Electromagnetic compatibility and radio frequency coexisting architecture

Abstract

The invention relates to an electromagnetic compatibility and radio frequency coexistence framework, and belongs to the technical field of vehicle-mounted display and electromagnetic compatibility. The device comprises a display module and a control system which are arranged outside a vehicle body, the control system is provided with a cooperative control unit, an electromagnetic interference suppression module and a running state monitoring and adjusting module to form a closed-loop framework, and the closed-loop framework is used for dynamically managing display signals, power and a time sequence in the running process of the vehicle, suppressing conduction and radiation interference and controlling the running state of the vehicle. And the coexistence performance of the external display and the vehicle-mounted radio frequency system is ensured, and the electromagnetic compatibility regulations are met. Further, the system comprises an integrated topology unit, a coexistence monitoring unit and a strategy execution unit, driving time sequence shaping, backflow path constraint and power supply ripple shaping are achieved, and when interference exceeds a threshold value, the system is switched to a controlled display state. A shielding-grounding-filtering three-in-one layout and a driving time sequence shaping unit can be adopted. According to the invention, the safety and reliability of external display in the aspects of electromagnetic compatibility, radio frequency coexistence and service life management are ensured.

Description

Technical Field

[0001] This invention relates to the field of automotive display technology, specifically to an architecture that allows for both electromagnetic compatibility and radio frequency coexistence. Background Technology

[0002] With the development of intelligent connected vehicles, external display modules are increasingly being used for information interaction and advertising. However, these display devices are prone to electromagnetic interference when operating simultaneously with onboard radio frequency systems (such as antennas, wireless communication modules, and vehicle buses). Existing display systems have high-frequency drive signals and large switching transients, which can easily couple to the onboard radio frequency link through conduction or radiation, leading to degraded communication quality, link interruption, or failure to meet vehicle electromagnetic compatibility (EMC) regulations.

[0003] Meanwhile, the vehicle-mounted radio frequency (RF) system operates in different frequency bands, power levels, and time slots. Its operational status lacks effective coordination with the external display module, often requiring sacrifices in either display or RF performance, making coexistence optimization difficult. Traditional measures such as simple shielding or filtering often lack global control over high-frequency ripple, return path, and dynamic interference, presenting limitations. Therefore, establishing a collaborative control mechanism between the display module and the vehicle-mounted RF system, and constructing a closed-loop regulation through methods such as drive timing shaping, power supply ripple control, and return path constraints to achieve electromagnetic compatibility and coexistence between the vehicle's external display and the RF system, has become an urgent technical problem to be solved. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an architecture that enables both electromagnetic compatibility and radio frequency (RF) coexistence. The control system comprises a collaborative control unit, an electromagnetic interference suppression module, and an operational status monitoring and adjustment module, forming a closed-loop architecture. This architecture dynamically manages display signals, power, and timing during vehicle operation, suppressing conducted and radiated interference, ensuring the coexistence performance of the external display and the vehicle's RF system, and meeting RF regulations.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an architecture that allows for electromagnetic compatibility and radio frequency coexistence, comprising a display module (excluding the center console, seatbacks, passenger compartment, rear-seat television, roof-mounted advertising screen, and vehicle-mounted soft screen) and a control system, wherein,

[0006] The control system includes: a collaborative control unit, which communicates with the vehicle's external display module and related on-board radio frequency systems (including but not limited to wireless communication antennas, transceiver modules, and on-board bus interfaces), and dynamically manages the signal, power, modulation, and operating timing of the external display module during vehicle operation to reduce electromagnetic interference with the radio frequency system and ensure its coexistence performance; an electromagnetic interference suppression module, which reduces electromagnetic coupling effects, including conducted interference and radiated interference, in the signal and power paths between the external display module and the on-board radio frequency system; and an operating status monitoring and adjustment module, which automatically adjusts the operating mode of the external display module based on the vehicle's operating status, the radio frequency system's operating status, and the external electromagnetic environment, ensuring its operation meets vehicle electromagnetic compatibility regulations and radio frequency performance requirements. These modules constitute a closed-loop control architecture to ensure that the external display module always meets applicable electromagnetic compatibility and radio frequency coexistence regulations when operating simultaneously with the on-board radio frequency system. The collaborative management unit avoids high-power transmission or high-amplitude signal switching between the external display module and the on-board radio frequency system within the same time window through time slot multiplexing, spectrum allocation, or data scheduling. The electromagnetic interference suppression unit includes a multi-stage filtering network and a continuous conductive shielding structure. This shielding structure forms a closed grounding loop with the vehicle body, and electrical continuity is maintained at structural gaps via conductive elastic connectors. The operation status monitoring and adjustment module unit comprehensively judges the interference level based on RF link quality indicators (including signal-to-noise ratio, received power, and bit error rate) and EMI sensor output. The external display module's drive circuit features frequency jump control and pulse edge shaping to reduce harmonic components in the vehicle's RF-sensitive frequency band. The closed-loop control architecture has a self-learning algorithm that automatically optimizes signal scheduling strategies and filtering parameters based on historical interference events. When the system detects electromagnetic interference exceeding a preset threshold, it triggers a safety degradation mode, reducing the power output of the external display module or switching to a low-interference display template.

[0007] Further, the control system also uses a method to prevent traffic signal confusion, including: S1) obtaining a sequence of frames of the content to be broadcast on the vehicle's external display module; S2) performing cross-domain feature extraction on the sequence of frames to be broadcast, obtaining a first feature set that at least includes a color domain, a spatial graphics domain, and a temporal modulation domain; S3) performing similarity measurement and / or approximation discrimination on the first feature set with a reference library of legal traffic signals and law enforcement / emergency signals stored, obtaining a confusion risk score R; S4) adaptively determining a threshold T based on the vehicle driving / environment context; S5) when R≥T, blocking the output of the content to be broadcast on the vehicle's external display module, and / or automatically replacing the frames to be broadcast with a preset safe style before playing; when R<T, allowing playback. The reference library includes any one or more of the following: the red / yellow / green states of traffic lights and their temporal templates, warning / enforcement signals that alternate between red and blue and flash, spatial distribution templates of warning light strips / bee-eye arrays, geometric contours and icon templates of legal road signs, standard warning color matching and reflective level parameters, and time-frequency fingerprints of typical emergency vehicle light states. The cross-domain feature extraction includes: a) calculating statistical vectors and histograms of hue / saturation / brightness in a perceptually uniform color space; b) extracting shape / edge / corner and topological relationship features; c) performing spectral / wavelet analysis on the inter-frame brightness and chrominance sequences to obtain the flicker frequency, duty cycle, phase relationship, and harmonic ratio; d) performing robust hashing or deep embedding coding on local blocks to obtain appearance fingerprints. The similarity measurement includes at least two of template matching similarity, cosine similarity in a deep embedding space, robust perceptual hash distance, and temporal spectral similarity, and generates the confusion risk score R through weighted or learning-based fusion. The context includes at least one of vehicle speed, gear position, turn signal state, legal jurisdiction of the geofence, day / night / weather, road type, and traffic restriction rules, and the threshold T is adaptively adjusted according to the context. It also includes two-level discrimination of offline pre-review when accessing the content source and online inspection in the actual output link: offline pre-review is used to reject uploading or mark high-risk content; online inspection performs incremental detection and dynamic screen-off / replacement on the played frames with a sliding time window. When it is determined that R≥T, the safe style includes any one or more of the following: overall desaturation or hue shift to avoid legal color matching, a constant brightness animation without flicker, texturing / geometrization removal, reducing peak brightness / contrast, filling with an approved prompt graphic or solid color. The robustness improvement against bypass behaviors includes: a) keeping the similarity measurement unchanged or changing slowly for hue rotation, gamma change, white balance shift, low saturation, and grayscale conversion; b) spatially robust matching for scaling, rotation, perspective deformation, occlusion, and split-screen splicing; c) temporally robust discrimination for stroboscopic frequency shifting, phase perturbation, and pseudo-random flickering; d) local abnormal attention and regional entropy constraint for embedding traffic signs / lamp states in local areas.It also includes text and number recognition and semantic filtering to block cognitive misleading caused by simulating legal text / numbers / speed limits / directional arrows, etc.; the text recognition results and graphic / temporal discrimination jointly participate in risk score fusion. When a vehicle is equipped with multiple external display panels, cross-panel consistency discrimination is performed, and the waiting frames of each panel are spliced ​​or aggregated in the embedding space for unified discrimination to prevent circumvention of single-panel detection by scattered sub-patterns. A trust chain and whitelist mechanism is adopted: when the waiting content carries a security tag signed by the platform and the signature is valid and has not been revoked, fast passage is allowed; otherwise, it enters the full detection and audit path. It also includes fault / uncertainty fallback: when the model confidence is low or the detection link is abnormal, it is forced to enter a controlled display state, including unifying the security style or turning off the external display, until the recovery conditions are met. It also includes a vehicle external display anti-confusion system, comprising: a content access unit for receiving content to be played from mobile terminals / in-vehicle applications / the cloud; a feature extraction unit for calculating color, spatial, and temporal features of the waiting frame sequence; a similarity discrimination unit for matching features with a benchmark library and outputting a confusion risk score; a context awareness unit for collecting vehicle / environmental context and generating thresholds; a decision and execution unit for blocking or automatically replacing with a safe style and controlling the external display module when R≥T; an online inspection unit for performing incremental detection and dynamic intervention using a sliding time window during playback; an audit and signature verification unit for verifying content signatures, recording logs, and synchronizing with cloud policies / templates; and an external display module connected to the decision and execution unit to output the final display result. The similarity discrimination unit includes at least two of the following: a template matching engine, a deep embedding retrieval engine, a robust hash comparison engine, and a temporal spectrum analysis engine, and is configured to output a single risk score via a fusion processor. The context awareness unit interacts with map / regulatory services to load differentiated benchmark libraries and threshold strategies according to the legal domain, and dynamically switches between them when driving across regions. The online inspection unit performs time synchronization and cross-panel consistency checks on multiple panel frames to suppress false signals constructed through panel splicing. The audit and signature verification unit supports certificate rotation, revocation list issuance, offline caching, and minimum availability strategies, and triggers controlled display when verification fails. It also includes a security style library and mapping rule library to map frames deemed high-risk to alternative styles that do not cause confusion in color, brightness, geometry, and timing. The feature extraction unit includes a module for recognizing text / number / arrow direction and inputs the recognition results along with graphic, color, and strobe features into the fusion processor. The system provides an offline pre-review interface for batch review of content during upload and an online low-latency path for real-time discrimination during operation; both share the same audit and policy version. When the system detects link anomalies, model timeouts, or insufficient resources, it automatically enters controlled display mode and performs supplementary review and log retransmission after recovery.A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the computer to perform the steps of the method described above. A computer program product comprising program instructions stored on a non-transitory medium, which, when executed by a processor, cause the method described on the apparatus.

