Millimeter wave radar meeting functional safety requirements

Abstract

The technical scheme of the invention discloses a millimeter wave radar capable of meeting functional safety requirements. A three-layer monitoring safety architecture design is adopted, safety monitoring and diagnosis are carried out on the MMIC front end, the system power supply, the communication state, the vehicle signal and all internal modules on the basis of millimeter wave radar function implementation, and when a radar system is abnormal, a radar system fault can be reported to an intelligent driving controller through the Ethernet. When the radar processor has a serious fault, the external monitoring module can directly close radar data output, so that the situation that the intelligent driving controller is misled to make unexpected actions to endanger personal safety due to wrong data sent by the fault of the millimeter-wave radar is avoided. Therefore, reasonable diagnosis and degradation can be performed according to the fault of the radar, so that the radar sensing part of the intelligent driving system always works in a safe and controllable working state, and serious harm caused by the fault of the millimeter wave radar in the intelligent driving process is avoided or reduced.

Description

Technical Field

[0001] The present invention relates to a millimeter wave radar design scheme capable of meeting functional safety requirements. Background Art

[0002] With the technological evolution of millimeter-wave radar, 4D millimeter-wave radar has gradually become one of the hot spots in the research of intelligent driving perception systems for automobiles due to its excellent detection performance. In recent years, major research institutions and manufacturers have made great progress in the realization and application of 4D millimeter-wave radar. Patent CN202211621727.2 has proposed a design of a 4D millimeter-wave radar system, which uses FMCW modulation to achieve target perception capabilities of 4-dimensional data.

[0003] However, to be applied to the automotive intelligent driving perception system, it must meet the requirements of ISO26262 automotive functional safety ASIL-B, that is, to formulate corresponding safety measures to prevent and detect radar failures in response to the failure of the 4D millimeter wave radar system, to avoid or reduce the failure of the millimeter wave radar to send erroneous point cloud data, and to mislead the intelligent driving controller to make unexpected driving operations, causing serious harm. However, the existing 4D millimeter wave radar technology has not proposed an effective solution. Summary of the invention

[0004] The technical problem to be solved by the present invention is that the existing 4D millimeter wave radar technology cannot meet the requirements of ISO26262 automotive functional safety ASIL-B.

[0005] In order to solve the above technical problems, the technical solution of the present invention is to disclose a millimeter wave radar that meets the functional safety requirements, which is characterized by comprising: The radar front end has multiple cascaded MMICs, which are used to transmit radar radio frequency waves, receive reflected waves from target obstacles, process to obtain raw ADC data, and send the raw ADC data to the radar processor SOC, and are characterized by further comprising: A radar processor SOC adopting a three-layer security monitoring architecture, wherein the three-layer security monitoring architecture includes: Functional layer: used to realize the basic functions of millimeter wave radar; Functional monitoring layer: used to monitor the functional layer, including: monitoring of the multi-chip cascaded MMIC at the front end of the radar, CRC verification of the input raw ADC data, vehicle data verification of the vehicle input signal, internal communication data verification, diagnosis of output data and Ethernet communication, radar system temperature and voltage status monitoring; and classifying and processing priority arbitration of faults at the functional monitoring layer. When a fault affecting radar detection is detected at the functional monitoring layer, the radar processor SOC gives a radar fault warning signal, and sends it to the intelligent driving controller together with the point cloud signal via Ethernet PHY, to inform the intelligent driving controller that the current radar has a fault and needs to be functionally downgraded; Controller monitoring layer: used to monitor and manage serious faults at the processor level. It is jointly implemented by the radar processor SOC and the safety PMIC module. The safety PMIC module is an external independent monitoring module of the radar processor SOC. It integrates the radar processor SOC external watchdog to monitor the software program flow. It also has a fault monitoring pin to monitor the serious fault pin signal issued by the radar processor SOC in real time.

[0006] Preferably, the basic functions of the millimeter wave radar are: processing the raw ADC data into sampled data through an algorithm, extracting target information of the target obstacle, realizing detection, tracking and classification of the target obstacle, and outputting the sensed radar data to the intelligent driving controller through Ethernet PHY.

[0007] Preferably, in the controller monitoring layer, the radar processor SOC optional security mechanism includes SOC memory protection, register read and write verification, system clock monitoring, and program flow monitoring.

[0008] Preferably, when a dog feeding timeout or a serious internal fault of the radar processor SOC occurs, the internal fault management module of the radar processor SOC outputs the fault status to the safety PMIC module, and the functional safety state machine inside the safety PMIC module drives the Disable control signal to shut down the Ethernet communication output, and at the same time sends a reset signal to restart the radar processor SOC to avoid sending unreliable point cloud data, thereby entering the millimeter-wave radar functional safety state.

