A safety control method and system for an electric vehicle door of a vehicle, and a vehicle

Abstract

The application discloses a kind of safety control method, system and vehicle of navigation car electric car door, it is related to automobile electronic control technical field, real-time acquisition driving mode state and water level height;When driving mode state is navigation mode or water level height is greater than first set threshold, multiple function disable instructions are sent out, control each execution mechanism executes disable operation;The disable operation includes the function of disabling outer door handle switch, in-vehicle electronic switch, voice control and large screen soft switch to open electric car door, and the function of disabling glass one-key lowering;When driving mode state is land mode or water level height is less than second set threshold, function recovery instruction is sent out, control each execution mechanism recovers all disabled functions.Solve the problem that navigation car is caused in navigation mode due to misoperation door switch and leads to accidental water intake, to improve navigation safety.

Description

Technical Field

[0001] This invention relates to the field of automotive electronic control technology, and in particular to a safety control method, system, and vehicle for a car's electric door. Background Technology

[0002] With the development of intelligent automotive technology, electric door systems are becoming increasingly popular, and their control methods include various forms such as exterior door handle switches, interior electronic switches, voice control, and large-screen soft switches. However, for amphibious vehicles, these convenient control methods may pose safety hazards when entering water navigation mode. For example, accidental operation of a door or window by an occupant could cause water to rush into the vehicle, damaging internal equipment and potentially endangering the safety of the occupants.

[0003] Currently, automotive door safety control technology primarily focuses on scenarios such as anti-pinch and collision-based unlocking. While some vehicles are equipped with driving mode selection functions, mode switching typically only involves adjustments to the powertrain and suspension, without deeply covering the door control logic. In navigation mode, there is a lack of intelligent disabling mechanisms for various door operation methods, failing to effectively prevent the risk of water ingress due to accidental operation. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, the present invention provides a safety control method, system and vehicle for amphibious vehicle electric doors, aiming to solve the problem of accidental water ingress caused by improper door operation in amphibious vehicle navigation mode.

[0005] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions: In a first aspect, the present invention provides a safety control method for an electric car door, comprising: Real-time monitoring of driving mode status and water level; When the driving mode is in navigation mode or the water level is greater than the first set threshold, multiple function disable commands are issued to control each actuator to perform the disable operation; the disable operation includes disabling the function of opening the electric door with the external door handle switch, the in-vehicle electronic switch, the voice control and the large screen soft switch, as well as disabling the one-button lowering function of the window; When the driving mode is in land mode or the water level is less than the second set threshold, a function recovery command is issued to control each actuator to restore all disabled functions.

[0006] A further technical solution combines driving mode status, water level, and vehicle speed, and uses a multi-source information fusion algorithm to calculate the water ingress risk level, triggering corresponding function disable commands based on the water ingress risk level.

[0007] A further technical solution is that when the driving mode is navigation mode or the water level is greater than the first set threshold and the vehicle speed is lower than the first vehicle speed threshold, the water ingress risk level is determined to be high risk, triggering a complete disable command; when the driving mode is navigation mode or the water level is greater than the third set threshold and the vehicle speed is lower than the second vehicle speed threshold, the water ingress risk is determined to be medium risk, triggering a partial disable command.

[0008] A further technical solution involves acquiring vehicle tilt angle information and dynamically correcting the water level height using a dynamic water level correction mechanism.

[0009] A further technical solution involves issuing multiple function disable commands while also issuing an inflation command to drive the inflatable sealing airbag to inflate to the set pressure.

[0010] A further technical solution involves setting multiple exit conditions, issuing a function recovery command only when all conditions are met simultaneously. The multiple exit conditions include: the driving mode is in land mode; and the water level is less than a second set threshold.

[0011] Secondly, the present invention provides a safety control system for a car electric door, comprising: The data acquisition module is configured to acquire driving mode status and water level in real time. The control module is configured to issue multiple function disabling commands when the driving mode is navigation mode or the water level is greater than a first set threshold, and control each actuator to perform disabling operations. The disabling operations include disabling the functions of opening the electric door with the exterior door handle switch, the in-vehicle electronic switch, the voice control and the large screen soft switch, as well as disabling the one-button lowering function of the window. The recovery control module is configured to issue a function recovery command when the driving mode is land mode or the water level is less than a second set threshold, thereby controlling each actuator to restore all disabled functions.

[0012] Further technical solutions include door lock controllers and window regulator controllers as actuators.

[0013] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a safety control method for a car electric door as described in the first aspect.

[0014] Fourthly, the present invention provides a vehicle including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of a safety control method for a car electric door as described in the first aspect.

[0015] The above one or more technical solutions have the following beneficial effects: This invention can intelligently disable high-risk door operations in vehicle navigation mode and automatically restore them after exiting navigation mode, solving the problem of accidental water ingress caused by accidental door operation in navigation mode, thereby improving navigation safety.

[0016] This invention can intelligently identify navigation conditions and, based on this, manage the control permissions of electric doors and windows in a refined manner. While eliminating the risk of misoperation, it ensures the possibility of emergency escape and realizes automatic function recovery when switching modes, thereby comprehensively improving the safety and reliability of the vehicle in the water environment.

[0017] This invention significantly improves the safety of vehicles in aquatic environments by intelligently disabling operations that could lead to water ingress, effectively avoiding risks caused by misoperation. It automates the control logic, eliminating the need for manual operation of additional switches by the driver and reducing their workload. While ensuring safety, it also addresses escape needs in emergency situations by retaining mechanical emergency functions. The system has a fast response time, and functions are restored promptly after mode switching, without affecting the normal land-based user experience of the vehicle. Attached Figure Description

[0018] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0019] Figure 1 This is a flowchart of a safety control method for an electric car door according to an embodiment of the present invention; Figure 2 This is a block diagram of the vehicle system composition according to an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0021] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0022] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0023] Terminology Explanation: Navigation mode: The driving mode status when the vehicle enters a water environment, which is generated by the driving mode selection module.

[0024] Land mode: The normal driving mode of the vehicle in a land environment.

[0025] Body Control Module (BCM): The core control unit of the vehicle's electronic control system, responsible for controlling electronic devices in the vehicle body such as doors, windows, and lighting.

