Safety control system and control method for steering lamp in OTA mode

Abstract

The invention provides a safety control system and method for a steering lamp in an OTA mode, and relates to the technical field of automobile electronics. The system comprises a vehicle body control system, an LED driving control module and an LED lamp panel module. Aiming at the potential safety hazard that the function of a steering lamp fails during OTA upgrading of an existing single-core MCU lamp system, a steering lamp hard wire driving module is arranged in an LED driving control module, and an independent hardware backup control access is constructed by utilizing the Fail-Safe function of an LED driving chip. In a normal working mode, the MCU controls the LED driving chip through the UART serial port; and when the OTA upgrading mode is entered and the MCU cannot be normally controlled, the system is automatically switched to directly drive the LED lamp string by a vehicle body steering lamp hard wire signal through the backup access, so that the steering lamp can flicker according to the hard wire frequency, and a danger warning function is kept. According to the invention, on the premise that the hardware cost is not obviously increased, the safety performance of the vehicle in the OTA process is effectively ensured.

Description

Technical Field

[0001] This invention relates to the field of automotive electronics technology, specifically to a safety control system and control method for turn signals in OTA mode. Background Technology

[0002] As automotive electronics technology continues to mature, the demand for over-the-air (OTA) upgrades in automobiles is increasing, while the requirements for vehicle safety performance are also continuously rising. Currently, due to cost control considerations, the MCUs (microcontroller units) used in automotive lights are mostly single-core chips, and their design does not optimize for the turn signal hazard warning function during the OTA process. This results in the turn signals failing to illuminate properly when the lights are in OTA mode, losing their hazard warning function and posing a potential safety hazard to vehicles.

[0003] The above problems urgently need to be solved. Summary of the Invention

[0004] The purpose of this invention is to solve the technical problem in existing technologies where turn signals fail to illuminate properly when the lights are in OTA (Over-The-Air) mode, thus losing their hazard warning function and posing a safety hazard to vehicle driving. This invention provides a safety control system and method for turn signals in OTA mode.

[0005] On one hand, embodiments of the present invention provide a safety control system for turn signals in OTA mode. The safety control system includes: a body control system, an LED drive control module, and an LED light panel module. The body control system integrates a CAN communication module and a hardwired turn signal for the vehicle's turn signals. The CAN communication module is suitable for sending CANFD signals. The hardwired turn signal provides a hardwired control signal for illuminating the turn signals when the vehicle lights switch to OTA upgrade mode. The LED drive control module integrates an MCU main control module, an LED drive module, and a turn signal hardwired drive module. The MCU main control module controls the vehicle lights to switch to normal operation mode and OTA upgrade mode based on the received CANFD signals. When the vehicle lights switch to normal operating mode, the MCU main control module controls the LED driver module to illuminate the LED light panel module via serial port, and disables the turn signal hardwired driver module via the steering function safety I / O port. When the vehicle lights switch to OTA upgrade operating mode, the MCU main control module enables the turn signal hardwired driver module via the steering function safety I / O port and disables serial communication. The turn signal hardwired driver module controls the LED driver module to illuminate the LED light panel module according to the turn signal hardwired signal from the vehicle body. The LED light panel module integrates the turn signal LED module and the daytime running / position light LED module, and their negative terminals are grounded through MOSFETs to perform corresponding lighting actions based on the control signals sent by the LED driver module.

[0006] Furthermore, the vehicle body control system also integrates a power supply module, and the LED drive control module also integrates an SBC module and a BUCK module. The power supply module supplies power to the MCU main control module through the SBC module, and the power supply module supplies power to the LED drive module through the BUCK module.

[0007] Furthermore, the SBC module is also used to receive the current status information of the lamps fed back by the MCU main control module, and transmit the information to the vehicle body control system through the CANFD signal to realize real-time interaction of lamp status.

[0008] Furthermore, the LED driver module is composed of a linear constant current chip. The linear constant current chip has a built-in EEPROM and a watchdog module. The EEPROM pre-stores the output channel parameters corresponding to safety mode 1 and safety mode 2. When the watchdog module times out and there is no serial port UART feed signal, the linear constant current chip enters the safety mode and calls the corresponding parameters in the EEPROM according to the Fail-Safe pin level to switch to safety mode 1 and safety mode 2. Safety mode 1 is to turn on all channel outputs to illuminate the turn signals, and safety mode 2 is to turn off all channel outputs to extinguish the turn signals.

[0009] Furthermore, the Fail-Safe pin level of the LED driver module is linked to the hard-wire signal of the vehicle turn signal. When the hard-wire signal of the vehicle turn signal is high, the Fail-Safe pin is high, and the LED driver module enters safety mode 1; when the hard-wire signal of the vehicle turn signal is low, the Fail-Safe pin is low, and the LED driver module enters safety mode 2, so as to realize that the turn signal flashes at the frequency of the hard-wire signal.

