Automobile air bag computer diagnosis system

Abstract

The invention discloses an automobile air bag computer diagnosis system, relates to the field of electrical testing, and realizes full-process fine control of ECU mirror image writing through byte-level differential management, three-model parallel simulation verification and two-stage judgment strategies. A system leads out an ECU original mirror image and generates an SHA256 snapshot, a target mirror image is compared byte by byte to form a differential bitmap DIFFmap, and the differential bitmap DIFFmap is aggregated into a minimum write-in unit according to pages, so that the write-in amount and flash memory wear are reduced, and the write-in success rate is improved. The simulation verification unit parallels a plurality of models and dynamically recognizes a high-risk mirror image through weighted combination and a two-stage judgment strategy, and the write-in verification unit adopts segment-level CRC32 and global SHA256 verification and guarantees write-in atomicity and rollback traceability through two-stage submission, atomic switching and exponential backoff retry. And the cloud and local operation and maintenance module generates a compliance diagnosis report and provides authorization management, so that data security synchronization and edge cloud cooperative processing are realized. According to the scheme, the safety, the reliability and the traceability of ECU updating operation are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electrical testing, in particular to an airbag computer diagnostic system. BACKGROUND

[0002] Current vehicle ECU firmware updates and repairs mainly rely on local diagnostic equipment or remote update platforms, and data is transmitted through CAN, LIN, CAN-FD, etc. Common protection measures include segmented verification, transactional writing, and basic rollback mechanisms. There are several key problems in real-world applications that lead to safety risks and reliability decline. First, transient voltage drops or pulsations may occur during vehicle power supply during diagnosis or writing. Simple software retries cannot fundamentally prevent writing interruptions and image damage. Existing solutions lack close coupling between hardware energy caching and communication adaptation, and cannot guarantee writing continuity. Second, direct writing of byte-level differences or whole-image replacement can result in large writing volumes, severe flash wear, and high rollback costs. Existing differential strategies are mostly at the file or block level, lacking flexible page-level aggregation and minimum write unit concepts.

[0003] Third, traditional verification relies on a single rule set or static test cases, which cannot cover logic semantic errors and abnormal disturbance scenarios, and lacks a dynamic trust allocation mechanism based on model historical performance, leading to the possibility of misapproving high-risk changes or over-blocking low-risk changes.

[0004] Finally, multi-level verification is usually limited to checksums and self-checks, lacking a closed-loop consistency judgment and traceable audit package from segmented verification to global integrity to business self-check. The interface between cloud authorization and local decision-making is not uniform, and the manual intervention strategy lacks fine-grained risk scaling support. Based on the above shortcomings, there is an urgent need for a diagnostic system that implements end-to-end collaboration in power protection, differential minimum writing, parallel simulation verification, and multiple consistency checks to meet the higher requirements of airbag ECU in safety, reliability, and traceability. SUMMARY

[0005] The purpose of the present application is to solve the problems of traditional airbag ECU diagnostic processes, and to provide an airbag computer diagnostic system.

[0006] To achieve the above purpose, the present application adopts the following technical solutions: an airbag computer diagnostic system, characterized by comprising:

[0007] A power supply unit with multi-protocol automatic identification and data correction, and outputs reliable communication data stream;

[0008] A data processing unit pre-processes ECU original data, extracts difference data between original data and pre-repair data, and aggregates the difference data into a minimum write unit set according to storage pages;

[0009] analog verification unit, importing pre-repair data for virtual verification and filtering risk images;

[0010] write verification unit, segmenting and managing differential data to be written after verification, checking and confirming consistency of segments and the whole through CRC32 and SHA256, and performing rollback recovery when failed, and then authorized to write ECU by the security module;

[0011] cloud and local operation and maintenance module, synchronizing local data to cloud backup, and choosing whether to intervene manually.

[0012] 2. As a further description of the above technical solution: the power supply unit includes:

[0013] Real-time monitoring of power supply voltage and using capacitor to cache energy when fluctuating, power management module to avoid writing interruption, generating stable power flow;

[0014] Adopting adaptive baud rate matching and error detection method, communication interface module under CAN / LIN / CAN-FD protocol to realize automatic identification and data error correction, maintaining communication data flow;

[0015] Based on overvoltage / overcurrent detection algorithm and reverse connection protection circuit, electrical protection module to realize isolation protection of abnormal power supply state, generating safe physical channel.