[0026] CAN bus: Controller Area Network, a serial communication protocol used for data communication between automotive electronic control units.

[0027] Water immersion sensor: A water level detection sensor installed on the vehicle chassis to monitor the water level around the vehicle in real time.

[0028] Multi-source information fusion algorithm: A data fusion method that comprehensively processes data from multiple information sources (driving mode status, water level, vehicle speed, etc.) to calculate the flood risk level.

[0029] Differentiated disabling strategy: Based on the risk level of different door operation methods, different levels of control strategies are adopted, such as complete disabling, partial disabling, or retention of functions.

[0030] Inching descent function: An operating mode in the window lift control, in which the window slowly descends only when the switch is pressed continuously, and stops when the switch is released, in contrast to one-button descent (which automatically descends completely after a long press).

[0031] Mechanical emergency release function: The mechanical opening mechanism on the inside of the door does not rely on the electronic control system and can be manually opened directly in an emergency.

[0032] Majority voting mechanism: In multiple redundant sensors, when some sensor signals are abnormal, the majority of the signals that are consistent are used as the valid input for judgment.

[0033] Lag range: The difference range between the first set threshold and the second set threshold, used to prevent frequent mode switching caused by small fluctuations in water level.

[0034] With the development of automotive intelligent technology, electric door systems are becoming increasingly popular, and their control methods include various forms such as exterior door handle switches, interior electronic switches, voice control, and large-screen soft switches.

[0035] For amphibious vehicles, when entering waterways, occupants may accidentally operate the doors or windows, causing water to rush into the vehicle, damaging internal equipment and threatening the safety of the occupants.

[0036] In existing technologies, automotive door safety control technology mainly focuses on scenarios such as anti-pinch and collision unlocking. Although some vehicles are equipped with driving mode selection functions, mode switching usually only involves adjustments to the powertrain and suspension, and does not deeply cover the door control logic.

[0037] In navigation mode, the lack of an intelligent disabling mechanism for various door operation methods makes it impossible to effectively prevent the risk of water ingress due to misoperation. At the same time, existing solutions often use a single trigger condition (relying only on the driving mode signal or only on the water level signal), which poses a risk of misjudgment; adopting a one-size-fits-all disabling strategy, completely sealing off the door and window functions, may result in loss of ventilation and blockage of emergency escape routes, posing a safety hazard.

[0038] This invention provides a safety control method, system, and vehicle for electric doors in a navigating vehicle. The system obtains the driving mode status and water level in real time through the vehicle body controller, adopts a graded water ingress risk assessment mechanism, and combines driving mode signals and immersion sensor signals for dual trigger judgment, and executes differentiated disabling strategies according to the risk level.

[0039] Core technology improvements include: (1) Graded water ingress risk assessment mechanism: The vehicle controller combines driving mode status, water level and vehicle speed information, and uses a multi-source information fusion algorithm to calculate the water ingress risk level, namely low risk, medium risk and high risk, to solve the problem of misjudgment that may be caused by a single triggering condition.

[0040] (2) Differentiated disabling strategy: Completely disable the functions of opening doors using exterior door handle switches, interior electronic switches, voice control, and large screen soft switches; partially disable the one-touch window lowering function, such as ignoring the long press signal of ≥500ms, retaining the intermittent lowering function of <500ms and lowering ≤2cm each time; always retain the mechanical emergency release function. While ensuring safety, user experience and regulatory requirements are also taken into account.

[0041] (3) User prompt and confirmation mechanism before disabling: Before executing the disabling command, send a prompt message to the user through the instrument panel or central control screen and ask for confirmation to improve the user's perception and understanding of the system behavior.

[0042] (4) Automatic triggering logic under abnormal conditions: The immersion sensor is an independent trigger source and is connected to the body controller through an independent wire. When the water level is detected to be greater than the first set threshold, the body controller will automatically execute the disable command even if the driving mode selection module does not send the navigation mode signal, so as to achieve redundant protection.

[0043] (5) Multiple safety confirmation process: When exiting navigation mode, the function will only be restored when multiple conditions such as driving mode signal and water level are met at the same time, to ensure that the vehicle has completely left the water environment.

[0044] (6) Real-time monitoring and abnormal alarm mechanism: During navigation mode, the body controller checks the driving mode status signal every 10ms to 30ms, records the number of abnormal operation attempts, maintains the current mode status and alarms when CAN communication times out, automatically restores all functions when the voltage is low, stores the last mode status when the power is off, and has a built-in self-diagnostic function to support fault code reading and online calibration.

[0045] Through the above-mentioned technical improvements, the present invention fundamentally solves the technical problem of accidental water ingress into amphibious vehicles due to improper door operation during navigation mode.

[0046] Example 1 like Figure 1 As shown in the figure, this embodiment discloses a safety control method for an electric car door, which includes the following steps: Real-time monitoring of driving mode status and water level; When the driving mode is in navigation mode or the water level is greater than the first set threshold, multiple function disable commands are issued to control each actuator to perform the disable operation; the disable operation includes disabling the function of opening the electric door with the external door handle switch, the in-vehicle electronic switch, the voice control and the large screen soft switch, as well as disabling the one-button lowering function of the window; When the driving mode is in land mode or the water level is less than the second set threshold, a function recovery command is issued to control each actuator to restore all disabled functions.

[0047] Specifically, the method includes the following steps: S1: Real-time acquisition of driving mode status and water level; In this embodiment, the vehicle may include a body control module (BCM), a driving mode selection module, a door lock controller, a window regulator controller, an exterior door handle sensor, a water immersion sensor, a voice recognition module, a central control screen touch sensor, and a CAN bus network. The door lock controller and the window regulator controller are door actuators, and the exterior door handle sensor, water immersion sensor, voice recognition module, and central control screen touch sensor are sensor groups.

