system comprising a communication module, a main control module, an execution module, a detection module, and a power supply module was designed. By monitoring the faults of each module and implementing corresponding reset and redundancy designs, the system ensures that the vehicle lights are correctly turned on and off.
It effectively reduces the risk of system failure and random failure, improves the reliability and safety of the vehicle lighting system, and ensures the safety of drivers and road users.
Smart Images
Figure CN116572836B_ABST
Abstract
Description
Technical Field
[0001] This invention pertains to automotive lighting modules, specifically relating to functional safety control technology for intelligent automotive lighting control systems. Background Technology
[0002] With the continuous development of automotive electronics technology, automobile control is gradually becoming more automated and intelligent, and automotive electronic systems are becoming increasingly complex. This is particularly evident in the headlight system. In traditional automobiles, the functional division and implementation of each headlight are relatively fixed. However, with the rise of new energy vehicles and emerging car manufacturers, as well as the updating of electrical architecture, the layout and functional division of traditional headlights are gradually breaking with convention: the reuse of various functions is becoming more and more frequent, and a single function can also be synthesized from multiple modules to achieve basic and extended functions.
[0003] Traditional vehicle lights are limited to simply turning on or off, offering relatively simple functionality and thus generally having a lower functional safety level. However, modern vehicles utilize combinations, reuse, and redundant lighting to achieve complex optical designs and interactive lighting signals. These functions require an increasing number of electrical components, but all electronic components are susceptible to systemic and random failures. The more functions a vehicle light has, the more consequences it can have if it fails due to hardware malfunctions or other reasons. This could lead to driver obstruction of the road or transmit incorrect information to other drivers and pedestrians, potentially resulting in serious accidents.
[0004] Currently, there are many intelligent control systems for automotive lighting. For example, patent document 202011271538.8 proposes a lighting control device and method to control the drive current; patent document 202011019929.0 proposes a lighting control module to simplify the fault detection circuit for automotive lights; and patent document 202010989110.0 provides a lighting control system based on 5G technology, solving the problems of difficult internal wiring and high wiring harness costs in existing technologies, and also addressing the issue that drivers cannot directly perform functional diagnostics, software rewriting, and parameter calibration of the lights. However, none of the above-mentioned existing technologies have designed functional safety measures for the lighting system, and cannot effectively reduce the safety hazards existing in the intelligent lighting control system. Summary of the Invention
[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a vehicle lighting intelligent control system with functional safety design, so as to effectively reduce the safety hazards of vehicle lighting intelligent control systems.
[0006] The technical solution of the present invention is as follows:
[0007] A vehicle lighting intelligent control system with functional safety design includes a communication module, a main control module, an execution module, a detection module, and a power supply module, each module having the following functional safety design.
[0008] For the main control module, monitor whether there is a failure in processing the main control information or whether the headlights are not being controlled correctly. If so, reset the external circuit.
[0009] For the communication module, a communication response mechanism is used to monitor for communication failures. If a communication failure is detected, the driver is alerted to the cause of the failure.
[0010] For the power module, monitor the output voltage, software, and hardware faults of the power module. When a fault occurs, reset the power chip and MCU.
[0011] The detection module monitors whether the execution module illuminates the corresponding lights as required. If the execution module fails to illuminate the lights as required, it transmits this information to the main control module to remind the driver of the cause of the malfunction.
[0012] Preferably, the main control module has functions such as VCC power monitoring, application and debugging module switching, multi-core fault recovery, and reset control of external circuits. When a fault is detected inside the MCU of the main control module, the fault output pin of the MCU outputs a signal to the power management chip SBC, causing the SBC to reset. That is, in this invention, the MCU detects a fault, transmits the fault to the power management chip SBC through the fault line, and then the power management chip SBC sends a reset signal to reset the SBC and the MCU.
[0013] Preferably, the communication module uses CAN or CANFD communication. Each time the system sends a message frame, it judges the sending status based on the response message to determine whether a communication failure has occurred.
[0014] Preferably, the power module has a power management chip (SBC), which monitors the input voltage and output voltage. When overvoltage or undervoltage is detected, the SBC directly pulls down the reset pin.
