Vehicle lamp system

Abstract

A vehicle lamp system (10) comprises: a lamp ECU (20) including a first failure detection unit (22) which detects a failure in the vehicle lamp system (10), and generates a first failure flag signal indicating the detection of the failure and first failure data related to the detected failure; a monitoring ECU (30) including a second failure detection unit (32) which detects a failure in the vehicle lamp system (10), and generates a second failure flag signal indicating the detection of the failure and second failure data related to the detected failure; a first transmission path (40) for transmitting the first failure flag signal and the second failure flag signal between the lamp ECU (20) and the monitoring ECU (30); and a second transmission path (50) for transmitting the first failure data and the second failure data between the lamp ECU (20) and the monitoring ECU (30).

Description

Vehicle lighting system

[0001] The present invention relates to a vehicle lighting system, for example, a vehicle lighting system suitable for mounting on a vehicle such as an automobile.

[0002] In order to ensure a fail-safe, a vehicle lamp control device has been proposed that is provided with a lamp control means for each of the left and right headlamps, capable of controlling both lamps. With this control device, even if an abnormality occurs in one lamp control means, the other lamp control means can continue to control the left and right headlamps (see, for example, Patent Document 1).

[0003] Japanese Patent Application Laid-Open No. 2022-15772

[0004] In recent years, in order to enhance the safety of automotive electrical and electronic systems, it has become common to build functional safety systems in which a main function for achieving the intended function and a monitoring function for monitoring it are provided within the system, and these two functions monitor each other. It is desirable to effectively achieve anomaly detection and fail-safe within the system through cooperation between the main function and the monitoring function in this mutual monitoring.

[0005] The present invention has been made in view of the above circumstances, and one exemplary purpose of an embodiment of the present invention is to provide a technique that contributes to improving the safety of vehicle lighting systems.

[0006] In order to solve the above problems, one embodiment of the vehicle lighting system of the present invention comprises a main controller having a first abnormality detection unit that detects an abnormality in the vehicle lighting system and generates a first abnormality flag signal indicating the detection of an abnormality and first abnormality data related to the detected abnormality, a monitoring controller having a second abnormality detection unit that detects an abnormality in the vehicle lighting system and generates a second abnormality flag signal indicating the detection of an abnormality and second abnormality data related to the detected abnormality, a first transmission path that transmits the first abnormality flag signal and the second abnormality flag signal between the main controller and the monitoring controller, and a second transmission path that transmits the first abnormality data and the second abnormality data between the main controller and the monitoring controller.

[0007] According to this embodiment, the main controller and the monitoring controller share the abnormality flag signal through a transmission path separate from that for the abnormality data. Typically, the abnormality flag signal has a smaller data volume than the abnormality data, and it is thought that its generation and communication can be performed at high speed. The main controller and the monitoring controller can quickly share information about an abnormality detected within the system, and can take safety measures such as fail-safe measures as necessary.

[0008] The first transmission path may include a first GPIO signal line for transmitting a first abnormality flag signal from the main controller to the monitoring controller, and a second GPIO signal line for transmitting a second abnormality flag signal from the monitoring controller to the main controller. In this way, the GPIO signal lines can be used to instantly transmit the abnormality flag signal between the main controller and the monitoring controller. Detection of an abnormality in the system can be immediately shared between these two controllers.

[0009] The vehicle lighting system may further include a first fail-safe processing unit provided in the main controller and instructing the vehicle lighting system to perform fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal, a second fail-safe processing unit provided in the monitoring controller and instructing the vehicle lighting system to perform fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal, and a third fail-safe processing unit provided outside the main controller and the monitoring controller, receiving the first abnormality flag signal and the second abnormality flag signal from the first transmission line and instructing the vehicle lighting system to perform fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal. In this way, the fail-safe processing units are triple redundant, thereby increasing safety.

[0010] The first abnormality data may indicate a type of abnormality detected by the first abnormality detection unit, and the second abnormality data may indicate a type of abnormality detected by the second abnormality detection unit, and the vehicle lighting system may execute an abnormality recovery process according to the type of abnormality detected based on at least one of the first abnormality data and the second abnormality data. In this way, the vehicle lighting system can attempt to recover from the detected abnormality.