[0048] The body controller, as the control core, receives driving mode status signals and executes disable / enable logic. The driving mode selection module is connected to the body controller via CAN lines (CAN_H and CAN_L lines), generates driving mode status signals (including navigation mode and land mode), and sends them to the body controller via the CAN bus. The door lock controller receives commands from the body controller and controls the door locking mechanism. The window regulator controller receives commands from the body controller and controls the window raising and lowering. The exterior door handle sensor detects door handle operation signals and transmits them to the body controller via the LIN bus or hardwire. The immersion sensor detects the vehicle's water level signal and transmits it to the body controller via wires (including signal lines, grounding lines, and power supply lines). The voice recognition module recognizes voice door opening commands and transmits them to the body controller via the CAN bus. The central control screen touch sensor detects large screen soft switch operation signals and transmits them to the body controller via the CAN bus. The CAN bus network connects all controllers, transmitting control commands and status signals (the communication rate in this embodiment is 500kbps).

[0049] First, the system is initialized. Specifically, after the vehicle is powered on, the Body Control Controller (BCM) performs a self-test. After the self-test is completed, the Body Control Controller sends a ready signal to the instrument panel, which displays that the door system is ready and the vehicle is in an operable state.

[0050] The BCM performs the following self-test process: detects the status of each door sensor, verifies CAN communication with each controller, and initializes the door control function to the default land mode state.

[0051] The body controller monitors the driving mode status in real time via the CAN bus, and also monitors the water immersion sensor signal, which serves as an auxiliary judgment.

[0052] S2: Based on the driving mode status, combined with water level and vehicle speed, determine the risk level; In this embodiment, the body controller continuously monitors the driving mode status via the CAN bus: (1) Detection cycle: The status message of the driving mode selection module is queried once every set time interval, such as 50ms; (2) Simultaneously, the analog voltage signal of the immersion sensor is read in real time via an independent wire. The voltage value is converted into water level height using the following formula: Water level height (cm) = Voltage value (V) × 20; (3) At the same time, vehicle speed information is obtained through the CAN bus. It is obtained from the vehicle dynamic stability control system (ESC).

[0053] The vehicle controller employs a multi-source information fusion algorithm based on weighted scoring to comprehensively evaluate three signals: driving mode status, water level, and vehicle speed, calculating the current flood risk level. Specifically, the algorithm first normalizes the three input signals, converting the driving mode status signal into a binary variable (1 for navigation mode and 0 for land mode), and normalizing the water level and vehicle speed signals to the range of 0 to 1. Then, it assigns preset weight coefficients to each of the three signals, and performs a weighted sum of the normalized values ​​to obtain a comprehensive risk score. Finally, based on the range of the comprehensive risk score, the current flood risk level is classified into three levels: high risk, medium risk, or low risk.

[0054] The reason for introducing vehicle speed as a joint judgment condition is that the lower the vehicle speed, the lower the dynamic pressure of the vehicle in the water, the lower the pressure difference of the door seal, and the higher the risk of water entering the vehicle when opening the door at the same water level. Conversely, when driving at high speed, the vehicle is usually in the wading transition phase rather than a stationary immersion state, and the risk is relatively low. Therefore, combining vehicle speed with water level and driving mode can more accurately reflect the actual risk of water ingress and avoid false triggering caused by relying solely on water level or mode signals. In a specific embodiment, the weighting coefficient of the driving mode status signal is 0.4, the weighting coefficient of the water level height signal is 0.4, and the weighting coefficient of the vehicle speed signal is 0.2. A comprehensive risk score greater than 0.7 is considered high risk, a score between 0.4 and 0.7 is considered medium risk, and a score less than 0.4 is considered low risk.

[0055] The risk level determination logic is based on a joint assessment of three key parameters: driving mode status, water level, and vehicle speed. Different threshold combinations are used to classify risks into high, medium, and low levels. Specifically, when the driving mode is in navigation mode or the water level is above a first threshold, and the vehicle speed is below a first speed threshold, the overall risk score is the highest, indicating a high risk. This means the vehicle is in deep water at a low speed or stationary, with an extremely high risk of water ingress. When the driving mode is in navigation mode or the water level is above a third threshold, and the vehicle speed is below a second speed threshold, the overall risk score is in the middle range, indicating a medium risk. This means the vehicle is in medium water level or at a medium speed, but still faces some risk of water ingress. In other cases, the overall risk score is low, indicating a low risk. This means the vehicle has not entered the water area or is passing through shallow water at high speed, and the risk of water ingress is negligible. The first speed threshold is lower than the second speed threshold, and the third threshold is lower than the first threshold, forming a tiered assessment mechanism. In one specific embodiment, the first set threshold is 30cm, the third set threshold is 20cm, the first vehicle speed threshold is 10km / h, and the second vehicle speed threshold is 30km / h.

[0056] The vehicle body controller triggers differentiated disabling commands based on the level of water ingress risk. The higher the risk level, the wider the scope of disabling and the stronger the control, thus achieving graded safety protection. Specifically, when the water ingress risk level is high, the body controller immediately triggers a complete disable command, disabling all electronic door opening methods (including the functions of opening electric doors via exterior door handle switches, interior electronic switches, voice control, and large screen soft switches), and simultaneously disabling the one-touch window lowering function (ignoring long-press signals, retaining only the intermittent lowering function with limited distance per intermittent press). The mechanical emergency release function remains intact to ensure maximum prevention of water ingress risk due to misoperation in deep water and low-speed scenarios. When the water ingress risk level is medium, the body controller triggers a partial disable command, disabling only the functions of opening electric doors via the exterior door handle switches and large screen soft switches, which are most easily misactivated. The interior electronic switches and voice control functions remain intact (allowing the driver to actively operate the doors when necessary), while the one-touch window lowering function is disabled. A medium-risk warning is issued to the driver via the instrument panel (displaying "Current water level is high, some door functions are restricted"), prompting them to pay attention to the current water level and operate with caution. When the water ingress risk level is low, the body controller does not send a disable command, all door functions remain in normal working order, and users can use all door opening methods and window raising / lowering functions normally.

