A post-crash in-vehicle anti-suffocation control method and control system, vehicle

Abstract

The application discloses a post-collision in-vehicle anti-suffocation control method and a control system and a vehicle, and relates to the technical field of automobile safety. The method comprises the following steps: continuously monitoring a collision trigger signal after the vehicle is powered on; the collision trigger signal comprises at least one of a collision signal, a vehicle posture signal and a battery thermal runaway signal; when the collision trigger signal is received, the main power voltage is judged according to the monitored main power voltage, the stable power supply mode is switched to, and the environmental monitoring and the vital sign detection are started; the suffocation risk level is determined according to the monitored environmental parameters, the vehicle posture signal and the vital sign data; and the power supply range corresponding to the risk level is dynamically expanded according to the suffocation risk level, and the corresponding anti-suffocation emergency response action is triggered. The application can solve the problem that the existing in-vehicle anti-suffocation system is only applicable to a non-collision scene, and the main power supply is interrupted after the vehicle collides, the detection and execution components are invalid, and the anti-suffocation system is completely invalid, thereby threatening the safety of the vehicle personnel.

Description

Technical Field

[0001] This invention relates to the field of automotive safety technology, and in particular to a method and control system for preventing suffocation inside a vehicle after a collision, and a vehicle. Background Technology

[0002] With the development of automotive intelligent technology, in-vehicle safety protection systems are gradually evolving from passive protection to active protection. Current in-vehicle anti-suffocation technologies primarily focus on non-collision scenarios, such as children left inside the vehicle or static situations like when the car is parked and asleep. These rely on gas and human body sensors, combined with the vehicle's main power supply, to trigger alarms such as opening windows or remote alarms. However, because existing systems depend on the main power supply, once a collision damages the battery or interrupts the circuit, the system loses all its protective capabilities. Vehicle collisions can cause situations such as the vehicle overturning, body deformation leading to a closed cabin, airbag deployment releasing toxic fumes, or battery thermal runaway generating harmful gases. In these scenarios, occupants face the risk of suffocation without emergency response. Even if the main power supply remains operational after a collision, the impact can cause door deformation and window control failure, rendering existing technologies unable to perform basic emergency response actions such as opening windows, which also threatens the lives of occupants. Summary of the Invention

[0003] This invention provides a method and control system for preventing asphyxiation inside a vehicle after a collision, as well as a vehicle, to solve the problem that existing in-vehicle asphyxiation control systems are only applicable to non-collision scenarios, and that the asphyxiation control system will completely fail after a vehicle collision due to main power interruption, failure of detection and execution components, etc., thereby threatening the safety of the occupants.

[0004] In a first aspect, the present invention provides a method for preventing suffocation inside a vehicle after a collision.

[0005] A method for preventing suffocation inside a vehicle after a collision, comprising: After the vehicle is powered on, the collision trigger signal is continuously monitored; the collision trigger signal includes at least one of the following: collision signal, vehicle attitude signal, and battery thermal runaway signal. When a collision trigger signal is received, the system will determine the power supply mode based on the monitored main power supply voltage, switch to a stable power supply mode, and start environmental monitoring and vital sign detection. The asphyxiation risk level is determined based on monitored environmental parameters, vehicle attitude signals, and vital signs data. Based on the suffocation risk level, the power supply range corresponding to the risk level is dynamically expanded and the corresponding suffocation prevention emergency response action is triggered.

[0006] A further technical solution involves verifying the authenticity of a collision within a preset time after receiving a collision trigger signal; the collision authenticity verification includes detecting at least one of the following: airbag deployment signal, sudden drop in vehicle speed signal, and simultaneous trigger signals from multiple sensors. When the collision authenticity verification passes, it is confirmed as a real collision and the system is activated; otherwise, when the collision authenticity verification fails, it is determined to be a false trigger and the system returns to standby mode.

[0007] Further technical solutions, based on the monitored main power supply voltage, involve switching to a stable power supply mode, including: When the main power supply voltage is lower than the preset threshold, the main power supply will be switched to the backup power supply within the preset switching time; otherwise, the main power supply will be maintained. In the initial stage, when switching to backup power, the backup power only supplies power to the decision module and the sensor module. Based on the asphyxiation risk level, a power supply range expansion command is generated. Based on the power supply range expansion command, the backup power supply is connected to the load branch corresponding to the emergency response action step by step. After the emergency response action is completed, the execution feedback is received and the completed load branch is disconnected.

[0008] Further technical solutions, based on monitored environmental parameters, vehicle attitude signals, and vital sign data, determine the asphyxiation risk level, including: When the concentration of carbon monoxide or carbon dioxide exceeds a preset threshold, it is determined to be a Level 1 risk. When any of the following conditions are met, the risk level is determined to be Level 2: oxygen concentration is below a preset threshold and the duration exceeds a preset duration; oxygen concentration is within a preset range and the breathing rate is below a preset threshold or the breathing amplitude decreases by more than a preset proportion; oxygen concentration decrease rate exceeds a preset rate and the duration exceeds a preset duration; or vehicle tilt angle exceeds a preset threshold. When the vehicle tilt angle exceeds the preset overturning threshold and a battery thermal runaway signal is received, it is judged as a level three risk. Among them, vehicle attitude signals include vehicle tilt angle information; Level 3 risk level is higher than Level 2 risk level, and Level 2 risk level is higher than Level 1 risk level.

[0009] A further technical solution involves obtaining current altitude data via a GPS positioning module when determining the asphyxiation risk level; based on the current altitude data, obtaining the corresponding environmental parameter thresholds from the altitude calibration database built into the central computing ECU; and using the environmental parameter thresholds to evaluate the currently monitored environmental parameter data in order to determine the asphyxiation risk level. Among them, the environmental parameter thresholds include oxygen concentration threshold, carbon dioxide concentration threshold and respiratory rate threshold; the oxygen concentration threshold decreases with increasing altitude; the carbon dioxide concentration threshold is appropriately increased in high-altitude areas; the respiratory rate threshold is increased with increasing altitude in high-altitude areas.

[0010] Further technical solutions involve triggering corresponding asphyxiation prevention emergency response actions based on the asphyxiation risk level, including: When assessed as a Level 1 risk, the integrity of the vehicle and sunroof mechanism is checked, and the sunroof opening angle is adaptively adjusted based on the vehicle's attitude signal, including: When the vehicle tilt angle is less than the first preset angle, the sunroof opens to the first preset opening angle; When the vehicle tilt angle is between the first preset angle and the second preset angle, the sunroof opens to the second preset opening angle. When the vehicle tilt angle is greater than or equal to the second preset angle, the sunroof is prohibited from being opened and the emergency response action corresponding to the level 2 risk is triggered directly. If no successful execution feedback is received within a preset time after the sunroof opening command is issued, the emergency response action will automatically escalate to the level two risk level.

[0011] A further technical solution, when the risk level is determined to be level two, triggers a sudden window-dropping action, including: The windows will be lowered by explosives in the following priority order: driver's side window, passenger side window, rear left side window, and rear right side window. Within a preset time after each blast window drop command is issued, check whether a successful execution feedback has been received; If no success feedback is received, the system will automatically switch to the next priority window. If all window breaking attempts fail, the roof emergency airbags will be deployed immediately without waiting for the Level 3 risk conditions to be fully met.

[0012] Further technical solutions, when a level three risk is identified, trigger the deployment of the roof-mounted emergency airbags, including: Before deployment, four confirmations are performed: the vehicle tilt angle exceeds the preset inverted threshold and the duration exceeds the preset duration; a battery thermal runaway signal is received or all attempts to lower the windows by bursting are detected to have failed; the presence of people inside the vehicle is detected; and the roof temperature is lower than the preset temperature threshold. When all four conditions are met, a secondary confirmation command is sent to the airbag control unit through an independent verification channel. When both the master command and the verification command are received, the airbag deployment action is executed.

[0013] Further technical solutions include activating the location reporting function when a risk level is determined to be Level 2 or Level 3, including: When the risk level is determined to be Level 2, the vehicle location information and accident level information are reported in real time through the vehicle communication module. When the communication interruption time of the vehicle communication module exceeds the preset duration, the sonar positioning module is automatically activated. When the risk level is determined to be level three, the vehicle communication module and the sonar positioning module start working in parallel.