[0011] Another embodiment of the present invention also relates to a vehicle lighting system. This vehicle lighting system comprises: a main controller having a first abnormality detection unit that detects an abnormality in the vehicle lighting system and generates a first abnormality flag signal indicating the detection of the abnormality; a monitoring controller having a second abnormality detection unit that detects an abnormality in the vehicle lighting system and generates a second abnormality flag signal indicating the detection of the abnormality; a first transmission path that transmits the first abnormality flag signal and the second abnormality flag signal between the main controller and the monitoring controller; a first failsafe processing unit that is provided in the main controller and instructs the vehicle lighting system to perform failsafe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal; a second failsafe processing unit that is provided in the monitoring controller and instructs the vehicle lighting system to perform failsafe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal; and a third failsafe processing unit that is provided outside the main controller and the monitoring controller and receives the first abnormality flag signal and the second abnormality flag signal from the first transmission path and instructs the vehicle lighting system to perform failsafe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal.

[0012] According to this aspect, the fail-safe processing unit is triple-redundant, so that a highly safe vehicle lighting system can be provided.

[0013] According to the present invention, it is possible to provide a technique that contributes to improving the safety of vehicle lighting systems.

[0014] It is a block diagram of the vehicle lighting system according to the embodiment.It is a diagram showing an operation example of the vehicle lighting system shown in FIG.

[0015] The present invention will be described below with reference to the drawings based on preferred embodiments. The embodiments are illustrative and do not limit the invention, and all features and combinations thereof described in the embodiments are not necessarily essential to the invention. Identical or equivalent components, parts, and processes shown in each drawing are designated by the same reference numerals, and redundant description will be omitted where appropriate. The scale and shape of each part shown in each drawing are set for convenience to facilitate explanation and should not be interpreted as limiting unless otherwise specified. Furthermore, terms such as "first" and "second" used in this specification or claims do not indicate any order or importance, but are used to distinguish one configuration from another. Furthermore, some components that are not important for explaining the embodiments are omitted in each drawing.

[0016] 1 is a block diagram of a vehicle lighting system according to an embodiment. In this embodiment, the vehicle lighting system 10 is configured as a headlamp. Therefore, the vehicle lighting system 10 includes a lamp unit 12 that can operate as a headlamp, and a control device 14 that controls the lamp unit 12.

[0017] The lighting unit 12 may have a known configuration, and may include, for example, a light source having semiconductor light-emitting elements such as LEDs (Light Emitting Diodes) and a lighting circuit that drives the light source to light up. The lighting circuit may include a lighting control IC (Integrated Circuit) (LED driver) that can individually control the brightness and on / off of multiple light-emitting elements that make up the light source.

[0018] The control device 14 includes a lighting fixture ECU (Electronic Control Unit) 20 as a main controller that controls the lighting unit 12, a monitoring ECU 30 as a monitoring controller, and a first transmission path 40 and a second transmission path 50 that communicatively connect the lighting fixture ECU 20 and the monitoring ECU 30. The ECU can be implemented as a combination of a processor (hardware) such as a CPU (Central Processing Unit) or a microcomputer and a software program executed by the processor (hardware). The ECU may be one or more processors.

[0019] As an exemplary configuration, the control device 14 may be a single printed circuit board on which the lamp ECU 20 and the monitoring ECU 30 are mounted, and the first transmission path 40 and the second transmission path 50 may be wiring on this printed circuit board. Alternatively, as another example, the control device 14 may have a printed circuit board on which the lamp ECU 20 is mounted, another printed circuit board on which the monitoring ECU 30 is mounted, and a wire harness as the first transmission path 40 and the second transmission path 50 that connects these printed circuit boards to each other.

[0020] The vehicle is equipped with a vehicle ECU 100 as a host controller that comprehensively controls the entire vehicle or a part of the vehicle. The vehicle ECU 100 may be a controller also called a BCM (Body Control Module). The vehicle lighting system 10 and the vehicle ECU 100 are supplied with power from a power source 110 such as an on-board battery.

[0021] The control device 14 can communicate with the vehicle ECU 100 via an in-vehicle network that complies with a network protocol such as CAN (Controller Area Network) or any other appropriate communication network. The control device 14 can communicate with the lighting unit 12 via an appropriate communication network. The communication between the control device 14 and the vehicle ECU 100 and the communication between the control device 14 and the lighting unit 12 may comply with different protocols or may comply with the same protocol.

[0022] The lamp ECU 20 includes a first abnormality detection unit 22 that detects an abnormality in the vehicle lamp system 10. The first abnormality detection unit 22 may be configured to detect one or more types of abnormality, and may be capable of detecting, for example, at least one of "temperature abnormality," "power supply abnormality," and "CAN input abnormality." The first abnormality detection unit 22 may be capable of detecting such an abnormality by executing an existing abnormality detection method.