[0008] Furthermore, the control system also includes an advertising content distribution and billing system, comprising: a vehicle-side data acquisition module for acquiring sensor data on vehicle operating status and / or the external environment; a cloud-based processing platform for audience analysis based on the sensor data and, under the premise of meeting content compliance review, running an advertising bidding engine to generate placement decisions; a placement execution module connected to the vehicle's external display screen for rendering corresponding content according to the placement decisions after verifying the placement authorization information issued through the cloud-based processing platform; and a feedback and billing module for sending the actually displayed content information back to the cloud-based processing platform and triggering billing and settlement. The system is configured to only allow commercial content to be displayed on the vehicle's external display screen when the closed-loop process of vehicle sensing—cloud feedback—advertising distribution / bidding—content compliance review—placement execution—feedback billing is completed. If any step is missing or fails, the content is prohibited from being displayed, thus constituting a functional necessity. Content compliance review includes two levels: cloud review and vehicle-side local review. The vehicle-side local review performs a consistency check on content that has passed cloud review. The delivery authorization information includes a token that binds the delivery time, display area, brightness limit, and revocation attribute. The vehicle-mounted device interrupts display output when the token verification fails or expires. Audience analysis completes data anonymization and desensitization on the vehicle-mounted device, outputting only statistical characteristics to the cloud processing platform. The feedback and billing module generates display records containing content identifiers, playback duration, timestamps, and vehicle-mounted device signatures. The cloud processing platform only uses verified display records as the basis for settlement. When the network is unavailable, the vehicle-mounted device can only play locally cached content with offline authorization that does not exceed the preset playback limit. The delivery execution module includes hardware-level security gating circuits to physically block the display signal when the control token fails, compliance review fails, or policy violation occurs.

[0009] Furthermore, the control system also includes: a multi-terminal access module for receiving display control requests from two or more independent user terminals; a synchronization and arbitration module for generating a merged display output instruction based on a preset synchronization mechanism and arbitration rules among the multiple display control requests; and a display execution module connected to the vehicle's external display screen for presenting visual content on the vehicle's external display screen according to the display output instruction. The synchronization mechanism and arbitration rules include at least spatial allocation, time allocation, or a combination thereof control strategies, and the system is configured to prohibit the display of unauthorized content when valid authorization is missing, or when synchronization or arbitration conditions are not met, to ensure that no user can bypass the synchronization mechanism and arbitration rules to directly control the display output. The synchronization mechanism includes a globally unified time base for timestamping and aligning the display control requests of all user terminals. The arbitration rules include: a) allocating different areas of the vehicle's external display screen to different user terminals according to area division; and / or b) allocating the entire display screen to different user terminals at different time periods using a time-slice polling method. It also includes a token management module for issuing control tokens carrying spatial allocation, time allocation, validity period, and revocable attributes to authorized user terminals, and verifying the control tokens before display execution. It also includes an interoperability adaptation module to convert control requests from different communication protocols into a unified format and remove instruction parameters that do not comply with security policies. The synchronization and arbitration module discards a control request submitted by any user terminal that fails to arrive within a specified time window and maintains synchronized display content. The system dynamically adjusts or restricts multi-terminal control policies when vehicle speed, geographical location, or external environmental conditions meet specific conditions. The display execution module includes hardware-level security gating circuitry to interrupt the display signal when the control token is invalid, synchronization fails, or policy is violated. An auditing module is also included to generate signed display output records, serving as the sole basis for user behavior tracing and dispute resolution. Arbitration rules can be dynamically switched, including automatically switching between spatial and temporal allocation modes to optimize the multi-terminal experience.

[0010] Furthermore, the control system also includes: an integrated topology unit for coordinating control of the external display module in both the physical and circuit domains. This integrated topology unit simultaneously achieves: a) a three-in-one layout of shielding, grounding, and filtering, forming a composite network of continuous equipotentiality and multi-level filtering between the display module and the vehicle body structure; b) drive timing shaping, coordinating the time and frequency domains of the switching edges, scanning sequence, and modulation method of the display drive; c) return path constraint, guiding and closing the return path of high-frequency current to limit the return loop area and impedance; and d) power supply ripple shaping, performing spectral control and energy diversion on the ripple and common / differential mode noise of the display power supply. The coexistence monitoring unit is used to acquire the operating occupancy information and / or link quality indicators of the vehicle-mounted radio frequency system, and to detect the intensity of near-field or conducted interference. The strategy execution unit is communicatively connected to the integrated topology unit and the coexistence monitoring unit, and is used to adjust the three-in-one layout parameters, drive timing, return current constraints and power supply ripple shaping parameters in conjunction with the monitoring results, and to switch the external display module to a controlled display state when the interference exceeds the threshold. The integrated topology unit, the coexistence monitoring unit and the strategy execution unit constitute a closed-loop control architecture, so that the external display module meets the electromagnetic compatibility and radio frequency coexistence regulations applicable to vehicles when working simultaneously with the vehicle-mounted radio frequency system. The three-in-one layout includes: a shielding structure: a multi-layered shield covering the display back panel and edges, forming a continuous equipotential loop with the vehicle body via conductive elastic elements / conductive adhesive / braided tape; a grounding structure: ground seam stitching / via fence / 360° termination at structural joints, connected to the vehicle body's main grounding point in a star or planar low-impedance manner; and a filtering structure: a multi-stage filtering network of common-mode choke + differential-mode π / LC at the video / control / power path entrances. Driving timing shaping includes at least one of the following: edge slope limiting, spread-spectrum PWM / frequency jitter, row and column scanning phase misalignment, and grayscale mapping to eliminate spectral lines. Return path constraints include: gap bridging and cross-gap capacitors on the high-speed reference plane, providing nearby return closure at signal cross-layer locations via return via fences. Power supply ripple shaping includes at least one combination of spread-spectrum DC / DC, active / passive ripple cancellation, resonant notch filtering, and RC / RCD absorption. The strategy execution unit reduces the density of high di / dt events in the critical receive time slots of the vehicle RF system and suppresses drive harmonic stacking in the uplink transmit time slots. The coexistence monitoring unit jointly assesses the interference level based on RSSI / SINR / block error rate / retransmission rate and near-field EMI sensor output. Controlled display states include at least one of the following: reduced brightness, reduced refresh rate, frozen static safety template, and shutdown of high-frequency submodules. The three-in-one shielding structure employs 360° shielded termination + chassis-ground surround in the connector transition area. The filtering structure uses Y capacitors / bleeder networks in the common-mode current loop to limit high-frequency common-mode return current.The strategy execution unit collaborates with the vehicle data bus controller, employing bandwidth arbitration / TSN time slot planning to avoid overlap between high-activity periods and high-power wireless periods. The integrated topology unit adaptively reconfigures edge, spectrum, and return current parameters based on vehicle speed / gear shift / charging / high-voltage system mode / temperature. The system provides a test / calibration interface for injecting standardized disturbances and acquiring internal probe nodes to perform factory and in-service EMC self-tests and parameter recalibrations. Power supply ripple shaping creates programmable notches in the corresponding sensitive frequency bands of GNSS / cellular / Wi-Fi / C-V2X to suppress noise spectral lines. Return current path constraints provide shielding continuity and equipotential bonding for flexible interconnects at moving parts (doors / trunk) to reduce gap radiation. Drive timing shaping applies frame / subframe phase reversal to Mini / Micro LED scanning and OLED active matrix driving respectively to reduce peak spectral line superposition. The three-in-one grounding structure achieves compatibility between low-frequency equipotential bonding and high-frequency return current guidance through a frequency-selective grounding network between multi-point parallel grounding and single-point reference. The vehicle includes an electromagnetic compatibility control system, and the external display module is integrated with the vehicle's external cover and connected to the vehicle body through a low-impedance grounding path to reduce return current path impedance and structural radiation. The integrated carrier and the vehicle body structure together constitute a part of the Faraday cavity and meet both collision and environmental durability requirements. It also includes an electromagnetic compatibility control method for the coexistence of the vehicle's external display and the vehicle's radio frequency system, including: (1) collecting radio frequency occupancy and link quality and electromagnetic interference intensity; (2) calculating and issuing an integrated topology parameter set based on the collected results, which simultaneously performs linkage configuration for the three-in-one layout, drive timing, return path and power supply ripple; (3) performing edge / spectrum / phase / power shaping according to the parameter set and maintaining shielding and grounding continuity; (4) monitoring the interference threshold and switching to the controlled display state when the threshold is exceeded; (5) automatically reverting to the normal display mode and updating the parameter model after the interference is recovered. Step (2) implements time avoidance within the critical receiving window of the vehicle wireless and applies a programmable notch to the power supply ripple. Step (3) involves placing a return via fence / slit capacitor at the signal cross-layer location to close the nearest return current. It also includes performing self-calibration and updating the parameter mapping from step (2) under different temperatures / power supply / vehicle conditions.