[0009] The present invention adopts a three-layer monitoring security architecture design. On the basis of the realization of the millimeter-wave radar function, the MMIC front end, system power supply, communication status, vehicle signal and internal modules are safely monitored and diagnosed. When an abnormality occurs in the radar system, the radar system fault can be reported to the intelligent driving controller via Ethernet. When a serious fault occurs in the radar processor itself, the external monitoring module can directly shut down the radar data output to avoid the millimeter-wave radar fault sending erroneous data to mislead the intelligent driving controller to make unexpected actions and endanger personal safety. Therefore, the present invention can perform reasonable diagnostic downgrades for the fault of the radar itself, so that the radar sensing part of the intelligent driving system always works in a safe and controllable working state, avoiding or reducing the serious harm caused by the failure of the millimeter-wave radar during the intelligent driving process. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is the principle diagram of the present invention; Figure 2 A specific implementation of the hardware part of the present invention is illustrated. DETAILED DESCRIPTION

[0011] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only intended to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art may make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0012] like Figure 1 As shown, a millimeter-wave radar that meets functional safety requirements disclosed in an embodiment of the present invention is mainly composed of multiple cascaded MMICs, a radar processor SOC, an Ethernet PHY, and a safety PMIC module. The safety PMIC module powers the system and integrates an external watchdog and a safety state machine as an external monitoring mechanism of the radar processor SOC to achieve safety monitoring of the radar processor SOC. The multiple cascaded MMICs realize: radar RF wave transmission, target obstacle reflection wave reception, millimeter-wave radar raw detection data processing, and sending the millimeter-wave radar raw detection data to the radar processor SOC. The radar processor SOC performs digital signal processing on the millimeter-wave radar raw detection data, realizes four-dimensional data analysis and calculation of the distance, speed, angle, and height of the target obstacles in the environment, outputs millimeter-wave radar point cloud data, and then sends the 4D data of the target obstacle to the intelligent driving controller through the Ethernet PHY for perception fusion with the camera visual data.

[0013] The radar processor SOC adopts a three-layer security monitoring architecture: The first layer, Level 1, functional layer: realizes the basic functions of millimeter-wave radar, processes the sampled data of the original ADC data of the radar front end through the algorithm, extracts the target information (distance, speed, angle, height), realizes target detection, tracking and classification, and outputs the perceived radar data to the intelligent driving controller through Ethernet PHY.

[0014] The second layer, Level 2, function monitoring layer: mainly monitors the first layer functions. It includes monitoring of the multi-chip cascaded MMICs at the front end of the radar, CRC verification of the input raw radar data, vehicle data verification of the vehicle input signal (vehicle speed, acceleration, angle, angular velocity, etc.), internal communication data verification, diagnosis of output data and Ethernet communication, radar system temperature, voltage status monitoring, etc. In addition, at this layer, faults are classified and priority arbitration is processed. When a fault that affects radar detection is detected at this layer, the radar processor SOC sets the radar fault warning signal to Fault and sends it out together with the point cloud signal through the Ethernet PHY, which provides the first functional safety state transfer path to inform the intelligent driving controller that the current radar has a fault and needs to be functionally downgraded.

[0015] The third layer, Level 3, controller monitoring layer: mainly monitors and manages serious faults at the processor level. It is a combination of some safety mechanisms of the radar processor and external independent monitoring modules, and is jointly implemented by the radar processor SOC and the safety PMIC module. The optional safety mechanisms of the radar processor SOC include SOC memory protection, register read and write verification, system clock monitoring, program flow monitoring, etc. The external independent monitoring module uses a safety PMIC module, which integrates the radar processor SOC external watchdog to monitor the software program flow, and has a fault monitoring pin to monitor the serious fault pin signal issued by the radar processor SOC in real time. When the dog feeding timeout or the radar processor SOC has a serious internal fault, the radar processor SOC internal fault management module outputs the fault state to the safety PMIC module, and the functional safety state machine inside the safety PMIC module will drive the Disable control signal to shut down the Ethernet communication output, and send a reset signal to restart the radar processor SOC to avoid issuing untrusted point cloud data, thereby entering the millimeter wave radar functional safety state. The safety PMIC module integrates the external monitoring mechanism of the processor and also provides a second functional safety state transfer path, so that the radar system can achieve the safety goal of ASIL B.