[0023] A "temperature abnormality" refers to a state in which the temperature of the lamp unit 12 or the control device 14 is outside the normal range (e.g., a state in which the temperature is too high, i.e., a state in which the temperature exceeds the upper limit of the normal range). To detect this temperature abnormality, a temperature sensor such as a thermistor may be provided in the vehicle lighting system 10. When detecting a temperature abnormality in the lamp unit 12, the temperature sensor may be disposed inside or near the lamp unit 12 (e.g., temperature sensor 16a shown in FIGS. 1 and 2). When detecting a temperature abnormality in the control device 14, the temperature sensor may be disposed inside or near the lamp ECU 20 (or the monitoring ECU 30) (e.g., temperature sensor 16b shown in FIGS. 1 and 2). The first abnormality detection unit 22 may be configured to receive temperature data indicating the temperature measured by the temperature sensor and detect a temperature abnormality based on the temperature data. For example, the first abnormality detection unit 22 may compare the temperature measured by the temperature sensor with a preset temperature threshold (e.g., the upper limit of the normal range) and detect a temperature abnormality when the measured temperature exceeds the temperature threshold.

[0024] A "power supply abnormality" refers to a state in which the voltage supplied from the power supply 110 to the vehicle lighting system 10 is outside a normal range (e.g., the voltage is too low). The first abnormality detection unit 22 may be configured to monitor the voltage supplied from the power supply 110 to the control device 14 (e.g., the lighting ECU 20). The first abnormality detection unit 22 may compare the voltage from the power supply 110 with a preset voltage threshold, and detect a power supply abnormality when the voltage is below the voltage threshold.

[0025] The "CAN input abnormality" refers to a state in which the input of the CAN signal C from the vehicle ECU 100 to the vehicle lighting system 10 is interrupted. The first abnormality detection unit 22 may detect the CAN input abnormality when the lighting ECU 20 does not receive the CAN signal C for a predetermined period of time.

[0026] When an abnormality is detected, the first abnormality detection unit 22 generates a first abnormality flag signal S1 indicating the abnormality detection and first abnormality data D1 related to the detected abnormality. The first abnormality flag signal S1 indicates that any of one or more types of abnormality detectable by the first abnormality detection unit 22 has been detected. Thus, the first abnormality flag signal S1 is a binary signal indicating normality or abnormality. For example, the first abnormality flag signal S1 may indicate normality (i.e., no abnormality has been detected) with 0 (or Lo) and an abnormality with 1 (or Hi).

[0027] For example, if the first abnormality detection unit 22 can detect three types of abnormalities, namely, "temperature abnormality," "power supply abnormality," and "CAN input abnormality," the first abnormality flag signal S1 indicates that one of these three types of abnormalities (i.e., temperature abnormality, power supply abnormality, or CAN input abnormality) has been detected. Therefore, it is not possible to determine which type of abnormality has been detected from the first abnormality flag signal S1 alone.

[0028] The first anomaly data D1 indicates information related to the detected anomaly, such as the type of the detected anomaly. Therefore, by referring to the first anomaly data D1, it is possible to determine the type of anomaly that has been detected. Additionally or alternatively, the first anomaly data D1 may include other data related to the detected anomaly, such as the severity of the detected anomaly, or the date, time, and location of the anomaly.

[0029] The monitoring ECU 30 also includes a second abnormality detection unit 32 that detects abnormalities in the vehicle lighting system 10. Similar to the first abnormality detection unit 22, the second abnormality detection unit 32 may be configured to execute an existing abnormality detection method, and may be capable of detecting at least one of "temperature abnormality," "power supply abnormality," and "CAN input abnormality," for example. The second abnormality detection unit 32 is capable of detecting the same types of abnormalities as the first abnormality detection unit 22 is capable of detecting.

[0030] When an abnormality is detected, the second abnormality detector 32 generates a second abnormality flag signal S2 indicating the abnormality detection and second abnormality data D2 related to the detected abnormality. Similar to the first abnormality flag signal S1, the second abnormality flag signal S2 indicates that the second abnormality detector 32 has detected some kind of abnormality. Similar to the first abnormality data D1, the second abnormality data D2 indicates information related to the detected abnormality, such as the type of abnormality detected.

[0031] The first transmission path 40 transmits the first abnormality flag signal S1 and the second abnormality flag signal S2 between the lamp ECU 20 and the monitoring ECU 30. The first transmission path 40 is a communication path specialized for transmitting the abnormality flag signals, which connects the lamp ECU 20 and the monitoring ECU 30 so that they can communicate with each other.

