A low beam control system and FOTA upgrade method

Abstract

The present invention discloses a low beam control system and a FOTA upgrade method, which belong to the technical field of vehicle light control. The low beam control system includes a domain controller, a low beam controller and a low beam LED; the low beam controller includes an MCU module, an SBC module and a Boost‑Buck module; the KL30 power supply of the domain controller supplies power to the SBC module and the Boost‑Buck module of the low beam controller, and the BODY CAN module of the domain controller performs CAN communication with the SBC module of the low beam controller; the SBC module is used to supply power to the MCU module and perform CAN communication with the MCU module; the Boost‑Buck module performs SPI communication with the MCU module, the limp channel of the Boost‑Buck module is connected to the limp switch port of the MCU module, and the voltage output end of the Boost‑Buck module is used to power the low beam LED. The present invention provides a low beam control system and a FOTA upgrade method, which avoids mistakenly entering a safe state during the FOTA flashing process and increases the reliability of the system.

Description

Technical Field

[0001] The invention relates to a low beam lamp control system and a FOTA upgrade method, belonging to the technical field of vehicle lamp control. Background Art

[0002] At present, with the advancement of intelligent and connected vehicles, the complexity of vehicle functions and the requirements for remote upgrades are getting higher and higher. In the existing technology, the functional safety design of the low beam controller usually does not consider the need to keep the lights off during the FOTA flashing process. The existing safety design considers that the safety state of the low beam is to turn on the low beam. During the FOTA flashing process, the system may mistakenly enter the safety state, thereby turning on the low beam. During the FOTA flashing process, it may cause a power loss and affect the user experience. Summary of the invention

[0003] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a low beam control system and a FOTA upgrade method to avoid mistakenly entering a safe state during the FOTA flashing process and increase the reliability of the system.

[0004] In order to solve the above technical problems, the technical solution of the present invention is:

[0005] In one aspect, the present invention provides a low beam control system, which includes a domain controller, a low beam controller and a low beam LED;

[0006] The low beam controller includes an MCU module, an SBC module and a Boost-Buck module;

[0007] The KL30 power supply of the domain controller supplies power to the SBC module and the Boost-Buck module of the low beam controller, and the BODY CAN module of the domain controller performs CAN communication with the SBC module of the low beam controller;

[0008] The SBC module is used to supply power to the MCU module and perform CAN communication with the MCU module;

[0009] The Boost-Buck module performs SPI communication with the MCU module, the limp home channel of the Boost-Buck module is connected to the limp home switch port of the MCU module, and the voltage output end of the Boost-Buck module is used to power the low beam LED.

[0010] Another aspect of the present invention provides a FOTA upgrade method for a low beam control system, which comprises the following steps:

[0011] Step S1, the low beam controller is powered on or reset;

[0012] Step S2, the low beam controller enters the pre-programming step;

[0013] Step S3, the low beam controller switches to the programming step, and turns off the low beam LED within the waiting time after requesting to enter the loading program;

[0014] Step S4: the low beam controller enters the post-programming step.

[0015] Furthermore, in step S2, the low beam controller enters a pre-programming step, which specifically includes the following steps:

[0016] Enter the extended session and check whether the current low beam controller meets the prerequisites for entering FOTA. If it meets the prerequisites for entering FOTA, request the vehicle controller (ECU) to stop sending messages and stop recording diagnostic trouble codes (DTCs).

[0017] Furthermore, the prerequisite for entering FOTA is:

[0018] Condition 1: The controller power supply voltage is between 9-16V;

[0019] Condition 2: Is the vehicle speed valid and less than 3km / h?

[0020] If the current low beam controller meets both conditions 1 and 2, it meets the prerequisites for FOTA.

[0021] Furthermore, in step S3, the low beam controller switches to the programming step, and turns off the low beam LED within the waiting time after the request to enter the loading program, which specifically includes the following steps:

[0022] The low beam controller switches to the programming step;

[0023] There is a waiting time after the request to enter the loader. During the waiting time, the limp switch port of the MCU module is initialized, and the level of the limp switch port of the MCU module is set to high, so that the limp switch is invalid, the BOOST-BUCK module does not enter the safe state, and the low beam LED is turned off;

[0024] After the waiting time is over and the program is loaded, the information is verified. After the verification is successful, the information that needs to be updated by FOTA is downloaded. After the download is complete, the integrity and validity of the downloaded information are checked.

[0025] Furthermore, the information verification specifically includes the following steps:

[0026] The security mode seed is sent to the vehicle controller (ECU) through the diagnostic service, and the key is obtained according to the agreed algorithm. The security access level is unlocked after the vehicle controller (ECU) verifies it.

[0027] Further, after the download is completed, the integrity and validity of the downloaded information is checked, which specifically includes the following steps:

[0028] Execute the program for byte length and CRC check of the downloaded information, and judge the integrity and validity of the downloaded information by the return result of the program execution. If the integrity and validity meet the requirements, go to step S4, otherwise erase the downloaded information, download it again and verify it.