[0010] Furthermore, the turn signal hardwired driver module includes an input terminal and an output terminal. The input terminal is connected to the vehicle body turn signal hardwire and the steering function safety I / O port of the MCU main control module. The output terminal is connected to the Fail-Safe pin of the LED driver module and the MOSFET control terminal of the turn signal LED board, respectively. When the vehicle lights switch to normal operating mode, the MCU main control module turns off the turn signal hardwired driver module by pulling the steering function safety I / O port high. When the vehicle lights switch to OTA upgrade operating mode, the MCU main control module turns on the turn signal hardwired driver module by pulling the steering function safety I / O port low, so that the vehicle body turn signal hardwire is transmitted to the Fail-Safe pin and the MOSFET control terminal of the turn signal LED module.

[0011] Furthermore, a first anti-reverse diode is connected in series between the MOS transistor control terminal of the turn signal LED module and the steering function safety I / O port of the MCU main control module, and a second anti-reverse diode is connected in series between the MOS transistor control terminal of the turn signal LED module and the turn signal hard-wired driver module; when the steering function safety I / O port of the MCU main control module outputs a valid signal or the turn signal hard-wired driver module outputs a valid signal, the MOS transistor of the turn signal LED module can be turned on, so that the turn signal LED module is grounded and lit.

[0012] Furthermore, the turn signal LED module and the daytime running / position light LED module share the same light-emitting surface and are mutually exclusive in function, and their negative MOS transistors are controlled by the same functional safety I / O port of the MCU main control module.

[0013] Furthermore, the turn signal hardwired drive module includes a level conversion and drive circuit for converting the voltage of the vehicle body turn signal hardwired signal into a signal that matches the level required by the Fail-Safe pin of the LED drive module.

[0014] Secondly, embodiments of the present invention provide a safety control method for turn signals in OTA mode. This method is applied to the aforementioned safety control system for turn signals in OTA mode. The control method includes: in normal operating mode, the MCU main control module controls the LED driver module via serial communication and disables the turn signal hardwired driver module; when switching to OTA upgrade operating mode, the MCU main control module switches to encoding session mode, enables the turn signal hardwired driver module, and disables the serial communication; the LED driver module enters a safe mode, and its output state is determined by the level of the turn signal hardwired signal transmitted from the vehicle body to the Fail-Safe pin via the turn signal hardwired driver module, thereby driving the turn signal LED module to flash; after the OTA upgrade is completed, the system restarts and returns to normal operating mode.

[0015] In another aspect, the present invention also provides a computer-readable storage medium storing one or more instructions for causing the computer to execute the above-described safety control method for turn signals in OTA mode.

[0016] In another aspect, the present invention provides an electronic device, comprising: a memory and a processor; the memory storing at least one program instruction; the processor loading and executing the at least one program instruction to implement the above-mentioned safety control method for turn signals in OTA mode.

[0017] The beneficial effects of this invention are: (1) Based on the existing single-core MCU hardware solution, no additional core chip is required. The turn signal and daytime running / position light share the same LED driver module and light-emitting surface, which greatly reduces the hardware cost of the lamp.

[0018] (2) In OTA mode, the turn signal hard wire drive module and the LED drive module work together in a safe mode to ensure that the turn signal can perform the danger warning function normally and eliminate safety hazards during OTA.

[0019] (3) By using anti-reverse diodes and MOSFET mutual exclusion control, the function conflicts of different lamp boards are avoided, and the lamp function is guaranteed to be stable in normal mode and OTA mode.

[0020] (4) The daytime running lights / position lights are automatically turned off during OTA, which complies with safety regulations. At the same time, the turn signals work normally, which enhances the user's sense of security. Attached Figure Description

[0021] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0022] Figure 1 This is a structural diagram of a safety control system for turn signals in OTA mode provided in Embodiment 1 of the present invention.

[0023] Figure 2 This is a structural diagram of another safety control system for turn signals in OTA mode provided in Embodiment 1 of the present invention.

[0024] Figure 3 This is a block diagram of an LED driving control circuit provided in Embodiment 1 of the present invention.

[0025] Figure 4 This is a flowchart of a safety control method for turn signals in OTA mode provided in Embodiment 2 of the present invention.