[0015] Preferably, the power management chip SBC has the function of resetting the main control module MCU. The reset pin of the SBC is connected to the reset pin of the main control MCU, and the fault pin of the main control module MCU is connected to the fault input pin of the SBC. When a fault occurs inside the MCU, it outputs a fault signal. The power management chip SBC receives the fault signal and sends a reset signal to reset the MCU. That is, in this invention, the power management chip SBC not only receives fault information transmitted by the MCU, but also faults detected by the power management chip SBC itself, and then resets the SBC and MCU according to the fault.
[0016] Preferably, the power management chip SBC has a watchdog pin, and when the watchdog refresh error occurs, the power management chip SBC resets the MCU.
[0017] Preferably, the execution module detects whether the lamp is working properly by means of: image acquisition, current acquisition by a shunt or Hall sensor, or current detection by an optocoupler.
[0018] Preferably, the method of using optocoupler current detection involves setting an optocoupler detection circuit in each row and column of the matrix LED. Each optocoupler detection circuit determines the operation of several LEDs in the corresponding row / column by detecting the current. The detection module feeds the detection information back to the main control module. The main control module lights up the corresponding detection result table by preset different LEDs, compares the detected information with the table information, and confirms whether the LEDs are lit and turned off as required.
[0019] Preferably, if a light fixture malfunctions, other LEDs with redundant design can be used to replace the malfunctioning light fixture for display.
[0020] Preferably, the matrix LED is divided into multiple display blocks. When the temperature detection circuit detects that the LED temperature of one display block is higher than the set value, it switches to another display block.
[0021] Preferably, the method performs functional safety monitoring on each module based on functional safety level B, which can reduce a series of safety hazards brought about by the development of vehicle lights to an acceptable range.
[0022] As can be seen from the above technical solutions, the present invention designs an intelligent vehicle lighting system with functional safety strategies, which reduces the risk of system failure and random failure, making the entire system more reliable and safer for drivers, passengers and road users. Attached Figure Description
[0023] Figure 1 This is a block diagram of an intelligent vehicle lighting control system according to an embodiment of the present invention;
[0024] Figure 2 This is a FTA (Fault Tree Analysis) of a vehicle lighting intelligent control system with functional safety design, as shown in one embodiment of the present invention.
[0025] Figure 3 This is a 3*3 LED matrix circuit diagram shown in one embodiment of the present invention. Detailed Implementation
[0026] The following description, with reference to the accompanying drawings and preferred embodiments, illustrates the implementation of the technical solution of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.
[0027] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.
[0028] The following embodiments mainly provide a vehicle lighting intelligent control system based on functional safety level B, such as Figure 1 The diagram shows the main modules of a typical intelligent vehicle lighting control system, including a power module, communication module, main control module, execution module, and detection module. The basic functions of each module are described in detail below:
[0029] The power module converts the energy from the battery into the required system voltage to power the entire control system.
[0030] The communication module can be CAN, CANFD, or other communication methods, which enables the vehicle lighting control system to communicate with the domain controller, so that the vehicle lights can display corresponding states when driving in different conditions.
[0031] The main control module receives and processes the information transmitted by the domain controller and the detection module, and sends out corresponding drive signals to control the working status of the vehicle lights.
[0032] The execution module, namely the vehicle lighting module, uses LED lights. Due to the absolute performance advantages of LED lights, and their color temperature being closer to natural light, resulting in greater eye comfort, more and more vehicle lights are using LED lights. Since a single LED light may not be able to achieve the desired effect, matrix LED lights are often used.
[0033] The detection module is a feedback module that can detect current and temperature information and transmit fault information to the main control module.
[0034] like Figure 2 As shown, this embodiment further illustrates the functional safety configuration of the above control system.
[0035] The functional safety objective of this vehicle lighting intelligent control system is to ensure the correct illumination and deactivation of the lights, conveying accurate driving information. However, in actual operation, potential violations of this functional safety objective may include corrupted information received by the main controller, the power module not outputting the correct operating voltage, main controller information processing failure leading to incorrect light control, and execution module malfunction resulting in the failure to illuminate the corresponding light fixtures as required. Therefore, this embodiment incorporates the following functional safety mechanisms to achieve the functional safety objective, addressing these potential causes of failure.
[0036] 1. For the communication module, the main function is to monitor for communication failures based on the communication response mechanism. Once a communication failure is detected, the driver is alerted to the cause of the failure.