[0032] In this embodiment, the first transmission path 40 includes a first GPIO (General Purpose Input / Output) signal line 42 that transmits a first abnormality flag signal S1 from the lamp ECU 20 to the monitoring ECU 30, and a second GPIO signal line 44 that transmits a second abnormality flag signal S2 from the monitoring ECU 30 to the lamp ECU 20. The first GPIO signal line 42 connects a first GPIO terminal 46a of the lamp ECU 20 to a first GPIO terminal 48a of the monitoring ECU 30, and the second GPIO signal line 44 connects a second GPIO terminal 46b of the lamp ECU 20 to a second GPIO terminal 48b of the monitoring ECU 30.

[0033] In this way, the GPIO signal line can be used to instantly transmit the abnormality flag signal between the lamp ECU 20 and the monitoring ECU 30. The fact that an abnormality has been detected in the vehicle lighting system 10 can be immediately shared between these two ECUs.

[0034] The second transmission path 50 transmits the first abnormality data D1 and the second abnormality data D2 between the lamp ECU 20 and the monitoring ECU 30. The second transmission path 50 is a communication path that communicatively connects the lamp ECU 20 and the monitoring ECU 30, and is separate from the first transmission path 40. The second transmission path 50 may be a signal line for serial communication, such as SPI communication or UART communication. The second transmission path 50 may be used not only to transmit the abnormality data but also to transmit other data unrelated to abnormality detection between the lamp ECU 20 and the monitoring ECU 30.

[0035] The first transmission path 40 using GPIO is advantageous for communicating an abnormality flag signal at high speed, but occupies one input / output port for only one piece of data, the abnormality flag signal. Therefore, excessive use of data communication using GPIO may result in the exhaustion of input / output ports on the ECU. In contrast, the second transmission path 50 can communicate multiple types of data (e.g., tens to hundreds of types) using only a few input / output ports (typically two or three ports). This is advantageous because it reduces the number of ports used. From this perspective, in this embodiment, the abnormality flag signal is transmitted via GPIO, which enables faster communication, while abnormality data, which does not require such high speed, is transmitted via a path separate from GPIO.

[0036] The vehicle lighting system 10 also includes a first fail-safe processing unit 24 provided in the lighting ECU 20, which instructs the vehicle lighting system 10 to perform fail-safe processing in response to at least one of the first abnormality flag signal S1 and the second abnormality flag signal S2.

[0037] The fail-safe process may be a process determined in advance to ensure safety when an abnormality is detected, such as stopping the operation of the lamp unit 12 or restricting the function of the lamp unit 12. For example, the fail-safe process may be a process of turning off the lamp unit 12. The fail-safe process may be a process of dimming (i.e., darkening) the lamp unit 12. Alternatively, the fail-safe process may be a process of switching the lamp unit 12 from an advanced light distribution control, such as adaptive driving beam (ADB) control, which dynamically adapts a non-illuminated area to a preceding vehicle or an oncoming vehicle, to a simple light distribution, such as a low beam. The fail-safe process may be common regardless of the type of abnormality that has occurred.

[0038] The first fail-safe processing unit 24 may be configured to receive the first abnormality flag signal S1 and the second abnormality flag signal S2 as inputs and output a first fail-safe signal F1 for instructing the vehicle lighting system 10 to perform fail-safe processing. The first fail-safe processing unit 24 receives the first abnormality flag signal S1 from the first abnormality detection unit 22 and receives the second abnormality flag signal S2 from the second abnormality detection unit 32 via the first transmission path 40, specifically the second GPIO signal line 44. It can also be said that the first fail-safe processing unit 24 monitors the signal levels of the first GPIO signal line 42 and the second GPIO signal line 44 of the first transmission path 40.

[0039] The first fail-safe processing unit 24 is connected to the lamp unit 12 by a first fail-safe signal line 52, and the first fail-safe signal F1 is output from the first fail-safe processing unit 24 to the lamp unit 12 through the first fail-safe signal line 52. The first fail-safe signal F1 may be a binary signal indicating whether or not the fail-safe processing is being performed.

[0040] The first fail-safe processing unit 24 may be, for example, an OR circuit. Therefore, when at least one of the received first abnormality flag signal S1 and second abnormality flag signal S2 indicates an abnormality, the first fail-safe processing unit 24 outputs a first fail-safe signal F1 indicating the execution of fail-safe processing. In this case, the lighting unit 12 executes fail-safe processing in response to the first fail-safe signal F1. On the other hand, when the received first abnormality flag signal S1 and second abnormality flag signal S2 both indicate normality, the first fail-safe processing unit 24 outputs a first fail-safe signal F1 indicating the non-execution of fail-safe processing. In this case, the lighting unit 12 does not execute fail-safe processing. Normal operation of the lighting unit 12 is permitted.