[0026] Figure 5 This is a partial block diagram of the electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0027] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations as sequential processes, many of these operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0028] It should be understood that although the terms "first," "second," etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are used merely to distinguish one unit from another. For example, without departing from the scope of the exemplary embodiments, a first unit may be referred to as a second unit, and similarly, a second unit may be referred to as a first unit. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0029] The present invention will now be described in detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0030] Example 1 To facilitate understanding, the working principle of this system is explained in general before describing the embodiments of the present invention in detail: This embodiment provides a safety control system and control method for turn signals in OTA mode, including a vehicle body control system, an LED driver control module, and an LED light panel module. The vehicle body control system provides the lights with KL30 power, turn signal hardwire, and CAN signal. KL30 is responsible for power supply; the turn signal hardwire provides the turn signal flashing signal when the MCU is performing OTA; the CAN module is connected to the MCU through the SBC module of the LED driver control module to control the operation of the lights. The LED driver control module includes a BUCK module, an SBC module, an MCU main control chip, an LED driver module, and a turn signal hardwire control module. The BUCK module supplies power to the LED driver module. The LED light panel module includes turn signal LED light panels and daytime running light / position light LED light panels. The positive terminal of the LED light panel module is connected to the output terminal of the LED driver module, and the negative terminal is connected to GND through a MOSFET. The daytime running lights / position lights' LED board MOSFETs are controlled by an MCU I / O. The turn signal LED board's MOSFETs are controlled by both the MCU's turn signal I / O port and the turn signal hardwired control module. Both are connected to the control terminals of the LED turn signal LED board's LED module's MOSFETs via anti-reverse diodes. When one is active, the turn signal LED board is grounded. The turn signal hardwired control module's on / off function is controlled by the MCU's turn signal safety I / O port. Before surface mounting on the production line, the LED driver chip needs to have parameters for each output channel in function safety mode 1 and function safety mode 2 written to its EEPROM. When the LED driver chip enters function safety mode, it directly retrieves data from the EEPROM to light and extinguish the turn signal LEDs. Under normal circumstances, the MCU disables the turn signal hardwired function through the turn signal safety I / O port and controls both the LED driver module and the turn signal I / O port's MOSFETs to light the LED board. When the lighting requires OTA (Over-The-Air) updates, the MCU first enters extended session mode, then enters programming session mode. In programming session mode, the MCU disables the serial UART, and the LED driver chip enters function safety mode. Simultaneously, the MCU enables the turn signal hardwired function via the steering function safety I / O port, disables the turn signal and daytime running light / position light I / O control, and turns off the position lights and daytime running lights. At this time, the turn signal's on / off state is solely based on changes in the vehicle's turn signal hardwired signal. The turn signal hardwired control receives the vehicle's turn signal hardwired signal and connects to the Fail-Safe pin of the LED driver module, causing the vehicle's turn signal hardwired signal to control the Fail-Safe pin voltage. During OTA (Over-The-Air) updates, the linear drive chip enters a safety mode, switching between different safety modes depending on the Fail-Safe pin's voltage level.When the vehicle's turn signal is high, the Fail-Safe pin is high, and the LED driver chip enters safety mode 1, at which point all outputs are turned on and the turn signals illuminate. When the vehicle's turn signal is low, the Fail-Safe pin is low, and the LED driver chip enters safety mode 2, at which point all outputs are turned off and the turn signals extinguish. This ensures that the lights can still provide hazard warning functionality via turn signals during OTA upgrades.

[0031] The specific implementation method is as follows: like Figure 1 The diagram shown is a structural diagram of a safety control system for turn signals in OTA mode provided by the present invention.

[0032] As an example, the safety control system includes: a body control system 1, an LED drive control module 2, and an LED light panel module 3; the body control system 1 integrates a CAN communication module 10 and a body turn signal hardwire 11, the CAN communication module 10 being suitable for sending CANFD signals; the body turn signal hardwire 11 is used to provide a hardwire control signal for the turn signal to illuminate when the vehicle lights switch to OTA upgrade working mode; the LED drive control module 2 integrates an MCU main control module 20, an LED drive module 21, and a turn signal hardwire drive module 22; the MCU main control module 20 is used to control the vehicle lights to switch to normal working mode and OTA upgrade working mode based on the received CANFD signal, and when the vehicle lights switch to normal working mode, the MCU main control module 20... The MCU main control module 20 controls the LED driver module 21 to illuminate the LED light board module 3 via a serial port, and disables the turn signal hardwired driver module 22 via the steering function safety I / O port. When the vehicle lights switch to OTA upgrade mode, the MCU main control module 20 enables the turn signal hardwired driver module 22 via the steering function safety I / O port and disables serial communication. The turn signal hardwired driver module 22 controls the LED driver module 21 to illuminate the LED light board module 3 according to the vehicle body turn signal hardwired signal. The LED light board module 3 integrates the turn signal LED module 30 and the daytime running / position light LED module 31, and their negative terminals are grounded through MOSFETs to perform corresponding lighting actions based on the control signals sent by the LED driver module 21.