[0014] Secondly, the present invention provides a post-collision vehicle suffocation prevention control system.

[0015] A post-collision vehicle suffocation prevention control system includes: A multi-dimensional signal sensing layer is used to collect collision signals, vehicle attitude signals, battery thermal runaway signals, environmental parameters, and vital signs data. The cross-domain collaborative decision-making module, including the central computing ECU, is used to receive multi-dimensional signal data, determine the suffocation risk level, and generate anti-suffocation control commands and power supply range extension commands corresponding to the risk level. A multi-level response actuator is used to execute emergency response actions based on anti-asphyxiation control commands; The redundant power supply module is used to monitor the main power supply voltage in real time, automatically switch to system power supply when the main power supply is interrupted, and dynamically expand the power supply range according to the power supply range expansion command.

[0016] A further technical solution is provided, wherein the redundant power supply module includes: The backup power supply consists of a lithium polymer battery and a supercapacitor connected in parallel; the lithium polymer battery provides continuous power, while the supercapacitor provides instantaneous high current output. The power supply management unit is electrically connected to the central computing ECU via an independent power supply topology control bus. It is used to monitor the main power supply voltage in real time, automatically switch to the backup power supply to power the system when the main power supply is interrupted, and control the on / off of each load branch that performs emergency response actions according to the received power supply range extension command.

[0017] A further technical solution is that the multi-level response execution mechanism includes: Sunroof motor, used to open the sunroof when a Level 1 risk is triggered; A blasting window device is used to blast windows when a level 2 risk is triggered. The roof-mounted emergency airbag is designed to deploy and provide emergency breathing space when a Level 3 risk is triggered. A sonar positioning module is used to provide positioning signals when vehicle communication is interrupted; The audible and visual alarm module is used to issue an alarm signal when a risk is triggered.

[0018] Thirdly, the present invention provides a vehicle.

[0019] A vehicle includes the above-described post-collision in-vehicle asphyxiation control system, or a method for implementing the above-described post-collision in-vehicle asphyxiation control method.

[0020] The above one or more technical solutions have the following beneficial effects: This invention provides a post-collision in-vehicle asphyxiation control method, control system, and vehicle. It addresses the fundamental problem of system paralysis caused by main power interruption after a collision through redundant power supply modules and a dynamic topology expansion mechanism. Simultaneously, it achieves comprehensive perception of complex risks and protection against false triggering through a collision authenticity confirmation mechanism that fuses multiple signals such as collision signals, vehicle attitude signals, and battery thermal runaway signals, combined with cross-verification by multiple sensors. Furthermore, a three-level graded response mechanism—level one: sunroof ventilation; level two: window closure upon explosion; and level three: roof airbag deployment—precisely matches differentiated emergency measures for different risk levels. Altitude-adaptive threshold adjustment enhances adaptability to all environments. Through sunroof attitude pre-judgment, a four-level downgrade strategy for window closure upon explosion, four-fold confirmation and dual-bus verification of airbags, monitoring of the internal environment after airbag deployment, and collaborative switching between T-BOX and sonar dual-mode positioning, it achieves autonomous emergency asphyxiation protection capabilities with reliable power supply, accurate triggering, graded response, environmental adaptability, and full coverage of extreme scenarios after a collision, significantly improving the survival probability and timely rescue of occupants after a collision.

[0021] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0023] Figure 1 This is an overall flowchart of the post-collision vehicle suffocation control method in an embodiment of the present invention; Figure 2 This is a framework diagram of the vehicle in-vehicle anti-suffocation control system after a collision, as described in an embodiment of the present invention. Detailed Implementation

[0024] It should be noted that the following detailed descriptions are exemplary and are intended only to describe specific embodiments and to provide further explanation of the invention, and are not intended to limit the scope of exemplary embodiments of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0025] As noted in the background section, existing in-vehicle anti-suffocation systems are primarily designed for non-collision scenarios, such as children left inside the vehicle or static situations like when the car is parked and the driver is asleep. These systems typically monitor oxygen and carbon dioxide concentrations inside the vehicle using environmental sensors, triggering audible and visual alarms or remotely notifying the owner when an anomaly is detected. However, existing systems rely entirely on the vehicle's main power supply. When a collision damages the battery or interrupts the circuit, the system cannot continue operating. Even if the main power supply remains operational after a collision, the triggering mechanism of existing systems is relatively simple, relying solely on single-dimensional data from environmental sensors. This makes it difficult to effectively perceive the actual condition of the vehicle after a collision, potentially leading to missed or false detections. More importantly, in extreme scenarios such as vehicle rollover or overturning, door deformation can cause conventional window controls to fail, rendering anti-suffocation measures ineffective and threatening the lives of occupants.

[0026] To address the aforementioned issues, this invention proposes a post-collision in-vehicle anti-suffocation control method, control system, and vehicle based on multimodal ECU (Electronic Control Unit) collaboration. This solution achieves post-collision anti-suffocation emergency protection through a three-level "perception-decision-execution" architecture and cross-domain ECU collaborative design. Specifically, after the vehicle is powered on, the system continuously monitors the collision trigger signal. Upon receiving the signal, it determines the power supply mode based on the monitored main power voltage and switches to a stable power supply. Simultaneously, environmental monitoring and vital sign detection are initiated. The suffocation risk level is then determined based on monitored environmental parameters, vehicle attitude signals, and vital sign data. Finally, the power supply range corresponding to the suffocation risk level is dynamically expanded, triggering corresponding anti-suffocation emergency response actions. Specifically, a level one risk triggers sunroof opening and audible / visual alarms; a level two risk triggers window closure and location reporting; and a level three risk triggers roof-mounted emergency airbag deployment and sonar positioning.

[0027] The post-collision in-vehicle anti-suffocation control system proposed in this invention can be applied to passenger vehicles equipped with multimodal sensors. These vehicles are equipped with multi-dimensional signal perception layer devices such as airbag controllers (ACU), gyroscope sensors, battery management systems (BMS), environmental sensor arrays, and vital sign detection modules (e.g., millimeter-wave radar). The system's computing device is a central computing ECU, which can be an on-board domain controller or an edge computing node, communicating in real-time with various sensors and actuators via CANFD or Ethernet buses. The system also includes a power supply topology control bus independent of the main communication bus, used to transmit power supply control commands even in the event of a main communication bus failure, ensuring that the power supply management unit can receive risk level commands. This system is suitable for emergency anti-suffocation protection scenarios after passenger vehicle collisions and can also be extended to other vehicle types such as new energy vehicles and commercial vehicles.

[0028] It should be noted that during the above data collection and processing process, the system strictly follows relevant laws and regulations to ensure user privacy and data security. In addition, the system architecture described in the embodiments of this application is only an example and should not be construed as a limitation on the scope of protection of this application. Those skilled in the art can make appropriate adjustments and optimizations to the system architecture according to actual needs.

[0029] Example 1 This embodiment provides a method for preventing suffocation inside a vehicle after a collision. This method is executed by the central computing ECU, such as... Figure 1 As shown, the specific steps include: Step S1: After the vehicle is powered on, continuously monitor the collision trigger signal. The collision trigger signal includes at least one of the following: collision signal, vehicle attitude signal, and battery thermal runaway signal.

[0030] Specifically, considering the multiple compound risks a vehicle may face after a collision: deformation of the vehicle body and damage to electrical circuits, rollover or overturning preventing doors from opening, and battery thermal runaway leading to toxic gas leaks or fires, existing in-vehicle anti-suffocation systems rely solely on single-dimensional data from environmental sensors. This makes it impossible to detect collisions and abnormal vehicle conditions in a timely manner, resulting in delayed or even non-starting emergency response. Therefore, this embodiment integrates three heterogeneous trigger signals—collision signals, vehicle attitude signals, and battery thermal runaway signals—to achieve comprehensive perception of collisions and their associated risks. Any signal trigger can activate the system, preventing system failure due to damage to a single sensor. Simultaneously, the multi-source signal fusion triggering mechanism can initiate emergency protection procedures immediately after a collision, laying the foundation for subsequent risk assessment and tiered response.

