Patent Publication Number: US-11380014-B2

Title: Control modules and methods

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
     This application claims priority to European Patent Application Number 20163605.7, filed Mar. 17, 2020, the disclosure of which is hereby incorporated by reference in its entirety herein. 
     BACKGROUND 
     The present disclosure relates to control modules and methods. 
     Digital imaging devices, such as digital cameras, for example remote camera, are used in automotive applications for various applications, for example for monitoring the occupants (for example driver) of a vehicle or a surrounding of the vehicle. 
     The cameras should be simple and easy to connect. In new designs, remote cameras may include memory components to enable easier configuration and means for protection against copying. However, the cameras must be properly configured and tested on the startup, which may take several seconds (sometimes even more than 10 seconds). Processing tasks are commonly delegated to the ECU (electronic control unit), where a processor also is used for initializing other components before coming to camera initialization. At the same time, the user requires almost immediate operation of the camera. 
     Furthermore, with the advent of autonomous vehicles, it may be desired to operate more and more cameras simultaneously, and this may lead to the control channels (for example I2C) becoming a potential bottleneck. 
     Accordingly, there is a need for improved control of camera in vehicles. 
     SUMMARY 
     The present disclosure provides a control module, a computer implemented method, a computer system, a non-transitory computer readable medium, and a vehicle according to the independent claims. Embodiments are given in the subclaims, the description and the drawings. 
     In one aspect, the present disclosure is directed at a control module comprising: a first interface to a camera provided in a vehicle; a second interface to a serializer for communication with an electronic control unit of the vehicle; and a processing unit configured to process input data received via the first interface or via the second interface to obtain output data, and to output the output data via the first interface or via the second interface. 
     In other words, a control module may be provided in between the camera and the serializer (wherein the serializer may communicate with the electronic control unit (ECU) of the vehicle), and may either forward the signals received from the camera to the serializer and from the serializer to the camera, or may intercept the signals received from the camera or from the serializer and respond to the signals without forwarding the signals. This may reduce communication effort on the serial connection between the serializer and the ECU, and may reduce computational efforts of the ECU. 
     With the control module according to various embodiments, a fast starting ASIL (Automotive Safety Integrity Level) graded remote camera may be provided. ASIL grading may require measures to ensure proper operation also if some kind of error occurs. For example, in order to be ASIL graded, the camera shall provide an ability to check for internal health so that it may detect errors and provide information on its state. In some cases, ASIL graded cameras may even be required to ensure proper operation in the case of an error. 
     According to another aspect, the control module further comprises a memory configured to store information related to the camera. For example, information that may be repeatedly (for example at every start up) requested by the ECU from the camera or that may be provided from the ECU to the camera may be stored in the memory, and then the information may be provided directly from the memory of the control module (instead of from the camera or from the ECU). This may allow starting up the camera without the ECU being involved (since the control module may provide the data or information or control instructions which are usually provided by the ECU, so that the ECU may focus on other tasks during start up and at the same time, the camera is available at a short time after startup). 
     According to another aspect, the input data comprises configuration or calibration data for the camera. For example, the configuration data or calibration data may be provided from the camera to the control device, and may then be stored in the control device. The calibration parameters may include operation parameters such as voltage or current requirements, shutter speed, ISO settings, pixel binning options, color calibration data, dark image data (to compensate for “hot pixels”), or the like. 
     According to another aspect, the output data comprises configuration or calibration data for the camera. For example, configuration or calibration data that has been previously received from the camera and saved in the memory may be obtained from the memory and be used in further processing and/or be forwarded to the ECU, without requesting the configuration or calibration from the camera again. 
     According to another aspect, the output data comprises identification data identifying the camera. The identification data may include data indicating a type of the camera and/or requirements of the camera for proper operation (for example allowable maximum or minimum operating temperatures). 
     According to another aspect, the processing unit is configured to carry out a run time check of the camera. At run time, the camera may be constantly or intermittently checked for valid operation. When camera is in operation, priority may be to provide connectivity for the video components (imager and video processor for example via a video lane), but at the same time, the camera may also be monitored for the validity of the operation. 
     According to another aspect, the run time check comprises a check of at least one of the following: a voltage drawn by the camera (in other words: a voltage drop over the camera or a voltage applied to the camera), a current drawn by the camera, a temperature of the camera, or a link quality to the camera. By avoiding that the multiple factors (voltages, temperature etc) must be checked and reported directly and separately to the ECU, heavy loading of the control channels may be may avoided. Furthermore, by checking the link quality, it may be ensured that the cameras have a good quality link for allowing quick setup and testing at the run time. 
