Program and boot layer self-updating method and system

Abstract

The application provides a program and a boot layer self-updating method and system, comprising three layers of software, a first boot program, a second boot program and a function program. The three layers are independent of each other and do not overlap in storage addresses. The first boot program comprises a main area and a slave area, both of which have the same boot function and do not overlap in storage areas. A burner writes the first layer boot program, and after power-on, the first boot main area is run, and if normal, the slave area is ignored, and if the main area program fails, the slave area is jumped to. A can box writes the second layer boot program through the first boot program; the can box writes the function program through the second boot program; during offline testing, the can is not written with the upper computer software through the second boot program, the first boot and the upper computer software are used to write the offline test and customer boot combined program; the customer provides the second boot to write the upper computer software, and the second boot is used to write the offline test program and the app combined program. If the offline test program is executed and qualified, the boot program is self-deleted from the offline test program.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automotive electronic controllers, in particular, to a program and boot layer self-updating method and system. BACKGROUND

[0002] Currently, single-layer boot layers are still used in the market of automotive electronic controller products.

[0003] In a cooperation mode in which a supplier provides an electronic control unit hardware and an automobile manufacturer (i.e., a customer) only provides a binary executable file of a boot layer as a default write program of a master chip when the electronic control unit is shipped, the supplier needs to test offline before the electronic control unit is shipped. The supplier can only use a chip company-provided burning program to control a burner (which needs to open a shell or additionally connect a debugging port wire harness) to burn and write the offline test program. After confirming that the hardware is not problematic by testing, the customer is given the electronic control unit by burning and writing the customer's boot binary file through the burner for the second time. The process is complicated and time-consuming.

[0004] Even if the electronic control unit supplier has the customer's single-layer boot program upper computer burning software, the current common process is as follows: 1. Use the chip company-provided burning program to control the burner (which needs to open the shell or additionally connect the debugging port wire harness) to burn and write the customer's single-layer boot program, 2. Burn and write the offline test program and perform hardware testing through the single-layer boot program upper computer can box, and 3. After the hardware testing is passed, the customer's single-layer boot program upper computer can box is used to erase the offline test program and then burn and write the customer's function layer software.

[0005] Secondly, when the automobile manufacturer receives the electronic control unit hardware burned with the single-layer boot, the automobile manufacturer wants to upgrade the single-layer boot program or use the electronic control unit in the process. Once the single-layer boot layer is damaged, the automobile manufacturer can only use the burner to open the shell to update the program, which is very troublesome. The shell opening operation is troublesome and destroys the air tightness and waterproofness. The shell can also be opened to use the external debugging port to the output wire harness, but this will increase the risk of program being mistakenly modified or disturbed.

[0006] In the patent document with the publication number CN111475179A, a software online burning method, device, electronic control unit, and upper computer are disclosed, which relate to the automobile technical field. The method includes: when the currently running program is a first boot loader, if a second boot loader sent by the upper computer is received, the second boot loader is burned to a non-refreshable area; the second boot loader is run, and an instruction representing the completion of the second boot loader burning is sent to the upper computer. Although this patent uses a two-layer boot program method, when the first layer boot program has no redundant backup, it must be burned and written after being damaged. The first layer boot program is the foundation of the three-layer program structure, and the function of the electronic control unit cannot be normally run after being damaged.

[0007] Therefore, a new technical solution needs to be proposed. SUMMARY

[0008] In view of the defects in the prior art, the purpose of the present application is to provide a program and a boot layer self-updating method and system.