[0031] In this embodiment, the central computing ECU enters a standby monitoring state immediately after the vehicle is powered on, continuously receiving data from the multi-dimensional signal sensing layer via CANFD or ETHERNET bus. Specifically: 1) Collision signals are sent by the airbag control unit (ACU). When a collision occurs and the acceleration reaches or exceeds a preset threshold (e.g., 5g), the ACU sends a collision signal to the central computing ECU within 10ms after the collision; 2) Vehicle attitude signals, such as vehicle tilt angle information, are sent by a gyroscope sensor. The gyroscope sensor is installed at the vehicle's center of gravity and has a sampling frequency of 100Hz. When the vehicle tilt angle exceeds a preset threshold (e.g., 60°), it is determined that the vehicle has rolled over. When the tilt angle exceeds a preset overturning threshold (e.g., 80°), it is determined that the vehicle is in an overturned state. The gyroscope sensor sends the vehicle attitude signals to the central computing ECU in real time; 3) Battery thermal runaway signals are sent by the battery management system (BMS). When the battery temperature exceeds a preset temperature threshold (e.g., 80°C) or the battery voltage drops sharply by more than a preset percentage (e.g., 30%) in a short period of time, the BMS sends a battery thermal runaway signal to the central computing ECU.

[0032] Ultimately, the system is activated when the central computing ECU receives a collision trigger signal. In this way, comprehensive perception and rapid response to complex risks after a collision can be achieved, avoiding the problem of traditional solutions having a single trigger mechanism and being unable to perceive complex risks. This provides a reliable trigger mechanism for emergency protection after a collision.

[0033] In one embodiment, considering that when a vehicle travels over severely bumpy roads (such as off-road conditions) or brakes suddenly, the acceleration sensor may detect that the acceleration reaches or exceeds a preset threshold (e.g., 5g), thereby triggering a collision signal. However, this is not a real collision accident, and if the system falsely triggers the signal, it will interfere with normal driving and even cause secondary risks. Therefore, this embodiment also introduces a collision authenticity verification strategy. Within a preset time (e.g., within 50ms) after receiving the collision trigger signal, the central computing ECU also performs collision authenticity verification. This collision authenticity verification includes detecting at least one of the following: airbag deployment signal, sudden drop in vehicle speed signal, and simultaneous trigger signals from multiple sensors.

[0034] Specifically, the central computing ECU detects whether it receives an airbag deployment signal from the ACU; it detects whether the vehicle speed drops sharply beyond a preset speed threshold (e.g., 20 km / h) within 100 ms before and after the collision signal using the vehicle speed sensor; it detects whether the front collision sensor, side collision sensor, and acceleration sensor are triggered simultaneously (i.e., multiple sensors trigger signals simultaneously); when at least one of the above conditions is met, the central computing ECU confirms it as a real collision and activates the system, proceeding to the subsequent power supply switching and risk assessment process; conversely, when the collision authenticity verification fails, the central computing ECU determines it as a false trigger and returns to standby mode, without performing any emergency response actions.

[0035] The aforementioned collision confirmation mechanism effectively prevents false triggering in non-collision scenarios through cross-verification of multi-sensor data, avoids unnecessary emergency response actions from interfering with normal driving, and ensures that the system only activates the emergency protection process when a real collision occurs, thereby improving the accuracy and reliability of system triggering.

[0036] In another embodiment, while the aforementioned collision authenticity verification can effectively prevent most false triggering scenarios, in certain special circumstances (e.g., a minor collision but the vehicle can still drive normally), the driver or passengers may determine that emergency response actions are unnecessary. In such cases, an active exit mechanism is needed to avoid unnecessary actions, or the system should be able to automatically identify non-serious collision scenarios where the vehicle can still drive, thereby achieving intelligent degradation of the system state. To this end, this embodiment designs a system exit mechanism, including: granting the driver or passengers the ability to actively control the system. Specifically, within a preset time after system activation (e.g., within 60 seconds), when the central computing ECU receives an active exit command from the driver (e.g., the driver presses the dedicated "emergency release button" in the vehicle), the system stops executing subsequent emergency response actions and returns to standby mode; or, when the central computing ECU detects that the vehicle speed has recovered to above a preset threshold (e.g., the vehicle speed has recovered to above 5 km / h), the system automatically degrades to monitoring mode, retaining only environmental parameter monitoring functions and not executing physical emergency response actions.

[0037] The aforementioned exit mechanism resolves the issue of unnecessary actions being executed due to system misjudgment, improves the system's intelligence and user-friendliness, balances security protection and user experience, and avoids user annoyance caused by excessive response.

[0038] Step S2: When a collision trigger signal is received, the system will determine the power supply mode based on the monitored main power supply voltage, switch to a stable power supply mode, and start environmental monitoring and vital sign detection.

[0039] Specifically, considering that existing in-vehicle anti-suffocation systems rely entirely on the vehicle's main power supply, when a collision causes battery damage, circuit interruption, or a sudden voltage drop, the system directly fails and cannot continue to operate, leaving occupants without any emergency protection when facing suffocation risks after a collision. Therefore, this embodiment designs a redundant power supply module (including a backup power supply and a power management unit). The power management unit (PMU) continuously monitors the main power supply voltage. When the main power supply voltage falls below a preset threshold, the PMU completes a switchover between the main and backup power supplies within a short time. The power outage time during the switchover is less than a set value, such as 1ms, ensuring that the core system does not fail due to power outages and resolving the system paralysis problem caused by main power interruption.

[0040] In this embodiment, after confirming a real collision, the central computing ECU immediately monitors the voltage of the main power supply (i.e., the vehicle's 12V battery) in real time through the voltage monitoring chip in the redundant power supply module. When the main power supply voltage is lower than a preset voltage threshold (e.g., 10V), the central computing ECU determines that the main power supply is interrupted or about to be interrupted. At this time, the redundant power supply module completes the main power supply switch within a preset switching time (e.g., within 5ms), switching the main power supply to the backup power supply. The power outage time during the switching process is less than 1ms, ensuring that the core control unit and sensor modules will not fail due to power failure. Conversely, when the main power supply voltage is higher than or equal to the preset voltage threshold, the system maintains the main power supply and the backup power supply remains in standby mode.

[0041] It should be noted that when switching to backup power, in the initial stage, the backup power only supplies power to the decision-making module (i.e., the central computing ECU) and the sensor modules (i.e., the environmental sensor array and the vital signs detection module). At this time, the power consumption is at its lowest, reserving the maximum energy margin for subsequent risk assessment and graded response. At the same time, the central computing ECU sends a start command to the environmental sensor array and the vital signs detection module. The environmental sensor array begins to collect environmental parameters such as oxygen concentration, carbon monoxide concentration, carbon dioxide concentration, temperature, and humidity inside the vehicle in real time, and the vital signs detection module (such as a millimeter-wave radar installed in the roof lining) begins to monitor the breathing rate and breathing amplitude of the occupants inside the vehicle.

[0042] In this embodiment, the backup power supply consists of a lithium polymer battery and a supercapacitor connected in parallel. The lithium polymer battery provides continuous power; preferably, it has a nominal voltage of 12V, a capacity of 5Wh (approximately 416mAh@12V), and an operating temperature range of -40℃ to 85℃, meeting automotive-grade application requirements. The supercapacitor provides instantaneous high-current output; preferably, it has a capacity of 10~50F, meeting the needs of instantaneous high-current loads such as the window-lowering ignition circuit and the roof airbag ignition circuit. During normal vehicle operation, the backup power supply is charged by the main power supply at a constant current rate of 0.5C via a DC-DC converter. When the battery's state of charge (SOC) falls below 80%, it automatically replenishes the charge, ensuring the backup power supply always maintains sufficient power.

[0043] In this way, the system can switch to backup power after a collision, avoiding the shortcomings of existing technologies that rely entirely on the main power supply. This ensures that the core system can continue to work after the main power supply is interrupted, improves the power supply reliability of the system after a collision, and provides a stable energy guarantee for subsequent risk assessment and emergency response.