[0057] The design principle of the aforementioned tiered disabling strategy is to achieve a dynamic balance between safety and ease of use based on the actual severity of the water ingress risk. Specifically, in high-risk scenarios, where the risk of water ingress is extremely high, all electronic door opening channels need to be completely closed to prevent any accidental operation, with only mechanical emergency release functions remaining to ensure unobstructed emergency escape routes. In medium-risk scenarios, while there is still some risk of water ingress, the vehicle is not yet in a completely dangerous state. By disabling the most easily accidentally touched exterior door handles and large-screen soft switches, while retaining in-vehicle electronic switches and voice control—methods requiring driver intervention—safety is provided without excessively restricting the driver's ability to operate actively, and warning prompts enhance the driver's risk awareness. In low-risk scenarios, no intervention is required, avoiding unnecessary functional restrictions that could negatively impact the user experience, and ensuring ease of operation when driving on normal land or navigating shallow water at high speeds. Compared to traditional one-size-fits-all disabling schemes, this tiered strategy can dynamically adjust the level of control based on actual risk, maximizing user freedom of operation while ensuring safety, and significantly improving user experience satisfaction.

[0058] The above technical solution uses a multi-source information fusion algorithm to calculate the water ingress risk level by combining driving mode status, water level, and vehicle speed information, thus solving the problem of misjudgment that may be caused by a single triggering condition. For example, even if the driver has not switched to navigation mode, but the water immersion sensor detects that the water level exceeds 30cm and the vehicle speed is below 10km / h, the system can still automatically determine it as a high-risk state and trigger the disable logic, avoiding the risk of water ingress caused by human negligence.

[0059] In some implementations, an innovative vehicle tilt angle sensing and dynamic water level correction mechanism is incorporated. The vehicle body controller also acquires vehicle tilt angle information and dynamically corrects the water level height detected by the immersion sensor to eliminate the influence of vehicle attitude changes on water level judgment.

[0060] The vehicle is equipped with an IMU (Inertial Measurement Unit) sensor to detect the vehicle's longitudinal tilt angle (pitch angle) and lateral roll angle (roll angle) in real time. The IMU sensor transmits the tilt angle data to the body controller via the CAN bus.

[0061] The vehicle body controller adjusts the water level based on the vehicle's tilt angle, using the following formula: Corrected water level height = Sensor measured water level height × cos (pitch angle) × cos (roll angle) + L × sin (pitch angle), where L is the longitudinal distance from the water immersion sensor installation position to the vehicle's center of gravity.

[0062] This dynamic water level correction mechanism addresses the discrepancy between the water level measured by a single-point immersion sensor and the actual risk of water ingress when a vehicle tilts longitudinally or laterally in water. For example, when the vehicle tilts forward, the front sensor might measure a higher water level than the rear sensor might measure a lower one. Without correction, this could lead to misjudgment of the risk level. By incorporating IMU data to correct the water level measurements in real time, the accuracy of risk level assessment can be improved, preventing false or missed triggers caused by changes in vehicle attitude.

[0063] S3: When the risk level is determined to be high risk, execute multiple disabling commands; In this embodiment, when the driving mode is in navigation mode and the vehicle speed is less than a first speed threshold, the risk level is determined to be high, and the vehicle controller executes several disabling commands. The disabling commands are as follows: (1) Disable the exterior door handle switch function The body controller stops responding to the capacitive sensor signal from the exterior door handle sensor. Specifically, software filtering logic is added to the input port of the body controller. When a touch signal is received from the exterior door handle sensor, the internal mode flag is checked. If it is in navigation mode, the signal is discarded, and the door opening mechanism is not triggered.

[0064] The door handle operation cannot trigger the door opening mechanism, but the mechanical emergency release function is retained. That is, the mechanical handle on the inside of the door is always available, and the door can be opened directly through the mechanical linkage mechanism without relying on the electronic control system.

[0065] (2) Disable the one-touch lowering function of the glass. The body controller sends a mode switching command to the window regulator controller via the CAN bus.

[0066] After receiving the instruction, the window regulator controller ignores long press signals with a duration of 500ms or more (the trigger condition for the traditional one-button descent function), but retains the inching descent function with a duration of less than 500ms.

[0067] The implementation of the inching descent function: When the user presses the window lift switch, the window lift controller detects the pressing duration. If the pressing duration is less than 500ms, the window motor is driven to descend at a low speed, with a descent distance limited to 2cm (the window position is detected by a Hall sensor, and it automatically stops after descending 2cm). If the pressing duration is greater than or equal to 500ms, the signal is ignored, and the window does not move.

[0068] (3) Disable in-vehicle electronic switch function The body controller disables in-vehicle electronic switch signals through hardware filtering and software shielding. Specifically, an RC filter circuit is added to the input port of the body controller to filter out high-frequency interference signals; simultaneously, shielding logic is added at the software level. When a signal from an in-vehicle electronic switch is received, the internal mode flag is checked; if it indicates navigation mode, the signal is discarded.

[0069] (4) Disable voice control function Add logical judgment to the output of the voice recognition module. Specifically: After recognizing a preset voice command such as "open the door", the voice recognition module queries the mode status of the body controller before sending the CAN message. If the body controller returns the navigation mode flag, the voice recognition module discards the door opening command and does not send the CAN message to the body controller.

[0070] Other voice functions remain normal, such as voice control of the audio system, air conditioning, and navigation.

[0071] (5) Disable the large screen soft switch function The central control screen software adds mode detection. Specifically, when the central control screen application starts up, it queries the mode status of the body controller via the CAN bus. If it is in navigation mode, the virtual door opening button on the central control screen will be displayed in gray (the color changes from the normal blue to gray), and touch response will be disabled (no action will be triggered when the user clicks the button).

[0072] At the same time, the central control screen displays the status message: "Currently in navigation mode, some door functions are disabled."

[0073] By employing the aforementioned technical solutions and differentiated disabling strategies, a balance between safety and practicality is achieved while ensuring the prevention of accidental water ingress, and simultaneously addressing basic ventilation needs (retaining the jogging descent function) and emergency escape needs (retaining the mechanical emergency release function).

[0074] In some implementations, while sending multiple function disable commands, the body controller also triggers the door sealing airbag inflation controller to drive the inflatable sealing airbag installed in the sealing groove at the edge of the door to automatically inflate and expand, so as to actively enhance the door sealing performance and further reduce the risk of water ingress from a physical perspective.