[0029] Furthermore, in step S4, the low beam controller enters a post-programming step, which specifically includes the following steps:

[0030] After the integrity and validity check of the information is successful, a hard reset is performed to exit the programming step;

[0031] Request the vehicle control unit (ECU) to resume message sending and recording of diagnostic trouble codes (DTCs);

[0032] Enter the default session.

[0033] By adopting the above technical scheme, the present invention performs top-level design from the system requirement level in the existing security design, adds a design for port initialization during the programming session when the system is FOTA, avoids the Boost-Buck module from mistakenly entering the security state during the FOTA flashing process, and increases the reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a principle block diagram of a low beam lamp control system of the present invention;

[0035] Figure 2 A circuit schematic diagram of a low beam lamp control system of the present invention;

[0036] Figure 3 The present invention is a flow chart of a FOTA upgrade method for a low beam control system. DETAILED DESCRIPTION

[0037] In order to make the contents of the present invention more clearly understood, the present invention is further described in detail below based on specific embodiments in conjunction with the accompanying drawings.

[0038] Embodiment 1

[0039] like Figure 1 , 2 As shown, this embodiment provides a low beam control system, which includes a domain controller, a low beam controller and a low beam LED.

[0040] like Figure 1 , 2 As shown, the low beam controller of this embodiment includes an MCU module, an SBC module and a Boost-Buck module.

[0041] The MCU module is the logic operation module of the low beam controller, integrating software protection and communication protection functions.

[0042] The KL30 power supply of the domain controller supplies power to the SBC module and Boost-Buck module of the low beam controller, and the BODY CAN module of the domain controller communicates with the SBC module of the low beam controller via CAN.

[0043] The SBC module integrates an external watchdog, CAN communication and power supply module, and is used to power the MCU module and perform CAN communication with the MCU module.

[0044] The Boost-Buck module communicates with the MCU module through SPI. The limp channel LH ​​of the Boost-Buck module is connected to the limp switch port of the MCU module. The voltage output of the Boost-Buck module is used to power the low-beam LED. The Boost-Buck module uses a buck-boost chip with SPI communication, and has a communication timeout dog and limp mode. The limp channel LH ​​is configured during power-on initialization, and the limp mode is entered by pulling down the limp channel LH ​​configuration by the MCU module's limp switch port.

[0045] The low beam LED is turned on and off according to the power supply status of the low beam controller.

[0046] Under normal working conditions: KL30 supplies power to the SBC module and BOOST-BUCK module respectively, and the SBC module outputs 5V to power the MCU module. When the MCU module is powered on, the BOOST-BUCK module's limp channel LH ​​is initialized to the open state, and the MCU module's limp switch port is initialized to low. When the MCU module receives the low beam lighting signal sent by the BODY CAN module of the domain controller, the MCU module uses the SPI signal to make the voltage output end of the BOOST-BUCK module output power, so that the low beam LED is lit.

[0047] In the case of FOTA upgrade: When the system is in FOTA, if the MCU module does not control the limp switch port, the limp switch is valid, and the BOOST-BUCK module enters the safe state to turn on the low beam, which is contrary to the need to keep all lights off during FOTA. To solve this problem, this embodiment initializes the limp switch port of the MCU module after the system FOTA upgrade enters the programming session, sets it to high, the limp switch is invalid, the BOOST-BUCK module does not enter the safe state, and the low beam LED is turned off.

[0048] Embodiment 2

[0049] like Figure 3As shown, this embodiment provides a FOTA upgrade method for a low beam control system, which includes the following steps:

[0050] Step S1, the low beam controller is powered on or reset;

[0051] Step S2, the low beam controller enters the pre-programming step;

[0052] Step S3, the low beam controller switches to the programming step, and turns off the low beam LED within the waiting time after requesting to enter the loading program;

[0053] Step S4: the low beam controller enters the post-programming step.

[0054] In step S2 of this embodiment, the low beam controller enters a pre-programming step, which specifically includes the following steps:

[0055] Enter the extended session and check whether the current low beam controller meets the preconditions for entering FOTA. If it meets the preconditions for entering FOTA, request the vehicle controller (ECU) to stop sending messages and stop recording diagnostic trouble codes (DTCs). The preconditions for entering FOTA are:

[0056] Condition 1: The controller power supply voltage is between 9-16V;

[0057] Condition 2: Is the vehicle speed valid and less than 3km / h?

[0058] If the current low beam controller meets both condition 1 and condition 2, it meets the FOTA preconditions; if one condition is not met, the precondition judgment is exited.