[0044] Furthermore, after obtaining a stable power supply, environmental monitoring and vital sign detection are initiated to collect in-vehicle environmental parameters and vital sign data. Considering that a collision may cause physical damage to some sensors or displacement of their installation positions, if the system relies on only a single sensor, sensor damage will directly lead to the loss of data in the corresponding dimension, affecting the accuracy of risk assessment and even causing the system to malfunction. Therefore, this embodiment achieves multi-dimensional redundant perception of the in-vehicle environment and the status of occupants through redundant deployment of the environmental sensor array and independent installation of the vital sign detection module. Even if some sensors are damaged in a collision, the system can still obtain necessary data through other sensors, ensuring that the risk assessment process is not affected.

[0045] In this embodiment, after receiving the start command from the central computing ECU, the environmental sensor array and vital sign detection module begin to collect data in real time and send the data to the central computing ECU via CANFD or ETHERNET bus.

[0046] In one implementation, the environmental sensor array includes an oxygen sensor, a carbon monoxide sensor, a carbon dioxide sensor, a temperature sensor, and a humidity sensor, which are installed on both sides of the cockpit and trunk for redundant deployment. Preferably, the oxygen sensor has a measurement range of 15%~21%, the carbon monoxide sensor has a measurement range of 0~1000ppm, and the carbon dioxide sensor has a measurement range of 0~5000ppm, with a sampling period of 1 second. The vital signs detection module uses millimeter-wave radar technology and is installed in the center of the roof lining, covering all seats. It can penetrate clothing and seat materials to detect micro-motion signals in the chest and abdomen, thereby extracting respiratory rate and amplitude information, with a sampling period of 1 second.

[0047] The aforementioned redundant deployment design ensures that when any sensor or detection module is damaged by a collision, another sensor or detection module can still continue to provide valid data, avoiding perception failure caused by a single point of failure and improving the fault tolerance and reliability of the system.

[0048] Step S3: Determine the asphyxiation risk level based on the monitored environmental parameters, vehicle attitude signals, and vital signs data. The asphyxiation risk levels are categorized into Level 1, Level 2, and Level 3.

[0049] Specifically, considering the diversity and complexity of the asphyxiation risk faced by vehicle occupants after a collision, and the significant differences in the degree of danger under different risk scenarios, a single response strategy may lead to either over-response (e.g., triggering a window to shatter when there is only a slight carbon monoxide exceedance, causing unnecessary vehicle damage and secondary risks) or under-response (e.g., only opening the sunroof when the oxygen concentration is severely insufficient and the vehicle is overturned, failing to provide effective protection). Therefore, this embodiment establishes a three-dimensional combined judgment mechanism based on environmental parameters, vehicle status, and vital signs to accurately identify different risk levels, and then executes corresponding anti-asphyxiation emergency response actions based on the identified risk level.

[0050] In this embodiment, the central computing ECU performs a comprehensive analysis based on the received environmental parameters, vehicle attitude signals, and vital sign data—namely, real-time in-vehicle environmental parameters (including oxygen concentration, carbon monoxide concentration, carbon dioxide concentration, temperature, humidity, etc.), vehicle tilt angle data (collected in real-time by a gyroscope sensor), and vital sign data (including respiratory rate, respiratory amplitude, etc.)—according to a preset risk assessment logic, to determine the current asphyxiation risk level. Specifically: 1) When the carbon monoxide concentration exceeds a preset threshold (e.g., 200 ppm) or the carbon dioxide concentration exceeds a preset threshold (e.g., 1000 ppm), the central computing ECU determines it to be a Level 1 risk. 2) When one of the following conditions is met, the central computing ECU determines it to be a level 2 risk: the oxygen concentration is lower than a preset threshold (e.g., 18%) and the duration exceeds a preset duration (e.g., 30s); the oxygen concentration is within a preset range (e.g., between 18% and 19.5%) and the breathing rate is lower than a preset threshold (e.g., 12 breaths / minute) or the breathing amplitude decreases from the baseline by more than a preset percentage (e.g., 30%); the oxygen concentration decrease rate exceeds a preset rate (e.g., 0.5% / min) and the duration exceeds a preset duration (e.g., 20s); the vehicle tilt angle exceeds a preset threshold (e.g., 60°, which is determined to be a rollover). 3) When the vehicle tilt angle exceeds a preset overturn threshold (e.g., 80 degrees) and a battery thermal runaway signal is received, the central computing ECU determines it to be a Level 3 risk. The vehicle attitude signal includes vehicle tilt angle information. Among them, Level 3 risk level is higher than Level 2 risk level, and Level 2 risk level is higher than Level 1 risk level. Different risk levels correspond to different anti-asphyxiation emergency response actions, so as to achieve graded and precise protection.

[0051] By setting up multiple independent triggering conditions (such as oxygen concentration triggering alone, oxygen concentration and vital signs triggering together, oxygen concentration decrease rate triggering, vehicle attitude triggering alone, etc.), we can avoid secondary risks caused by over-response, ensure rapid protection in high-risk scenarios, improve the accuracy and timeliness of emergency response, and take differentiated measures according to different risk levels, thus balancing safety protection and resource utilization efficiency.

[0052] In one embodiment, considering that atmospheric pressure decreases with increasing altitude, leading to a drop in the partial pressure of oxygen in the air, the background value of normal oxygen concentration in high-altitude areas is lower than that in plains areas. If the standard oxygen concentration threshold (e.g., 18%) for plains areas is still used for risk assessment in high-altitude areas, a large number of misjudgments will occur, causing the system to frequently trigger emergency responses, resulting in user inconvenience and resource waste. At the same time, in the low-oxygen environment at high altitudes, the human body will produce a compensatory respiratory acceleration response, with a normal respiratory rate higher than that in plains areas. If the standard respiratory rate threshold (e.g., 12 breaths / minute) for risk assessment is still used, it will also lead to misjudgments. To this end, this embodiment uses a GPS positioning module to obtain the current altitude data in real time, combined with the altitude calibration database built into the central computing ECU (covering the altitude range from 0 to 5000 meters, with threshold calibration in 1000-meter increments), and autonomously corrects the environmental parameter judgment standard based on the real-time altitude data, effectively eliminating the impact of the high-altitude low-oxygen environment on the accuracy of risk assessment.

[0053] In this embodiment, when determining the asphyxiation risk level, the central computing ECU also obtains the current altitude data through the GPS positioning module. Based on the current altitude data, it retrieves the corresponding environmental parameter thresholds from the altitude calibration database built into the central computing ECU. These environmental parameter thresholds are then used to evaluate the currently monitored environmental parameter data to determine the asphyxiation risk level. The environmental parameter thresholds include oxygen concentration thresholds, carbon dioxide concentration thresholds, and respiratory rate thresholds. The oxygen concentration threshold decreases with increasing altitude; for example, the oxygen concentration threshold is 18% in the 0-1000 meter altitude range, 17.5% in the 1000-2000 meter range, 17% in the 2000-3000 meter range, 16.5% in the 3000-4000 meter range, and 16% in the 4000-5000 meter range. Similarly, the carbon dioxide concentration threshold is appropriately increased at higher altitudes. For example, the threshold is 1000 ppm in the 0-1000 meter altitude range, 1100 ppm in the 2000-3000 meter range, and 1300 ppm in the 4000-5000 meter range. Additionally, the respiratory rate threshold is increased with altitude at higher altitudes. For example, the respiratory rate threshold is 12 breaths / minute in the 0-1000 meter altitude range, 14 breaths / minute in the 2000-3000 meter range, and 18 breaths / minute in the 4000-5000 meter range.

[0054] By adopting the above methods, the system's environmental adaptability and global applicability can be improved, ensuring that the system can accurately determine the risk of suffocation in different altitude environments such as plains and plateaus. This avoids the problems of using fixed thresholds for judgment, which can easily lead to a large number of misjudgments in high-altitude areas, causing user inconvenience and resource waste.