[0041] The vehicle lighting system 10 also includes a second fail-safe processing unit 34 provided in the monitoring ECU 30, which instructs the vehicle lighting system 10 to perform fail-safe processing in response to at least one of the first abnormality flag signal S1 and the second abnormality flag signal S2.

[0042] The second fail-safe processing unit 34 may be configured to receive the first abnormality flag signal S1 and the second abnormality flag signal S2 as inputs and output a second fail-safe signal F2 for instructing the vehicle lighting system 10 to perform fail-safe processing. The second fail-safe processing unit 34 receives the first abnormality flag signal S1 from the first abnormality detection unit 22 via the first transmission path 40, specifically the first GPIO signal line 42, and receives the second abnormality flag signal S2 from the second abnormality detection unit 32. It can also be said that the second fail-safe processing unit 34 monitors the signal levels of the first GPIO signal line 42 and the second GPIO signal line 44 of the first transmission path 40.

[0043] The second fail-safe processing unit 34 is connected to the lamp unit 12 by a second fail-safe signal line 54, and the second fail-safe signal F2 is output from the second fail-safe processing unit 34 to the lamp unit 12 through the second fail-safe signal line 54. Like the first fail-safe signal F1, the second fail-safe signal F2 may be a binary signal indicating whether or not the fail-safe processing is being performed.

[0044] The second fail-safe processing unit 34 may also be an OR circuit, like the first fail-safe processing unit 24. Thus, when at least one of the received first abnormality flag signal S1 and second abnormality flag signal S2 indicates an abnormality, the second fail-safe processing unit 34 outputs a second fail-safe signal F2 indicating execution of fail-safe processing, and when both the received first abnormality flag signal S1 and second abnormality flag signal S2 indicate normality, the second fail-safe processing unit 34 outputs a second fail-safe signal F2 indicating non-execution of fail-safe processing. In response to the received second fail-safe signal F2, the lighting unit 12 either executes fail-safe processing or performs normal operation without executing fail-safe processing.

[0045] Furthermore, the vehicle lighting system 10 includes a third fail-safe processing unit 60 provided outside the lamp ECU 20 and the monitoring ECU 30. The third fail-safe processing unit 60 receives the first abnormality flag signal S1 and the second abnormality flag signal S2 from the first transmission path 40, and instructs the vehicle lighting system 10 to perform fail-safe processing in response to at least one of the first abnormality flag signal S1 and the second abnormality flag signal S2. The third fail-safe processing unit 60 may be provided on the printed circuit board on which the lamp ECU 20 and / or the monitoring ECU 30 are mounted, or may be provided separately therefrom.

[0046] The third fail-safe processing unit 60 may be configured to receive the first abnormality flag signal S1 and the second abnormality flag signal S2 as inputs and output a third fail-safe signal F3 for instructing the vehicle lighting system 10 to perform fail-safe processing. The third fail-safe processing unit 60 receives the first abnormality flag signal S1 from the first abnormality detection unit 22 via the first transmission path 40, specifically the first GPIO signal line 42, and receives the second abnormality flag signal S2 from the second abnormality detection unit 32 via the first transmission path 40, specifically the second GPIO signal line 44. As shown in the figure, the first GPIO signal line 42 and the second GPIO signal line 44 each branch midway and are connected to the third fail-safe processing unit 60. In other words, the third fail-safe processing unit 60 monitors the signal levels of the first GPIO signal line 42 and the second GPIO signal line 44 of the first transmission path 40.

[0047] The third fail-safe processing unit 60 is connected to the lamp unit 12 by a third fail-safe signal line 56, and the third fail-safe signal F3 is output from the third fail-safe processing unit 60 to the lamp unit 12 through the third fail-safe signal line 56. Like the first fail-safe signal F1, the third fail-safe signal F3 may be a binary signal indicating whether or not the fail-safe processing is being performed.

[0048] The third fail-safe processing unit 60 may also be an OR circuit, like the first fail-safe processing unit 24. Thus, when at least one of the received first abnormality flag signal S1 and second abnormality flag signal S2 indicates an abnormality, the third fail-safe processing unit 60 outputs a third fail-safe signal F3 indicating execution of fail-safe processing, and when the received first abnormality flag signal S1 and second abnormality flag signal S2 both indicate normality, the third fail-safe processing unit 60 outputs a third fail-safe signal F3 indicating non-execution of fail-safe processing. In response to the received third fail-safe signal F3, the lighting unit 12 executes fail-safe processing or performs normal operation without executing fail-safe processing.