[0016] As a further description of the above technical solution: the data processing unit includes:

[0017] Mirror backup module, exporting ECU original image IMG_old, calculating and saving SHA256 based on IMG_old to generate original image snapshot;

[0018] Differential management module, generating byte-level bit vector through byte-by-byte comparison between original image IMG_old and target image IMG_new and aggregating it into page-level marker PM_j according to configurable page size P to output DIFF_map and differential data set;

[0019] Temporary write area module, providing a buffer and isolation space before final data is written to ECU, used to store data to be verified, ensuring safe writing to the official storage area after subsequent verification and confirmation.

[0020] As a further description of the above technical solution: the analog verification unit contains three models of lightweight rule machine rule, deep logic simulator deep and abnormal disturbance model fault in parallel, the conjunction result of the three models forms the simulator decision through majority decision rule, if any model is judged as not passing, the simulator decision is output as not passing and prevented from entering the write verification unit.

[0021] As a further description of the above technical solution: the conjunctive result one-stage judgment includes the following steps:

[0022] S1, receiving three model output scores, unifying outputs from different sources to the same dimension;

[0023] S2, setting a veto layer, establishing a safety bottom line through a preset veto threshold, directly blocking the entry into the writing stage when any critical dimension is too low, and reducing the risk of high-risk errors

[0024] S3, assigning a historical reliability to each model, assigning more weight to the model with a more reliable history, and realizing dynamic trust allocation.

[0025] Calculate the weighted total score to obtain the overall confidence of the three models after weighting, and integrate the three model evidences into an overall confidence for the first-stage decision;

[0026] S4, set the conjunctive threshold;

[0027] Form an efficient one-time decision, and quickly release high-confidence samples, where T is the conjunctive pass threshold configured according to the safety level

[0028] As a further description of the above technical solution: the conjunctive result two-stage judgment includes the following steps:

[0029] S5, if S is in the conservative interval, a second judgment is made in the form of majority voting,

[0030] S6, calculate the final confidence, output the complete decision package to write audit, provide fine-grained risk scale to downstream writing strategy, and form a traceable evidence set;

[0031] S7, after each write audit, update the accuracy of model i in the recent window to reflect the true performance, and calculate through the exponential moving average to make the system converge to a better weight allocation over time, continuously improving the overall judgment quality.

[0032] As a further description of the above technical solution: the cloud and local operation and maintenance module generates a compliance diagnosis report containing IMG_old hash, IMG_new hash, DIFF_map, segment-level verification record and final verification result, and safely uploads it to the cloud backup through the remote synchronization module. The cloud server provides an authorization module for issuing write authorization and prohibiting local submission actions when there is no valid authorization.

[0033] As a further description of the above technical solution: the write verification unit includes a transaction control module, a multiple verification module and a retry and rollback module, the transaction control module implements segmented writing and two-phase commit, the preparation phase writes the differential writing to the temporary writing area and generates a segment-level verification record, and the commit phase updates the active mirror flag bit by single-byte or single-unit atomic writing to activate the new mirror and output the transactional write mirror metadata packet.

[0034] As a further description of the above technical solution: the multiple verification module uses CRC32 for fast verification at the segment level and uses SHA256 for integrity verification globally, and at the same time, after writing, the ECU service self-checking interface reads the DTC and the ready flag to generate the final verification result, and only when the segment-level verification, global verification and service self-checking are all passed, it is considered that the writing is successful.

[0035] As a further description of the above technical solution: the retry and rollback module uses an exponential backoff retry strategy and sets a maximum number of retries N, and if the maximum number of retries is exceeded, a rollback process is triggered to restore IMG_old and generate a safe rollback state record.

