Control circuit for controlling an output signal The present invention relates to a control circuit for controlling an output signal provided to a relay responsible for a light source.

Further, the present invention relates to a vehicle.

Furthermore, the present invention relates to a method of controlling an output signal provided to a relay responsible for a light source. Moreover, the invention relates to a program element.

Furthermore, the invention relates to a computer-readable medium. In the field of automotive, controlling light sources like the low beam of a vehicle is an important purpose of control circuits. The control of the low beam of a vehicle may be performed by a BCM (body controller module) . However, as the low beam control requires special safety, special means have to be taken in order to provide the necessary safety, for example to avoid an unintended switch-off of the low beam. Common control mechanisms are not completely- fail-safe as in common circuits a microcontroller works together with a further part of the circuit which may not detect every malfunction of the microcontroller.

There may be a need for providing a less expensive and more fail-safe circuit for controlling an output signal provided to a relay responsible for a light source. This need may be met by a circuit and a method according to the independent claims. Preferred embodiments, which can be used alone or in combination with each other, are presented in the dependent claims . According to a first aspect of the invention, a control circuit for controlling an output signal provided to a relay responsible for a light source is provided, wherein the control circuit comprises an output terminal adapted for providing the output signal to the relay responsible for the light source, a microcontroller coupled to the output terminal for providing the output signal to the output terminal, and a safety circuit coupled to the output terminal and adapted for controlling the output signal redundantly to the microcontroller.

In the control circuit, any interaction of the microcontroller and the safety circuit may be avoided as the safety circuit may be designed to use a low-beam switch input for controlling the output to the low-beam relay via the output terminal directly and in parallel to the microcontroller. The safety circuit may activate an output driver for the low beam when a low-beam switch is active and ignition is on. The safety circuit may be supplied from a different supply source than the microcontroller. Thus, the safety circuit may ensure that a single failure of any kind inside the BCM (beside connector failures) will not cause an unintended switch-off of the low-beam relay.

According to a second aspect of the invention, a vehicle is provided comprising such a control circuit for controlling an output signal provided to a relay responsible for a light source.

According to a further aspect of the invention, a method of controlling an output signal provided to a relay responsible for a light source is provided, wherein the method comprises providing the output signal by an output terminal to the relay responsible for the light source, providing the output signal by a microcontroller to the output terminal, and controlling the output signal by a safety circuit redundantly to the micro- controller.

According to a further aspect of the invention, a computer-readable medium (for instance a semiconductor memory, a CD, a DVD, a USB stick, a floppy disk or a harddisk) is provided, in which a computer program of controlling an output signal is stored, which computer program, when being executed by a processor, is adapted to carry out or control a method of controlling an output signal provided to a relay responsible for a light source having the above mentioned features.

According to a further aspect of the invention, a program element (for instance a software routine, in source code or in executable code) of controlling an output signal is provided, which program element, when being executed by a processor, is adapted to carry out or control a method of controlling an output signal provided to a relay responsible for a light source having the above mentioned features.

Controlling an output signal, which may be performed according to embodiments of the invention, can be realized by a computer program, that is by software, or by using one or more special electronic optimization circuits, that is in hardware, or in hybrid form, that is by means of software components and hardware components .

According to an exemplary embodiment, the light source is a low beam of a vehicle. For a low beam of a vehicle it may be very important to ensure that it may not be switched off accidentally or due to malfunctions of the microcontroller or any other part of the circuit.

According to a further exemplary embodiment, the safety circuit comprises an input protection circuit for activating the safety circuit when receiving a signal indicating that the light source is switched on. The input protection circuit may receive a signal from a switch which may be actuated for turning on the light source .

According to a further exemplary embodiment, the input protection circuit is adapted to be supplied by an ignition voltage. Thus, the safety circuit may only work when the ignition is turned on, that means that user has started the vehicle.

According to a further exemplary embodiment, the safety circuit comprises a logic circuit for controlling the output signal in response to a signal received from the input protection circuit. The logic circuit may receive a high signal level from the input protection circuit and may be activated in response to this high signal level.