[0049] Furthermore, the vehicle lighting system 10 may be configured to execute an abnormality recovery process according to the type of abnormality detected based on at least one of the first abnormality data D1 and the second abnormality data D2. A recovery processing unit 26 that executes such an abnormality recovery process may be provided in the lighting ECU 20. In this way, the vehicle lighting system can attempt to recover from the detected abnormality.

[0050] If multiple types of abnormalities can be detected in the vehicle lighting system 10, the recovery processing unit 26 may be capable of executing multiple predetermined abnormality recovery processes corresponding to the multiple types of abnormalities. Assuming that the simultaneous occurrence of two or more different types of abnormalities in the vehicle lighting system 10 is an extremely rare event and can be ignored, it is assumed that the first abnormality data D1 generated by the first abnormality detection unit 22 and the second abnormality data D2 generated by the second abnormality detection unit 32 represent the same type of abnormality. The recovery processing unit 26 may receive the first abnormality data D1 from the first abnormality detection unit 22 (or receive the second abnormality data D2 from the second abnormality detection unit 32 via the second transmission path 50), and may select and execute a specific abnormality recovery process from multiple predetermined abnormality recovery processes corresponding to the type of abnormality indicated by the first abnormality data D1 (or the second abnormality data D2).

[0051] For example, the abnormality recovery process from a temperature abnormality may be a process for suppressing a temperature rise in the vehicle lighting system 10, such as a process for limiting or suspending some of the functions of the lighting ECU 20 (or the monitoring ECU 30) to reduce the processing load on the ECU, or a process for turning off or dimming the lighting unit 12. During the abnormality recovery process, the recovery processing unit 26 may acquire a temperature measurement by a temperature sensor provided in the vehicle lighting system 10, such as the lighting ECU 20, the monitoring ECU 30, or the lighting unit 12, as described above, and compare the measured temperature with a temperature threshold value for detecting the temperature abnormality. The recovery processing unit 26 may continue the abnormality recovery process if the measured temperature exceeds the temperature threshold value, and terminate the abnormality recovery process if the measured temperature falls below the temperature threshold value. After the abnormality recovery process is completed, the vehicle lighting system 10 can return to normal operation.

[0052] Furthermore, the abnormality recovery process from a power supply abnormality may be a process of waiting until the voltage supplied from the power supply 110 to the vehicle lighting system 10 returns to a normal range. The abnormality recovery process from a CAN input abnormality may be a process of waiting until the CAN signal is received normally. During the execution of these abnormality recovery processes (i.e., during standby), the recovery processing unit 26 may limit or stop some of the functions of the lamp ECU 20 (or the monitoring ECU 30) to reduce the processing load on the ECU, or may turn off or dim the lamp unit 12. The recovery processing unit 26 may continue the abnormality recovery process while the voltage (or CAN signal) abnormality continues, and end the abnormality recovery process when the voltage (or CAN signal) returns to normal.

[0053] Fig. 2 is a diagram showing an example of the operation of the vehicle lighting system shown in Fig. 1. An example of the flow from abnormality detection to fail-safe control in the vehicle lighting system 10 will be described below with reference to Fig. 2.

[0054] The first abnormality detection unit 22 of the lamp ECU 20 and the second abnormality detection unit 32 of the monitoring ECU 30 each perform abnormality detection independently. For example, consider a case where the second abnormality detection unit 32 detects a temperature abnormality. The second abnormality detection unit 32 generates and outputs a second abnormality flag signal S2 and second abnormality data D2. As described above, the second abnormality flag signal S2 is a signal indicating that some kind of abnormality has been detected, and the second abnormality data D2 indicates information related to the abnormality, such as the type of abnormality detected.

[0055] 2 , the monitoring ECU 30 outputs the second abnormality flag signal S2 from the second abnormality detection unit 32 to the lamp ECU 20 through the second GPIO signal line 44 of the first transmission path 40. In this way, the monitoring ECU 30 can share the second abnormality flag signal S2 with the lamp ECU 20.

[0056] The second abnormality flag signal S2 received by the lamp ECU 20 is input to the first fail-safe processing unit 24. In this embodiment, the first fail-safe processing unit 24 is an OR circuit, so the first fail-safe processing unit 24 receives the second abnormality flag signal S2, generates a first fail-safe signal F1, and outputs this to the lamp unit 12, as shown by arrow A2. The lamp unit 12 receives the first fail-safe signal F1 and executes the above-mentioned fail-safe processing.