[0036] As described above, due to the use of the above technical solution, the beneficial effects of the present application are:

[0037] The present application introduces a joint mechanism of "byte-level difference" and "multi-model simulation verification" before ECU data repair, which realizes the double optimization of diagnosis and writing. Through byte-level difference, the difference between the original image and the target image can be accurately to the byte, and combined with page-level aggregation and segment-level verification, the writing is limited to the minimum necessary unit, thereby significantly reducing the number of flash erase, reducing memory wear, shortening the writing time and improving atomic consistency and rollback traceability.

[0038] At the same time, the simulation verification is determined by multiple parallel judgment of rule machine, deep logic simulator and abnormal disturbance model, and under the mechanism of one-stage fast decision and two-stage conservative decision, it ensures that high confidence samples are quickly released and low confidence samples are finely reviewed, which not only improves the coverage and reliability of abnormal detection, but also reduces the risk of false release. The combination not only guarantees the data integrity and security of ECU in the writing process, but also improves the stability and traceability of the overall diagnostic system, and meets the stringent requirements of automotive safety electronic systems for high reliability and verifiability. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 The figure is a schematic diagram of the system architecture of the present application;

[0040] Figure 2 The figure is a flowchart of the present application;

[0041] Figure 3Timing diagram for the differential bitmap and two-phase commit write of the present invention;

[0042] Figure 4 Flow chart for implementing the differential bitmap DIFF_map of the present invention;

[0043] Figure 5 Example bitmap for the differential bitmap DIFF_map of the present invention;

[0044] Figure 6 Flow chart for the mirror extraction of the present invention;

[0045] Figure 7 Flow chart for the differential bitmap generation of the present invention;

[0046] Figure 8 Flow chart for the check update of the present invention;

[0047] Figure 9 Flow chart for the security emulator of the present invention. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0049] As shown in Figure 1 - Figure 9 The automobile airbag computer diagnostic system provided by the present application comprises:

[0050] The power supply unit has the functions of multi-protocol automatic identification and data error correction, and outputs reliable communication data stream.

[0051] The power supply unit comprises a power management module, a communication interface module and an electrical protection module.

[0052] The power management module monitors the power supply voltage in real time and uses the capacitor to store energy when the voltage fluctuates, so as to avoid write interruption and generate stable power flow.

[0053] The communication interface module uses the adaptive baud rate matching and error detection method to realize automatic identification and data error correction under the CAN / LIN / CAN-FD protocol, and maintains the communication data stream.

[0054] The electrical protection module is based on the overvoltage / overcurrent detection algorithm and the reverse connection protection circuit, realizes isolation protection for abnormal power supply state, and generates a safe physical channel.

[0055] Data processing unit, pre-process ECU raw data, extract difference data between raw data and pre-repair data, and aggregate into minimum write unit set according to storage page;

[0056] Pre-processing includes differential analysis on read image and verification of modified check chain and self-checking logic on a safe simulator (simulation verification unit). Only after passing the simulation, it enters the real write stage. The specific steps are as follows:

[0057] Read the complete original image from ECU, denoted as IMG_old.

[0058] Generate the expected modified target image from the repair tool, denoted as IMG_new. Perform byte-by-byte comparison between IMG_old and IMG_new to generate the difference bitmap DIFF_map.

[0059] Group the differences into storage pages or sector granularity to form the minimum write unit set. Calculate CRC32 for each difference block and SHA256 for the whole image to generate the check chain.

[0060] Update the internal storage mapping table of ECU to generate new check chain (page-level check + global check). Load IMG_new into the safe simulator (simulation verification unit) to simulate the internal self-checking logic of ECU.

[0061] Data processing unit includes image backup module, difference management module and temporary write area module.

[0062] Image backup module exports ECU original image IMG_old, calculates and saves SHA256 based on IMG_old to generate original image snapshot;

[0063] Difference management module generates byte-level bit vector by byte-by-byte comparison between original image IMG_old and target image IMG_new, and aggregates it into page-level marker PM_j according to configurable page size P to output DIFF_map and difference data set;

[0064] Temporary write area module provides a buffer and isolation space before the final data is written into ECU, which is used to store the data to be checked, ensuring that the data is safely written into the official storage area after subsequent verification and confirmation.