[0033] In some feasible implementations, the working principle of this control system is as follows: Normal mode: The MCU main control module 20 controls the LED driver module 21 via the UART serial port to realize the normal functions of the turn signals, daytime running lights, and position lights. The MCU main control module 20 controls the MOSFETs connected to the negative terminals of the turn signal LED module and the daytime running / position light LED module through the turn function I / O port to realize the switching of different function lights. The turn signal hardwired driver module 22 is turned off by the MCU main control module 20 through the "turn function safety I / O port" (pull high to short-circuit to ground).

[0034] OTA upgrade working mode: MCU main control module 20 enters extended session mode, then switches to programming session mode; MCU main control module 20 shuts down the serial port UART peripheral and stops the "watchdog feeding" operation to LED driver module 21; LED driver module 21 enters safe mode (Fail-Safe mode) due to watchdog timeout; MCU main control module 20 pulls low the "steering function safety IO port" and enables turn signal hardwired driver module 22; the turn signal hardwired signal provided by the vehicle body is connected to the Fail-Safe pin of LED driver module 21 through turn signal hardwired driver module 22; according to the high and low levels of the hardwired signal: high level → Fail-Safe pin is high → drive LED driver module to enter safe mode 1 → all output channels are open → turn signal illuminates. low level → Fail-Safe pin is low → drive LED driver module to enter safe mode 2 → all output channels are closed → turn signal is off; daytime running lights / position lights cannot be illuminated because the MOSFET is disconnected due to the IO port being pulled low, and the LED negative terminal is floating.

[0035] In some feasible implementations, combined with Figure 2 As shown, the vehicle body control system 1 also integrates a power supply module 12, and the LED drive control module 2 also integrates an SBC module 23 and a BUCK module 24. The power supply module 12 supplies power to the MCU main control module 20 through the SBC module 23, and the power supply module 12 supplies power to the LED drive module 21 through the BUCK module 24.

[0036] Preferably, the SBC module 23 is also used to receive the current status information of the lamps fed back by the MCU main control module 20, and transmit the information to the vehicle body control system through the CANFD signal to realize real-time interaction of the lamp status.

[0037] Specifically, the MCU main control module 20 preferably uses the NXP S32K3XX series, and the SBC module 23 preferably uses the NXP UJA1169 chip. The system is powered by the power supply module 12 (KL30) in the body control system 1. Under normal circumstances, the LED driver control module 2 is connected to the CAN communication module 10 through its own SBC module 23. The body turn signal hardwire 11 is connected to the turn signal hardwire driver module 22 of the LED driver control module 2. When the lights are in normal mode, the MCU main control module 20 turns off the turn signal hardwire driver module 22 by pulling up the turn signal safety control IO port, so that the lights are only controlled by the MCU main control module 20. The LED driver module 21 uses the TPS919120 linear constant current driver chip, which has an internal EEPROM and an internal watchdog module. When the internal watchdog of the TPS919120 chip times out, the chip enters different safety modes according to the high or low level of the chip's Fail-Safe pin. Different safety modes can illuminate or extinguish the LED turn signals according to different data in the EEPROM. It should be noted that the selection of module models mentioned above is not restricted here.

[0038] In some feasible implementations, the LED driver module 21 is composed of a linear constant current chip. The linear constant current chip has a built-in EEPROM and a watchdog module. The EEPROM pre-stores the output channel parameters corresponding to safety mode 1 and safety mode 2. When the watchdog module times out and there is no serial port UART feed signal, the linear constant current chip enters the safety mode and calls the corresponding parameters in the EEPROM according to the Fail-Safe pin level to switch to safety mode 1 and safety mode 2. Safety mode 1 is to turn on all channel outputs to illuminate the turn signals, and safety mode 2 is to turn off all channel outputs to extinguish the turn signals.

[0039] Preferably, the Fail-Safe pin level of the LED driver module 21 is linked to the hard-wire signal of the vehicle turn signal. When the hard-wire signal of the vehicle turn signal is high, the Fail-Safe pin is high, and the LED driver module enters safety mode 1; when the hard-wire signal of the vehicle turn signal is low, the Fail-Safe pin is low, and the LED driver module enters safety mode 2, so as to realize that the turn signal flashes at the frequency of the hard-wire signal.

[0040] Preferably, the turn signal hardwired driver module 22 includes an input terminal and an output terminal. The input terminal is connected to the turn signal hardwire of the vehicle body and the steering function safety I / O port of the MCU main control module. The output terminal is connected to the Fail-Safe pin of the LED driver module and the MOS transistor control terminal of the turn signal LED board, respectively. When the vehicle lights switch to normal operating mode, the MCU main control module 20 turns off the turn signal hardwired driver module 22 by pulling the steering function safety I / O port high. When the vehicle lights switch to OTA upgrade operating mode, the MCU main control module 20 turns on the turn signal hardwired driver module 22 by pulling the steering function safety I / O port low, so that the turn signal hardwire of the vehicle body is transmitted to the Fail-Safe pin and the MOS transistor control terminal of the turn signal LED module.