[0059] In step S3 of this embodiment, the low beam controller switches to the programming step, and turns off the low beam LED within the waiting time after requesting to enter the loading program, which specifically includes the following steps:

[0060] The low beam controller switches to the programming step;

[0061] There is a waiting time after the request to enter the loader. During the waiting time, the limp switch port of the MCU module is initialized, and the level of the limp switch port of the MCU module is set to high, so that the limp switch is invalid, the BOOST-BUCK module does not enter the safe state, and the low beam LED is turned off;

[0062] After the waiting time is over and the program is loaded, the information is verified. After the verification is successful, the information that needs to be updated by FOTA is downloaded. After the download is complete, the integrity and validity of the downloaded information are checked.

[0063] The information verification specifically includes the following steps:

[0064] The security mode seed is sent to the vehicle controller through the diagnostic service, and the secret key is obtained according to the agreed algorithm. The security access level is unlocked after verification by the vehicle controller.

[0065] After the download is completed, the integrity and validity of the downloaded information are checked, which specifically includes the following steps:

[0066] Execute the program for byte length and CRC check of the downloaded information, and judge the integrity and validity of the downloaded information by the return result of the program execution. If the integrity and validity meet the requirements, go to step S4, otherwise erase the downloaded information, download it again and verify it.

[0067] In step S4 of this embodiment, the low beam lamp controller enters the post-programming step, which specifically includes the following steps:

[0068] After the integrity and validity check of the information is successful, a hard reset is performed to exit the programming step;

[0069] Request the vehicle control unit (ECU) to resume message sending and recording of diagnostic trouble codes (DTCs);

[0070] Enter the default session.

[0071] The specific embodiments described above further illustrate the technical problems, technical solutions and beneficial effects solved by the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A low beam headlight control system, characterized in that: It includes a domain controller, a low beam controller and a low beam LED; The low beam controller includes an MCU module, an SBC module and a Boost-Buck module; The KL30 power supply of the domain controller supplies power to the SBC module and the Boost-Buck module of the low beam controller, and the BODY CAN module of the domain controller performs CAN communication with the SBC module of the low beam controller; The SBC module is used to supply power to the MCU module and perform CAN communication with the MCU module; The Boost-Buck module performs SPI communication with the MCU module, the limp home channel of the Boost-Buck module is connected to the limp home switch port of the MCU module, and the voltage output end of the Boost-Buck module is used to power the low beam LED; The FOTA upgrade method of the low beam control system comprises the following steps: Step S1, the low beam controller is powered on or reset; Step S2, the low beam controller enters the pre-programming step; Step S3, the low beam controller switches to the programming step, and turns off the low beam LED within the waiting time after requesting to enter the loading program; specifically, the following steps are included: after the system FOTA upgrade enters the programming session, the limp switch port of the MCU module is initialized and set to high, the limp switch is invalid, the BOOST-BUCK module does not enter the safe state, and the low beam LED is turned off; Step S4, the low beam controller enters the post-programming step; In step S2, the low beam controller enters a pre-programming step, which specifically includes the following steps: Enter the extended session and check whether the current low beam controller meets the preconditions for entering FOTA. If it meets the preconditions for entering FOTA, request the vehicle controller to stop sending messages and stop recording diagnostic fault codes. The prerequisites for entering FOTA are: Condition 1: The controller power supply voltage is between 9-16V; Condition 2: Is the vehicle speed valid and less than 3km / h? If the current low beam controller meets both conditions 1 and 2, it meets the preconditions for FOTA; The step S3, in which the low beam controller switches to the programming step and turns off the low beam LED within the waiting time after the request to enter the loading program, specifically includes the following steps: The low beam controller switches to the programming step; There is a waiting time after the request to enter the loader. During the waiting time, the limp switch port of the MCU module is initialized, and the level of the limp switch port of the MCU module is set to high, so that the limp switch is invalid, the BOOST-BUCK module does not enter the safe state, and the low beam LED is turned off; After the waiting time is over and the program is loaded, the information is verified. After the verification is successful, the information that needs to be updated by FOTA is downloaded. After the download is complete, the integrity and validity of the downloaded information are checked.

2. The low beam control system according to claim 1, characterized in that: The information verification specifically includes the following steps: The security mode seed is sent to the vehicle controller through the diagnostic service, and the secret key is obtained according to the agreed algorithm. The security access level is unlocked after verification by the vehicle controller.

3. The low beam control system according to claim 1, characterized in that: After the download is completed, checking the integrity and validity of the downloaded information specifically includes the following steps: Execute the program for byte length and CRC check of the downloaded information, and judge the integrity and validity of the downloaded information by the return result of the program execution. If the integrity and validity meet the requirements, go to step S4, otherwise erase the downloaded information, download it again and verify it.

4. The low beam control system according to claim 1, characterized in that: The step S4, in which the low beam lamp controller enters the post-programming step, specifically includes the following steps: After the integrity and validity check of the information is successful, a hard reset is performed to exit the programming step; Request the vehicle controller to resume message sending and recording of diagnostic trouble codes; Enter the default session.

Images