[0057] Similarly, the second fail-safe processing unit 34 receives the second abnormality flag signal S2, generates a second fail-safe signal F2, and outputs this to the lighting unit 12. The third fail-safe processing unit 60 also receives the second abnormality flag signal S2 from the second GPIO signal line 44 of the first transmission path 40, generates a third fail-safe signal F3, and outputs this to the lighting unit 12. Therefore, the lighting unit 12 can also receive the second fail-safe signal F2 or the third fail-safe signal F3 and perform fail-safe processing.

[0058] These three fail-safe processing units do not use the first abnormality data D1 and the second abnormality data D2 to instruct the fail-safe processing, and therefore do not need to receive these abnormality data.

[0059] As shown by arrow A3, the monitoring ECU 30 outputs the second abnormality data D2 from the second abnormality detection unit 32 to the lamp ECU 20 via the second transmission path 50. The second abnormality data D2 received by the lamp ECU 20 is input to the recovery processing unit 26. Since the second abnormality data D2 indicates that the detected abnormality is a temperature abnormality, the recovery processing unit 26 executes an abnormality recovery process from the temperature abnormality.

[0060] In this way, even if the first abnormality detection unit 22 does not detect an abnormality due to a malfunction or the like, the second abnormality detection unit 32 can detect the abnormality, quickly execute fail-safe processing, and further execute abnormality recovery processing.

[0061] When the first abnormality detection unit 22 of the lamp ECU 20 is operating normally, the first abnormality detection unit 22 should also detect a temperature abnormality in addition to the temperature abnormality detected by the second abnormality detection unit 32. In this case, the first abnormality detection unit 22 generates a first abnormality flag signal S1 and first abnormality data D1. Therefore, the first fail-safe processing unit 24 can generate a first fail-safe signal F1 in response to the first abnormality flag signal S1 and output it to the lamp unit 12. The lamp unit 12 may receive the first fail-safe signal F1 and perform fail-safe processing.

[0062] The first abnormality flag signal S1 is sent from the lamp ECU 20 to the monitoring ECU 30 through the first GPIO signal line 42 of the first transmission path 40 and is shared by both. At this time, the second fail-safe processing unit 34 receives the first abnormality flag signal S1, generates a second fail-safe signal F2, and outputs it to the lamp unit 12. The third fail-safe processing unit 60 receives the first abnormality flag signal S1 from the first GPIO signal line 42 of the first transmission path 40, generates a third fail-safe signal F3, and outputs it to the lamp unit 12. The lamp unit 12 can also receive the second fail-safe signal F2 or the third fail-safe signal F3 and perform fail-safe processing.

[0063] The recovery processing unit 26 can also execute the recovery process from the abnormality in response to the first abnormality data D1.

[0064] Therefore, even if the second abnormality detection unit 32 does not detect an abnormality due to a malfunction or the like, the first abnormality detection unit 22 can detect the abnormality, quickly execute fail-safe processing, and further execute abnormality recovery processing.

[0065] As described above, according to the embodiment, the lamp ECU 20 and the monitoring ECU 30 share the first abnormality flag signal S1 and the second abnormality flag signal S2 through the first transmission path 40, which is a dedicated communication path. The abnormality flag signal is a binary signal indicating whether an abnormality has been detected. Compared to abnormality data, the data volume is smaller, and it is thought that the signal can be generated and communicated at high speed. In contrast, since error checking is typically performed when transmitting and receiving abnormality data, communication of the abnormality data can take a relatively long time. Typically, the abnormality flag signal is shared within microseconds of the abnormality detection, and the abnormality data can be shared within tens of milliseconds. The lamp ECU 20 and the monitoring ECU 30 can quickly share information about an abnormality detected in the vehicle lighting system 10 and take safety measures such as fail-safe measures as necessary, thereby ensuring the safety of the vehicle lighting system 10.

[0066] Furthermore, the first failsafe processing unit 24 (or the second failsafe processing unit 34, or the third failsafe processing unit 60) can instruct the lamp unit 12 to perform failsafe processing when at least one of the first abnormality detection unit 22 and the second abnormality detection unit 32 detects an abnormality. Even if one of the failsafe processing units fails, the other failsafe processing unit that is functioning normally can instruct the lamp unit 12 to perform failsafe processing. Since the failsafe processing units are triple-redundant, the safety of the vehicle lighting system 10 is enhanced.

[0067] In particular, the third fail-safe processing unit 60 has a simple structure of a two-input OR circuit, and therefore can be easily realized as an external circuit provided outside the lamp ECU 20 and the monitoring ECU 30.

[0068] Furthermore, by configuring the GPIO as a pull-up circuit, even when an abnormality flag signal is not generated due to a malfunction of the abnormality detection function, it can be treated as an abnormality, and the fail-safe processing unit can be operated.