[0041] Specifically, when the lighting fixture undergoes OTA (Over-The-Air) updates, the MCU main control module 20 enters extended session mode and then switches to programming session mode, during which time the MCU main control module 20 will have a waiting period. During this time, the MCU main control module 20 pulls the steering function safety control I / O port and the daytime running light / position light I / O control port low, while simultaneously disabling the serial UART peripheral. The negative terminal of the daytime running light / position light LED module is left floating and cannot work, fulfilling the safety requirement that the daytime running light / position light cannot be illuminated during the lighting fixture OTA update, thus improving the customer experience during OTA. With the steering function safety control I / O port pulled low, the vehicle turn signal hardwire is connected to the negative terminal of the turn signal LED, and simultaneously, the vehicle turn signal hardwire is connected to the Fail-Safe pin of the LED driver chip. Because the MCU disables the UART peripheral, it cannot feed the LED driver chip, and the chip enters safe mode. At this time, the chip receives high and low levels from the vehicle's turn signal hardwired signal via the Fail-Safe pin, entering different safety modes. When the vehicle's turn signal hardwired signal is high, the Fail-Safe pin is high, and the LED driver chip enters safety mode 1, at which point all outputs are turned on, illuminating the turn signals. When the vehicle's turn signal hardwired signal is low, the Fail-Safe pin is low, and the LED driver chip enters safety mode 2, at which point all outputs are turned off, extinguishing the turn signals. This enables the lights to provide warning via hazard warning lights during OTA updates, greatly improving the safety of the entire vehicle system. After the OTA update is complete and the MCU exits OTA mode, it restarts and enters normal mode.

[0042] In some feasible implementations, combined with Figure 3As shown, a first anti-reverse diode is connected in series between the MOS transistor control terminal of the turn signal LED module and the steering function safety I / O port of the MCU main control module, and a second anti-reverse diode is connected in series between the MOS transistor control terminal of the turn signal LED module and the turn signal hard-wired driver module. When the steering function safety I / O port of the MCU main control module outputs a valid signal or the turn signal hard-wired driver module outputs a valid signal, the MOS transistor of the turn signal LED module can be turned on, so that the turn signal LED module is grounded and lit.

[0043] Specifically, in combination Figure 3 As shown, the LED driver chip control in normal mode includes: the MCU sending commands to the LED driver chip via the UART serial port; the output of the LED driver chip providing power to the positive terminal of the LED string. First MOSFET and MCU turn signal I / O control: The MCU's turn signal I / O control port controls the first MOSFET, which is connected to the negative terminal of the LED string and GND. Working with the LED driver chip, it controls the on / off state of the LED string (turn signals, etc.), thus controlling the lighting and extinguishing of the turn signals. Second MOSFET and MCU turn signal safety I / O control: The MCU's turn signal safety I / O control port controls the on / off state of the second MOSFET via a first resistor. The second MOSFET is connected to the turn signal hardwired circuitry and GND. In normal mode, it is used to disable the turn signal hardwired control module, ensuring that the MCU dominates the control logic for the turn signals, etc.

[0044] The LED driver chip control in OTA mode includes: when entering OTA mode, the MCU will activate the turn signal hard wire control module. At this time, the turn signal hard wire, through the second resistor and other circuits, combined with the second anti-reverse diode and other components, participates in the control of the first MOSFET, so that the turn signal can turn on and off according to the hard wire signal. At the same time, the LED driver chip enters the safety mode, and the daytime running lights / position lights are turned off, ensuring safety and specific functional performance during the OTA process.

[0045] In addition, the first and second anti-reverse diodes prevent current from flowing in the opposite direction, protect the components in the circuit, and ensure that the circuit operates stably in different operating modes.

[0046] In short, in normal mode: the MCU disables the backup path through its steering function safety I / O port (e.g., by setting the I / O port to a high level output and pulling the control electrode of the backup MOSFET low); the MCU controls the current output of the LED driver chip entirely through the UART and directly controls the first MOSFET through its steering I / O port to light up or turn off the LED string. In safety / OTA mode (when the MCU is busy upgrading and cannot execute the normal program): the MCU first enables the backup path through its steering function safety I / O port (e.g., by setting the I / O port to an input or pulling it low); the MCU stops controlling the LED driver chip through the UART; at this time, the lighting of the LED string is entirely determined by the "steering hardwire" signal from the vehicle body; when the hardwire signal is high, it forces the backup MOSFET to conduct through the diode, lighting up the string; when the hardwire signal is low, the second MOSFET is turned off, and the string turns off.