[0009] According to the program and the boot layer self-updating method provided by the present application, the method comprises the following steps:

[0010] Step S1: The master control unit places three layers of software in three mutually independent non-overlapping areas;

[0011] Step S2: The first layer boot program is written by a burner, the first layer boot program comprises a first layer boot program one and a first layer boot program two with the same boot function, and the first layer boot program one and the first layer boot program two are stored in two non-overlapping addresses; the same boot function means that the steps of writing the upper layer program are completely the same, and the running state is also completely the same, except that the jump address and the checksum are different;

[0012] Step S3: If the first layer boot function is normal, the second layer boot program or the synthetic program of the second layer boot program and the offline test program is written by the can box through the first layer boot program;

[0013] Step S4: If the second layer boot function is normal, the function program or the synthetic program of the function program and the offline test program is written by the can box through the second layer boot program;

[0014] Step S5: After the electronic control unit is powered on, the first layer boot program is run first, the checksum of the first layer boot program one is detected, after normal, the first layer boot program two is ignored, otherwise, the first layer boot program two is jumped to; if the first layer boot program has a writing or updating program request, the first layer boot program is stopped, the second layer boot program and the function program are erased, after the erasing, the second layer boot program is updated; the first layer boot program two checks whether the checksum is normal, if not, the software is forced to reset;

[0015] Step S6: When the master control unit is tested, the app written by the boot program comprises two parts of the offline test program and the app program; after the offline test program is executed for a fixed number of times, the boot program automatically deletes the offline test program, and then the app written by the boot program only comprises the app program;

[0016] Step S7: In the process of running the normal function program, if an updating program request of the upper computer is received in the working condition allowing the updating program, a writing request mark is recorded in the non-volatile memory, and then the program requested to be updated is directly jumped to the first layer boot program or the second layer boot program for updating.

[0017] Preferably, the three-layer software in the step S1 is three independent functions, the boot program receives an effective flash request when the electronic control unit is powered on and when the function program is running, jumps to the boot program update program, and executes after confirming that the function program is normal when the flash or update is completed or there is no update requirement.

[0018] Preferably, the step S3 updates the second layer boot program after detecting an effective flash request of the first layer boot program, otherwise, jumps to the second layer boot program after confirming that the second layer boot program is normal, and remains in the first layer boot program until power off if it is not normal.

[0019] Preferably, the second layer boot program detects an effective flash function program requirement, updates the function program if there is one, otherwise, jumps to the function program after checking that the function program is normal, and remains in the second layer boot program until power off if it is not normal.

[0020] The application also provides a program and a boot layer self-updating system, the system comprising the following modules:

[0021] Module M1: the master control unit places the three-layer software in three independent and non-overlapping areas;

[0022] Module M2: the first layer boot program is flashed by a burner, the first layer boot program comprises a first layer boot program 1 and a first layer boot program 2 with the same boot function, the first layer boot program 1 and the first layer boot program 2 are stored in two non-overlapping addresses; the same boot function means that the modules for flashing the upper layer program are completely the same, and the running state accumulations are also completely the same, only the jump addresses and the checksums are different;

[0023] Module M3: if the first layer boot function is normal, the second layer boot program or the synthetic program of the second layer boot program and the offline test program is flashed by the first layer boot program through a can box;

[0024] Module M4: if the second layer boot function is normal, the function program or the synthetic program of the function program and the offline test program is flashed by the second layer boot program through a can box;

[0025] Module M5: the first layer boot program is run first after the electronic control unit is powered on, the checksum of the first layer boot program 1 is detected, the first layer boot program 2 is ignored if it is normal, otherwise, jumps to the first layer boot program 2; if the first layer boot program has a flash or update program request, it is stopped at the first layer boot program, the second layer boot program and the function program are erased, the second layer boot program is updated after the erasing is completed; the first layer boot program 2 checks whether the checksum is normal, and the software is forced to reset if it is not normal;

[0026] Module M6: when the master unit factory test, the boot program app contains two parts of the offline test program and app program; when the offline test program executes a fixed number of times, the boot program automatically deletes the offline test program, and then the boot program app only contains the app program;

[0027] Module M7: in the process of normal function program running, such as in the working condition of allowing the update program, the update program request of the upper computer is received, the non-volatile memory records the brush request mark, and then directly jumps to the first layer boot program or the second layer boot program to update the program.

[0028] Preferably, the three layers of software in the module M1 are three independent functions, the boot program is powered on in the electronic control unit and receives an effective brush request during the function program running, jumps to the boot program to update the program, and executes after confirming that the function program state is normal after the brush or update is completed or there is no update requirement.