[0065] The scheme exports the ECU original image IMG_old and saves the SHA256 snapshot, compares IMG_new and IMG_old byte by byte to generate a difference bit vector, records the offset address, the original byte and the target byte. According to the configurable page size P, the bit vector is aggregated into a page-level marker PM_j, the adjacent differences are merged into the minimum write block, and the aggregation considers the flash erase unit and page alignment to avoid write amplification. The output DIFF_map includes page markers, difference offset tables and difference data, generates segment-level CRC32 for each segment and SHA256 for the whole image. First write to the temporary area and pre-write verification, and after verification, switch the active image through single-byte atomic activation flag, and if it fails, roll back and generate a complete audit record. With adjacent difference merging, write balancing, difference compression and difference data encryption signature, the efficiency and security are improved. The outstanding effect is to significantly reduce the write amount and flash wear, shorten the write time window, improve the write success rate and ensure the traceability and atomic consistency of rollback.

[0066] The simulation verification unit imports the pre-repair data for virtual verification and filters the risk image.

[0067] The simulation verification unit includes three models in parallel, namely, a lightweight rule machine (rule), a deep logic simulator (deep) and a fault disturbance model (fault). The conjunctive result of the three models is formed into a simulator decision by majority decision rule. If any model is determined to be not passed, the simulator decision is output as not passed and the write verification unit is prevented from being entered.

[0068] The conjunctive result segment decision includes the following steps:

[0069] S1, receiving three model output scores Convert each score to a binary decision , The binary pass flag is two, and the binary threshold Is configurable, For continuous scores, the outputs from different sources are unified to the same dimension;

[0070] S2, set the veto layer, pass the preset veto threshold , if there is any Immediately output , and record Its expression is:

[0071] If Output ;

[0072] Establish a security bottom line, and any critical dimension is too low to directly block the entry into the write stage, reducing the high-risk false pass

[0073] S3, assign a history reliability to each model with normalized weights:

[0074] ;

[0075] where: represents the accuracy of model i in the recent window, is the conjunctive weight, satisfying the sum of weights is 1;

[0076] which assigns more weight to the models with more reliable history, achieving dynamic trust distribution.

[0077] Calculate the weighted sum score:

[0078] ;

[0079] where: is the overall confidence after weighting the three models, whose value is positively correlated with the confidence, which integrates the three-model evidence into an overall confidence for the first-stage decision;

[0080] S4, set the conjunctive threshold , if then preliminarily determine PASS, otherwise determine FALL;

[0081] Form an efficient one-time decision and quickly release high-confidence samples, where T is the conjunctive passing threshold configured according to the safety level.

[0082] The conjunctive result two-stage decision includes the following steps:

[0083] S5, if S is in the conservative interval, i.e. , then perform a second decision:

[0084] ;

[0085] if , then PASS, which is the sum of the three-model binary decisions, used for majority voting, otherwise FALL, if, for example but , then decide according to the key priority rule (if the deep reliability exceeds the threshold , then decide with , otherwise decide according to the majority voting result);

[0086] S6, calculate the final confidence:

[0087] ;

[0088] Where C ∈ [0, 1] and output complete decision package write audit, provide fine-grained risk scale for downstream write strategy, and form a traceable evidence set;

[0089] S7, update to reflect the true performance, and exponential moving average:

[0090] ;

[0091] Where, is the actual accuracy rate of the tth window model i, and a ∈ (0, 1) is the learning rate of weight update, allowing the system to converge to a better weight distribution over time, continuously improving the overall judgment quality.

[0092] The scheme runs three models in parallel, a lightweight rule machine for fast syntax and strategy verification, a deep logic simulator for semantic-level logic and state machine verification, and an abnormal disturbance model for input and timing disturbance evaluation of robustness. Each output continuous confidence score, which is converted to a binary decision according to a configurable threshold and has a veto layer. If any of the three outputs is below the veto threshold, it is immediately blocked and the risk image is recorded. Based on the latest sliding window, the accuracy of each model is calculated and normalized to a weight, and the weighted total score is used for one-time preliminary judgment. If it is higher than the threshold T, it is directly passed, otherwise it triggers a two-stage judgment. The two-stage judgment is mainly based on majority voting, and when the reliability of the deep simulator exceeds the threshold, it is given priority. The system generates a complete decision package containing input snapshots, model original output, normalized weight, weighted calculation process, random seed, and audit signature, and uses an exponential moving average to update the model reliability online with a learning rate a. This improves the detection rate of semantic errors and timing anomalies, reduces the probability of false passage, dynamically adapts the model performance, and provides auditable decision evidence to support safety-critical writing.