[0047] In some feasible implementations, the turn signal LED module 30 and the daytime running / position light LED module 31 share a common light-emitting surface and are mutually exclusive in function, and their negative MOS transistors are controlled by the same functional safety I / O port of the MCU main control module 20.

[0048] In some feasible implementations, the turn signal hardwired driver module includes a level conversion and drive circuit for converting the voltage of the vehicle body turn signal hardwired signal into a signal that matches the level required by the Fail-Safe pin of the LED driver module.

[0049] To facilitate understanding of the above embodiments, specific examples are provided here: Let's take the example of a car owner receiving a push notification on their in-car system stating: "This version update (V2.1) will optimize the dynamic flow effect of the turn signals, improving visual appeal and brand recognition. The upgrade process will take approximately 5 minutes; it is recommended to perform the upgrade while the vehicle is safely parked."

[0050] The car owner parks the vehicle in a roadside parking lot and clicks "Confirm Upgrade". The vehicle is then powered off, and the OTA upgrade process begins.

[0051] The system configuration (specific hardware) includes: Body Control Module (BCM): Provided by the OEM, responsible for supplying KL30 power, CAN FD signals, and 12V, 1Hz hardwired PWM signals for the turn signals (when hazard warning lights are activated). LED Driver Control Module (inside the taillights): MCU: NXP S32K344 (single-core ARM Cortex-M7, cost-effective). SBC: NXP UJA1169, responsible for powering the MCU and handling CAN communication. LED Driver Chip: Texas Instruments (TI) TPS929120-Q1. This is an automotive-grade 32-channel linear LED driver with a built-in watchdog timer, UART interface, Fail-Safe pin, and EEPROM. Turn Signal Hardwired Control Module: A simple MOSFET switching circuit controlled by the MCU's "PT1-IO" (functional safety I / O port). LED Light Board Module: Turn Signal LED Light Board: Composed of 24 red LEDs arranged in a light strip. Daytime running / position light LED board: Shares these 24 LEDs with the turn signals, but with lower brightness during operation. MOSFET control: The control terminal of the negative MOSFET of the turn signal is connected to the "PT1-IO" (turn signal control I / O port) of the MCU and the output terminal of the hard-wired control module through two anti-reverse diodes.

[0052] The normal operating procedure (before upgrade) includes: vehicle start, BCM sends a "light position lights" command via CANFD; the command is transmitted to MCU via SBC; MCU executes normal procedure: outputs a high level through "PT1-IO" to short-circuit the input of the turn signal hardwired control module to ground, disabling the backup path; sends a command to TPS929120 via UART: set all channel current to 50mA (low brightness) and enable output. The position lights are lit. Outputs a low level through "PT2-IO" to ensure the turn signal MOSFET is off (because the position lights and turn signals share the same LED, the turn signal function is not needed at this time). If the driver changes lanes and activates the right turn signal, the MCU commands TPS929120 via UART to generate a dynamic flowing effect; the MCU outputs a high level through "PT2-IO" to turn on the MOSFET, and the turn signal LED flashes with high brightness (300mA) in a flowing effect.

[0053] The OTA upgrade process includes: entering extended session mode: the MCU establishes a secure connection with the vehicle gateway via SBC, preparing to receive new software packages; switching to programming session mode: the MCU prepares to erase and write its own Flash. At this moment, the MCU begins executing the Bootloader program, and the core control application stops running; enabling backup control paths: a pre-written simple code in the Bootloader executes: pulling "PT1-IO" low. The turn signal hardwired control module is enabled, and the hardwired signal from the vehicle body can now be transmitted to the backend; pulling "PT2-IO" and the daytime running light control IO port low, disconnecting the grounding path of all light boards. Daytime running / position lights turn off. UART peripherals are turned off. The MCU no longer sends any instructions to the TPS929120, including the "feed the watchdog" instruction; the LED driver chip enters safe mode: the TPS929120's watchdog (assuming a timeout of 20ms) does not receive a "feed" and triggers a timeout; the chip stops normal operation and enters Fail-Safe mode. It no longer responds to UART commands, but instead constantly monitors the level of its Fail-Safe pin; hard-wired signal takeover control: Since the vehicle is in a parked upgrade state, the BCM automatically activates the hazard warning light function, sending a 12V, 1Hz square wave hard-wired signal to the left and right taillights; this signal is directly transmitted to the Fail-Safe pin of the TPS929120 through the enabled turn signal hard-wired control module; when the hard-wired signal is high (12V): the Fail-Safe pin is high, and the chip enters safety mode 1 (pre-configured in EEPROM): all 32 output channels are turned on; when the hard-wired signal is low (0V): the Fail-Safe pin is low, and the chip enters safety mode 2: all output channels are turned off; thus, the 24 turn LEDs in the taillights begin to flash synchronously at a frequency of 1Hz (instead of a flowing effect), just like traditional hazard warning lights.