According to a further exemplary embodiment, the control circuit further comprises a driver unit, wherein the driver unit is coupled to the microcontroller and the safety circuit and is adapted for controlling the output signal in response to a signal received by the safety circuit. Thus, the safety circuit may control the output signal via the driver unit.

According to a further exemplary embodiment, the safety circuit is adapted for protecting the driver unit. The microcontroller may not provide a control and software protection strategy. The driver unit may comprise a self-protection that limit the output current to a maximum value and switches off the driver unit when an over-temperature threshold has been exceeded. If it is detected that the driver unit is for example in current limitation or in over-temperature switch-off mode, the logic circuit may switch the input of the driver unit, which may be for example a transistor, to ground in order to protect the driver unit from toggling in over-temperature condition. According to a further exemplary embodiment, the microcontroller is adapted for detecting a malfunction of the safety circuit and for activating a safety mode upon detection of the malfunction. The safety mode may be a locking of the safety circuit. The microcontroller may report a permanent malfunction of the safety circuit via a bus system of the vehicle. Further, the micro ^¬ controller may release the locking of the safety circuit, if the malfunction has been removed. According to a further exemplary embodiment, the vehicle may be selected from a group consisting of an automobile, a passenger car, a truck, a bus, a train, an aircraft and a ship. It has to be noted that embodiments of the invention have been described with reference to different subject matters. In particular, some embodiments have been described with reference to method type claims whereas other embodiments have been described with reference to apparatus type claims. However, a person skilled in the art will gather from the above and the following description that, unless other notified, in addition to any combination of features belonging to one type of subject matter also any combination between features relating to different subject matters, in particular between features of the apparatus type claims and features of the method type claims is considered as to be disclosed with this application.

Further details and advantages of the invention are explained with regard to the enclosed figures. The invention will be described in more detail hereinafter with reference to examples of embodiment but to which the invention is not limited.

Figure 1 shows a schematic diagram of a circuit according to one embodiment of the invention;

Figure 2 shows a schematic diagram of a common circuit;

Figure 3 shows a schematic diagram of a further common circuit; Figure 4 shows a schematic diagram of a circuit according to a further embodiment of the invention.

With regard to the following description of the embodiments of the invention the same reference signs refer to the same or comparable components.

The control of a low beam of a vehicle can be performed by a BCM (body controller module) . However, as the low-beam control requires special safety, special means have to be taken in order to provide the necessary safety, for example to avoid an unintended switch-off of the low beam. There are different common solutions of low-beam control. First, the low-beam control may not be integrated into the BCM as shown in Figure 2. The simplest solution is to use a low-beam switch 105 that can control the low-beam relay 104 directly by being able to run the relay current through the switch. Both the switch and the relay are not integrated in the BCM, so the safety issue refers to the cable harness connecting the switch with the relay and the relay switch with the low-beam lamps 108. The BCM' s microcontroller (uC) 102 can drive the low-beam relay in parallel to the switch via a low-side driver (LSD) 106 or alternatively with a high-side driver in order to provide comfort functions like "vehicle approach light" or "follow me home light". In any case the BCM 's LSD has to take the inductive kick of the external relay at switch-off. This simple solution is used rather in low-end cars . Second, the low-beam control may be fully integrated by double channel. A comfortable but expensive solution is to integrate the low-beam control into the BCM by providing two independent channels, one for the left low beam and the other for the right one. For the integration of the output switches, relays and solid-state circuits (semiconductor smart drivers) can be used. The split of the low-beam function is necessary, because a single failure in a single output control circuit would otherwise switch off both low-beam lamps which would not be compliant with safety re ^¬ quirements. As the microcontroller of the BCM could get non-operative due to some incident (for example supply voltage drop-out), a watch-dog is implemented that monitors the microcontroller and is able to control the low beam in the case of a malfunction of the microcontroller as shown in Figure 3. Third, the low-beam control may be partly integrated in the BCM. In order to avoid the double low beam control, a solution with only one external relay for controlling both lamps is possible as shown in Figure 3. However, the efforts, how to control the external relay safely, are similar to those described above. The watch-dog circuit shown in Figure 3 has two drawbacks: It is rather expensive and not absolutely fail-safe. A Watch-Dog 112 includes means for analyzing incoming signals. However, a watchdog 112 is not complex enough to detect any malfunction of the microcontroller 102. To increase the safety level, monitoring units are used (for example in airbag and powertrain systems) that interact with the microcontroller regularly to ensure the proper operation or to interfere immediately.