[0037] The security mechanism is to prevent damage to information received by the main control module through a communication response mechanism.
[0038] The corruption of information received by the main controller may be due to a fault in the domain controller's information transmission or a communication failure. For intelligent vehicle lighting control systems, communication failures are the primary concern. Communication modules typically use CAN or CANFD communication, which has a communication acknowledgment mechanism. For each message sent, the system receives an acknowledgment message to determine the transmission status. If a communication failure occurs, the system can detect it immediately. Upon detecting a communication failure, the system alerts the driver to the cause of the problem.
[0039] 2. For the power module, the main monitoring functions are the output voltage, software, and hardware faults of the power module. When a fault occurs, the power chip and MCU are reset.
[0040] Because the intelligent vehicle lighting control system is quite complex, the power module uses a single power management chip (SBC). The SBC chip has the function of resetting the MCU, and the reset pin of the SBC chip is connected to the reset pin of the MCU; the fault pin of the MCU is connected to the fault input pin of the SBC. When a fault occurs inside the MCU, it outputs a fault signal. The SBC receives the fault signal and sends a reset signal to reset the MCU.
[0041] The SBC management chip monitors the input and output voltages. When overvoltage or undervoltage is detected, it will directly pull the reset pin low. The SBC chip has a watchdog pin. When the watchdog refresh error occurs, the SBC will reset the MCU. The internal fault flag bit of the SBC indicates whether a fault has occurred. It is cleared when power is off.
[0042] 3. For the main control MCU, the main function is to monitor whether there is a failure in the main control information processing and whether the vehicle lights are not working correctly. If so, the external circuit is reset.
[0043] The main control information processing failed, and the vehicle lights were not controlled correctly: The main control MCU itself has a functional safety level of at least C, and the MCU's safety objective must be consistent with the system's functional safety objective. The main MCU has the functions of VCC power monitoring, application and debugging module switching, multi-core fault recovery, and external circuit reset control. The MCU has a fault output pin, which outputs a signal to the SBC when a fault is detected inside the MCU, causing the SBC to reset; in addition, the MCU's I / O ports have open and short circuit detection functions.
[0044] 4. For the execution module, monitor whether the corresponding lamps are lit as required. If not, the execution module is faulty. The safety mechanism of the execution module can also be improved by adding open / short circuit self-checks for the I / O ports, performing a self-check on the I / O ports between each lamp control operation.
[0045] 5. Detection module: Monitors whether the execution module illuminates the corresponding lights as required. If the execution module fails to illuminate the lights as required, it transmits this information to the main control module to remind the driver of the cause of the malfunction.
[0046] The detection includes voltage and temperature detection functions, as detailed below:
[0047] The vehicle lights use matrix LEDs. Currently, many acquisition modules use image acquisition or current acquisition via shunts or Hall sensors to detect whether the LED array is working properly. These methods are relatively expensive, and because each LED array needs to be checked for proper functioning, multiple detection devices are required. Because LEDs draw a large current, using traditional resistors to detect voltage leads to high power consumption and significant heat generation, shortening the LED's lifespan. Therefore, this invention proposes an optocoupler-based current detection method, placing optocoupler detection circuits in each row and column to detect whether the LED array is working properly.
[0048] like Figure 3 As shown, this embodiment uses a 3x3 matrix LED as an example. In a 3x3 matrix LED, each row and each column is equipped with an optocoupler detection circuit. The detection circuit in each row can determine how many LEDs are working in that row by detecting the current, and the detection circuit in each column can also determine how many LEDs are working in that column by detecting the current. The detection module feeds back the detected information to the main control module. The main control module has a detection result table corresponding to the lighting of different LEDs. The main control module confirms whether the LEDs are lit and turned off as required by comparing the detected information with the table corresponding to the set display graphics. If an LED malfunctions, due to the matrix LED design, other LEDs can be used in a redundant design to achieve the same display effect. At the same time, the cause and location of the malfunction are uploaded to the display screen, allowing the driver and after-sales personnel to clearly see the cause of the malfunction, facilitating after-sales troubleshooting.