[0054] The operation process after the upgrade is completed includes: If the software download and verification are completed in 5 minutes, the MCU will restart and rerun the updated application; the MCU will initialize, "PT1-IO" will output a high level again, and the hardwired control module will be disabled; the MCU will then control the TPS929120 again via UART, restoring full control of the lighting fixture.

[0055] In the above implementation, an innovative hardware backup path ensures reliable operation of the hazard warning light function under any conditions, greatly improving the vehicle's safety performance during upgrade scenarios. It fundamentally solves the major safety hazard of turn signal failure caused by the main control program stalling during OTA upgrades in single-core MCU lighting systems. By fully utilizing the inherent safety characteristics of existing vehicle hardware (such as hardwired turn signals) and LED driver chips (such as Fail-Safe mode), advanced safety redundancy is achieved simply by adding low-cost circuitry (such as MOSFETs, diodes, and resistors). It eliminates the need for expensive dual-core lockstep MCUs or complex external monitoring units, achieving high-value-added safety features while maintaining extreme cost control. The hardwired backup control path has a fast response speed, is unaffected by complex MCU software states, and has extremely high reliability. Simultaneously, through clever circuit design (such as "OR logic" composed of anti-reverse diodes), seamless and non-interfering switching between the main control and backup paths is achieved, ensuring that the mutual exclusion logic between turn signals and other functional lights (daytime running lights, position lights) works effectively in both modes. During OTA upgrades, the system automatically turns off the daytime running lights / position lights, leaving only the hazard warning lights flashing. This meets the user's expectations for the vehicle's safety status, avoids confusion caused by incorrect light signals, and provides a professional and reliable user experience.

[0056] It is worth mentioning that all modules involved in this embodiment are logical units. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by this invention; however, this does not mean that other units are absent from this embodiment.

[0057] Example 2 Please see Figure 4 The above is a flowchart of a safety control method for turn signals in OTA mode provided by an embodiment of the present invention.

[0058] As an example, the method is applied to the safety control system for turn signals in OTA mode as described in Embodiment 1, and the control method includes: In normal operating mode, the MCU main control module controls the LED driver module through serial communication and disables the turn signal hardwire driver module.

[0059] When switching to OTA upgrade mode, the MCU main control module switches to encoding session mode, enables the turn signal hardwired driver module, and disables the serial communication.

[0060] When the LED driver module enters the safety mode, its output state is determined by the level of the turn signal hardwired signal transmitted from the vehicle body turn signal hardwired driver module to the Fail-Safe pin, thereby driving the turn signal LED module to flash.

[0061] After the OTA upgrade is completed, the system restarts and returns to normal working mode.

[0062] It is not difficult to see that this embodiment is a method embodiment corresponding to the first embodiment, and this embodiment can be implemented in conjunction with the first embodiment. The relevant technical details mentioned in the first embodiment are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the first embodiment.

[0063] Example 3 This invention also proposes a storage medium storing a safety control method for turn signals in OTA mode. When the turn signal safety control program in OTA mode is executed by a processor, it implements the steps of the safety control method for turn signals in OTA mode as described above. Since this storage medium employs all the technical solutions of the above embodiments, it possesses at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be elaborated upon here.

[0064] Example 4 Please see Figure 5 The present invention also provides an electronic device, including: a memory and a processor; the memory stores at least one program instruction; the processor loads and executes the at least one program instruction to implement the safety control method for turn signals in OTA mode provided in Embodiment 2.

[0065] The memory 702 and processor 701 are connected via a bus, which may include any number of interconnecting buses and bridges, connecting various circuits of one or more processors 701 and memory 702 together. The bus may also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 701 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to processor 701.

[0066] Processor 701 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 702 can be used to store data used by processor 701 during operation.

[0067] The above descriptions are merely embodiments of the present invention. Commonly known structures and characteristics are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, based on the guidance provided in this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. A safety control system for turn signals in OTA mode, characterized in that, The safety control system includes: a vehicle body control system, an LED drive control module, and an LED light panel module; The vehicle body control system integrates a CAN communication module and a hardwired body turn signal. The CAN communication module is used to send CANFD signals; the hardwired body turn signal is used to provide a hardwired control signal for illuminating the turn signal when the vehicle lights switch to OTA upgrade working mode. The LED drive control module integrates an MCU main control module, an LED drive module, and a turn signal hard wire drive module. The MCU main control module is used to control the vehicle lights to switch between normal operation mode and OTA upgrade mode based on the received CANFD signal. When the vehicle lights are switched to normal operation mode, the MCU main control module controls the LED driver module to light up the LED light panel module through the serial port and turns off the turn signal hardwire driver module through the steering function safety I / O port. When the vehicle lights are switched to OTA upgrade mode, the MCU main control module turns on the turn signal hardwire driver module through the steering function safety I / O port and turns off the serial communication. The turn signal hardwire driver module controls the LED driver module to light up the LED light panel module according to the turn signal hardwire signal of the vehicle body. The LED light panel module integrates a turn signal LED module and a daytime running / position light LED module. The negative terminals of both modules are grounded through a MOSFET, which is used to perform corresponding lighting actions based on the control signals sent by the LED driver module.