[0029] Preferably, the module M3 updates the second layer boot program after detecting the first layer boot program effective brush request, otherwise, the second layer boot program is confirmed to be normal, jumps to the second layer boot program, and is left in the first layer boot program until power off.

[0030] Preferably, the second layer boot program detects the effective refresh function program requirement, updates the function program if there is, otherwise, checks the function program to be normal, jumps to the function program, and is left in the second layer boot program until power off.

[0031] Compared with the prior art, the present application has the following beneficial effects:

[0032] 1、The present application does not need a burner to brush the offline test program at the factory, and after completion (two times in total), the test program is erased by the burner (must be opened or another debugging port wire harness is connected) and the single layer (second layer) boot program given by the customer is burned back; using the multi-layer boot program, when the hardware quality of the electronic control unit is qualified at the factory, the first layer boot program is first brushed by the burner, and then the can box is used to brush the offline test program and the customer boot program synthesis software through the first layer boot program; after the hardware detection is qualified after the offline test program executes a fixed number of times, the boot layer self-erases the test program, which simplifies the operation steps and is not easy to make mistakes;

[0033] 2、In the actual use process of the present application, when the second layer boot is damaged (for example, the second boot layer and the function program are adjacent, and the function program is overflowed and mistakenly modified the second layer boot), the first layer boot can be used to rebrush the second layer boot through the canH canL two communication wire harnesses connected outside the electronic control unit, which is more safe and reliable;

[0034] 3、The first layer booting main area is damaged in the actual use process of the application, another backup can be switched to, which reduces the risk that the first layer booting program cannot be used and needs to be opened and burned by a burner once it is damaged;

[0035] 4、The function program of the booting program flashing contains two parts, an offline test program and a function program, after the offline test program is executed for a fixed number of times and the hardware detection is qualified, the booting program will automatically delete the offline test program; only APP is left, which simplifies the offline test process. BRIEF DESCRIPTION OF DRAWINGS

[0036] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments thereof, read in conjunction with the accompanying drawings:

[0037] Figure 1 For all electronic devices using master control chips, the communication interface schematic diagram of the master control chip self-contained booting program flashing program is shown in the figure;

[0038] Figure 2 For the automobile electronic control unit, the communication interface schematic diagram of the user-written booting program flashing program is shown in the figure;

[0039] Figure 3 For the battery management system electronic control unit, the three-layer program storage address relationship example diagram is shown in the figure;

[0040] Figure 4 For the electronic control unit containing two layers of booting programs of the application, the power-on to power-off program running flowchart is shown in the figure. DETAILED DESCRIPTION

[0041] The application will be described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the application, but do not limit the application in any form. It should be pointed out that, for those skilled in the art, without departing from the concept of the application, a number of changes and improvements can be made. These all belong to the protection scope of the application.

[0042] Example 1

[0043] The application provides a program and a booting layer self-updating method, the self-updating program contains two parts, and the updating method is performed according to the following steps:

[0044] Step S1: the master unit places three layers of software in three independent non-overlapping areas; the three layers of software are three independent functions, the boot program receives an effective flashing request when the electronic control unit is powered on and when the function program is running, jumps to the boot program update program, and executes after confirming that the function program is normal when the flashing or updating is completed or there is no updating requirement. The entire program storage space of the electronic control unit is divided into three blocks, which are independent and non-overlapping, the first layer boot program, the second layer boot program and the product function program are respectively stored in three different addresses. Complete the upper computer software, cooperate with the boot layer program of the electronic control unit to control the updating of the electronic control unit program. The program is placed in the non-volatile program memory flash. This memory will not lose the stored content after power failure. The three layers of software are stored in the specified program storage address, the file used to allocate the executable file storage address of the three layers of software is modified, and the three layers of software are respectively placed in three different areas, for example, the flash size is 1000 bytes, the three layers of software size are 300 bytes, 200 bytes and 400 bytes respectively, the first layer boot can be placed in 1-300 bytes, the second layer boot can be placed in 800-1000 bytes, and the function program can be placed in 360-760 bytes. Three independent non-overlapping areas ensure that the three layers of software can be independently run and do not affect each other, and if they overlap, the program content written first in the program memory will be covered by the program content written later.