[0093] The write verification unit manages the segmented differential data to be written after verification, and checks the consistency of the segments and the whole through CRC32 (treats the data as a binary polynomial, uses a predefined generator polynomial to perform modulo 2 division on the data, and the remainder is the check code) and SHA256 (performs complex operations on the data through multiple rounds of nonlinear functions including bit shifting, modulo addition, and Boolean functions, and outputs a hash value that is difficult to reverse calculate), and performs rollback recovery when it fails, and then the security module authorizes the write to the ECU;

[0094] The write verification unit includes a transaction control module, a multiple verification module, and a retry and rollback module.

[0095] Transaction control module implements segmented write and two-phase commit, preparation phase writes differential to temporary write area and generates segment-level check record, commit phase updates active mirror flag by single byte or unit atomic write to activate new mirror and output transactional write mirror metadata package.

[0096] The strategy of segmented write and two-phase commit aims to avoid the loss of target storage completion status or function caused by interrupted write process. Flash or EEPROM has page erase and write granularity limit, and the risk of whole block coverage is high. Therefore, the modification is divided into the smallest transaction unit that can be recovered. Segmented write is written according to the storage page or block and checked after each segment write. If it fails in the middle, only the segment can be retried instead of rewriting the whole. Two-phase commit includes preparation phase and commit phase. The preparation phase writes new data to the temporary area and completes the check. The commit phase does a single byte or unit atomic mark to switch the new mirror to the effective version, which ensures that at least one consistent mirror is available at any time.

[0097] The multiple check module uses CRC32 for fast check at the segment level and SHA256 for integrity check globally. At the same time, the ECU business self-check interface is triggered after writing to read DTC and readiness flag to generate the final check result. Only when the segment-level check, global check, and business self-check are passed is the write considered successful.

[0098] The role of writing to the temporary area before writing and recalculating the check value is to ensure that the original mirror is not affected. The temporary area saves the new mirror and metadata such as version number, length, timestamp, and check value. Recalculating the check value is used for subsequent read-back comparison and integrity proof. The check algorithm can be used in stages, with fast check such as CRC32 for real-time comparison and strong check such as SHA256 for evidence preservation. Metadata should be written and checked at the same time.

[0099] The role of atomic replacement of target flag is to switch the prepared mirror to the effective mirror. This step must be a single write operation or single metadata update to ensure atomicity. Common implementations include double backup area with active identification bit or version number comparison. First, write to the inactive area and check, then write the last status byte as a switching instruction. Since the minimum granularity of atomic write for embedded storage is single byte or single unit, a small enough identification bit is selected to ensure that the switching cannot be interrupted.

[0100] Multiple checks and maximum retry limit are used for write operation to deal with transient errors such as bus jitter, power transient, or bit flip caused by write failure. The implementation is to read back and compare the check value immediately after each segment write. If they do not match, retry according to the backoff strategy. The recommended maximum number of retries is 3 times, and exponential backoff is used. The voltage and bus state are detected before each write to avoid repeated failures.

[0101] Retry and rollback module adopts exponential backoff retry strategy and sets the maximum number of retries N, if the maximum number of retries is exceeded, the rollback process is triggered to restore IMG_old and generate a safe rollback state record.

[0102] The role of re-reading and checking the hash, CRC and business self-check flag immediately after writing is completed is to double guarantee that the writing has taken effect permanently and there is no implicit error on the business level. First, compare the check values to confirm the bit level consistency, and then trigger the self-check interface of the ECU to read the self-check result or DTC state. If any check or self-check fails, trigger automatic rollback and restore the backup image. The rollback implementation should go through the same two-stage process to ensure that the rollback also has atomicity. The backup image should be reliably saved to the cloud and the local operation and maintenance module before the write operation and signed for integrity.