[0016] The above design can be adopted Figure 2 The hardware circuit shown: The DCDC module is connected to the VBAT power supply of the vehicle and converts 12V electricity to 3.3V to power the system. The radar processor SOC is based on AM2732 and uses SPI to realize RF control and safety monitoring of the multi-chip cascade MMIC of the radar front end. The multi-chip cascade MMIC of the radar front end adopts the AWR2243 dual-chip cascade mode, each with three-transmit and four-receive RF antennas. The radar RF module is integrated inside. After the front-end signal processing of the multi-chip cascade MMIC of the radar front end, the original radar ADC data is transmitted to the radar processor SOC via the CSI2 bus. The DSP core inside the radar processor SOC realizes the 4D data calculation of the radar target obstacle through digital signal processing, extracts the target information, and realizes target detection, tracking and classification. It is then transmitted to the MCU core by the on-chip bus, and after conversion by the Ethernet communication protocol, the radar data is sent to the intelligent driving controller, that is, the first layer Level 1 function mentioned above is realized.

[0017] At the same time, the MCU core inside the processor AM2732 is a safety core, responsible for the second-layer Level 2 functional monitoring of the radar system, including system voltage monitoring, temperature monitoring, MMIC safety monitoring, Ethernet PHY safety monitoring, radar signal processing DSP module monitoring, etc. When a functional safety-related fault is detected, the MCU will send the radar fault status position as Fault and send it to the intelligent driving controller via Ethernet for functional degradation.

[0018] The safety PMIC module is based on LP876242, which realizes multi-channel power conversion output to power the system. It integrates a watchdog module and is connected to the radar processor SOC through SPI to realize program flow monitoring of the MCU core in the processor. When the MCU of the radar processor SOC fails seriously, its internal fault management module activates the Error pin. After the safety PMIC module detects the serious failure of the radar processor SOC mapped by the Error pin, the internal functional safety state machine realizes the safety state switching and drives the Disable output to shut down the radar data sent out of Ethernet, which is the function of the third layer Level3 processor monitoring layer mentioned above, so that the radar system can achieve the functional safety goal of ASIL B.

Claims

1. A millimeter wave radar that meets functional safety requirements, characterized in that: include: The radar front-end multi-chip cascade MMIC is used to receive the reflected wave of the target obstacle after transmitting the radar radio frequency wave, process to obtain the original ADC data, and send the original ADC data to the radar processor SOC, characterized in that it also includes: a radar processor SOC adopting a three-layer security monitoring architecture, the three-layer security monitoring architecture includes: a functional layer: used to realize the basic functions of the millimeter wave radar; a functional monitoring layer: used to monitor the functional layer, including: monitoring of the radar front-end multi-chip cascade MMIC, CRC check of the input original ADC data, vehicle data check of the vehicle input signal, internal communication data check, output data and Ethernet communication diagnosis, radar system temperature, voltage status monitoring; and faults are checked at the functional monitoring layer. Classification and processing priority arbitration are performed. When a fault that affects radar detection is detected in the functional monitoring layer, the radar processor SOC gives a radar fault warning signal and sends it to the intelligent driving controller together with the point cloud signal via Ethernet PHY, which is used to inform the intelligent driving controller that the current radar has a fault and requires functional degradation; Controller monitoring layer: used to monitor and manage serious faults at the processor level, which is jointly implemented by the radar processor SOC and the safety PMIC module. Among them, the safety PMIC module serves as an external independent monitoring module of the radar processor SOC, integrates the radar processor SOC external watchdog, realizes the monitoring of the software program flow, and has a fault monitoring pin to monitor the serious fault pin signal issued by the radar processor SOC in real time.

2. A millimeter wave radar meeting functional safety requirements as claimed in claim 1, characterized in that: The basic functions of the millimeter wave radar are: processing the raw ADC data into sampled data through an algorithm, extracting target information of target obstacles, realizing detection, tracking and classification of target obstacles, and outputting the sensed radar data to the intelligent driving controller through Ethernet PHY.

3. A millimeter wave radar meeting functional safety requirements as claimed in claim 1, characterized in that: In the controller monitoring layer, the radar processor SOC optional security mechanisms include SOC memory protection, register read and write verification, system clock monitoring, and program flow monitoring.

4. A millimeter wave radar meeting functional safety requirements as claimed in claim 1, characterized in that: In the controller monitoring layer, when a dog feeding timeout occurs or a serious internal fault occurs in the radar processor SOC, the internal fault management module of the radar processor SOC outputs the fault status to the safety PMIC module. The functional safety state machine inside the safety PMIC module will drive the Disable control signal to shut down the Ethernet communication output and send a reset signal to restart the radar processor SOC to avoid sending unreliable point cloud data, thereby entering the millimeter-wave radar functional safety state.

Images