[0011] Furthermore, the control system also includes an integrated electromagnetic compatibility topology system coexisting with the vehicle-mounted radio frequency system, comprising: a collaborative control unit, communicatively connected to the external display module and the vehicle-mounted radio frequency system (including at least one of the vehicle-mounted antenna, wireless transceiver unit, and / or vehicle-mounted data bus), for coordinating display driving and radio frequency operation during vehicle operation; and a shielding-grounding-filtering three-in-one layout constructed in the power supply and signal interface of the external display module and its perimeter area, wherein: (a) the shielding body forms a geometrically and electrically continuous equipotential shell with the vehicle body; (b) the grounding network provides a low-impedance, constrained return path and limits the high-frequency loop area; and (c) filtering and / or impedance shaping. A network is deployed at the power supply and signal boundaries to suppress common-mode and differential-mode interference. A drive timing shaping unit is used to time-disperse and window-avoid the display's frame / row / column scanning, PWM modulation, and switching edges to reduce equivalent emission in RF-sensitive time slots. A power supply ripple shaping and power constraint unit is used to control the ripple spectrum and redistribute harmonic energy of the display power supply. This three-in-one layout, drive timing shaping, and return path constraint together constitute a single controlled electromagnetic loop topology. Under the closed-loop scheduling of the cooperative control unit, the external display module and the vehicle-mounted RF system meet applicable vehicle electromagnetic compatibility and RF coexistence regulations under any legal operating state. The shielding includes at least one of conductive elastic seals, a metal braided mesh, a conductive coating, or a metallized backplate, and is connected to the vehicle body via multi-point equipotential bonding. The grounding network has stitched vias / ground fences and conductive bridges at the perimeter of the display module, and uses gap stitching at structural joints to suppress gap radiation. The filtering and / or impedance shaping network includes a cascaded combination of a common-mode choke and a differential-mode LC / π filter, with distributed decoupling across different self-harmonic frequency bands. The power supply ripple shaping and power constraint unit includes at least one of spread-spectrum DC / DC converters, edge slowing, absorption / damping networks, and current slope limiting. The drive timing shaping unit implements refresh phase misalignment, frequency jitter, harmonic notches, and critical time slot muting to avoid critical RF uplink / downlink windows. Return path constraints limit high-frequency loop area and reduce common-mode current by specifying a reference plane, differential coupling control, and return via proximity. The cooperative control unit performs bandwidth allocation and priority arbitration on the vehicle data bus, using Time-Sensitive Networking (TSN) or time slot allocation to avoid overlap between high-activity periods and high RF occupancy periods. The cooperative control unit and the vehicle RF system exchange frequency band / subband occupancy maps, transmit power, and TDD ratio information through a protocol adaptation layer to achieve cross-system coexistence. The three-in-one layout and power supply ripple shaping unit form a closed electromagnetic barrier ring at the power input, signal input, and module perimeter. It provides near-field EMI sensing and link quality monitoring; when interference levels exceed a threshold, the display switches to a controlled display state (at least one of brightness reduction / refresh rate reduction / template freezing / high-frequency drive shutdown), and automatically reverts to normal operation when recovery conditions are met.Test and in-service calibration interfaces are configured to inject standardized interference or collect data from internal monitoring nodes, performing factory / maintenance EMC self-tests and parameter recalibrations. The DC resistance and high-frequency impedance of the grounding connection are limited to preset thresholds and remain stable under vibration / temperature cycling conditions. The shielding and vehicle body together form part of a Faraday cavity, employing honeycomb or frequency-selective surfaces at openings / windows to balance heat dissipation / acoustic ventilation and shielding effectiveness. Differential video lines use controlled impedance and internal delay matching, and maintain common-mode suppression at cross-zone / cross-layer locations with equal length and adjacent return vias. Spread spectrum and timing jitter parameters are adaptively adjusted based on the environmental electromagnetic spectrum and vehicle operating conditions, and optimized through model prediction. It also includes an electromagnetic compatibility control method for the coexistence of vehicle external display and vehicle radio frequency system, including: (1) constructing a shield-grounding-filtering three-in-one layout at the display power supply and signal boundary and perimeter and applying return path constraints; (2) collecting near-field EMI / return current indicators and radio frequency link quality; (3) implementing phase misalignment, time slot avoidance and edge shaping for display drive switching timing according to radio frequency occupancy map and vehicle operating conditions; (4) performing ripple spectrum control on display power supply and limiting high frequency di / dt events; (5) entering controlled display state when the disturbance exceeds the threshold, and returning to normal mode when the recovery conditions are met. In step (1), continuous equipotential of the perimeter is achieved through ground fence / stitched via and conductive seal; in step (4), ripple redistribution is performed through spread spectrum DC / DC+ distributed decoupling. In step (3), refresh silence / harmonic notch strategy is executed according to TDD ratio or up / down critical window and linked with bus arbitration. Steps (2)–(5) are closed-loop iterations, and timing and ripple shaping parameters are updated through self-calibration.

[0012] Furthermore, the display module also includes: a security domain control unit, running in a trusted computing environment, controlling the arbitration policies, hardware gates, and controlled templates related to display; non-security domain application units, including applications and / or services for content creation / arrangement / deployment, used only to submit display requests to the security domain control unit; a display path execution unit, including video signal interfaces, compositing / overlay circuits, and power supply control interfaces; and an inter-domain communication and enforcement gateway, located between the security domain control unit and the non-security domain application units, used to perform format verification, frequency limiting, and signature verification on requests, and to issue approved display authorization tokens to the display path execution unit. The system executes request-authorization-execution according to a unified arbitration state machine: any external display control signal must first be generated by the non-security domain to form a display request, which is then arbitrated by the security domain based on policies to generate a display authorization token with time / brightness / region / type constraints. The display path execution unit renders the corresponding content only if the token is valid and has not been revoked. If there is no authorization or an anomaly is detected, the security domain preempts and switches to a controlled display template or an off state with the highest priority. The security domain control unit and the non-security domain application unit are physically or logically isolated on the processor / memory / bus / I / O, and implement least privilege access control through **IOMMU / MPU / kernel strong isolation / Trusted Execution Environment (TEE)**. The display path execution unit includes a video hardware gate and / or pixel bus multiplexer / overlay unit exclusively controlled by the security domain. It is located on the serial critical path and physically blocks or overlays any video / pixel stream from the non-security domain to prevent direct drive bypass. The display authorization token includes content category, allowed area, maximum brightness / duty time, duration, update cycle, content fingerprint, and revocation count; the token is a short-term lease and needs to be renewed periodically, automatically expiring upon expiration. The non-security domain application unit only submits request metadata (type / duration / area / priority / compliance template index, etc.) and is not allowed to include raw pixel frames to bypass the security domain; pixel content is synthesized by the security domain or issued through the gate after fingerprint / signature verification within the security domain. The security domain sets absolute priority for external display control signals; in the event of a security event or policy conflict, the security domain can forcibly preempt and switch to the controlled display template within a single frame cycle. The security domain control unit has a built-in controlled display template library, which includes at least: static low brightness, uniform pattern, and off, and sets upper limits for brightness, color gamut, refresh rate, and PWM spectrum. The arbitration strategy is dynamically adjusted based on at least one of the following: vehicle status (speed / gear / steering / lights), location / time period / geofencing, ambient light / weather, neighbor vehicle density, and regulatory list. Inter-domain communication and the law enforcement gateway only accept requests with valid signatures originating from whitelisted applications; the security domain maintains a revocation list, and issued tokens can be revoked immediately. Rate limits, cooldown times, and quotas are set for requests from the same application / region; exceeding the threshold triggers latching and entry into the controlled template.When a security domain fails to start, policy verification fails, or inter-domain communication fails, the system defaults to being controlled (template or off) and rejects any display requests from non-security domains. The security domain signs and records request summaries, arbitration decisions, token parameters, preemption events, and recovery conditions, and can report these via a secure channel. Updates to the security domain policy and template library must meet dual-signature verification and rollback windows; in case of update anomalies, the existing policy is maintained and the controlled state is preserved. When multiple display surfaces exist, the security domain implements cross-surface synchronization for template switching and token activation, prohibiting fragmented states of partial dynamics and partial statics. Dual-domain arbitration is effective under any power supply method: vehicle high / low voltage, external charging, portable power supply, or V2L. Inter-domain communication and the law enforcement gateway detect unknown playback source access, video path topology changes, or pixel timing anomalies; if bypass is detected, the system immediately enters a controlled template and triggers an alarm. The security domain control unit enables secure startup, metric startup, and key hardware protection, and implements anti-rollback counting for the inter-domain gateway firmware. Inter-domain communication uses at least one of CAN / CAN FD, Ethernet, LIN, UART, or GPIO; the display path can be at least one of MIPIDSI / eDP / LVDS / parallel RGB / Ethernet video. It also includes a dual-domain arbitration method for vehicle external displays, comprising: S1, a non-security domain application forms a display request and submits it through the inter-domain gateway; S2, the security domain performs signature / whitelist / frequency verification on the request and arbitrates according to the scenario policy, generating a display authorization token with constraint parameters or rejecting it; S3, the display path execution unit renders only when the token is valid; S4, when a risk or conflict is detected, the security domain preempts the display and switches to a controlled template; S5, the event is recorded and preemption is released after the set of recovery conditions is met. Recovery conditions include at least one of diagnostic recovery, stabilization time window, manual confirmation, an empty revocation list, and geofence exit; and hysteresis / counting / cooling is set for releasing preemption to avoid jitter. The non-security domain must renew the token before it expires; if renewal fails, it automatically enters the controlled template. It also includes a dual-domain arbitration and enforcement gateway for the vehicle's external display system, comprising: a request verification unit: performing signature, whitelisting, and frequency verification on display requests from non-security domains; a policy arbitration unit: generating display authorization tokens according to security policies; a hardware gate control unit: controlling video blocking / overlay and power supply interfaces, allowing access only when the token is valid; and a recording and reporting unit: signing, recording, and reporting arbitration and preemption events. The gateway provides independent, retrofittable dual-domain arbitration and enforcement capabilities for the external display without altering other vehicle functions. Its form factor is one of wiring harness inline type, connector tail type, or independent box type, and it interacts with at least one bus in CAN / Ethernet; the video path supports both series gate and overlay direct control forms.