[0049] Besides lamp holder or circuit malfunctions, temperature also has a significant impact on LED lights. Excessive temperature can reduce luminous efficiency, shorten lifespan, or even damage the LED. Current LED light temperature control design focuses on structural and simulation design, rationally selecting and arranging LED light sources, heat sinks, substrates, and fans within limited space. This invention mitigates the impact of temperature on LED lights by using a regional display. When a temperature detection circuit detects that the temperature of one LED area is too high, another LED area can be used to replace the overheated LED, displaying the same lighting pattern. For example, based on the time it takes for the LED temperature to reach a critical point, the LEDs can be divided into equal regional blocks, and the same lighting pattern can be displayed uniformly within several blocks, keeping the LED temperature below the critical temperature. This ensures both the luminous effect and extends the LED's lifespan. Furthermore, this modular LED design allows for higher real-time current, brighter light, and the display of dynamic graphics.
[0050] As can be seen from the above embodiments, the functional safety objective is to ensure the correct lighting and shutdown of the headlights. Without any safety mechanism, this would be a single point of failure. However, by adding a detection module (which is itself a safety mechanism) to check whether the headlights are correctly lit or turned off, the safety mechanism provides a certain degree of coverage for the faults. Faults not covered by the safety mechanism become residual faults, thus ensuring the functional safety level set by the system.
Claims
1. A vehicle lighting intelligent control system with functional safety design, comprising a communication module, a main control module, an execution module, a detection module, and a power supply module, characterized in that, Each module has the following functional safety design: For the main control module, it monitors whether there is a failure in processing main control information or whether the headlights are not working correctly. If so, it resets the external circuit. For the communication module, it monitors whether there is a communication failure according to the communication response mechanism. If a communication failure is detected, it alerts the driver to the cause of the failure. For the power module, monitor the output voltage, software, and hardware faults of the power module. When a fault occurs, reset the power chip and MCU. For the detection module, it monitors whether the execution module illuminates the corresponding light pillars as required. If the execution module fails to illuminate the light pillars as required, it transmits this information to the main control module to remind the driver of the cause of the malfunction. The detection module uses optocoupler current detection. An optocoupler detection circuit is set in each row and each column of the matrix LED. Each optocoupler detection circuit determines the operation of several light pillars in the corresponding row / column by detecting the current. The detection module feeds the detection information back to the main control module. The main control module illuminates the corresponding detection result table for different light pillars and compares the detected information with the table information to confirm whether the light pillars are illuminated and turned off as required. The execution module divides the matrix LED into multiple display blocks. When the temperature detection circuit detects that the LED temperature of one display block is higher than the set value, it switches to another display block.
2. The intelligent vehicle lighting control system with functional safety design according to claim 1, characterized in that, The main control module has the functions of VCC power monitoring, application and debugging module switching, multi-core fault recovery, and reset control of external circuits. When a fault is detected inside the MCU, the fault output pin of the MCU outputs a signal to the power management chip SBC, so that the SBC is reset.
3. The intelligent vehicle lighting control system with functional safety design according to claim 1, characterized in that, The communication module uses CAN or CANFD communication. Each time the system sends a message frame, it judges the sending status based on the response message to determine whether a communication failure has occurred.
4. The intelligent vehicle lighting control system with functional safety design according to claim 1, characterized in that, The power module has a power management chip (SBC), which monitors the input and output voltages. When overvoltage or undervoltage is detected, the SBC directly pulls down the reset pin.
5. The intelligent vehicle lighting control system with functional safety design according to claim 4, characterized in that, The power management chip SBC has the function of resetting the main control module MCU. The reset pin of the SBC is connected to the reset pin of the main control MCU, and the fault pin of the main control module MCU is connected to the fault input pin of the SBC. When a fault occurs inside the MCU, it outputs a fault signal. The SBC receives the fault signal and sends a reset signal to reset the MCU.
6. The intelligent vehicle lighting control system with functional safety design according to claim 4, characterized in that, The power management chip SBC has a watchdog pin. When the watchdog refresh error occurs, the SBC resets the MCU.
7. The intelligent vehicle lighting control system with functional safety design according to claim 1, characterized in that, If a light fixture malfunctions, redundant LEDs will be used to replace it and continue the display.
8. The intelligent vehicle lighting control system with functional safety design according to claim 1, characterized in that, The control system performs functional safety monitoring on each module based on functional safety level B.