[0103] Subsequently, trigger the instrument and airbag self-check program to confirm that the system enters a normal ready state and record the specific results. The role of this is to extend the device level consistency verification to the whole vehicle function verification, confirm that the instrument lamp state has been cleared, the ready flag in the ECU message is normal, and read a number of key sensors or self-check items. If necessary, do a short circuit or impedance check to confirm the electrical integrity of the interface.

[0104] Cloud and local operation and maintenance module, synchronize local data to cloud backup, and choose whether to intervene manually.

[0105] The cloud and local operation and maintenance module generates a compliance diagnosis report containing IMG_old hash, IMG_new hash, DIFF_map, segment-level check record and final check result, and safely uploads it to the cloud backup through the remote synchronization module. The cloud server provides an authorization module for issuing write authorization and prohibiting local submission actions when there is no valid authorization. Optionally, when a large amount of computation is involved, deploy a one-segment judgment locally and a two-segment judgment on the cloud. Complex computing tasks can be calculated on the cloud through data upload and the results can be returned, which can realize the low-cost application of the same function of edge computing.

[0106] In summary, the present scheme introduces byte-level differential management, three-model parallel simulation verification and two-stage decision strategy in the automobile airbag computer diagnostic system, realizes the fine control of the whole process of ECU image writing, and has obvious progress effect. First, the byte-level differential technology compares the original image and the target image byte by byte, and generates the minimum write unit DIFF_map by page aggregation, so that the write operation is accurate to the minimum granularity, significantly reduces the risk of the write process, improves the data transmission and storage efficiency, and guarantees the safety of ECU original data and system stability. Secondly, the simulation verification unit uses rule machine, deep logic simulator and abnormal disturbance model to run in parallel, realizes the dynamic identification and intelligent blocking of potential risks through weighted conjunction and multi-stage decision strategy, so that high-risk images are effectively filtered before writing, ensuring that the writing decision is efficient and safe. Thirdly, the two-stage decision mechanism combines the historical model reliability and the key priority rules, not only optimizes the accuracy of the decision, but also provides traceable decision evidence, so that the system can continuously adapt to improve the decision quality, thereby reducing the probability of misjudgment and omission. In summary, the present scheme realizes high reliability, high safety and high traceability of the automobile airbag ECU update operation through the combination of differential control, simulation verification and intelligent judgment, which is a comprehensive technical progress that does not exist in the prior art.

[0107] The above is only the preferred embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can make equivalent replacement or change according to the technical scheme and the inventive concept of the present application within the technical range disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1. An automotive airbag computer diagnostic system, characterized by, Comprise: A power supply unit with multi-protocol automatic identification and data error correction, and outputs reliable communication data stream; A data processing unit, which pre-processes ECU original data, extracts difference data between original data and pre-repair data, and aggregates the difference data into a minimum write unit set according to storage pages; An analog verification unit, which imports pre-repair data for virtual verification and filters risk images; A write verification unit, which segments the difference data to be written after verification, checks the consistency of the segments and the whole through CRC32 and SHA256, and performs rollback recovery when it fails, and then writes into ECU by authorization of the security assurance module; A cloud and local operation and maintenance module, which synchronizes local data to cloud backup and selects whether to intervene manually.

2. The automotive airbag computer diagnostic system of claim 1, wherein, The power supply unit comprises: A power management module that monitors the power supply voltage in real time and uses capacitor to cache energy when the voltage fluctuates, avoiding write interruption; A communication interface module that uses adaptive baud rate matching and error detection method to realize automatic identification and data error correction under CAN / LIN / CAN-FD protocol, and maintains communication data stream; An electrical protection module that realizes isolation protection of abnormal power supply state based on overvoltage / overcurrent detection algorithm and reverse connection protection circuit, and generates a safe physical channel.