[0013] Furthermore, the display module also includes: a compliance policy management unit for receiving, verifying, and executing compliance policy packages; an inter-domain enforcement gateway, located between the secure and non-secure domains, for implementing tokenized authorization and forced interception of external display requests based on the compliance policy package; and a display path execution unit, including a video signal path and a power supply control interface. The compliance policy package is a set of policies signed by an authorized issuer, containing at least regional policies, content / publisher blacklists / whitelists, revocation lists, and an effective time window. The system only issues a display authorization token to the display path execution unit to allow rendering of the corresponding content when the policy package signature is valid, not revoked, and within the effective window. If any condition is not met, the inter-domain enforcement gateway preempts the display path execution unit with the highest priority and puts it into a controlled display state (static low brightness, uniform pattern, or off). The compliance policy package includes: a header (issuer identifier, KeyID, version number, scope of application, device / vehicle series binding information), a body (regional rules, blacklists / whitelists, scene thresholds, conflict handling rules), and a footer (signature and digest); and optionally includes differential update information and a revocation list version pointer. Policy package signatures employ at least one of ECDSA / RSA / EdDSA; t / n threshold multi-signature and chained signatures are allowed for cross-agency co-management. Policy packages and revocation lists contain monotonically increasing counters / version and device binding identifiers; the compliance policy management unit performs rollback checks on versions and refuses installation when device bindings do not match. Revocation mechanisms include whole package revocation, issuance key revocation, and entry-level whitelist / blacklist revocation; once a revocation list is hit, the issued display authorization token immediately becomes invalid and a controlled display is triggered. The effective window is described by NotBefore / NotAfter, with time derived from a hardware secure clock and cross-validated with GNSS / network time and a monotonically increasing counter; the strictest compliance mode is entered when time is unreliable or a rollback occurs. Geographic policies are represented by a set of geofences, based on GNSS+IMU+map matching fusion positioning; conservative policies are executed when positioning is uncertain or deviations exceed limits. For multiple packages coexisting or rule conflicts, the strictest priority is applied; when an emergency policy package exists, the emergency package has the highest priority within its effective window. The inter-domain enforcement gateway issues a short-term display authorization token for each display action. The token includes the content category, publisher fingerprint, allowed area, maximum brightness / duty time, duration, revocation count, and link digest. The token automatically expires if not renewed. Non-secure domains can only submit display requests. The compliance policy management unit arbitrates and generates tokens based on policy packages. The display path execution unit renders only when the token is valid and is physically enforced by a hardware gate connected in series on the video / power supply path. The whitelist is represented by the publisher certificate chain / application signature, and the blacklist is represented by the content fingerprint / category tag; the fingerprint uses at least one of hash / perceptual hash / fragment fingerprint.Policy packages can be distributed via any channel: cellular, Ethernet, Wi-Fi, or USB. Once offline access exceeds the offline threshold TTL or the revocation list expires, the package enters controlled display. Pre-configured offline emergency policy packages are available, with strict window and region restrictions. Policy package installation uses A / B partitioning and atomic switching; in case of verification failure or power outage, it rolls back to the previous valid version. Root certificates and issuance keys are hosted in hardware security modules / security elements, supporting key rotation; once the root key is revoked, all downstream packages are forcibly invalidated. Policy entries can constrain variables such as time period, weather, vehicle speed / gear, neighbor vehicle density, and ambient light; arbitration follows the strictest compliance mode. Inter-domain enforcement gateways monitor video path topology changes, pixel timing / bandwidth anomalies, and unknown source access; once bypassing or external direct drive is detected, the token is immediately revoked and the package enters controlled display. The compliance policy management unit and inter-domain enforcement gateways enable secure boot / metric boot and firmware signing; upon detecting metric deviations, execution is refused and reported. The system records the policy package ID / version, signature verification results, revocation hits, token issuance and preemption events through a secure channel, forming a non-repudiable audit chain. Multiple external display surfaces execute policy packages and token activation / revocation synchronously across surfaces to avoid local inconsistencies. It also includes a method for signing, distributing, and revoking compliance policy packages for vehicle external displays, including: S1, receiving the compliance policy package and verifying its signature and integrity based on root trust; S2, verifying device binding, version rollback, activation window, and region adaptation; S3, synchronizing or querying the revocation list, rejecting installation or immediately deactivating it if a match is found; S4, arbitrating external display requests based on valid policy packages and issuing short-term display authorization tokens; S5, rendering the display path only when the token is valid; S6, entering a controlled display state and recording / reporting events when the time is unreliable, the location is uncertain, revocation / update fails, or bypassing is suspicious. Policy packages use differential / block downloading and phased canary release; if any phase fails, it automatically rolls back and maintains the existing valid package. The system employs a hardware monotonic counter and multi-source time / location consistency verification to resist time rollback and location spoofing; if consistency fails, the most stringent compliance is executed and high-frequency re-verification is triggered. It also includes a compliance enforcement gateway for the vehicle's external display system, comprising: a policy verification unit: verifying the signature, windowing, and revocation of the compliance policy package; a token issuance unit: generating a short-term token for the external display request based on the policy package; a hardware gate control unit: connected in series on the video / power supply path, allowing access only when the token is valid; and a log and reporting unit: recording and reporting verification and revocation events with signatures. The gateway provides independent signature distribution and revocation enforcement capabilities for the external display without altering other vehicle functions. The gateway is in the form of an in-line wiring harness, a connector-end type, or a standalone enclosure, and communicates with at least one in-vehicle bus, either CAN or Ethernet. A computer-readable storage medium stores a program that, when executed by a processor, enables the system to perform the above-described method steps.

[0014] Furthermore, the control system also includes: an in-service parameter acquisition unit, which communicates with the vehicle's external display module, power and thermal management, vehicle bus, and environmental sensors, for acquiring in-service parameters reflecting display aging and operating conditions during vehicle operation; a lifespan prediction and remote diagnostic unit, deployed on a remote diagnostic service and / or on-board computing platform, for establishing a health / remaining lifespan (RUL) model of the display module based on the in-service parameters and outputting lifespan prediction results and degradation zone identification information; and a drive parameter adaptive unit, which communicates with the display timing controller / current driver / backlight or pixel controller, for adjusting the brightness limit, drive current / voltage, and other parameters according to the lifespan prediction results. At least one of the following parameters is automatically adjusted: duty cycle, refresh rate, and local dimming / color recalibration; a verification and feedback unit is used to perform closed-loop verification of indicators such as optical stability / color shift / thermal boundary / current ripple after parameter adjustment, and to feedback the in-service parameters, life prediction results and verification data to the remote diagnostic service via wired or wireless network for archiving and continuous optimization; wherein, the in-service parameter acquisition unit, life prediction and remote diagnostic unit, drive parameter adaptive unit and verification and feedback unit constitute an in-service parameter acquisition-model prediction-automatic adjustment-verification feedback closed-loop control architecture, so that the external display module can achieve predictable life and in-service life extension while meeting applicable regulations and image quality requirements. In-service parameters include at least one of the following categories: electrical parameters (drive current / voltage, duty cycle, rise / fall time, peak di / dt, ripple spectrum), thermal parameters (junction temperature / backplane temperature, temperature gradient, thermal cycle count and dwell time), optical parameters (face brightness / contrast, color coordinates, regional uniformity, Δu′v′ / ΔEab, pixel / zone attenuation map), environmental parameters (ambient illuminance / UV dose, humidity, salt spray, rain / snow, vibration / shock), and operating condition parameters (APL distribution, content type statistics, power-on duration and cycle count). The lifespan prediction and remote diagnostic unit employs a combination of physical failure mechanism models and / or data-driven models, including acceleration factors and cumulative damage assessment, and performs online adaptive testing based on in-service data. The drive parameter adaptive unit supports zone / subpixel / pixel-level differential compensation and implements regional constraints on color recalibration and local brightness limits to suppress uneven aging. The verification and feedback unit executes controlled display states based on Health Index (HI) and RUL thresholds. These controlled display states include at least one of the following: reduced brightness, limited current, reduced refresh rate, frozen templates, or restriction of high APL content. The system provides an in-service self-calibration interface, periodically recalibrating the luminance-chromaticity-temperature mapping and current-luminance conversion relationship via built-in / external optical and temperature reference sources. The remote diagnostic service performs group modeling / federated learning based on in-service data from multiple vehicles, and distributes the updated model to the vehicle using digital signatures and version control.The adaptive drive parameter unit meets regulatory brightness limits, glare constraints, and energy consumption constraints during adjustments, and optimizes the balance between image quality, lifespan, and energy consumption through a strategy engine. The system synchronizes estimated maintenance windows, fault codes, and component replaceable units (FRU) recommendations to the fleet management / maintenance platform via remote diagnostic services. Communication and OTA upgrades employ end-to-end authentication, encryption, and integrity verification, and ensure in-service safety through parameter rollback and dual-partition mechanisms. Differentiated lifespan sub-models are established for LED / Micro-LED, OLED, LCD, or projection displays, addressing current aging, color point drift, backlight decay, polarizer / liquid crystal degradation, or optomechanical dust and fogging. The in-service parameter acquisition unit performs edge-side data downsampling / characterization and privacy protection processing, uploading only features and health summaries to reduce bandwidth and protect data. The system performs multi-factor coupled lifespan regression on thermal cycle counts, residence time, UV dose, and high humidity exposure to capture the combined effects of external environment on lifespan. The steps of parameter adjustment → indicator retesting → comparison with thresholds → continued fine-tuning or entering a controlled state are time-sequentially ensured to be completed within the configurable maximum closed-loop delay. The remote diagnostic service maintains traceable audit logs, recording in-service parameters, model versions, adjustment strategies, and validation results for compliance audits and quality traceability. The system implements content orchestration restrictions or pixel rotation / jitter (pixel shift) for high-risk areas / pixels to reduce the rate of localized over-aging. It also includes a remote diagnostic and life prediction method for vehicle external displays, including: (1) collecting in-service parameters of electrical-thermal-optical-mechanical-environmental-operating conditions during vehicle operation; (2) calculating the health and remaining life of the display module and identifying degradation areas based on the parameters on a remote diagnostic service and / or on-board computing platform; (3) automatically adjusting at least one of the following parameters of the display module: upper limit of brightness, driving current / voltage, duty cycle, refresh rate and color recalibration, based on the life prediction results; (4) performing closed-loop verification of the adjusted optical and electrical-thermal indicators; (5) back-archiving the in-service parameters, life prediction results, adjustment and verification data and using them for model updates; (6) entering a controlled display state and generating maintenance recommendations when the health or RUL is below a threshold. Step (2) adopts a hybrid modeling of physical mechanism + data-driven approach, and completes online adaptive / transfer learning updates in step (5). Step (3) performs differential adjustments by partition / pixel level, and constrains regional uniformity and color difference in step (4). Step (1) involves characterizing and anonymizing the in-service parameters before uploading them. Steps (3) and (4) satisfy the regulatory boundary conditions for brightness / glare / energy consumption.