     According to another aspect, the output data comprises at least one of a summary of results of the run time check or a detailed report of the results of the run time check. For example, a summary of the results may be an indication as to whether or not the run time check revealed any fault or not. For example, the summary of the results may be available at a higher frequency than the detailed report. For example, a detailed report may be provided upon request (for example, if it is determined by the ECU that a fault has occurred (for example based on the summary of the results), the ECU may request a detailed report in order to precisely locate the fault). 
     According to another aspect, the input data and/or the output data comprise synchronization data. Multiple sensors operating the same time provide demand on them to be synchronous to make fusion of data easier. At the same time in real live systems, it may be desired that operation of the sensor(s) is matched with a current situation. As an example, a camera may be set to a ‘shooter speed’ (or shutter speed) related to the light availability and to the current mode of the operation. At the same time, the front camera(s) and side camera(s) may use different lenses and sensors, which may lead to suboptimal settings when used for both devices. Based on the synchronization data, all cameras may be synchronized with the central time source (for example provided in the vehicle and/or provided in the ECU) with exposure time clearly related to that time. Furthermore, the vehicle ECU synchronization may be used to synchronize exterior and interior cameras for calibration. 
     According to another aspect, the processing unit is configured to determine a type of the camera and to process the input data based on the determined type of the camera. Information indicating the type may be stored in a memory of the control module (or in a memory associated or connected with the control module). More than one camera may be connected to the control module at the same time, and various types of cameras may be connected at the same time. According to various embodiments, multiple types of the imagers or cameras may be interfaced. Differences between different types of imagers or cameras may be compensated for by the control module. Furthermore, security and safety of the design (both as it comes to potential counterfeit and sabotage or mishandling) may be ensured by various embodiments, by taking control of the different types of cameras (which may include a check as to whether the camera is safe to operate and whether the camera is a counterfeit camera or not). 
     In another aspect, the present disclosure is directed at a vehicle comprising the control module as described above, the camera; the serializer; and the electronic control unit. 
     According to another aspect, the control module is configured to configure the camera during a startup of the vehicle and/or during a startup of the electronic control unit (ECU). Since the control module may be responsible only for the camera (or the plurality of cameras if more than one camera is provided), the control module may directly start processing at the time of startup, while the ECU is handling other tasks. 
     According to various embodiments, at least hundreds of ms to dozens of seconds of the startup time may be gained, changing perceived startup time for the user. At the same time, gain may be achieved in all areas of cybersecurity (initialization and configuration update), safety (build in diagnostic independent on the ECU), and time synchronization (clock synchronization). 
     In another aspect, the present disclosure is directed at a computer implemented method (for example control method) for processing data received via a first interface to a camera provided in a vehicle or via a second interface to a serializer for communication with an electronic control unit of the vehicle, the method comprising the following steps performed (in other words: carried out) by computer hardware components: determining output data based on the received data; and outputting the output data via the first interface or via the second interface. 
     In another aspect, the present disclosure is directed at a computer system, said computer system comprising a plurality of computer hardware components configured to carry out several or all steps of the computer implemented method described herein. 
     The computer system may comprise a plurality of computer hardware components (for example a processing unit, at least one memory unit and at least one non-transitory data storage). It will be understood that further computer hardware components may be provided and used for carrying out steps of the computer implemented method in the computer system. The non-transitory data storage and/or the memory unit may comprise a computer program for instructing the computer to perform several or all steps or aspects of the computer implemented method described herein, for example using the processing unit and the at least one memory unit. 
     In another aspect, the present disclosure is directed at a non-transitory computer readable medium comprising instructions for carrying out several or all steps or aspects of the computer implemented method described herein. The computer readable medium may be configured as: an optical medium, such as a compact disc (CD) or a digital versatile disk (DVD); a magnetic medium, such as a hard disk drive (HDD); a solid state drive (SSD); a read only memory (ROM), such as a flash memory; or the like. Furthermore, the computer readable medium may be configured as a data storage that is accessible via a data connection, such as an internet connection. The computer readable medium may, for example, be an online data repository or a cloud storage. 
     The present disclosure is also directed at a computer program for instructing a computer to perform several or all steps or aspects of the computer implemented method described herein. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Exemplary embodiments and functions of the present disclosure are described herein in conjunction with the following drawings, showing schematically: 
         FIG. 1  an illustration of a system including a control module  104  according to various embodiments; and 
         FIG. 2  a flow diagram illustrating a control method according to various embodiments. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  shows an illustration  100  of a system including a control module  104  according to various embodiments. The control module  104  may also be referred to as ‘supervisor’ or ‘standardizer’. An imager  102  (in other words: image sensor, for example an image sensor of a camera, for example a remote camera) does not have a direct control channel from a serializer/deserializer  106  (which may be connected to an ECU; electronic control unit) via a high speed serial and PoC (power over coax) connection  136 . The serializer/deserializer  106  (which may be referred to as serializer for sake of brevity) may be used as the communication means to provide high speed signals over relatively large distance between the ECU on one side and the imager  102  and the control module  104  on the other side. Instead of using a direct communication between the imager  102 , serializer  106  and ECU, the additional component of the control module  104  may be used according to various embodiments. 