[0045] Step S2: Use a programmer to flash the first-level boot program. The first-level boot program includes two boot programs with the same boot function: First-Level Boot Program 1 and First-Level Boot Program 2. Store First-Level Boot Program 1 and First-Level Boot Program 2 in two non-overlapping addresses. "Same boot function" means that the steps for flashing the upper-level program are exactly the same, and the running state product is also exactly the same; only the jump addresses and checksums are different. A program update boot program that supports CAN communication needs to be flashed into an empty ECU. "Supports CAN communication" means that it can interact with the host computer that provides the boot program via CAN communication. The readable program write memory of the ECU microcontroller main control chip is empty when purchased; it only supports flashing the program using asynchronous serial communication (UART) and the host computer flashing software provided by the microcontroller supplier through the internally built-in read-only boot program. The USB communication connection between the programmer and a PC (personal computer) is as follows: one end connects to the programmer via USB, and the other end connects to the debug port on the electronic control unit (ECU) hardware circuit board using DuPont wires. The DuPont wires communicate via methods such as asynchronous serial port or JTAG port. The programming software on the PC is used to flash the boot layer 1 program to the ECU. The MCU (Microcontroller Unit) in the programming software is provided by the chip company and is used for updating, erasing, and debugging the MCU program. The ECU supplier is the manufacturer that designs, manufactures, and mounts the ECU hardware circuit board, while the chip company provides the MCU chip, which functions as the brain of the ECU circuit board. The chip's built-in read-only bootloader is used to flash a bootloader that supports CAN communication. The first-layer bootloader is a universal and standardized bootloader used by all ECUs within the company. Regardless of the customer or whether their bootloader requirements are consistent (e.g., flashing CAN ID, flashing protocol, and specific steps), the first-layer bootloader (a standardized ECU supplier's own) can be pre-flashed. The second-layer bootloader is generally the customer's bootloader. Even without a customer, a bootloader similar to the first-level bootloader can be used, except that the location of the generated executable file and the jump address are different from the first-level bootloader. This allows for a unified flashing of the first-level bootloader when the electronic control unit is off the production line, without needing to distinguish between different bootloaders for different customers, making it simple, reliable, and less prone to errors. When the second-level bootloader is damaged, without the first-level bootloader, it is necessary to disassemble the casing and re-flash it via serial URAT or parallel port, which is cumbersome and compromises airtightness. With the first-level bootloader, the second-level bootloader can be directly re-flashed via CAN communication. The first-level bootloader backup is crucial because in a three-layer software system, the first-level bootloader is fundamental. If the first-level bootloader is damaged, flashing it requires disassembling the casing. This backup improves the reliability of the first-level bootloader, thus improving the reliability of the entire software system. The programming software is provided by the chip company and includes two types: one is specifically for programming, and the other can be used for both programming and debugging.

[0046] Step S3: If the first layer boot function is normal, use the can box to write the second layer boot program or the synthesis program of the second layer boot program and the offline test program through the first layer boot program. Update the second layer boot program after detecting the valid write request of the first layer boot program, or jump to the second layer boot program after confirming the normality of the second layer boot program, and stay in the first layer boot program until power off if it is not normal. The second layer boot program detects the valid refresh function program requirement, updates the function program if there is one, or jumps to the function program after checking the normality of the function program, and stays in the second layer boot program until power off if it is not normal. The USB communication connects one end of the CAN box to the PC, and the other end of the CAN box uses the CANH\CANL communication line to connect the electronic control unit. The CANH\CANL communicates through the CAN, and the burning software (not provided by the MCU supplier) on the PC made by the user's self-researched MCU is used to write the boot layer 2 program or product function program to the electronic control unit provided by the supplier. The host computer can choose to write or update the second layer boot program according to the user's purpose. The write selection means that the hardware is just produced without the second layer boot program, the update means that the second layer boot program has been written and used for a period of time and found to have bugs. The boot layer 2 program and the product function program can be written at the same time, which is more efficient and saves operation steps. The can box is a communication adapter box with one end of the USB interface connected to the computer and the other end of the CANH\CANL connected to the communication interface of the automobile electronic local area network.