2. The safety control system for turn signals in OTA mode according to claim 1, characterized in that, The vehicle body control system also integrates a power supply module, and the LED drive control module also integrates an SBC module and a BUCK module. The power supply module supplies power to the MCU main control module through the SBC module, and supplies power to the LED drive module through the BUCK module.

3. The safety control system for turn signals in OTA mode according to claim 2, characterized in that, The SBC module is also used to receive the current status information of the lamps from the MCU main control module and transmit the information to the vehicle body control system via CANFD signal to realize real-time interaction of lamp status.

4. The safety control system for turn signals in OTA mode according to claim 1, characterized in that, The LED driver module consists of a linear constant current chip, which has a built-in EEPROM and watchdog module. The EEPROM pre-stores the output channel parameters corresponding to safety mode 1 and safety mode 2. When the watchdog module times out and there is no serial port UART feed signal, the linear constant current chip enters the safety mode and calls the corresponding parameters in the EEPROM according to the Fail-Safe pin level to switch to safety mode 1 and safety mode 2. Safety mode 1 is to turn on all channel outputs to illuminate the turn signals, and safety mode 2 is to turn off all channel outputs to extinguish the turn signals.

5. The safety control system for turn signals in OTA mode according to claim 4, characterized in that, The Fail-Safe pin level of the LED driver module is linked to the hard-wire signal of the vehicle turn signal. When the hard-wire signal of the vehicle turn signal is high, the Fail-Safe pin is high, and the LED driver module enters safety mode 1. When the hard-wire signal of the vehicle turn signal is low, the Fail-Safe pin is low, and the LED driver module enters safety mode 2, so that the turn signal flashes at the frequency of the hard-wire signal.

6. The safety control system for turn signals in OTA mode according to claim 1, characterized in that, The turn signal hardwired driver module includes an input terminal and an output terminal. The input terminal is connected to the turn signal hardwire of the vehicle body and the steering function safety I / O port of the MCU main control module. The output terminal is connected to the Fail-Safe pin of the LED driver module and the MOSFET control terminal of the turn signal LED board, respectively. When the vehicle lights switch to normal operating mode, the MCU main control module turns off the turn signal hardwired driver module by pulling the steering function safety I / O port high. When the vehicle lights switch to OTA upgrade operating mode, the MCU main control module turns on the turn signal hardwired driver module by pulling the steering function safety I / O port low, so that the turn signal hardwire of the vehicle body is transmitted to the Fail-Safe pin and the MOSFET control terminal of the turn signal LED module.

7. The safety control system for turn signals in OTA mode according to claim 1, characterized in that, A first anti-reverse diode is connected in series between the MOS transistor control terminal of the turn signal LED module and the steering function safety I / O port of the MCU main control module, and a second anti-reverse diode is connected in series between the MOS transistor control terminal of the turn signal LED module and the turn signal hard-wired driver module. When the steering function safety I / O port of the MCU main control module outputs a valid signal or the turn signal hard-wired driver module outputs a valid signal, the MOS transistor of the turn signal LED module can be turned on, so that the turn signal LED module is grounded and lit.

8. The safety control system for turn signals in OTA mode according to claim 1, characterized in that, The turn signal LED module and the daytime running / position light LED module share the same light-emitting surface and are mutually exclusive in function. Their negative MOSFETs are controlled by the same functional safety I / O port of the MCU main control module.

9. The safety control system for turn signals in OTA mode according to claim 1, characterized in that, The turn signal hardwired drive module includes a level conversion and drive circuit for converting the voltage of the vehicle body turn signal hardwired signal into a signal that matches the level required by the Fail-Safe pin of the LED drive module.

10. A safety control method for turn signals in OTA mode, the method being applied to the safety control system for turn signals in OTA mode as described in any one of claims 1-9, characterized in that, The control method includes: In normal operating mode, the MCU main control module controls the LED driver module through serial communication and disables the turn signal hardwire driver module. When switching to OTA upgrade mode, the MCU main control module switches to encoding session mode, enables the turn signal hardwired driver module, and disables the serial communication. When the LED driver module enters the safety mode, its output state is determined by the level of the turn signal hardwire signal transmitted from the vehicle body to the Fail-Safe pin through the turn signal hardwire driver module, thereby driving the turn signal LED module to flash. After the OTA upgrade is completed, the system restarts and returns to normal working mode.

Images