     A remote camera may be a camera which is not integrated with the ECU directly but connected to the ECU via a (usually long) connection. For example, rear cameras and side cameras are usually remote cameras. Front cameras may be remote cameras or may be integrated with the ECU. 
     The control module  104  may be provided between the imager  102  and the serializer  106 , and may either forward or modify data transmitted on the control interface lines  110 ,  118 , the sync lines  112 ,  120 , and the diagnostic lines  116 ,  122 . 
     The control interface lines  110 ,  118  may provide an interface for control of the integrated circuits, for example according to I2C or an SPI. 
     According to various embodiments, the control module  104  may be provided between the imager  102  and the serializer  106 . This may enable operation of the imager  102  by control of the control module  104 , and independent from any interaction with the ECU. As a result, the ECU may interrogate the camera  102  on its state at the same the control module  104  interacts with the imager  102 . At the same time, some control functions (for example measurements of voltage levels as seen by the imager  102 ) may be delegated from the ECU to the camera control module  104 . 
     The sync lines  112 ,  120  may be used to enforce time synchronization in the remote camera  102  with the ECU, for example using a serializer GPIO (general-purpose input/output) line. This time synchronization may be part of the time synchronization as described herein, or may be used independently as to be used to signify an expected (for example expected by the ECU) image capture time. 
     The sync line  112  between the control module  104  and the imager  102  may be used to synchronize operation of the imager  102 . For example, a high speed clock may be used which frequency could be adjusted using the control module  104  to achieve a proper framerate. In another example, a shutter line may be used to control the moment when the image capture occurs. 
     The capture line  114  may indicate when physical capture is being done by the imager  102 . The capture line  114  may provide a feedback signal from the imager  102  indicating that the shutter is open. In embodiments where a capture line  114  is not provided, the indication whether the shutter is open may be determined using different means, for example, imager register polling (in other words: cyclic reading of a register of the imager  102 ) by the control module  104 . The control module  104  may check the shutter state (for example ‘shutter open’ or ‘shutter closed’) periodically (and independent from ECU) by reading a pre-determined register of the imager. Instead of checking the state by register polling, registration in the reading queue may be used. 
     The imager diagnostics line  116  may provide information about potential failures. In an embodiment where an image diagnostics line  116  is not present, other means, like imager register polling or interaction with imager  102  by the control module  104 , may be used. Information about potential failures may allow ASIL related monitoring of the state of the camera  102 , together with other means (like for example power supply monitoring (indicated via line  128 ), temperature monitoring, or control module internal diagnostics). 
     The camera diagnostics line  122  may alert the ECU about potential failures or abnormal states of the camera  102 . According to various embodiments, the camera diagnostics line  122  may be combined or substituted with other means, like for example register polling over control line  118  or as injected error state in the video lane signal  108  provided to the ECU over the camera connection  136 . 
     It should be understood that each of the lines  118  may include one or more physical lines. 
     The imager  102  may still be in direct contact with the serializer  106  via a video lane  108 ; in other words: the image data or video data provided by the imager  102  may not be routed through the control module  104 . 
     A DC/DC (direct current/direct current) converter  124  may provide power to the various components, for example via a power supply line  126  to the imager  102 , via a power supply line  130  to the control module  104 , and via a power supply line  132  to the serializer  106 . The DC/DC converter  124  may receive electric energy via a PoC (power over coax) line  134  (from the high speed serial and PoC line  136 ). The power supply lines  126 ,  130 ,  132  may be monitored to detect failures. In commonly used designs, power supply lines are monitored via the ECU by measurement or comparison with fixed levels, which may cause load on the interface and may cause issues when multiple cameras are used. According to various embodiments, the power supply lines  126 ,  130 ,  132  may be monitored via the control module  104  with fault signalization provided to the ECU so that the connection (for example connection  136 ) is less loaded on the diagnostic component. At the same time, more detailed diagnostic measurements may be done by the control module  104 . 
     In the following, startup of the camera or imager  102  according to various embodiments will be described. 