[0015] Furthermore, the display module also includes: a display execution module; a diagnostic unit for online diagnostics of electrical, communication, content, and environmental safety parameters related to the display; an isolation / execution unit for implementing electrical isolation, power limiting, and controlled shutdown of the power supply and / or video signal path of the display execution module; a safety template generation unit for generating controlled display templates without relying on external content sources, wherein the controlled display templates include at least one of static low brightness, uniform pattern, and off; and a preemption and recovery management unit, communicatively connected to the diagnostic unit, the isolation / execution unit, and the safety template generation unit, for performing closed-loop control based on a unified safety state machine, namely fault diagnosis → isolation → controlled display template → condition fulfillment and recovery, and preempting any ordinary display content with the highest priority. Specifically, when any abnormality or risk occurs, the preemption and recovery management unit forcibly issues a controlled display template to the display execution module and ensures that ordinary content cannot be displayed through the isolation / execution unit, releasing the preemption and restoring normal display only when the recovery condition set is met and the anti-jitter criterion is passed. Anomalies or risks include at least one of the following: power supply anomaly, overvoltage / undervoltage / overcurrent, insulation or grounding failure, overtemperature, suspected packet loss or tampering in communication, content review failure, human-caused risks due to vehicle speed / gear / ambient light, plugging / unplugging / maintenance status, regulatory geofencing and time restrictions. The preemption path is configured at at least two different levels: hardware overlay / blocking of the video signal path, pixel / frame buffer level blanking, and power limiting or power failure at the display power supply level, to ensure that any single point of failure does not bypass the controlled template. The secure template generation unit is a hardware pattern generator or a trusted execution environment kernel, with power-on capability, independent of the operating system and external content channels. The controlled display template meets the following requirements: brightness not exceeding a preset threshold, pattern being static or with a change rate below a threshold, video / scrolling / flickering effects and audio output disabled, and PWM / refresh spectrum limited to avoid glare and sensitive triggering. The preemption and recovery management unit implements consistent control and synchronized template switching for multiple external display surfaces to avoid localized residual dynamic images. The isolation / execution unit performs graded actions based on fault level, including frame / brightness limiting, video blocking, power derating, controlled shutdown, and residual energy discharge. Recovery conditions include at least one of the following: diagnostic recovery, observation stabilization time window, valid content signature / whitelist, manual confirmation, and / or geofence exit; hysteresis / latching and counting are set to prevent frequent entry and exit from controlled states. Normal display content must pass one or more of the signature verification / integrity measurement / revocation list checks before preemption can be lifted or prevented. The preemption trigger reason, template type, isolation level, and recovery criteria are signed and recorded and can be reported via a secure channel for auditing and regulatory tracing. The preemption and recovery management unit dynamically adjusts the template brightness threshold and recovery conditions based on scenario variables such as location, time period, weather, vehicle speed / steering, and neighboring vehicle density. The preemption mechanism is effective under any power supply mode: on-board high voltage, low voltage, external charging, or external portable power supply.An independent hardware gate is set between the video / pixel interface and the power supply interface of the display execution module to prevent the controlled template from being bypassed even when the external playback source is directly driven or bypassed. Template type and priority are mapped one-to-one with fault category: for example, insulation or electrical risks → priority for shutdown; communication / content risks → priority for uniform pattern; human factors / glare risks → priority for static low brightness. Updates to the template library, thresholds, and state machine parameters require double signature and rollback window protection; the controlled state is maintained when updates fail or verification fails. When the system power-on self-test fails or the diagnostic unit is unavailable, it defaults to the controlled display template and prohibits rendering of normal content. The display execution module is located at least one of the following: front / rear bumper, side panel, door, engine hood, trunk lid, or side skirt. The system communicates with at least one of the following interfaces: CAN, Ethernet, LIN, UART, or GPIO to obtain vehicle status and issue preemption / recovery commands. The system also includes control methods for vehicle external displays under abnormal conditions, including: S1, continuously acquiring and diagnosing power, temperature, communication, content trustworthiness, and human factors-related parameters; S2, performing hierarchical isolation of the video / power supply path when the diagnostic results are triggered; S3, issuing controlled display templates with the highest priority and prohibiting ordinary content from being displayed; S4, monitoring the recovery condition set while recording events, and releasing the preemption and restoring normal display after the conditions are met and the anti-shake strategy is passed. The brightness, color gamut, duty cycle, pattern, and refresh parameters of the controlled display template can be configured and stored according to scenarios and regulations. Cooling time / number thresholds are set for the same type of abnormality; if the threshold is exceeded, the display remains latched until manual or remote approval. The system also includes a secure template preemption module / gateway for the vehicle external display system, including: an input video interface and an output video interface, inserted between the playback source and the display execution module; a trusted secure template generation unit; a video path hardware blocking or overlay circuit and a display power supply control interface; and a control and recording unit for all or part of the steps of the method. The module provides independent controlled display template preemption capability for the external display without altering the original functions of the vehicle. It can be in one of the following forms: wire harness inline type, connector tail type, or independent box type, and interacts with at least one bus in CAN / Ethernet.