[0075] Each vehicle door edge sealing groove is equipped with an inflatable sealing airbag. The sealing airbag is connected to an air pump and an inflation control valve via an inflation line. The inflation control valve is controlled by the body controller via a hard-wired signal. When the body controller determines that the water ingress risk level is high, it sends a function disable command to the door lock controller and window regulator controller, and at the same time sends an inflation command to the inflation control valve via a hard-wired signal. The air pump drives the sealing airbag to inflate to a set pressure (e.g., 50 kPa), causing the sealing airbag to expand and tightly fill the sealing gap between the door and the door frame, forming a reinforced sealing layer to prevent water from seeping in through the sealing gap.

[0076] The body controller monitors the inflation pressure of the airbag in real time through pressure sensors. If the airbag pressure is detected to be lower than the set lower limit (e.g., 40 kPa), it is determined that there is a leak in the airbag. The body controller automatically triggers the air replenishment command, drives the air pump to replenish the air, and issues a warning to the driver on the instrument panel that the airbag pressure is insufficient, prompting him to check the sealing system.

[0077] When the body controller detects that multiple exit conditions are met and sends a function recovery command, it simultaneously sends a deflation command to the inflation control valve. The sealing airbag automatically depressurizes and retracts to its initial state, ensuring that the doors can be opened and closed normally in land mode without affecting daily use.

[0078] When the body controller detects that the power supply voltage is lower than the low voltage protection threshold, it simultaneously triggers the emergency deflation of the sealing airbag while sending a function recovery command, ensuring that occupants can open the door normally through the mechanical emergency release function in the event of a power failure.

[0079] Existing door safety control solutions rely solely on electronic disabling to prevent accidental door opening. However, the door's sealing performance depends on the natural sealing effect of the original sealing strips. Under conditions of severe vehicle vibration, prolonged immersion in water, or aging of the sealing strips, there is still a risk of seal failure leading to water leakage. This invention introduces a door seal airbag active inflation mechanism, superimposing a physical sealing reinforcement layer on top of the electronic disabling mechanism. This achieves a dual protection system of electronic anti-misoperation and physical enhanced sealing, significantly improving the door's waterproof reliability in navigation mode and representing a significant technological advancement compared to existing technologies.

[0080] S4: Real-time monitoring mode status; In this embodiment, during navigation mode, the vehicle controller continuously performs the following monitoring tasks: (1) The body controller periodically polls and monitors the driving mode status signal, and at the same time monitors the locking status feedback of each door in real time. Specifically, the body controller queries the status message of the driving mode selection module through the CAN bus at a set detection period to ensure timely perception of mode changes; at the same time, the door lock status is continuously fed back to the body controller through CAN messages, and the body controller knows the current actual locking status of each door based on this, providing real-time basis for anomaly judgment.

[0081] (2) The body controller records and counts the user's attempts to operate the door in the navigation mode using disabled methods. Specifically, when a user attempts to open the door using disabled methods such as the external door handle, the in-vehicle electronic switch, voice control, or the large screen soft switch, the body controller, after detecting the corresponding signal, accumulates the number of abnormal operation attempts corresponding to that operation method and persistently stores the count result in the EEPROM non-volatile memory inside the body controller for subsequent fault analysis and user behavior research.

[0082] (3) The body controller continuously monitors the CAN bus communication status, maintains a safe state and issues an alarm to the driver when communication is abnormal. Specifically, the body controller sets a CAN communication timeout judgment time. If no status message from the driving mode selection module is received within this time, it is determined that the CAN communication has timed out. After the timeout, the body controller maintains the current mode state (i.e., continues to execute the disable command and does not mistakenly remove the disable due to communication interruption), and sends an alarm signal to the instrument panel via the CAN bus. The instrument panel then displays a driving mode communication fault warning message to alert the driver. In one specific embodiment, the CAN communication timeout judgment time is set to 500ms.

[0083] (4) The body controller monitors the vehicle power supply voltage in real time and automatically deactivates the disabled state to ensure safety when the voltage is abnormally low. It also has the ability to remember the power outage state so that the previous mode state can be continued after the power supply is restored. Specifically, the body controller continuously collects the power supply voltage through the built-in ADC at a set sampling period. When the power supply voltage is detected to be lower than the low voltage protection threshold, it is determined to be a power supply abnormality. The body controller automatically sends a function recovery command to each controller to deactivate all disabled states, ensuring that the occupants can still operate the doors normally in the event of a power abnormality. In addition, the body controller stores the current mode state in the EEPROM non-volatile memory. After the power supply is restored, it automatically reads and retains the previous mode state without the need for manual switching. In one specific embodiment, the low voltage protection threshold is set to 9V and the sampling period is set to 100ms.

[0084] (5) The body controller has a built-in fault self-diagnosis function, which supports reading fault codes through the standard diagnostic interface and supports online parameter calibration through a special tool. Specifically, the body controller continuously performs self-checks on key parameters such as CAN communication status, sensor signal status, and power supply voltage status during operation. When an abnormality occurs, it generates and stores the corresponding fault code. Maintenance personnel can read the fault code through the diagnostic interface to quickly locate the cause of the fault. In addition, the system supports online calibration and adjustment of signal thresholds (such as the first set threshold, the second set threshold, the low voltage protection threshold, etc.) and the response time of each function through a special diagnostic tool, which can adapt to the parameter requirements of different vehicle models without replacing the hardware.

[0085] The reference values ​​for the above monitoring parameters are as follows: driving mode status signal detection cycle is 20ms; CAN communication timeout judgment time is 500ms; power supply voltage sampling cycle is 100ms, and low voltage protection threshold is 9V. All of the above values ​​can be adjusted using an online calibration tool according to the actual needs of the vehicle model.

[0086] By employing the above technical solutions and implementing real-time monitoring and anomaly alarm mechanisms, the observability and maintainability of the system status are achieved, significantly improving system reliability.

[0087] S5: Issues a function recovery command based on multiple exit conditions; In this embodiment, the vehicle body controller periodically checks multiple exit conditions and only sends a function recovery command when all conditions are met simultaneously, to ensure that the vehicle has completely left the aquatic environment.

[0088] (1) The body controller detects whether the driving mode selection module has sent a land mode signal to confirm the driver's intention to actively exit the navigation mode. Specifically, the body controller continuously listens to the status message of the driving mode selection module through the CAN bus. When the mode flag in the message changes from navigation mode to land mode, it is determined that the condition is met. If only the land mode signal is received and other conditions are not met, the body controller remains disabled and does not send a function recovery command.