[0069] The present invention is not limited to the above-described embodiments and modifications, but may be combined with the embodiments and modifications, or may be further modified, such as by various design changes, based on the knowledge of a person skilled in the art. The scope of the present invention also includes embodiments and modifications that are combined or further modified in this way. The above-described embodiments and modifications, and new embodiments that are created by combining the above-described embodiments and modifications with the following modifications, combine the effects of the combined embodiments, modifications, and further modifications.

[0070] In the above embodiment, the vehicle lighting system 10 is described as having three fail-safe processing units, but the vehicle lighting system 10 may have at least one fail-safe processing unit. The fail-safe processing unit may be provided in the lamp ECU 20, in the monitoring ECU 30, or outside the lamp ECU 20 and the monitoring ECU 30.

[0071] In the above embodiment, the vehicle lighting system 10 is described as a vehicle headlamp, but the present invention is not limited to this. The vehicle lighting system 10 may be configured as a vehicle marker lamp such as a turn signal lamp, a tail lamp, a stop lamp, or a backup lamp, or other vehicle lamp.

[0072] The present invention has been described using specific terms based on the embodiments, but the embodiments merely illustrate one aspect of the principles and applications of the present invention, and many modifications and changes in arrangement are permitted to the embodiments as long as they do not deviate from the concept of the present invention as defined in the claims.

[0073] The present invention can be used in a vehicle lighting system, for example, a vehicle lighting system suitable for mounting on a vehicle such as an automobile.

[0074] 10 Vehicle lighting system, 20 Lighting ECU, 22 First abnormality detection unit, 24 First fail-safe processing unit, 30 Monitoring ECU, 32 Second abnormality detection unit, 34 Second fail-safe processing unit, 40 First transmission path, 42 First GPIO signal line, 44 Second GPIO signal line, 50 Second transmission path, 60 Third fail-safe processing unit.

Claims

1. a main controller including a first abnormality detection unit that detects an abnormality in the vehicle lighting system and generates a first abnormality flag signal indicating the detection of the abnormality and first abnormality data related to the detected abnormality; a monitoring controller including a second abnormality detection unit that detects the abnormality in the vehicle lighting system and generates a second abnormality flag signal indicating the abnormality detection and second abnormality data related to the detected abnormality; a first transmission path for transmitting the first abnormality flag signal and the second abnormality flag signal between the main controller and the monitoring controller; a second transmission path for transmitting the first abnormality data and the second abnormality data between the main controller and the monitoring controller.

2. 2. The vehicle lighting system according to claim 1, wherein the first transmission path includes a first GPIO signal line for transmitting the first abnormality flag signal from the main controller to the monitoring controller, and a second GPIO signal line for transmitting the second abnormality flag signal from the monitoring controller to the main controller.

3. a first fail-safe processing unit provided in the main controller, the first fail-safe processing unit instructing the vehicle lighting system to perform fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal; a second fail-safe processing unit provided in the monitoring controller, the second fail-safe processing unit instructing the vehicle lighting system to perform the fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal; 2. The vehicular lighting system according to claim 1, further comprising: a third fail-safe processing unit that is provided outside the main controller and the monitoring controller, receives the first abnormality flag signal and the second abnormality flag signal from the first transmission path, and instructs the vehicular lighting system to perform the fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal.

4. the first abnormality data indicates a type of abnormality detected by the first abnormality detection unit, the second abnormality data indicates a type of abnormality detected by the second abnormality detection unit, 4. The vehicle lighting system according to claim 1, wherein the vehicle lighting system executes an abnormality recovery process according to the type of abnormality detected based on at least one of the first abnormality data and the second abnormality data.

5. a main controller including a first abnormality detection unit that detects an abnormality in the vehicle lighting system and generates a first abnormality flag signal indicating the detection of the abnormality; a monitoring controller including a second abnormality detection unit that detects the abnormality in the vehicle lighting system and generates a second abnormality flag signal indicating the abnormality detection; a first transmission path for transmitting the first abnormality flag signal and the second abnormality flag signal between the main controller and the monitoring controller; a first fail-safe processing unit provided in the main controller, the first fail-safe processing unit instructing the vehicle lighting system to perform fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal; a second fail-safe processing unit provided in the monitoring controller, the second fail-safe processing unit instructing the vehicle lighting system to perform the fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal; a third fail-safe processing unit that is provided outside the main controller and the monitoring controller, receives the first abnormality flag signal and the second abnormality flag signal from the first transmission path, and instructs the vehicle lighting system to perform the fail-safe processing in response to at least one of the first abnormality flag signal and the second abnormality flag signal.