[0055] As a further implementation, considering that multiple risk factors may exist simultaneously inside the vehicle after a collision (e.g., toxic gas leakage and oxygen deficiency occurring simultaneously, vehicle rollover and battery thermal runaway occurring simultaneously), if the system responds independently to each risk condition, conflicting or duplicated response actions may occur, leading to resource waste or even secondary risks. Therefore, this embodiment also establishes a concurrent arbitration mechanism for asphyxiation risk levels, with clear priority rules (based on the highest risk level) and cumulative response logic (higher levels automatically include lower levels, and already executed actions are not triggered repeatedly). This resolves decision-making conflicts when multiple risk conditions are triggered simultaneously, ensuring the orderly execution of emergency response actions and efficient resource utilization.

[0056] This embodiment designs a concurrent arbitration mechanism for asphyxiation risk levels to handle situations where multiple risk level conditions are met simultaneously, specifically including: 1) When multiple risk level conditions are met simultaneously, the central computing ECU will use the highest risk level as the standard. For example, when carbon monoxide concentration exceeds the standard (level 1 risk condition) and oxygen concentration is below the threshold (level 2 risk condition) at the same time, the system will determine it as level 2 risk and trigger the emergency response action corresponding to level 2 risk. 2) Within the same accident cycle, the risk level only increases and does not decrease. That is, after a level 2 response has been triggered, even if the oxygen concentration rises briefly, the system will not drop back to level 1 risk and will remain in level 2 risk status until the system exit conditions are met (e.g., rescuers trigger the door unlock signal, or all environmental parameters return to normal and vital signs are stable). Only then can the risk level be reset. 3) High-level emergency response actions automatically include low-level emergency response actions. For example, when a level 2 response is triggered, the system automatically executes the level 1 response actions of opening the skylight and sound and light alarms, and at the same time executes the level 2 response actions of blasting the window and location reporting. 4) Low-level emergency response actions that have already been executed will not be triggered again. For example, if the sunroof opening action has been executed during a Level 1 response, it will not be executed again when the risk level is upgraded to Level 2.

[0057] The design of the risk level only increasing and never decreasing avoids repeated changes in risk level due to short-term fluctuations in environmental parameters, ensuring the continuity and stability of the emergency response process and ensuring the orderly and efficient operation of the emergency protection process.

[0058] Step S4: Based on the asphyxiation risk level, dynamically expand the power supply range corresponding to the risk level and trigger the corresponding asphyxiation prevention emergency response action.

[0059] Traditional backup power supply designs employ a static "full power supply after switching" model, meaning the backup power supply powers all loads after switching, resulting in a fixed power supply range. This leads to rapid energy depletion and an inability to maintain emergency protection for extended periods. Therefore, this embodiment innovatively deeply couples power supply management logic with risk level determination logic. The power supply range is dynamically reconfigured according to the risk level, expanding progressively and actively contracting after execution, forming a closed-loop control of "power supply-response-feedback." This design minimizes ineffective power consumption and extends backup power supply endurance.

[0060] That is, after determining the current asphyxiation risk level, a power supply range expansion command is first generated based on the asphyxiation risk level. Based on the power supply range expansion command, the backup power supply is connected to the load branch corresponding to the emergency response action step by step to ensure the normal execution of the subsequent corresponding anti-asphyxiation emergency response actions. After the emergency response action is completed, the execution feedback is received, and then the load branch that has completed the action is disconnected to avoid unnecessary energy consumption.

[0061] In this embodiment, after determining the asphyxiation risk level, the central computing ECU sends a power supply range expansion command to the power management unit (PMU) through a power supply topology control bus independent of the CANFD main communication bus; the power management unit controls the on / off of each load branch that performs emergency response actions according to the received command, thereby realizing the step-by-step expansion of the power supply range.

[0062] Specifically, based on the three levels of risk described above, the scenarios corresponding to each level of risk and the actions to prevent asphyxiation are clearly defined. For example: Level 1 risk corresponds to a scenario with mild toxic gas exceeding the standard. At this time, the oxygen concentration inside the vehicle is still acceptable, and the vital signs of the people are normal. It is only necessary to open the sunroof to achieve natural ventilation and issue an audible and visual alarm to alert the people inside the vehicle. Level 2 risk corresponds to a scenario with moderate hypoxia or abnormal vehicle posture. At this time, the oxygen concentration inside the vehicle has dropped to a dangerous level or the vehicle has rolled over, causing conventional ventilation to fail. It is necessary to force ventilation by bursting the windows and report the location information so that rescuers can quickly locate the vehicle. Level 3 risk corresponds to an extreme scenario (vehicle overturned and battery thermal runaway). At this time, the doors are deformed and cannot be opened, conventional window control fails, and there may be a risk of toxic gas leakage and fire. It is necessary to deploy the emergency breathing airbag on the roof to provide an independent emergency breathing space for the people inside the vehicle, and at the same time activate the sonar positioning module to cover the scenario without network signal.

[0063] Based on a clear understanding of the anti-asphyxiation actions corresponding to each risk level, the on / off state of each load branch executing emergency response actions is controlled according to the risk level, thereby achieving a step-by-step expansion of the power supply range, including: When the risk level is determined to be Level 1, the central computing ECU sends a Level 1 power supply extension command to the PMU. Based on the minimum load set (decision module and sensor module), the PMU connects the sunroof motor drive circuit (intermittent power supply, disconnected after the sunroof is opened), the instrument ECU audible and visual alarm circuit (continuous power supply), and the T-BOX communication module (low power standby mode), while simultaneously shutting down or keeping the explosive window lowering ignition circuit, roof airbag ignition circuit, and sonar positioning module main circuit disconnected. When the risk level is determined to be Level 2, the central computing ECU sends a "Level 2 power supply extension" command to the PMU. The PMU further connects the explosive window lowering ignition circuit (provided by a supercapacitor with a large instantaneous current, which is disconnected after execution), the T-BOX communication module (switched to full power transmission mode, continuously reporting location and accident level), and the sonar positioning module (entering standby preheating state) on the basis of Level 1, while shutting down or keeping the roof airbag ignition circuit disconnected. When the risk level is determined to be level three, the central computing ECU sends a "level three power supply extension" command to the PMU. The PMU connects all load branches, including the roof airbag ignition circuit (which is provided by a supercapacitor for instantaneous high current ignition, and the lithium polymer battery maintains the operation of the high-pressure gas cylinder valve control circuit for more than 5 minutes) and the sonar positioning module (working at full power). All activated branches maintain power supply.

[0064] After the emergency response action is completed, each executing ECU (such as the body control ECU and the instrument ECU) reports the execution status to the central computing ECU. The central computing ECU then sends a power-off command to the corresponding branch to the PMU, shutting down the execution circuit that has completed a single action (such as the ignition circuit for window lowering after explosion being disconnected immediately after explosion), avoiding unnecessary power consumption and extending the duration of backup power supply for continuous loads (such as the roof airbag supply valve control circuit and the sonar positioning module).

[0065] Furthermore, detailed explanations are provided regarding the corresponding asphyxiation emergency response actions triggered by different asphyxiation risk levels: 1) When the central computing ECU determines that the risk level is Level 1, it first checks the integrity of the vehicle and sunroof mechanism, and then adaptively adjusts the sunroof opening angle according to the vehicle attitude signal.

[0066] In this embodiment, considering that opening the sunroof is a primary emergency response action for Level 1 risks, but after a collision, the vehicle may be tilted, rolled over, or even upside down. Opening the sunroof without proper assessment could lead to the following problems: First, ventilation is extremely poor or even completely ineffective when the sunroof is opened towards the ground; second, soil, water, snow, and other foreign objects may flow into the vehicle, creating secondary risks; third, the collision may cause physical damage to the sunroof mechanism, and forcibly driving the sunroof motor in this situation would not only fail to complete the opening action but also consume valuable backup power. Therefore, this embodiment designs a pre-judgment mechanism (based on real-time tilt data from a gyroscope to determine if the vehicle's posture is suitable for opening the sunroof), a mechanism integrity detection mechanism (based on sunroof motor current detection to determine if the mechanism is damaged), and an adaptive angle adjustment mechanism (dynamically adjusting the sunroof opening angle according to the vehicle's tilt angle) to ensure the safety and effectiveness of the sunroof opening action.