3. The automotive airbag computer diagnostic system of claim 1, wherein, The data processing unit comprises: An image backup module that exports ECU original image IMG_old, calculates and saves SHA256 generated original image snapshot based on IMG_old; A difference management module that generates byte-level bit vector by byte-by-byte comparison between original image IMG_old and target image IMG_new, and aggregates the page-level markers PM_j according to the configurable page size P to output DIFF_map and difference data set; A temporary write area module that provides a buffer and isolation space before the final data is written into ECU, for storing data to be verified, to ensure that the data is safely written into the official storage area after verification and confirmation.

4. The automotive airbag computer diagnostic system of claim 1, wherein, The analog verification unit contains three models: lightweight rule machine rule, deep logic simulator deep, and abnormal disturbance model fault in parallel, and the conjunction result of the three models forms a simulator decision through majority decision rule. If any model is determined to be not passed, the simulator decision is not passed and the write verification unit is prevented from entering.

5. The automotive airbag computer diagnostic system of claim 4, wherein, The conjunction result one-stage decision comprises the following steps: S1, receive three model output scores convert each score to a binary decision , a binary pass flag, and a binary threshold is configurable for continuous scores, unify outputs from different sources to the same scale; S2, set the rejection layer, through the preset rejection threshold , if there is any then immediately output , and record , its expression is: If then output ; Establish a safety bottom line, and directly block the entry into the write stage if any key dimension is too low to reduce the risk of passing. S3. Assigning reliability to history for each model with normalized weights: ；= In the formula: denotes the accuracy of the model i in the recent window, is the conjunctive weight, satisfying the sum of weights being 1; It allocates more weight to the more reliable historical model to achieve dynamic trust allocation. Calculate the weighted sum score: ； In the formula: The total confidence of the three models is positively correlated with the reliability. The three model evidences are fused into a total confidence, which is used for the first stage decision. S4, set the threshold value , if then preliminarily determine PASS, otherwise determine FALL; Form an efficient one-time decision to quickly release high-confidence samples, where T is the conjunction pass threshold configured according to the safety level.

6. The automotive airbag computer diagnostic system of claim 5, wherein, The conjunction result two-stage decision comprises the following steps: S5, if S is in the conservative interval, i.e. then a second decision is made: ; If then PASS, which is the sum of three model binary decisions, is used for majority voting, otherwise FALL, if but then the key precedence rule (if deep reliability exceeds the threshold then the decision is taken, otherwise the majority voting result is taken) is applied. S6, calculate the final confidence: ； Where C ∈ [0, 1] and output the complete decision package for write audit, providing fine-grained risk scale for downstream write strategy, and forming a traceable evidence set. S7. Update after each write audit To reflect true performance, and exponentially moving average: ； wherein, is the actual accuracy of the t-th window model i, and a e (0, 1) is the learning rate of weight update, allowing the system to converge to a better weight distribution over time and continuously improve the overall judgment quality.

7. The automotive airbag computer diagnostic system of claim 1, wherein, The cloud and local operation modules generate a compliance diagnosis report containing IMG_old hash, IMG_new hash, DIFF_map, segment-level check record and final check result, and upload it to the cloud backup through the remote synchronization module. The cloud server provides an authorization module for issuing write authorization and prohibiting local submission actions when there is no valid authorization.

8. The automotive airbag computer diagnostic system of claim 1, wherein, The write check unit includes a transaction control module, a multiple check module and a retry and rollback module. The transaction control module implements segmented writing and two-phase commit. In the preparation phase, the differential writing is temporarily written to the writing area, and the segment-level check record is generated. In the submission phase, the active image flag is updated by single-byte or single-unit atomic writing, thereby activating the new image and outputting the transactional write image metadata packet.

9. The automotive airbag computer diagnostic system of claim 8, wherein, The multiple check module uses CRC32 for fast check at the segment level and SHA256 for integrity check at the global level. At the same time, the ECU service self-check interface is triggered to read DTC and readiness flag after writing to generate the final check result. Only when the segment-level check, global check and service self-check are all passed, the writing is considered successful.

10. The automotive airbag computer diagnostic system of claim 9, wherein, The retry and rollback module uses an exponential backoff retry strategy and sets a maximum number of retries N. If the maximum number of retries is exceeded, the rollback process is triggered to restore IMG_old and generate a safe rollback status record.

Images