[0089] (2) The vehicle body controller detects whether the water level height of the immersion sensor has fallen below the second preset threshold to confirm that the vehicle has left the aquatic environment. Specifically, the vehicle body controller reads the water level height signal of the immersion sensor in real time through an independent wire and compares it with the second preset threshold. The second preset threshold is lower than the first preset threshold, and a hysteresis interval is formed between the two to prevent the system from frequently switching between navigation mode and land mode due to small fluctuations in water level caused by water waves or vehicle bumps. In a specific embodiment, the first preset threshold is 30cm, the second preset threshold is 10cm, and the hysteresis interval is 20cm.

[0090] The vehicle controller polls the two conditions mentioned above at a set detection cycle. When both conditions are met simultaneously, it is determined that it is safe to exit the navigation mode and enter the function recovery process. In one specific embodiment, the detection cycle is set to 100ms.

[0091] The design principle of the hysteresis interval is as follows: when the water level drops from above the first set threshold, it needs to continue to drop below the second set threshold before the exit condition is triggered, rather than exiting immediately once it falls below the first set threshold. For example, when the water level drops from above the first set threshold to between the first and second set thresholds, the system will not immediately exit the navigation mode; only when the water level further drops below the second set threshold, and the other exit conditions (land mode signal) are met simultaneously, will the function recovery process be triggered.

[0092] The above technical solution, through multiple safety confirmation processes, ensures that the vehicle is completely out of the water environment before restoring its function, thus avoiding the risk of water ingress due to premature restoration.

[0093] S6: Execute the function recovery process.

[0094] In this embodiment, after all the multiple exit conditions in step S5 are met, the body controller executes the function recovery process to restore all disabled door control functions to normal working status.

[0095] (1) The body controller immediately sends a function recovery command to the door lock controller and the window regulator controller via the CAN bus to release the disabled state of each actuator. Specifically, the function recovery command is broadcast to the relevant controllers via the CAN bus. After receiving the command, the door lock controller resumes normal response to the door opening requests of the external door handle and the electronic switch inside the vehicle. After receiving the command, the window regulator controller resumes normal response to the one-button lowering function.

[0096] (2) The body controller resets all input signal processing algorithms to the default state and removes the shielding logic of each signal source. Specifically, the body controller sequentially removes the software filtering shielding logic of the exterior door handle sensor, the hardware filtering and software shielding logic of the in-vehicle electronic switch, and the command interception logic of the voice recognition module, and notifies the central control screen touch sensor to restore the normal display and touch response of the virtual door opening button, so that all the above operation methods can be restored to normal function.

[0097] (3) The body controller sends status query commands to each controller to verify the function recovery results and ensure that each controller has correctly returned to normal working status. Specifically, the body controller sends status query messages to the door lock controller, window regulator controller, voice recognition module, and central control screen touch sensor via the CAN bus, and waits for the response messages from each controller; if all controllers return a normal status response within the set timeout period, the function recovery is determined to be successful, and the body controller sends a function recovery completion prompt signal to the instrument panel; if any controller fails to respond within the timeout period or returns to an abnormal status, the body controller sends a fault alarm signal to the instrument panel, prompting the driver that there is an abnormality in the relevant controller and that it needs to be checked. In one specific embodiment, the status query timeout period is set to 200ms.

[0098] The following effects can be achieved through the implementation of this embodiment: The tiered water ingress risk assessment mechanism significantly improves the accuracy of risk identification through dual-trigger judgment, effectively solving the problem of missed detection that may be caused by a single trigger condition. Specifically, the mechanism uses the driving mode signal and the water immersion sensor signal together as trigger conditions. Even if the driver forgets to switch to navigation mode but the vehicle has entered the water, the water immersion sensor can still independently detect the water level and trigger a disabling command, avoiding the risk of water ingress caused by human negligence. The accuracy of risk identification is significantly improved compared to solutions that rely on only a single trigger condition.

[0099] The differentiated disabling strategy ensures protection against accidental water ingress while balancing basic ventilation and emergency escape needs, achieving a balance between safety and practicality. Specifically, this strategy applies different levels of control to different operating methods: it completely disables high-risk door opening operations such as exterior door handle switches, interior electronic switches, voice control, and large screen soft switches; it partially disables the one-touch window lowering function, ignoring the long-press signal but retaining the intermittent lowering function, allowing users to fine-tune the window opening for basic ventilation even in navigation mode; and it always retains the mechanical emergency release function, ensuring that occupants can quickly open the door and escape using the mechanical handle in an emergency. This significantly improves user experience satisfaction compared to a blanket disabling approach.

[0100] The independent triggering logic of the water immersion sensor enhances system reliability in communication failure scenarios through hardware redundancy protection. Specifically, the water immersion sensor is directly connected to the body controller via a wire independent of the CAN bus. Even if the CAN bus communication fails or the driving mode selection module malfunctions, the water immersion sensor can still independently transmit the water level signal to the body controller and trigger a disable command. This fundamentally eliminates the risk of protection failure due to a single point of failure in the communication link, significantly improving system reliability compared to a single trigger source solution.

[0101] The multi-factor safety confirmation process ensures the accuracy of function restoration timing through joint judgment of multiple conditions, effectively preventing the risk of water ingress caused by premature restoration. Specifically, the process requires multiple conditions, such as driving mode signal and water level, to be met simultaneously before function restoration can be triggered, ensuring that the door operation function can only be restored after the vehicle is completely out of the water environment. At the same time, the design of a lag interval formed by the second set threshold being lower than the first set threshold further improves the robustness of the exit judgment and prevents frequent mode switching caused by small fluctuations in water level.

[0102] The real-time monitoring and anomaly alarm mechanism, through comprehensive status awareness and anomaly handling capabilities, achieves observability and maintainability of system status, significantly improving overall system reliability. Specifically, during navigation mode, the mechanism continuously monitors driving mode status signals and door lock status, recording abnormal user operation attempts for subsequent analysis; it maintains the current disabled state and alarms the driver when CAN communication times out, preventing misunderstanding of protection termination due to communication interruption; it automatically restores all functions and saves the mode status through power-off memory when the power supply voltage is abnormal; and the built-in self-diagnostic function supports fault code reading and online calibration, facilitating after-sales maintenance and parameter adjustment.