In one embodiment of the present invention as shown in Figure 1, any interaction with the microcontroller in terms of watch-dog or monitoring unit is avoided. Instead, a safety circuit 103 is designed to use the low-beam switch input 105 for controlling the output 101 to the low-beam relay 104 directly and in parallel to the microcontroller 102. The relay 104 is coupled with a battery voltage supply via a fuse 109 and also coupled with the low-beam lamps 108 via fuses 109. The safety circuit 103 has to fulfill the following requirements: a) Activate the output driver 107 for the low beam 108 when the low-beam switch 105 is active and ignition 111 is on.

b) Protect the output driver from damage if the low-beam relay coil 104 is shorted. The built-in self-protection of the low-side driver is not sufficient, as it can withstand the short-circuit to battery condition for only limited time and number of activations. c) Re-activate the low side output driver when the short-circuit to battery condition has been removed. d) Allow the microcontroller to monitor the proper function of the safety circuit. e) Supply the safety circuit from a different supply source (for example ignition supply 111) than the microcontroller (in general battery supply 110) By those requirements the safety circuit ensures that a single failure of any kind inside the BCM (beside connector failures) will not cause an unintended switch-off of the low-beam relay.

According to a further exemplary embodiment, the safety circuit comprises an input structure and a simple logic block as shown in Figure 4. The safety circuit comprises a hardware circuit. The input protection circuit 114 gets supplied by the ignition voltage 111 via a pull-up resistor and passes a high signal level to the logic block 113 of the safety circuit if the low-beam switch 105 is closed. The low-side driver LSD2107 is controlled by the logic block and is activated by a high signal level. Normally, it switches the output 101 to ground potential by carrying the load current. For failure modes (for example short-circuit of the load) the driver contains a

self-protection that limits the output current to a maximum value and switches off the driver when an over-temperature threshold has been exceeded. When switched off, a status signal indicates the failure mode by a low level. As soon as the driver has cooled down to a lower temperature threshold, it switches on again. That toggling in over-temperature condition continues until the driver input is set to low level (or the driver gets damaged) .

The logic block 113 forwards the signal from the input protection circuit 114 to the low-side driver LSD2. If the output signal at OUT 101 remains high after a time delay, the driver unit 107 was not able to carry the load current and is either in current limitation or in over temperature switch-off mode. So the logic block 113 switches the input of LSD2 to ground in order to protect LSD2 from toggling in over-temperature condition. Now the over-load condition is locked in the logic block. It can be released by toggling the switch off and on or by switching the output OUT to ground with LSDl 106 activation by the microcontroller 102 after the short of the load at OUT 101 has been removed. The microcontroller uC controls the output OUT via the low-side driver LSDl redundantly to the safety logic. The microcontroller is supplied by an input protection circuit 115 with the battery voltage 110. Further, it receives a signal from a voltage regulator 116 adapted for maintaining a constant voltage level.

Furthermore, the microcontroller reads the status signals of LSDl and LSD2 to check for over-temperature switch-off and for a locking of the logic block. It can release the locking of the safety circuit by activation of LSDl when the failure condition at OUT has been removed. It can detect and report a permanent malfunction of the safety circuit via the vehicle's bus system.

The safety circuit ensures the proper activation and con- tinuation of the low-beam relay. It does not need to monitor the BCM's microcontroller with the efforts it would take, but operates redundantly the low-beam relay. Furthermore it protects the low-side driver LSD2 for which the microcontroller cannot provide a control and software protection strategy. Because of its simple structure, the invention may be a competitive low-cost solution.

It should be noted that the term "comprising" does not exclude other elements or features and the "a" or "an" does not exclude a plurality. Also elements described in association with different embodiments may be combined.

It should also be noted that reference signs in the claims shall not be construed as limiting the scope of the claims.