[0016] Furthermore, the control system also includes a network security and trust chain unit, comprising: a trust root and identity unit, used to establish the unique identity and key materials of the device on the vehicle side, and to perform trusted verification of the software, firmware, and policies upon power-on startup; a signature verification and policy decision unit, communicatively connected to the trust root and identity unit, the vehicle's external display module, and the network communication interface, used to perform digital signature verification on the content to be displayed or its manifest, and to make a decision on whether to allow display based on the publisher / application / content ID whitelist and revocation information; a policy execution and pixel-level gating unit, located on the display data path, used to allow the pixel stream when the decision is to allow, and to switch the display to a preset controlled display state when the decision is to deny or when trust cannot be verified; and a secure channel and The remote shutdown unit receives revocation / update / deactivation commands from authorized entities via a bidirectionally authenticated and encrypted communication channel, and executes remote deactivation when policy conditions are met. The audit and time baseline unit provides a trusted time source, records signature verification results, whitelists and revocation events, and non-repudiable logs of remote shutdown execution, and supports compliant forensic export. These units constitute a closed-loop architecture of "signature verification—whitelist / revocation—gating execution—remote shutdown—audit traceability," with the inability to display untrusted content as a functional necessity. The system satisfies: (i) the propagation delay of revocation information from publication to system effectiveness is no higher than a preset threshold of X minutes; (ii) the delay from receiving a remote deactivation command to completion of execution is no higher than a preset threshold of Y seconds. The root of trust and identity unit includes at least one of a secure element / TPM / TEE / HSM, and stores device certificates and keys, supporting secure boot and metric boot. The signature verification and policy decision-making unit verifies content packages, manifests, and metadata hashes, supporting certificate chain verification, short-term certificates, and online revocation queries. When the revocation service is unavailable, it only allows the display of locally cached, unexpired, and unrevoked content according to the policy. A whitelist is established based on publisher, application, content hash, and usage scenario, and participates in decision-making in conjunction with the revocation list and online status; entities on the graylist are subject to function restrictions or reduced display privileges. The policy execution and pixel-level gating unit is located on the terminal side of the display data path and works in conjunction with the timing controller (TCON) / column-driven / row-driven. All pixel streams are intercepted by hardware gating if they do not have a valid session authentication tag. The secure channel and remote control unit employ two-way authentication (mTLS / certificate binding / key derivation) and replay protection (random number / timestamp / single token / monotonic counter). The key rotation cycle does not exceed a preset upper limit W, and the expiration tolerance window does not exceed a preset upper limit V. In case of rotation failure or inconsistent policy versions, it enters a controlled display state. Controlled display states include at least one of blank / static security template / low brightness alarm screen / regulatory information only, and dynamic advertisements / user-generated content are prohibited.The auditing and time baseline unit provides append-only logs, which are protected for integrity using chained hashing and signatures, and support remote cryptographic archiving and version rollback records. The system achieves a signature verification pass rate no lower than the first threshold A and a false rejection rate no higher than the second threshold B in a specified test set, maintaining these metrics under conditions such as weak network / network outages, abnormal resets, and cross-version upgrades. The secure channel and remote control unit supports hierarchical authorization, setting minimum permission policies for full vehicle shutdown, zone shutdown, time-limited broadcasting, and content-level revocation. The system enforces expiration and immediate revocation expiration for cached content and stops displaying non-mandatory information when the time source is distorted or the certificate chain is abnormal. The policy execution and pixel-level gating unit detects bypass paths; if a pixel stream / interface pass-through without a policy stack is detected, a hardware assertion is triggered, and the system enters a controlled display state. The system supports offline enforcement credentials: when the network is unavailable but an authorized entity pre-signed shutdown order exists locally, shutdown can still be executed within Y seconds, and proof and reconciliation can be completed after the network is restored. The system employs atomic upgrades and dual-partition rollbacks for policies, certificates, and revocations. Upgrade failures do not affect the effectiveness of the default gated rejection policy. It also includes network security and trust chain control methods for external vehicle display content, including: (1) establishing a trust root on the vehicle side and loading whitelist / revocation information and policies; (2) performing signature verification and certificate chain verification on the content to be displayed or its list, and making allow / reject decisions based on the whitelist and revocation information; (3) implementing pixel-level gating on the data path terminal side: allowing pixel streams only when step (2) is allowed, otherwise switching to a controlled display state; (4) receiving revocation / update / deactivation instructions from authorized entities through a two-way authentication encrypted channel, and completing deactivation within Y seconds; (5) synchronizing and making the latest revocation information effective within X minutes; (6) recording verification, decision, and execution logs with trusted timestamps and performing chain hashing and signature protection; (7) completing key rotation before key expiration, and maintaining the default rejection and controlled display policies if rotation fails or the time source is abnormal. Step (2) performs consistency verification on content hash, metadata, and scenario restrictions, and performs online status confirmation or uses a revocation shortlist for short-cycle certificates. Step (3) binds the pixel stream to the authentication session through session tags / traffic tags. Hardware gating remains closed when not bound or verification fails. The logs from steps (4) to (6) are stored in an append-only structure and can be exported through a restricted interface to meet compliance audit requirements. The vehicle includes the aforementioned network security and trust chain control system, and the vehicle's external display module and the policy execution and pixel-level gating unit are deployed in the same security domain to reduce bypass risks. The vehicle also includes a secure communication stack that interfaces with the authorization management platform / fleet platform for the hierarchical distribution, revocation synchronization, and deactivation linkage of policies and certificates.

[0017] Furthermore, the control system also includes an electrical safety and power domain orchestration system, comprising: a) a power domain management unit, used for accessing, isolating, and prioritizing at least one power supply from 12V, 48V, and high-voltage DC traction power supply domains, and partitioning power supply to at least three types of load domains within the display system, wherein the load domains include at least a control / communication domain, an image processing / driving domain, and a light-emitting execution domain; b) a timing orchestration unit, used for enabling / deactivating the load domains sequentially according to a preset or adaptive power-on / power-off sequence during power-on, power-off, and power fluctuations, and performing handshake and status confirmation during cross-domain switching; c) a power shaping unit, used for limiting and shaping transient power consumption, including at least dynamic limiting of input current slope / peak value, frame-by-frame / line-by-line power budget allocation for the light-emitting execution domain, and adaptive peak clipping for image brightness, duty cycle, or frame scheduling; d) energy A buffer unit is used to provide straddle support under conditions of undervoltage, surge, and short-term power outage. The energy buffer unit includes, but is not limited to, capacitors / supercapacitors / equivalent energy storage networks and their charging and discharging control; e) a monitoring and protection unit is used to monitor the input voltage, current, and temperature rise in real time, and to perform controlled degradation or isolation when abnormalities such as undervoltage, overvoltage / surge, overcurrent, short circuit, or overtemperature are detected; f) a display execution unit is electrically connected to the image processing / driving domain and is used to output externally visible video content while meeting electrical safety constraints; wherein, the system is configured to allow the display execution unit to output video content only when the following necessary functional conditions are met simultaneously: A) the peak current does not exceed the configurable upper limit Imax; B) the visual recovery time of the cold start process does not exceed the configurable upper limit T; C) when the input undervoltage drops to a configurable lower limit below the nominal voltage and continues, the content continuity or controlled visibility state is maintained for at least X ms; and when any of the above conditions are not met, the system enters a controlled degradation / controlled shutdown state and records the event until the recovery conditions are met before recovery. Note: Imax, T, and X are configurable system parameters that can be used as functions of vehicle platform, wiring harness rating, housing display area, or nominal power for vehicle-level calibration. The power domain management unit implements mutual electrical isolation or current limiting isolation between the control / communication domain, image processing / drive domain, and light emission execution domain, and supports a priority table for cross-domain energy scheduling, prioritizing the survival of the control / communication domain under abnormal operating conditions. The energy buffer unit has controlled pre-charging and temperature rise limiting strategies, ensuring that the pre-charging current meets the dual threshold constraints of dI / dt and I_peak, and completing closed-loop control to the target state of charge within the power-on window. The timing orchestration unit sets the power-on sequence of "control / communication domain → image processing / drive domain → light emission execution domain," and only allows the next domain to enter enable after the previous domain has completed voltage stabilization and handshake confirmation; the power-down sequence is executed in reverse order.The power shaping unit implements frame-by-frame power budgeting and dynamic suppression of the brightness limit for the luminous execution domain. This budget is calculated in real-time by the energy buffer unit based on available energy and the transient margin of the input bus, ensuring that the average current within any 10–50 ms window does not exceed the configurable proportion of Imax. When the power shaping unit detects that the input voltage is below the undervoltage threshold or the current is close to Imax, it performs line-by-line / section-by-section scanning to reduce peak shaving and duty cycle reduction, thereby minimizing instantaneous power spikes. The power domain management unit includes source selection and seamless switching circuitry, allowing switching between the 12V, 48V, and high-voltage domain rails after isolation transformation based on priority or health status, with display interruptions caused by switching windows not exceeding the configurable Δt_max. The monitoring and protection unit can identify equivalent conditions of common automotive power supply disturbance waveform groups, including undervoltage sag, load drop / surge, short-term power outage, and cold start sag, and triggers corresponding power shaping curves and domain-level load removal for each disturbance scenario. A short-term power outage is defined as the input power supply dropping to near zero within a configurable t_break and then recovering. The system ensures content continuity or entry into a controlled static visible template within t_break through the energy buffer unit and timing-maintaining logic, with an overall visibility maintenance time ≥ X ms. Cold start capability is achieved by maintaining the control / communication domain and image processing / driving domain online during voltage sags caused by low temperature and high internal resistance, and completing the minimum brightness visibility recovery before the luminous execution domain is lit up step by step, with a recovery time ≤ T. The power shaping unit performs content-related peak clipping at the image layer, including limiting the instantaneous proportion and cross-frame change rate of large areas of full white / high APL (Average Picture Level), prioritizing power budget constraints and independent of specific display device types. The equivalent capacity and internal resistance of the energy buffer unit are configurable parameters, with target values ​​related to the effective area of ​​the display housing, nominal brightness, and Imax, to ensure X ms visibility under the most unfavorable disturbances. The monitoring and protection unit uses solid-state switches for rapid isolation and current limiting, supporting electrical decoupling between the fault domain and the health domain. A single-point fault does not cause uncontrolled current peaks or voltage collapses in other domains. During power failure, the timing orchestration unit enforces the sequence of "first degrading the luminous execution domain → then removing the image processing / drive domain → finally removing the control / communication domain" to prevent the luminous execution domain from being powered even when control is lost. The system must meet the following necessary conditions at any given time: (i) peak current ≤ Imax; (ii) undervoltage hold time ≥ X ms; (iii) cold start recovery time ≤ T. If any condition is not met, the system enters the controlled degradation template or the black screen safety template and reports the event to the vehicle controller. The threshold values ​​for the necessary conditions are determined by vehicle-level constraints, and Imax does not exceed the rated configurable ratio of the corresponding power supply circuit protection device. The configuration of X and T satisfies the wiring harness temperature rise and thermal balance limits.The system supports in-service remote or local calibration of parameters Imax, T, X, and the domain priority table, with the calibration range constrained by policy boundaries to avoid disrupting essential functionalities. When the power budget is not met, the power shaping unit degrades image quality parameters (brightness, frame rate, color sub-channel duty cycle) according to priority, prioritizing readability and the visibility of symbols / warning information. The high-voltage and low-voltage domains are connected via isolated power converters, which shut down the isolation side during anomalies to prevent energy backflow. The monitoring and protection unit records the disturbance amplitude, duration, and system response curve for each anomaly for traceability and in-service optimization; however, this recording function does not affect the execution of controlled degradation displayed during anomalies. It also includes electrical safety and power domain orchestration methods, including: S1: accessing at least one power supply domain and completing power domain priority setting and partitioned power supply; S2: enabling / deactivating the control / communication domain, image processing / driving domain, and luminous execution domain in a predetermined / adaptive order during power-on, power-off, and disturbance periods; S3: calculating the instantaneous power budget based on the input voltage / current and energy buffer status, and implementing current peak limiting and slope control; S4: maintaining content continuity or controlled visible templates using energy buffer units and content layer peak clipping strategies when undervoltage, surge, or short-term power failure is detected, for a duration ≥ X ms; S5: performing controlled degradation when the peak current exceeds Imax or the cold start recovery time is expected to exceed T, and resetting to the normal state after the recovery conditions are met. S3 includes frame-by-frame power budget, scan peak offset, and duty cycle limitation for the luminous execution domain. The power-on sequence of S2 is control / communication domain → image processing / driving domain → luminous execution domain, and the power-off sequence is the reverse. During S4, priority is given to ensuring the control / communication domain remains online, and image content is downgraded to low average brightness or symbolic templates to reduce instantaneous power consumption. Seamless switching is implemented between the 12V, 48V, and high-voltage domains when health conditions change, and the switching window is controlled within Δt_max to avoid visible flickering.