[0067] Specifically, the central computing ECU obtains real-time vehicle tilt angle data through a gyroscope sensor. When the vehicle tilt angle is less than a first preset angle (e.g., 10°), it is determined that the vehicle is in an upright position. At this time, the sunroof is opened to a first preset opening angle (e.g., 15°) to achieve minimum ventilation and prevent foreign objects from entering. When the vehicle tilt angle is between the first and second preset angles (e.g., between 10° and 30°), it is determined that the vehicle is in a slightly tilted position. At this time, the sunroof is opened to a second preset opening angle (e.g., 30°) to increase ventilation and compensate for the decrease in ventilation efficiency caused by the tilt. When the vehicle tilt angle is greater than or equal to the second preset angle (e.g., 30°), it is determined that the vehicle posture is abnormal. The sunroof is prohibited from opening and the emergency response action corresponding to the secondary risk is directly triggered (i.e., the window is lowered by explosion and the location is reported), to avoid invalid actions caused by the sunroof opening towards the ground or even the risk of soil and liquid backflow.

[0068] Subsequently, within a preset time (e.g., within 100ms) after the sunroof opening command is issued, the central computing ECU checks whether it has received successful execution feedback from the body control ECU. If no successful execution feedback is received (indicating sunroof mechanism damage due to collision), the emergency response action is automatically escalated to the level two risk level without waiting for the sunroof to retry, thus avoiding response delays. Simultaneously, the central computing ECU sends an audible and visual alarm command to the instrument cluster ECU, which activates the audible and visual alarm module, emitting an audible alarm and flashing lights to alert occupants to the abnormal environment.

[0069] In this way, when the vehicle's posture is abnormal or the sunroof mechanism is damaged, the system can promptly skip invalid actions and upgrade to a higher level of response (explosive window closure), avoiding response delays, improving the reliability and safety of the first-level emergency response, avoiding invalid actions and secondary risks, and ensuring the effective implementation of emergency protection measures.

[0070] 2) When the risk level is determined to be level 2, the explosive window lowering action and location reporting function are triggered to achieve forced ventilation and rescue positioning.

[0071] In this embodiment, considering that a collision may cause vehicle body deformation, and that some window areas may malfunction due to compression deformation, resulting in the breaking device failing to function properly or the window remaining unbroken after breaking (e.g., excessive external water pressure or the window being jammed). If the system only attempts to break a single window, the emergency ventilation target cannot be achieved when that window fails to break, and the occupants still face the risk of suffocation. Therefore, this embodiment establishes a priority ranking (driver's side window first, as the driver's side is usually where the driver is located, and breaking the window first facilitates the driver's escape) and an execution feedback confirmation mechanism (confirming whether the breaking was successful through pressure sensors or current detection) to ensure that ventilation can still be achieved even when vehicle collision deformation causes some window mechanisms to fail.

[0072] Specifically, when the central computing ECU determines a level 2 risk, it sends a sudden window-lowering command to the body control ECU. The body control ECU then executes the sudden window-lowering command in the following priority order: driver's side window, passenger side window, rear left side window, and rear right side window. The vehicle control ECU first sends an ignition command to the deflagration device in the driver's side window. The device detonates the explosive agent using a high instantaneous current (peak current can reach tens of amperes) provided by a supercapacitor, generating a high-pressure shock wave that shatters the window glass, achieving rapid window breakage and ventilation. The window glass uses a tempered laminated glass structure; after the explosion, glass fragments adhere to the interlayer, preventing flying debris and avoiding secondary injuries to occupants. Within a preset time (e.g., within 100ms) after each deflagration command, the central computing ECU checks whether it has received a successful execution feedback from the vehicle control ECU. Successful execution feedback can be indicated by a sudden pressure drop detected by the window pressure sensor (indicating the window has broken) or by the vehicle control ECU confirming through current detection that the deflagration circuit is functioning correctly.

[0073] If no successful execution feedback is received (indicating that the window failed to explode due to collision deformation or the explosion device was damaged), the system automatically switches to the next priority window, attempting the passenger side window, the left rear window, and the right rear window in sequence. When all window explosions fail, the system no longer waits for the Level 3 risk conditions to be fully met, but instead directly triggers the roof emergency airbag deployment, providing emergency breathing space for the occupants in advance and avoiding rescue delays caused by waiting for the Level 3 risk conditions to be met.

[0074] When all side window explosions fail, the system triggers the roof emergency airbag deployment in advance (without waiting for the vehicle tilt angle to exceed 80° and for all three risk conditions, such as battery thermal runaway signal, to be fully met), providing an independent emergency breathing space for the occupants and avoiding rescue delays.

[0075] By adopting the above approach, the problems of existing technologies not considering the failure scenario of vehicle window explosion and lacking degradation strategies are solved. This can significantly improve the robustness and reliability of the Level 2 emergency response, ensuring that emergency ventilation or breathing space can still be guaranteed in extreme scenarios, thereby increasing the survival probability of people inside the vehicle.

[0076] 3) When the risk level is determined to be level three, the roof emergency airbags will be deployed and the sonar positioning will be activated to provide an independent emergency breathing space for the occupants and achieve positioning coverage in extreme scenarios.

[0077] In this embodiment, considering that roof-mounted emergency airbag deployment is the highest-level emergency response action, and that the deployed airbag will occupy the roof space inside the vehicle, if it deploys accidentally while the vehicle is upright, the airbag may cause impact injury to the head of seated occupants. Simultaneously, airbag deployment consumes a large amount of energy (high instantaneous current during ignition and continuous gas supply energy consumption); if deployed accidentally, it will rapidly deplete the backup power supply, affecting the execution of other emergency response actions. Therefore, roof-mounted airbag deployment must possess extremely high safety and reliability to absolutely prevent accidental deployment. This embodiment establishes a four-fold verification mechanism, cross-validating four dimensions: vehicle posture (tilt angle continuously exceeding the inverted threshold), battery status (thermal runaway signal or failure of all window closures), presence of occupants (positive vital signs detection), and ambient temperature (roof temperature below the threshold). This ensures that deployment is only performed in extreme scenarios where airbag deployment is truly necessary.

[0078] Specifically, when the central computing ECU determines a level three risk, a four-fold verification is performed before the roof-mounted emergency airbags deploy to ensure absolute safety during airbag deployment. This four-fold verification includes: The first confirmation is that the vehicle tilt angle exceeds the preset inverted threshold (e.g., 80 degrees) and the duration exceeds the preset duration (e.g., 500 milliseconds), thus ruling out instantaneous attitude misjudgment. The second confirmation is received when the battery management system (BMS) sends a battery thermal runaway signal, or when all the burst window closing failures are detected (as a degradation trigger condition). The third confirmation is achieved by detecting the presence of a person inside the vehicle through the vital signs detection module (millimeter-wave radar) (positive respiratory or body movement characteristics), thus avoiding the waste of resources caused by the accidental deployment of airbags in unmanned scenarios. The fourth confirmation is that the temperature sensor reading in the roof airbag installation area is below the preset temperature threshold (e.g., 80 degrees Celsius), ruling out the possibility of a fire on the roof and preventing the high temperature from igniting the airbag material.

[0079] Only when all four conditions above are met simultaneously will the central computing ECU send a secondary confirmation command to the roof airbag control unit via an independent verification channel (a separate power supply topology control bus distinct from the CANFD main communication bus). The roof airbag control unit will only execute the airbag deployment action after simultaneously receiving both the main command (sent via the CANFD main communication bus) and the verification command (sent via the independent verification channel). The airbag deployment time is less than 300ns, with a deployed volume of 80L, and a built-in high-pressure gas cylinder continuously supplies air for more than 5 minutes, providing an independent emergency breathing space for the occupants.

[0080] By employing the above methods, the absolute safety of the roof airbag deployment is ensured, secondary injuries and energy waste caused by accidental deployment to occupants are avoided, and the reliability of the system is improved.