[0103] Example 2 The difference between this embodiment and Embodiment 1 is that a user prompt and confirmation step is added before executing the disable command, thereby improving the user's perception and understanding of the system behavior through human-computer interaction.

[0104] When the vehicle controller detects that the navigation mode trigger conditions are met, it prompts the user via the instrument panel display or central control screen before executing the disabling command, and sets a confirmation waiting time limit. After the time limit expires, the system automatically executes the disabling command to ensure safety first. Specifically, after determining that the water ingress risk level is high, the vehicle controller first pops up a prompt window on the instrument panel or central control screen, informing the user that "Navigation mode has been activated, and some door functions will be disabled. Please confirm whether to continue." The user can confirm via the physical button on the steering wheel or the virtual confirmation button on the central control screen. If the user confirms within the set time, the system immediately executes the disabling command. If the user does not confirm within the set time, the system automatically executes the disabling command to ensure that protection is not delayed due to waiting for user response in emergency situations (such as when the vehicle quickly enters water). If the user actively clicks the cancel button, the system will not execute the disabling command temporarily, but the vehicle controller will continue to monitor the trigger conditions. If the conditions persist, the prompt window will pop up again after a set interval. In one specific embodiment, the confirmation waiting time limit is set to 5 seconds, and the repeat prompt interval is set to 30 seconds.

[0105] This embodiment enhances users' perception and understanding of system behavior through prompts and confirmation mechanisms, reducing misoperations or complaints caused by information asymmetry. At the same time, the system can still automatically execute the disable command in emergency situations to ensure safety first.

[0106] Specifically, after receiving the prompt, users can clearly understand that some functions of the car door will be disabled, and have the opportunity to actively confirm or cancel, which improves users' sense of control over the system's behavior and their satisfaction with the experience. In emergency scenarios such as the vehicle quickly entering the water or the water level rising rapidly, even if the user does not confirm in time, the system can automatically execute the disabling command after the set waiting time limit expires, avoiding delays in protection due to waiting for user confirmation.

[0107] Example 3 The difference between this embodiment and Embodiment 1 is that a single immersion sensor is replaced with three redundant immersion sensors, and a majority voting mechanism is adopted to further reduce the risk of single point of failure, making it suitable for scenarios with higher system reliability requirements.

[0108] The system is equipped with three redundant immersion sensors, installed at the front, middle, and rear of the vehicle chassis respectively. Each sensor is electrically connected to the body controller via independent wires, including signal, ground, and power lines. Specifically, the purpose of distributing the three sensors is to cover different areas of the vehicle chassis, improving the spatial representativeness of water level detection and preventing false readings due to localized water accumulation or partial sensor obstruction.

[0109] The vehicle body controller reads signals from three immersion sensors at a set sampling period, converts them into water level heights, and then performs a majority vote to improve the fault tolerance of water level determination. Specifically, the vehicle body controller performs a consistency check on the water level readings of the three sensors. If the difference between the output value of one sensor and the output values ​​of the other two sensors exceeds a set difference threshold, the sensor signal is determined to be abnormal; the abnormal sensor reading is excluded, and the vehicle body controller takes the average of the readings of the other two consistent sensors as the valid water level height; if the readings of all three sensors are within the set difference threshold range, the average of the three is taken as the valid water level height. In a specific embodiment, the sampling period is set to 10ms, and the difference threshold is set to 10cm; for example, if the readings of the three sensors are H_A, H_B, and H_C, when both |H_C-H_A| and |H_C-H_B| exceed the difference threshold, sensor C is determined to be abnormal, and the average of H_A and H_B is taken as the valid water level height.

[0110] The core functionality implemented in this embodiment is the same as in Embodiment 1, both implementing independent triggering logic for the immersion sensor. This is suitable for scenarios with higher system reliability requirements, such as military amphibious vehicles and special rescue vehicles. Specifically, in harsh environments (such as mud, sand, weeds, etc., which may cause sensor contamination or damage), even if one sensor fails, the system can still obtain valid water level information through the other two sensors, ensuring that the reliability of the triggering logic is not affected by a single point of failure.

[0111] Example 4 This embodiment discloses a safety control system for a car electric door, including: The data acquisition module is configured to acquire driving mode status and water level in real time. The control module is configured to issue multiple function disabling commands when the driving mode is navigation mode or the water level is greater than a first set threshold, and control each actuator to perform disabling operations. The disabling operations include disabling the functions of opening the electric door with the exterior door handle switch, the in-vehicle electronic switch, the voice control and the large screen soft switch, as well as disabling the one-button lowering function of the window. The recovery control module is configured to issue a function recovery command when the driving mode is land mode or the water level is less than a second set threshold, thereby controlling each actuator to restore all disabled functions.

[0112] In this embodiment, the actuators include a door lock controller and a window regulator controller.

[0113] In this embodiment, the system hardware composition and connection relationships are first described, such as... Figure 2 As shown, this system includes the following main components: (1) Driving mode selection module: generates navigation mode status signal, connects to the body controller through CAN_H and CAN_L lines, and sends driving mode status message through CAN bus (message ID: 0x200, data length 8 bytes, where the second byte bit0=1 indicates navigation mode and bit0=0 indicates land mode).

[0114] (2) Body Controller (BCM): As the control core, it receives driving mode status signals and executes disable / enable logic. It adopts a 32-bit ARM Cortex-M4 processor with a main frequency of 168MHz, and has a built-in CAN controller and 128KB EEPROM non-volatile memory.

[0115] (3) Immersion sensor: A capacitive water level sensor is used, with a measurement range of 0-100cm and an accuracy of ±2cm. It is electrically connected to the vehicle body controller through an independent wire, which includes a signal wire (analog voltage output 0-5V, linearly corresponding to water level 0-100cm), a ground wire, and a power supply wire (12V DC).

[0116] (4) Door lock controller: It communicates with the body controller via CAN bus (CAN communication rate 500kbps), receives commands from the body controller, and controls the locking mechanism of the four doors.