     The control module  104  may start immediately after power is applied to the imager  102 . The startup time of the control module  104  may be shorter than the startup time of the ECU, since the control module  104  may have a simple design and may provide functions tailored to the need of working in conjunction with the imager  102 , as compared to the complex design and general requirements of the ECU. Before the start up procedure of the ECU comes to a stage of using the imager  102 , the control module  104  may configure and test the imager  102 , effectively taking over the communication channel (for example I2C channel or SPI cannel) and releasing it before the ECU uses the communication line. 
     In the case when the ECU is to write anything to the imager  102  and the control module  104  will not finish its tasks, then the ECU transaction may be delayed using a clock stretching technique. In this case, when the control module  104  operates the imager  102  and the ECU starts to request access to the imager  102 , then the control module  104  may delay operation of the ECU by using ‘clock stretching’ as defined in the I2C standard. One of those rare yet possible cases when this may occur is when the imager  102  is a remote camera and the when the remote camera is temporarily disconnected of from the ECU, or the camera  102  is restarted. 
     In the following, identification of the camera or imager  102  according to various embodiments will be described. 
     After releasing the control interface line communication path (i.e. after switching to a mode of forwarding any communication between the imager  102  and the serializer  106  via the control interface lines  110  and  118 ), the control module  104  may ‘self identify’ the imager  102  to the ECU. It may be desired to securely identify whether the camera  102  is ‘valid’ (for example authentic and not a counterfeit product) and has a proper identifier (ID). In commonly used designs, identification may be done using reading a write-once-area in the imager or in an extended form as crypto-signature of the area; however, such an identification may either be spoofed or take long time. According to various embodiments, the internal storage verification may be delegated to the camera control module  104  while providing strong verification of short confirmation message. At the same time, any communication between the camera  102  and ECU may be protected even when the imager  102  does not support secure data transfer. 
     According to various embodiments, the ECU may provide ‘invocation’ (for example some random sequence to be written onto emulated I2C registers). The control module  104  may encrypt the invocation with the usage of its private key and may return the encrypted result to the ECU as the ‘response’ in other registers. Finally, the ECU may encrypt the response with a public key of the camera and provide the encrypted response to the control module  104 . The whole sequence may mean transmission of less than 30 bytes, and may require less than 1 ms. 
     Encrypting the invocation using two different keys may be used for identification of the imager  102 . For example, the ECU may send a random long number, for example including several hundreds of bits. The camera control module  104  may encrypt a block consisting of internally generated random salt, received from ECU, together with (for example followed by or preceded by) identification and calibration data which is stored in the camera  102 . Encryption may be done using an asymmetric key being part of the structure of the camera control module  104  and protected within the camera control module  104  (for example like a secure element). The result may be an encrypted block, and the encrypted block may be provided to ECU where it is decrypted by the ECU in the internal cryptography module which protects its key to the camera provided data. 
     In the following, provisioning of the calibration values according to various embodiments will be described. 
     After identification ended successfully, the control module  104  may allow reading some part of a memory (for example provided in the control module  104  or attached to the control module  104 ) which stores camera characteristics. The camera characteristics may be provided using an emulation of an EEPROM (of the imager  102 ) under control of the control module  104 . The data related to the camera characteristics may be stored as part of the structure of the control module  104 . 
     In the following, programming of the calibration values (into the control module  104 ) according to various embodiments will be described. 
     In order to enable programming of the calibration values into the control module  104 , a special mode of operation may be activated (for example using a similar mechanism as described above for identification of the camera). Usage of the public/private key pair may protect access to such mode of operation. 
     In the following, run time camera validity check according to various embodiments will be described. 
     The camera operation (for example the operation of the imager  102 ) may be constantly verified to inform (for example to inform the ECU) about any potential failures. According to various embodiments, the following measurements may be done by the control module  104 : voltage check, temperature check, sanity check (for example of the imager  102 , or of the link to the imager  102 ), or link quality. The control module  104  may have access via the control interface line  118  to the serializer  106  and finally to the ECU. Thus, the control module  104  may monitor the state of the connection to the ECU. The measurements may be carried out periodically and may be made available as a summary (for example as an I2C accessible register with value of 100 ms counter and simultaneously as line replicating a time synchronization signal and/or as a detailed report (indicating the voltages, temperature etc.). The self-check may be performed periodically, and as such, the timing mechanism may be established both to control the measurements and to be checked that it works with the required time schedule. Furthermore, instead of using a static error line, a line providing a different code or PWM ratio may be used to signalize the error. 
     In the following, synchronization of cameras (or imagers) according to various embodiments will be described. 