[0081] As a further implementation, after the roof-mounted emergency airbag deploys, the system also includes a safety monitoring step to prevent secondary asphyxiation risks caused by deterioration of the airbag's internal environment. Specifically, the airbag integrates a temperature sensor and a carbon monoxide sensor, which periodically (e.g., every 10 seconds) collects the airbag's internal temperature and carbon monoxide concentration and sends the data to the central computing ECU. When the central computing ECU detects that the airbag's internal temperature exceeds a preset upper limit (e.g., 60°C, indicating a fire inside the vehicle), it sends a stop air supply command to the high-pressure gas cylinder control valve and simultaneously sends an enhanced alarm command to the audible and visual alarm module, prompting occupants to leave the airbag space as soon as possible. When the central computing ECU detects that the carbon monoxide concentration inside the airbag exceeds a preset upper limit (e.g., 100 ppm, indicating that the air inside the airbag is contaminated), it sends a switching command to the high-pressure gas cylinder control valve, switching to an external fresh air replenishment mode via the external air intake valve. In a vehicle-on-the-horizontal scenario, this replenishes and dilutes the contaminated gas inside the airbag with outside air, ensuring that the emergency breathing space provided by the airbag remains safe at all times.

[0082] By integrating temperature and carbon monoxide sensors inside the airbag, the airbag's internal environmental parameters are monitored in real time. Based on the monitoring results, the air supply strategy is dynamically adjusted (stopping air supply or switching to external fresh air replenishment), effectively preventing the risk of secondary asphyxiation caused by fire inside the vehicle or airbag gas contamination. This solves the problem that existing technologies do not consider the risk of deterioration of the internal environment after airbag deployment.

[0083] As a further implementation method, when a risk level is determined to be level two or three, the location reporting function is activated.

[0084] Considering that collisions may occur in scenarios with poor or no network signal coverage, such as underground parking garages, tunnels, and mountainous areas, the T-BOX communication module cannot report location information via 4G or 5G networks, preventing rescuers from locating the vehicle in time and delaying rescue efforts. Simultaneously, the vehicle may have fallen into water, where conventional radio signals cannot penetrate, rendering T-BOX positioning ineffective. This embodiment utilizes a redundant configuration of a primary T-BOX and a backup sonar module to achieve full coverage in both network-enabled and network-less scenarios. The T-BOX is suitable for conventional scenarios with network signals, enabling rapid notification of rescue organizations and emergency contacts via a cloud-based rescue platform. The sonar positioning module is suitable for network-less scenarios such as underground parking garages and underwater environments, using ultrasonic signals to penetrate walls or water, allowing rescuers to locate the vehicle within the effective range using receiving equipment.

[0085] Specifically, when a level 2 risk is determined, the central computing ECU sends a location reporting command to the vehicle communication module (T-BOX). The T-BOX switches to full-power transmission mode and reports the vehicle location information (GPS coordinates) and accident level information (including risk level, emergency response actions already performed, number of people in the vehicle, etc.) in real time through the 4G or 5G network. The reporting frequency is once every 10 seconds.

[0086] After receiving the location and accident level information, the cloud-based rescue platform automatically sends a rescue request to nearby rescue organizations (such as 120 emergency centers and fire departments) and simultaneously sends the vehicle location and accident level information to the emergency contacts reserved by the vehicle owner.

[0087] Furthermore, when the central computing ECU detects that the communication interruption time of the T-BOX communication module exceeds a preset duration (e.g., 5 seconds, determined to be a network signal interruption or T-BOX module damage), it automatically activates the sonar positioning module. The sonar positioning module uses a pulse transmission mode, emitting an ultrasonic pulse signal every 5 seconds. The signal encoding includes the vehicle's VIN code and accident level information. The transmission distance is greater than or equal to 50m in land scenarios and greater than or equal to 30m in underwater scenarios at a depth of 10m. Rescue personnel using receiving equipment can locate the vehicle and obtain accident level information within the effective range, achieving positioning coverage in scenarios without network access.

[0088] When a level 3 risk is assessed, the central computing ECU simultaneously sends a start command to both the T-BOX and the sonar positioning module. The T-BOX and sonar positioning module then begin parallel operation, achieving redundant coverage for dual-mode positioning. The T-BOX reports vehicle location and accident level information in real time via 4G or 5G networks, while the sonar positioning module provides positioning coverage in network-free scenarios using ultrasonic pulse signals. This dual-mode parallel operation further enhances positioning reliability, ensuring effective positioning in various complex scenarios (including those with and without network signals, and underwater scenarios), providing rescue personnel with accurate vehicle location and accident level information, significantly improving rescue efficiency and timeliness.

[0089] Example 2 This embodiment provides a post-collision vehicle in-vehicle anti-suffocation control system. The system includes a multi-dimensional signal perception layer, a cross-domain collaborative decision-making module, a multi-level response actuator, and a redundant power supply module. Figure 2 As shown, where: The multi-dimensional signal perception layer includes devices such as the vehicle airbag controller (ACU), attitude sensors (such as gyroscope sensors), battery management system (BMS), environmental sensor array, and vital sign detection module (such as millimeter-wave radar). These devices are used to collect collision signals, vehicle attitude signals, battery thermal runaway signals, environmental parameters, and vital sign data, providing comprehensive data input for the cross-domain collaborative decision-making module.

[0090] The cross-domain collaborative decision-making module includes a central computing ECU, which receives multi-dimensional signal data, determines the suffocation risk level, and generates anti-suffocation control commands and power supply range extension commands corresponding to the risk level. In other words, the central computing ECU executes the post-collision in-vehicle anti-suffocation control method proposed in Embodiment 1 above.

[0091] Preferably, the cross-domain collaborative decision-making module also includes a gateway ECU. The gateway ECU is used to route data from multiple network segments, ensuring real-time communication between the central computing ECU and electronic control units in different domains, such as the vehicle environmental information monitoring ECU, the body control ECU, and the T-BOX networking module. The gateway ECU supports the CANFD bus protocol, with a data transmission rate of 2Mbps and a routing latency of less than 10ms, ensuring high-speed and reliable cross-domain data transmission.

[0092] The redundant power supply module includes a backup power supply and a power management unit, which is used to monitor the main power supply voltage in real time, automatically switch to system power supply when the main power supply is interrupted, and dynamically expand the power supply range according to the power supply range expansion command.

[0093] The multi-level response actuator is used to execute emergency response actions according to the anti-suffocation control command, including sunroof motor, burst-type window device, roof emergency airbag, sonar positioning module and sound and light alarm module.

[0094] The system includes a sunroof motor to open the sunroof when a Level 1 risk is triggered, with the opening angle adaptively adjusted according to the vehicle's posture for natural ventilation; a blast-type window device to blast the windows when a Level 2 risk is triggered, providing forced ventilation; this device is installed on the driver's side window, passenger side window, rear left side window, and rear right side window, blasting and lowering the windows in priority order. The windows use tempered laminated glass, and after blasting, glass fragments adhere to the interlayer, preventing flying debris and secondary injuries to occupants; a roof-mounted emergency airbag to deploy and provide emergency breathing space when a Level 3 risk is triggered; a sonar positioning module to provide location signals when vehicle communication is interrupted, using a pulse emission mode to emit an ultrasonic pulse signal every 5 seconds, with the signal encoding including the vehicle's VIN and accident level information; and an audible and visual alarm module to issue alarm signals when a risk is triggered, including audible alarms and flashing lights, alerting occupants to the abnormal environment and providing visual and auditory location clues for rescue personnel.

[0095] Example 3 This embodiment also provides a vehicle, including the aforementioned post-collision in-vehicle anti-suffocation control system, or a vehicle for executing the aforementioned post-collision in-vehicle anti-suffocation control method. The vehicle can be a passenger vehicle, a new energy vehicle, or a commercial vehicle. By integrating the aforementioned anti-suffocation control system, the vehicle possesses autonomous emergency protection capabilities under complex post-collision risk scenarios, significantly improving the vehicle's passive safety performance and occupant protection level, and providing comprehensive suffocation risk protection for occupants after a collision.

[0096] The steps and methods involved in Examples 2 and 3 above correspond to those in Example 1. For specific implementation details, please refer to the relevant description section of Example 1.

[0097] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0098] The above description is only a preferred embodiment of the present invention. Although the specific implementation of the present invention has been described in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative effort are still within the scope of protection of the present invention.