[0047] Step S4: If the second layer boot function is normal, use the can box to write the function program or the synthesis program of the function program and the offline test program through the second layer boot program. The electronic control unit is powered on and jumps to the starting address of the first layer boot program through the interrupt vector table and executes. After detecting the normality of the first layer boot program, ignore the boot program in the first layer boot program backup area. The detection method is various, such as reading the content of the flash to calculate the crc and whether it is consistent with the flash, otherwise jump to the first layer backup boot program. The two copies of the first layer boot program can effectively prevent the problem of needing to disassemble and write with a burner if only one copy is damaged, reducing the risk. The host computer sends a write request to the battery management master control unit through the can box, and the master control unit boot program replies whether it is allowed. The host computer sends the product function to be written to the battery management master control unit through the can box, and the master control unit receives and checks it correctly and then puts it into the corresponding program storage area.

[0048] Step S5: the first layer boot program is run after the power on of the electric control unit, the first layer boot program is checked, the second layer boot program is ignored if the first layer boot program is normal, otherwise it is jumped to the second layer boot program; if the first layer boot program has a request for updating or writing, it is stopped at the first layer boot program, the second layer boot program and the function program are erased, the second layer boot program is updated after the erasing; the second layer boot program is checked if the checksum is normal, the software is forced to reset if it is not normal; the second layer boot program is updated if a valid request for writing is detected, otherwise it is jumped to the function program if the second layer boot program is normal, the software is triggered to reset if the first layer backup area and the main area program are not normal, the first layer boot program is executed to judge the validity if it is not normal, and it is reset repeatedly until power off. The function program is updated if a valid request for updating the function program is detected, otherwise it is jumped to the function program if the function program is normal, and it is left at the second layer boot program if the function program is abnormal until power off. The main body of the normal state is the normal function of the product. The function program of the battery management electric control unit is executed to perform the normal function of the product. However, the following two layer refresh boot programs must be executed every time the power is turned on. The first layer boot judges if the second layer boot needs to be updated, and the condition for updating the second layer boot is confirmed if it is needed. The PC is notified to send a new second layer boot through can communication, and the electric control unit receives and judges the received new second layer boot program to be accurate and correct, and then writes it into the program storage unit. The accurate and correct means that the checksum calculated by the downloaded data is consistent with the checksum segment data. The second layer boot program is read after the storage is successful, and it is jumped to the second layer boot program if the checksum is correct. Then the function program is updated in the same way as the first layer boot program. If the first layer boot or the second layer boot judges that there is no request for writing, the second layer boot or the function program is updated or written for the first time if it is needed, and the above is the same. The second layer boot or the function program data is normal, and it is directly jumped to the second layer boot or the function program. There is a mark bit in the non-volatile memory. When the PC wants to write the second layer boot or the function program of the electric control unit, the second layer boot or the function program of the electric control unit points to the mark bit, and sends a can message to the electric control unit. The electric control unit receives and confirms it to be legal, changes the value of the writing mark bit from invalid to valid, and stores it in the non-volatile memory whose variable value will not disappear after power off, so as to prevent the electric control unit from suddenly power off during the refreshing process. Then it is jumped to the first layer boot program to start execution, and the valid mark bit is changed to invalid after the writing is successful. The first layer boot program checks itself, for example, there is a checksum of the first layer program in the EEPROM as a reference. If the checksum calculated this time is the same as the one stored in the EEPROM, it is normal, otherwise it is judged to be abnormal.

[0049] Step S6: When the master unit is factory tested, the app programmed by the boot program contains two parts of offline test program and app program, when the offline test program is executed for a fixed number of times, the fixed number of times is N times which can be calibrated, the boot program will automatically delete the offline test program, and then the app programmed by the boot program only contains the app program.

[0050] Step S7: In the process of running the normal function program, if the update program request of the upper computer is received in the working condition allowing the update program, the non-volatile memory records the programming request mark, and then directly jumps to the first layer boot program or the second layer boot program to update the requested program.