[0018] Furthermore, the control system also includes a V2X emergency message priority takeover system, comprising: a) an event receiving unit, used to receive event messages from roadside units (RSUs), vehicle-to-cloud platforms, or other V2X sources via an onboard communication module, wherein the event messages include at least emergency information, warning information, advertising information, and decorative information; b) a priority queue management unit, used to establish priority queues according to message categories and schedule them in the order of emergency information > warning information > advertising information > decorative information to ensure that high-priority messages can preempt low-priority content; c) a template matching unit, used to select the corresponding display template from a preset template library based on the event type, priority, and current display status after the event is received; d) a display preemption unit, used to immediately interrupt or overwrite the current display content and switch to the display template when a high-priority event is received, and automatically restore the original display content when the recovery conditions are met; e) a packet loss and retry control unit, used to detect packet loss during event transmission and execute a retry mechanism to ensure that the message is ultimately delivered; wherein, the necessary functional conditions of the system include: (i) the time T_msg→UI from the receipt of the event message to the presentation of the user interface does not exceed the configurable upper limit X. (ii) The packet loss rate does not exceed the configurable upper limit Y%, and the number of retries does not exceed the configurable upper limit Z; (iii) The priority queue scheduling result conforms to the priority order at any time; when any necessary functional condition is not met, the system enters the controlled degradation mode and issues a fault record until the recovery condition is met. The event receiving unit supports C-V2X, DSRC, cellular network, Wi-Fi or any combination thereof, and can seamlessly switch between different protocols. The priority queue management unit sorts according to timestamps within the same priority and supports batch processing or merging display strategies when multiple high-priority messages arrive simultaneously. The template matching unit supports static image templates, dynamic image templates and text information templates, and is universal across different display technologies (LCD, OLED, Micro-LED, projection). The display preemption unit caches the current display state before preemption execution so that it can seamlessly restore to the state before preemption when the recovery condition is met. The packet loss and retry control unit dynamically adjusts the transmission power or switches the communication link during each retry interval to reduce the probability of retry failure. X, Y, and Z in the necessary functional conditions are configurable parameters and can be calibrated locally or remotely without violating the priority rules. Before the T_msg→UI timeout, the system will perform a priority downgrade check. If the delay risk of high-priority messages exceeds the threshold, the low-priority content will be forcibly cleared and the display template will be switched immediately.It also includes a V2X emergency message priority takeover method, comprising: S1: receiving event messages from RSU, vehicle-cloud platform, or other V2X sources; S2: mapping the event messages to priority queues according to their categories; S3: ensuring that emergency information has higher priority than warning information, higher than advertising information, and higher than decorative information in queue scheduling; S4: selecting the corresponding display template from the template library based on the event type; S5: preempting the current display when a high-priority event is received, and restoring the original display content when the recovery conditions are met; S6: detecting packet loss during event transmission and performing retries no more than Z times; S7: ensuring that T_msg→UI≤X ms and the packet loss rate≤Y%. Before preemption, S5 saves the cache information of the current display content. After a retry failure, S6 triggers a backup communication path to ensure message delivery.

[0019] Beneficial effects

[0020] Compared with the prior art, the technical solution of this application has the following beneficial effects:

[0021] 1. Actively suppress electromagnetic interference to meet EMC regulations;

[0022] 2. Dynamically adapt to the operation of the radio frequency system to ensure communication quality;

[0023] 3. This multi-dimensional parameter linkage avoids single-point failure; Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the functional block structure of the present invention; Detailed Implementation

[0025] The following detailed description, with reference to embodiments, illustrates an electromagnetic compatibility and radio frequency coexistence architecture proposed in this invention. Those skilled in the art should understand that the following embodiments are merely illustrative and not intended to limit the scope of protection of this invention. Equivalent improvements or substitutions can be made without departing from the spirit and claims of this invention.

[0026] Example 1: Overall Structure

[0027] An electromagnetic compatibility and radio frequency coexistence architecture according to this embodiment includes:

[0028] 1. Display Module: Located on the exterior of the vehicle, this module displays dynamic images or static visual content to the external environment. It employs high-brightness, low-power devices and utilizes waterproof, dustproof, and shock-resistant packaging technology to ensure its stability and durability under vehicle operating conditions.

[0029] 2. Control System: Communicates with the display module and the vehicle-mounted radio frequency system (including wireless communication antenna, transceiver module, and vehicle bus interface). The control system dynamically manages the signal, power, modulation, and drive timing of the display module, thereby reducing electromagnetic interference with the radio frequency system and ensuring that both can coexist in a limited spectrum and spatial coupling environment.

[0030] With the above structure, the display module and the vehicle radio frequency system can work together in close proximity and operate simultaneously, meeting the requirements of electromagnetic compatibility (EMC) and radio frequency coexistence regulations.

[0031] Example 2: Cooperative Control Unit

[0032] The collaborative control unit is the core module of the control system and has the following functions:

[0033] Signal dynamic management: Adjust the modulation mode and scanning sequence of the display drive signal in real time to avoid overlap between its spectral components and the RF communication bandwidth.

[0034] Power management: Reduce the instantaneous drive current of the display module and reduce conducted interference when the radio frequency system is conducting high-power communication.

[0035] Timing coordination: During the high-sensitivity window of RF transceiver, delay or reshape the switching action of the display driver to reduce pulse interference peaks.

[0036] For example, when the vehicle's LTE module is in uplink transmission mode, the cooperative control unit avoids simultaneous high-current switching of the display modules through timing coordination, thereby significantly reducing mutual interference.

[0037] Example 3: Electromagnetic Interference Suppression Module

[0038] This module is deployed in the signal and power path between the display module and the RF system, and includes the following measures:

[0039] Filtering and isolation circuit: A common-mode choke and an LC filter are introduced into the power supply path to reduce conducted noise.

[0040] Shielding and grounding optimization: Add a conductive shielding layer around the display module and guide the radiated current through low-impedance grounding to reduce near-field coupling.

[0041] Differential-mode noise suppression: Differential-mode inductors and RC dampers are used to reduce harmonic components caused by high-speed switching.

[0042] Through the above methods, the interference of the display module to the radio frequency system is reduced, and the coupling of the radio frequency system's transmission power to the display circuit is also effectively suppressed.

[0043] Example 4: Application Scenarios

[0044] 1. High-speed driving + vehicle-to-everything (V2X) communication: When the radio frequency system operates in the 5G high-frequency band, the display module automatically adjusts the drive spectrum distribution to avoid falling into the same frequency band.

[0045] 2. Navigation and communication in tunnels: When the electromagnetic environment in a tunnel is complex, the display module enters a low-power static mode to reduce the impact on communication quality.

[0046] 3. Emergency Communication Mode: When the vehicle establishes an emergency call link with an external base station, the display module automatically turns off the dynamic video and only retains the necessary low-brightness safety prompts.

[0047] Example 5: Experimental Verification

[0048] The effectiveness of the present invention was verified through the following tests:

[0049] Conducted interference test: In the 150kHz–30MHz frequency band, the noise level of the display module is reduced by 40%.

[0050] Radiated interference test: Interference amplitude decreased by 6 dBμV / m in the 30MHz–1GHz band.

[0051] Coexistence communication test: Under the condition that the LTE uplink transmission and display modules are operating simultaneously, the communication bit error rate is improved by 20%.

[0052] Regulatory compliance verification: Meets automotive EMC standards such as CISPR 25 and ISO 11452.

[0053] Summarize

[0054] The embodiments of the present invention construct a complete closed-loop control architecture by combining a collaborative control unit, an electromagnetic interference suppression module, an operation status monitoring and adjustment module, an integrated topology unit, a coexistence monitoring unit, and a strategy execution unit, thereby achieving electromagnetic compatibility and coexistence between the external display and the vehicle-mounted radio frequency system.

[0055] Its advantages are:

[0056] Actively suppresses electromagnetic interference to meet EMC regulations;

[0057] Dynamically adapt to the operation of the radio frequency system to ensure communication quality;

[0058] Multi-dimensional parameter linkage avoids single point of failure;

[0059] It has industrialization feasibility and universal applicability.