     The time in a vehicle is provided from a single source. All units (in particular all ECUs) receive that time and shall operate in relation to that time. According to various embodiments, the time may also be provided for operation in relation to the cameras provided in the vehicle. 
     At the startup of the vehicle, the ECU may provide the estimated current time to the control module  104 . During the operation, the ECU may provide squarewave (or rectangular) time synchronization signals as a side channel on the serial connection to the camera. The frequency of the signal may be dependent on the required stability of the camera clock (for example, the frequency may be 1 Hz). At each edge of the signal, the ECU may provide a current precise time in the ECU (which may be synchronized with the time base of the vehicle). The control module  104 , when seeing the edge of the signal, may capture the current internal time and compare this with time provided by the ECU and may modify the internal N/M divisor to make the internal clock stable and synchronized with the car time (i.e. the ECU time). At the same time, the control module  104  may provide a copy of the received signal to the ECU, so that the ECU may determine a transmission time and jitter which may be provided to the control module  104  as a way to make the time more precise. 
     According to various embodiments, the shutter may not be controlled directly or left it self-running. According to various embodiments, control of the shutter may be moved to synchronizing the time between the camera  102  and ECU, with the ECU being the loosely connected time source. This way of connection may reduce the load on the ECU and may provide that synchronization is a low priority process. 
     According to various embodiments, while the camera  102  may run with or without an internal generator, at one point such a signal may be established. After that, internal signals may be produced, leading to the process of taking images using the imager  102 . One of the particular methods of doing that may be using M/N given frequency signal generation. However, it will be understood that instead of the divisors, software or a programmable logic may be used to replicate that process. As the result, a signal of a given frequency may be received, and due to the regulation, the phase alignment may be received as well. Thus, adjustments may be provided to the M/N coefficients, so that exposures may be made at predicted times. Furthermore, this may reduce workload on the ECU in multi camera systems and also on the fusion component. 
     It will be understood that N and M refer to two coefficients in the PLL loop used for frequency generation (which may be referred to as N/M frequency generation). According to various embodiments, the base clock may be multiplied by N and divided by M, and the output signal may be divided by one coefficient and compared to the base clock divided by the other coefficient. However, it will be understood that any other method may be used alternatively. 
     Using such internal time, the control module  104  may produce a stable clock time to the imager  102  to make the period of the frames precise. At the same time, the control module  104  may use either ‘frame sync’ input or ‘flash’ output to synchronize a moment when an exposure is to be made. 
     In the case of ‘frame sync’ input, the control module  104  may produce the signal according to a computed internal scheduling, allowing the configurations with multiple frame formats to be used as well. 
     In the case when ‘flash’ output is used, the control module  104  may capture the time when the signal was provided and then make it available to the ECU. When precision of the time of exposure would not be adequate, then the control module  104  may change the configuration of the imager  102  to take the next images at a proper time. 
     The usage of ‘flash’ output may be based on the design of the imagers which sometimes provide such output when an image is taken, which may provide a source for the control loop adjusting the moment when the image should be taken according to the time schedule based on the time source. In other words: a time source may be provided to the camera  102 , and it may be expected that the camera  102  will schedule moments when images shall be taken. According to various embodiments, the ECU may provide a time source (using a low priority process) and the camera  102  may restore the time from the time source and then based on the time source may downregulate the frequencies of the internal signals in order to achieve images being shoot at pre-determined times. In order to achieve good synchronization, either a frame sync signal may be provided or a flash signal may be received to achieve proper loop of the control. With this method, the ECU may be offloaded and it may be ensured that the images are taken in well-defined moments of time. At the same time, the process of regulation may be relatively simple and may be carried out on specialized hardware or in a programmable logic or in a conventional central processing unit (CPU). 
     In the following, a camera hardware abstraction layer (HAL) according to various embodiments will be described. 
     More and more cameras are built with a variety of imagers. According to various embodiments, a compilation of required capabilities of imagers may be defined, and a HAL may be defined that exposes an idealized model to the software. The control module  104  may implement the HAL in such way that it may receive settings from the ECU and may then translate the settings to data to be provided to the imager  102  (in the correct format or with the correct content for that specific imager). At the same time, the control module  104  may allow access from the ECU to the imager. The clock stretching technique as described above may be implemented to eliminate any risk of access from multiple sources the same time. 
       FIG. 2  shows a flow diagram  200  illustrating a control method according to various embodiments. The control method may process data received via a first interface to a camera provided in a vehicle or via a second interface to a serializer for communication with an electronic control unit of the vehicle. At  202 , output data may be determined based on the received data. At  204 , the output data may be output via the first interface or via the second interface. 
     Each of the steps  202 ,  204  and the further processing described above may be performed by computer hardware components.