Claims

1. A method for preventing suffocation inside a vehicle after a collision, characterized in that, include: After the vehicle is powered on, the collision trigger signal is continuously monitored; the collision trigger signal includes at least one of the following: collision signal, vehicle attitude signal, and battery thermal runaway signal. When a collision trigger signal is received, the system will determine the power supply mode based on the monitored main power supply voltage, switch to a stable power supply mode, and start environmental monitoring and vital sign detection. The asphyxiation risk level is determined based on monitored environmental parameters, vehicle attitude signals, and vital signs data. Based on the suffocation risk level, the power supply range corresponding to the risk level is dynamically expanded and the corresponding suffocation prevention emergency response action is triggered.

2. The method for preventing suffocation inside a vehicle after a collision according to claim 1, characterized in that, Within a preset time after receiving the collision trigger signal, a collision authenticity verification is performed; the collision authenticity verification includes detecting at least one of the following: airbag deployment signal, sudden drop in vehicle speed signal, and simultaneous trigger signal from multiple sensors; When the collision authenticity verification passes, it is confirmed as a real collision and the system is activated; otherwise, when the collision authenticity verification fails, it is determined to be a false trigger and the system returns to standby mode.

3. The method for preventing suffocation inside a vehicle after a collision according to claim 1, characterized in that, Based on the monitored main power supply voltage, a decision is made to switch to a stable power supply mode, including: When the main power supply voltage is lower than the preset threshold, the main power supply will be switched to the backup power supply within the preset switching time; otherwise, the main power supply will be maintained. In the initial stage, when switching to backup power, the backup power only supplies power to the decision module and the sensor module. Based on the asphyxiation risk level, a power supply range expansion command is generated. Based on the power supply range expansion command, the backup power supply is connected to the load branch corresponding to the emergency response action step by step. After the emergency response action is completed, the execution feedback is received and the completed load branch is disconnected.

4. The method for preventing suffocation inside a vehicle after a collision according to claim 1, characterized in that, Based on monitored environmental parameters, vehicle attitude signals, and vital signs data, the asphyxiation risk level is determined, including: When the concentration of carbon monoxide or carbon dioxide exceeds a preset threshold, it is determined to be a Level 1 risk. When any of the following conditions are met, the risk level is determined to be Level 2: oxygen concentration is below a preset threshold and the duration exceeds a preset duration; oxygen concentration is within a preset range and the breathing rate is below a preset threshold or the breathing amplitude decreases by more than a preset proportion; oxygen concentration decrease rate exceeds a preset rate and the duration exceeds a preset duration; or vehicle tilt angle exceeds a preset threshold. When the vehicle tilt angle exceeds the preset overturning threshold and a battery thermal runaway signal is received, it is judged as a level three risk. Among them, vehicle attitude signals include vehicle tilt angle information; Level 3 risk level is higher than Level 2 risk level, and Level 2 risk level is higher than Level 1 risk level.

5. The method for preventing suffocation inside a vehicle after a collision according to claim 4, characterized in that, When determining the suffocation risk level, the current altitude data is obtained through the GPS positioning module; based on the current altitude data, the corresponding environmental parameter thresholds are obtained from the altitude calibration database built into the central computing ECU; the environmental parameter thresholds are used to evaluate the currently monitored environmental parameter data in order to determine the suffocation risk level. Among them, the environmental parameter thresholds include oxygen concentration threshold, carbon dioxide concentration threshold and respiratory rate threshold; the oxygen concentration threshold decreases with increasing altitude; the carbon dioxide concentration threshold is appropriately increased in high-altitude areas; the respiratory rate threshold is increased with increasing altitude in high-altitude areas.

6. The method for preventing suffocation inside a vehicle after a collision according to claim 4, characterized in that, Based on the suffocation risk level, trigger the corresponding anti-suffocation emergency response actions, including: When assessed as a Level 1 risk, the integrity of the vehicle and sunroof mechanism is checked, and the sunroof opening angle is adaptively adjusted based on the vehicle's attitude signal, including: When the vehicle tilt angle is less than the first preset angle, the sunroof opens to the first preset opening angle; When the vehicle tilt angle is between the first preset angle and the second preset angle, the sunroof opens to the second preset opening angle. When the vehicle tilt angle is greater than or equal to the second preset angle, the sunroof is prohibited from being opened and the emergency response action corresponding to the level 2 risk is triggered directly. If no successful execution feedback is received within a preset time after the sunroof opening command is issued, the emergency response action will automatically escalate to the level two risk level.

7. The method for preventing suffocation inside a vehicle after a collision according to claim 4, characterized in that, When the risk level is determined to be Level 2, a sudden window drop action is triggered, including: The windows will be lowered by explosives in the following priority order: driver's side window, passenger side window, rear left side window, and rear right side window. Within a preset time after each blast window drop command is issued, check whether a successful execution feedback has been received; If no success feedback is received, the system will automatically switch to the next priority window. If all window breaking attempts fail, the roof emergency airbags will be deployed immediately without waiting for the Level 3 risk conditions to be fully met.

8. The method for preventing suffocation inside a vehicle after a collision according to claim 4, characterized in that, When the risk level is determined to be Level 3, the roof-mounted emergency airbags will deploy, including: Before deployment, four confirmations are performed: the vehicle tilt angle exceeds the preset inverted threshold and the duration exceeds the preset duration; a battery thermal runaway signal is received or all attempts to lower the windows by bursting are detected to have failed; the presence of people inside the vehicle is detected; and the roof temperature is lower than the preset temperature threshold. When all four conditions are met, a secondary confirmation command is sent to the airbag control unit through an independent verification channel. When both the master command and the verification command are received, the airbag deployment action is executed.

9. The method for preventing suffocation inside a vehicle after a collision according to claim 4, characterized in that, When a risk level is determined to be Level 2 or Level 3, the location reporting function is activated, including: When the risk level is determined to be Level 2, the vehicle location information and accident level information are reported in real time through the vehicle communication module. When the communication interruption time of the vehicle communication module exceeds the preset duration, the sonar positioning module is automatically activated. When the risk level is determined to be level three, the vehicle communication module and the sonar positioning module start working in parallel.

10. A post-collision vehicle suffocation prevention control system, characterized in that, include: A multi-dimensional signal sensing layer is used to collect collision signals, vehicle attitude signals, battery thermal runaway signals, environmental parameters, and vital signs data. The cross-domain collaborative decision-making module, including the central computing ECU, is used to receive multi-dimensional signal data, determine the suffocation risk level, and generate anti-suffocation control commands and power supply range extension commands corresponding to the risk level. A multi-level response actuator is used to execute emergency response actions based on anti-asphyxiation control commands; The redundant power supply module is used to monitor the main power supply voltage in real time, automatically switch to system power supply when the main power supply is interrupted, and dynamically expand the power supply range according to the power supply range expansion command.

11. The post-collision vehicle suffocation prevention control system according to claim 10, characterized in that, The redundant power supply module includes: The backup power supply consists of a lithium polymer battery and a supercapacitor connected in parallel; the lithium polymer battery provides continuous power, while the supercapacitor provides instantaneous high current output. The power supply management unit is electrically connected to the central computing ECU via an independent power supply topology control bus. It is used to monitor the main power supply voltage in real time, automatically switch to the backup power supply to power the system when the main power supply is interrupted, and receive the power supply range extension command sent by the central computing ECU to control the on / off of each load branch that performs emergency response actions.

12. The post-collision vehicle suffocation prevention control system according to claim 10, characterized in that, The multi-level response execution mechanism includes: Sunroof motor, used to open the sunroof when a Level 1 risk is triggered; A blasting window device is used to blast windows when a level 2 risk is triggered. The roof-mounted emergency airbag is designed to deploy and provide emergency breathing space when a Level 3 risk is triggered. A sonar positioning module is used to provide positioning signals when vehicle communication is interrupted; The audible and visual alarm module is used to issue an alarm signal when a risk is triggered.

13. A vehicle, characterized in that, Includes the post-collision in-vehicle anti-suffocation control system as described in any one of claims 10-12, or the post-collision in-vehicle anti-suffocation control method as described in any one of claims 1-9.

Images