[0060] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0061] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An electromagnetic compatibility and radio frequency coexistence architecture, characterized by, The display module (not including the center console, seat back, car, rear color TV, car roof advertising screen, car stickers soft screen) and control system, wherein, The display module is arranged outside the vehicle body and is used for outputting visual content. The control system comprises: The cooperative control unit is in communication connection with the vehicle external display module and the vehicle-mounted radio frequency related system (including but not limited to wireless communication antenna, transceiver module, vehicle-mounted bus interface), and is used for dynamically managing the signal, power, modulation and working time sequence of the external display module during the operation of the vehicle, so as to reduce the electromagnetic interference with the radio frequency system and ensure the coexistence performance thereof; The electromagnetic interference suppression module is used for reducing the electromagnetic coupling effect including the conducted interference and the radiated interference in the signal and power paths between the external display module and the vehicle-mounted radio frequency system; The running state monitoring and adjusting module is used for automatically adjusting the working mode of the external display module based on the vehicle running state, the radio frequency system working state and the external electromagnetic environment, so that the external display module operates under the condition of meeting the vehicle electromagnetic compatibility regulations and radio frequency performance requirements; Wherein, the above-mentioned modules constitute a closed loop control architecture, so that the external display module always meets the electromagnetic compatibility and radio frequency coexistence regulations applicable to the vehicle when working with the vehicle-mounted radio frequency system.

2. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system comprises: The integrated topology unit is used for implementing cooperative control on the external display module in the physical domain and the circuit domain, and simultaneously realizes: a) driving time sequence shaping, which cooperatively shapes the switching edge, scanning sequence and modulation mode of the display driving in time domain and frequency domain; b) return path constraint, which guides and closes the return channel of high-frequency current to limit the return loop area and impedance; c) power supply ripple shaping, which controls the spectrum shape and energy diversion of the display power supply ripple and common / differential mode noise; the coexistence monitoring unit is used for acquiring the working occupation information and / or link quality index of the vehicle-mounted radio frequency system, and detecting the near-field or conducted disturbance strength; The strategy execution unit is in communication connection with the integrated topology unit and the coexistence monitoring unit, and is used for linking and adjusting the three-in-one layout parameters, driving time sequence, return constraint and power supply ripple shaping parameters based on the monitoring results, and switching the external display module to a controlled display state when the interference exceeds the threshold value; Wherein, the integrated topology unit, the coexistence monitoring unit and the strategy execution unit constitute a closed loop control architecture, so that the external display module meets the electromagnetic compatibility and radio frequency coexistence regulations applicable to the vehicle when working with the vehicle-mounted radio frequency system.

3. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system further comprises: The cooperative control unit is in communication connection with the external display module and the vehicle-mounted radio frequency system (including at least one of the vehicle-mounted antenna, wireless transceiver unit and / or vehicle-mounted data bus), and is used for coordinating the display driving and radio frequency working during the operation of the vehicle; The shield-ground-filter three-in-one layout is constructed on the power supply and signal interface of the external display module and the peripheral region thereof, wherein: (a) the shield body forms a geometric and electrical continuous equipotential shell with the vehicle body; (b) the ground network provides a low impedance, constrained return path and limits the high-frequency loop area; (c) a filter and / or impedance shaping network arranged at the power and signal boundary to suppress common mode and differential mode interference; a drive timing shaping unit for time dispersion and window avoidance of the display's frame / row / column scanning, PWM modulation and switching edges to reduce the equivalent emission in RF sensitive time slots; a power supply ripple shaping and power constraint unit for ripple spectrum shaping control and harmonic energy redistribution of the display power supply; wherein the triad layout, drive timing shaping and backflow path constraint collectively form a single controlled electromagnetic loop topology, and under the closed loop scheduling of the coordination control unit, the external display module and the vehicle mounted RF system meet the applicable vehicle electromagnetic compatibility and RF coexistence regulation requirements in any legal operating state.

4. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system further comprises: an in-service parameter acquisition unit: in communication connection with the vehicle external display module, power supply and thermal management, vehicle bus and environmental sensors, for acquiring electrical-thermal-optical-mechanical-environmental in-service parameters reflecting display aging and working conditions during vehicle operation; a life prediction and remote diagnosis unit: deployed in a remote diagnosis service and / or a vehicle-mounted computing platform, for establishing a health degree / residual useful life (RUL) model of the display module based on the in-service parameters and outputting life prediction results and degradation zone identification information; a drive parameter adaptive unit: in communication connection with the display timing controller / current driver / backlight or pixel controller, for automatically adjusting at least one of the brightness upper limit, drive current / voltage, duty cycle, refresh rate, local dimming / color recalibration according to the life prediction results; a verification and back transmission unit: for closed loop verification of optical stability / chromaticity deviation / thermal boundary / current ripple and other indicators after parameter adjustment, and back transmission of in-service parameters, life prediction results and verification data to the remote diagnosis service through wired or wireless network for archiving and continuous optimization; wherein the in-service parameter acquisition unit, life prediction and remote diagnosis unit, drive parameter adaptive unit and verification and back transmission unit form a closed loop control architecture of in-service parameter acquisition-model prediction-automatic adjustment-verification back transmission, so that the external display module meets the applicable regulations and image quality requirements while realizing life predictability and in-service life extension.

5. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system further comprises a root of trust and identity unit: for establishing a unique device identity and key material on the vehicle side, and conducting trusted verification on the software, firmware and policies started after power-on; a signature verification and policy decision unit: in communication connection with the root of trust and identity unit, vehicle external display module and network communication interface, for performing digital signature verification on the content to be displayed or its manifest, and making a decision on whether to allow display based on the publisher / application / content ID whitelist and revocation information; a policy execution and pixel level gating unit: arranged on the display data path, for releasing the pixel stream when the decision is to allow, and switching the display to a preset controlled display state when the decision is to refuse or cannot be verified as trusted; Secure channel and remote kill unit: for receiving revocation / update / disable instructions from authorized entities through a communication channel protected by mutual authentication and encryption, and executing remote disablement when policy conditions are met; Audit and time reference unit: for providing a trusted time source, recording signature verification results, white list and revocation events, remote kill execution, etc. non-repudiation logs, and supporting compliance forensics export; Wherein each unit constitutes a closed-loop architecture of "signature verification-white list / revocation-gated execution-remote kill-audit trace", and the display of untrusted content is not allowed as a functional necessity.

6. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system further comprises: a) Power domain management unit for accessing, isolating and prioritizing power supply from at least one of 12V, 48V and high-voltage DC traction power supply domains, and for partitioning power supply to at least three types of load domains in the display system, including control / communication domain, image processing / driving domain, and light emitting execution domain; b) Timing arrangement unit for sequentially enabling / disabling the load domains according to pre-set or adaptive power-on / off timing during power-on, power-off and power fluctuation, and implementing handshaking and state confirmation during cross-domain switching; c) Power shaping unit for limiting and shaping transient power consumption, including at least dynamic limiting of input current slope / peak, frame-by-frame / row-by-row power budget allocation for light emitting execution domain, and adaptive peak clipping for image brightness, duty cycle or frame scheduling; d) Energy buffer unit for providing ride-through under conditions of power supply under-voltage, surge and short-time power failure, including but not limited to capacitors / super capacitors / equivalent energy storage networks and their charge / discharge control; e) Monitoring and protection unit for real-time monitoring of input voltage, current and temperature rise, and performing controlled degradation or isolation when detecting abnormal conditions such as under-voltage, over-voltage / surge, over-current, short circuit or over-temperature; f) Display execution unit electrically connected to the image processing / driving domain for outputting externally visible video content under the condition of meeting electrical safety constraints.

7. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system further comprises: a) Event receiving unit for receiving event messages from roadside units (RSUs), vehicle cloud platforms or other V2X sources through on-board communication modules, the event messages including at least emergency information, warning information, advertising information and decoration information; b) Priority queue management unit for establishing a priority queue according to message categories and scheduling in the order of emergency information> warning information> advertising information> decoration information to ensure that high-priority messages can preempt low-priority content; c) Template matching unit for selecting a corresponding display template from a pre-set template library based on event type, priority and current display state after receiving the event; d) Display preemption unit for immediately interrupting or overriding the current display content when a high-priority event is received, switching to the display template, and automatically restoring the original display content when the restoration condition is met; e) Packet loss and retry control unit for detecting packet loss and implementing a retry mechanism during event transmission to ensure that the message is ultimately conveyed.

8. The electromagnetic compatibility and radio frequency coexistence architecture of claim 1, wherein, The control system further comprises: A vehicle-end collection module configured to collect sensing data of vehicle running status and / or external environment; A cloud-end processing platform configured to perform audience analysis based on the sensing data and generate a delivery decision by running an advertisement bidding engine under the premise of meeting content compliance review; A delivery execution module connected with a vehicle external display screen, configured to render corresponding content according to the delivery decision after verifying the delivery authorization information issued by the cloud-end processing platform; A feedback and billing module configured to feed back the actually displayed content information to the cloud-end processing platform and trigger billing and settlement; Wherein, the system is configured to allow the presentation of commercial content on the vehicle external display screen only when the closed-loop process of vehicle sensing-cloud feedback-advertisement distribution / bidding-content compliance review-delivery execution-feedback billing is completed, and any missing or failed link will prohibit the display of the content, thereby constructing a functional necessity condition.

9. The electromagnetic compatibility and radio -frequency coexistence architecture of claim 1, wherein, The control system further comprises: A multi-terminal access module configured to receive display control requests from two or more independent user terminals; A synchronization and arbitration module configured to generate a merged display output instruction based on a preset synchronization mechanism and arbitration rules among the multiple display control requests; A display execution module connected with a vehicle external display screen, configured to present visual content on the vehicle external display screen according to the display output instruction; Wherein, the synchronization mechanism and arbitration rules at least include control strategies of spatial allocation, time allocation or their combination, and the system is configured to prohibit the display of unauthorized content when valid authorization is missing or the synchronization or arbitration conditions are not met, to ensure that any user cannot bypass the synchronization mechanism and arbitration rules to directly control the display output.

10. A vehicle characterized by comprising: The safe and reliable device of any one of claims 1-9 is included.

Images