[0117] (5) Window regulator controller: It communicates with the body controller via CAN bus, receives commands from the body controller, and controls the raising and lowering of the four windows.

[0118] (6) Exterior door handle sensor: A capacitive touch sensor is used to detect door handle operation signals. It is connected to the body controller via LIN bus (communication rate 19.2kbps) and sends a touch signal to the body controller when a touch operation is detected.

[0119] (7) Voice recognition module: Recognizes voice door opening commands and communicates with the body controller via the CAN bus. When a preset voice command such as "open the door" is recognized, a door opening request is sent to the body controller via a CAN message (message ID: 0x300).

[0120] (8) Central control screen touch sensor: detects the soft switch operation signal of the large screen and communicates with the body controller via CAN bus. When the user clicks the virtual door opening button on the central control screen, a door opening request is sent to the body controller via CAN message (message ID: 0x400).

[0121] All CAN bus nodes are connected via CAN_H and CAN_L twisted-pair cables, with 120Ω terminating resistors at both ends of the bus. All components are powered by 12V DC, distributed through the vehicle's electrical system.

[0122] The beneficial effects of this system are: By employing a tiered flood risk assessment mechanism that combines driving mode status, water level, and vehicle speed information with a multi-source information fusion algorithm to calculate the flood risk level, the problem of misjudgment that may be caused by a single triggering condition is solved, thereby improving the accuracy of risk identification.

[0123] By employing a differentiated disabling strategy, the exterior door handle switches, interior electronic switches, voice control, and large screen soft switches are completely disabled, while the one-touch window lowering function is partially disabled (the intermittent lowering function is retained). The mechanical emergency release function is always retained, ensuring that basic ventilation needs and emergency escape needs are met while preventing accidental water ingress.

[0124] By using a user prompt and confirmation mechanism before disabling, a prompt message is sent to the user via the dashboard or central control screen before the disabling command is executed, and confirmation is required. This improves the user's perception and understanding of the system behavior and reduces misoperations or complaints caused by information asymmetry.

[0125] By using an independent triggering logic based on the immersion sensor, when the immersion sensor detects that the water level is higher than the first set threshold, the body controller will automatically execute a disable command even if the driving mode selection module does not send a navigation mode signal, thus achieving redundant protection.

[0126] Through a multi-step safety exit confirmation process, the function is only restored when multiple conditions such as driving mode signal and water level are met simultaneously, ensuring that the vehicle is completely out of the water environment before restoring the function and avoiding the risk of water ingress due to premature restoration; the first set threshold of 30cm and the second set threshold of 10cm form a 20cm lag interval to prevent frequent mode switching due to water level fluctuations.

[0127] Through real-time monitoring and anomaly alarm mechanisms, the vehicle controller checks the driving mode status signal every 10ms to 30ms during navigation mode, records the number of abnormal operation attempts, maintains the current mode status and alarms when CAN communication times out, automatically restores all functions when the voltage is low, stores the last mode status when the power is off, and has a built-in self-diagnostic function to support fault code reading and online calibration, thereby achieving observability and maintainability of the system status and significantly improving system reliability.

[0128] Example 5 The purpose of this embodiment is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method of Embodiment 1.

[0129] Example 6 The purpose of this embodiment is to provide a vehicle including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method of Embodiment 1.

[0130] The steps and methods involved in the apparatuses of Embodiments 3 and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0131] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0132] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0133] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A safety control method for an electric car door, characterized in that, include: Real-time monitoring of driving mode status and water level; When the driving mode is in navigation mode or the water level is greater than the first set threshold, multiple function disable commands are issued to control each actuator to perform the disable operation; the disable operation includes disabling the function of opening the electric door with the external door handle switch, the in-vehicle electronic switch, the voice control and the large screen soft switch, as well as disabling the one-button lowering function of the window; When the driving mode is in land mode or the water level is less than the second set threshold, a function recovery command is issued to control each actuator to restore all disabled functions.

2. The safety control method for an electric car door as described in claim 1, characterized in that, By combining driving mode status, water level, and vehicle speed, a multi-source information fusion algorithm is used to calculate the water ingress risk level, and corresponding function disable commands are triggered based on the water ingress risk level.

3. The safety control method for an electric car door as described in claim 2, characterized in that, When the driving mode is in navigation mode or the water level is greater than the first set threshold and the vehicle speed is lower than the first speed threshold, the water ingress risk level is determined to be high risk, triggering a complete disable command; when the driving mode is in navigation mode or the water level is greater than the third set threshold and the vehicle speed is lower than the second speed threshold, the water ingress risk is determined to be medium risk, triggering a partial disable command.

4. The safety control method for an electric car door as described in claim 1, characterized in that, The vehicle tilt angle information is obtained, and the water level is dynamically corrected through a dynamic water level correction mechanism.

5. The safety control method for an electric car door as described in claim 1, characterized in that, While issuing multiple function disable commands, it also issues an inflation command to drive the inflatable sealing airbag to inflate to the set pressure.

6. The safety control method for an electric car door as described in claim 1, characterized in that, Multiple exit conditions are set, and a function recovery command is issued only when all conditions are met simultaneously. The multiple exit conditions include: the driving mode is in land mode; the water level is less than a second set threshold.

7. A safety control system for an electric car door, characterized in that, include: The data acquisition module is configured to acquire driving mode status and water level in real time. The control module is configured to issue multiple function disabling commands when the driving mode is navigation mode or the water level is greater than a first set threshold, and control each actuator to perform disabling operations. The disabling operations include disabling the functions of opening the electric door with the exterior door handle switch, the in-vehicle electronic switch, the voice control and the large screen soft switch, as well as disabling the one-button lowering function of the window. The recovery control module is configured to issue a function recovery command when the driving mode is land mode or the water level is less than a second set threshold, thereby controlling each actuator to restore all disabled functions.

8. The safety control system for a car electric door as described in claim 7, characterized in that, The actuators include door lock controllers and window regulator controllers.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the safety control method for a navigation electric vehicle door as described in any one of claims 1-6.

10. A vehicle comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the safety control method for a navigation electric vehicle door as described in any one of claims 1-6.

Images