[0051] The application simplifies the previous steps by programming the offline test and the function layer software of the synthetic software of the single layer boot program of the upper computer can box, and the can box is programmed only once; and the offline test program is automatically erased by the boot program after the factory detection is completed by executing (the fixed) a number of times of the offline test program written in advance. Thus, the operation steps are simplified and errors are less likely to occur.

[0052] Embodiment 2

[0053] The difference between the embodiment and the embodiment 1 is that the two layers and more boot programs of the embodiment are applicable, and at least two layers of boot programs. The can communication can be replaced by other communication modes such as SPI, UART, local area network and internet, etc. The addresses of the three layer software are independent of each other without overlapping, and the order is not distinguished. After the power supply of the electronic control unit, the first layer boot program starting address is jumped to through the interrupt vector table, and the implementation can also be realized through other chip given configuration method.

[0054] The application also provides a program and boot layer self-updating system, the system comprises the following modules:

[0055] Module M1: the master unit places the three layer software in three independent and non-overlapping areas; the three layer software is three independent functions, the boot program receives the effective programming request when the electronic control unit is powered on and when the function program is running, jumps to the boot program to update the program, and executes after confirming that the function program state is normal after the programming or updating is completed or there is no updating demand.

[0056] Module M2: the first layer boot program is programmed by the programmer, the first layer boot program includes the first layer boot program one and the first layer boot program two with the same boot function, the first layer boot program one and the first layer boot program two are stored in two non-overlapping addresses; the same boot function means that the modules programmed in the upper layer are completely the same, and the running state is also completely the same, only the jump address and the check sum are different.

[0057] Module M3: If the first layer boot function is normal, use the can box to write the second layer boot program or the combination of the second layer boot program and the offline test program through the first layer boot program; update the second layer boot program after detecting the valid write request of the first layer boot program, otherwise, jump to the second layer boot program after confirming the normality of the second layer boot program, and stay in the first layer boot program until power off if it is not normal. The second layer boot program detects the valid refresh function program requirement, and updates the function program if there is, otherwise, jump to the function program after checking the normality of the function program, and stay in the second layer boot program until power off if it is not normal.

[0058] Module M4: If the second layer boot function is normal, use the can box to write the function program or the combination of the function program and the offline test program through the second layer boot program.

[0059] Module M5: The first layer boot program is run first after the power-on of the electronic control unit, the first layer boot program one is checked, and the first layer boot program two is ignored after the normality, otherwise, jump to the first layer boot program two; if the first layer boot program has a write or update program request, stop at the first layer boot program, erase the second layer boot program and the function program, and update the second layer boot program after erasing.

[0060] Module M6: When the master control unit is tested, the app written by the boot program contains two parts of the offline test program and the app program; when the offline test program is executed for a fixed number of times, the boot program automatically deletes the offline test program, and the app written by the boot program only contains the app program thereafter.

[0061] Module M7: In the process of normal function program running, if the update program request of the upper computer is received in the working condition allowing the update program, the non-volatile memory records the write request mark, and then directly jump to the first layer boot program or the second layer boot program to update the requested program.

[0062] The main area and the slave area of the first layer boot can also be backed up to each other, and when one of them occurs an error, the error area is erased by the normal partition, the normal program is written again, and the error area is recovered, which improves the reliability without disassembling the shell when a single first layer boot scheme occurs an error.

[0063] The application does not need to open the shell and twice operating the burner PC to write software, respectively, write into the offline test and customer guide program, only write once the two software combined binary file (put two binary files in the flash two non-overlapping independent continuous area and combine into a binary file), after the offline test program execution (fixed) several times to complete the factory detection, the guide program automatically erases the offline test program. This simplifies the operation steps, and is not easy to make mistakes.

[0064] Those skilled in the art know that, in addition to implementing the system provided by the present application and each device, module, unit thereof in the form of pure computer readable program code, the system provided by the present application and each device, module, unit thereof can also be implemented in the form of logic gate, switch, application specific integrated circuit, programmable logic controller and embedded microcontroller, etc. by logically programming the method steps to achieve the same function. Therefore, the system provided by the present application and each device, module, unit thereof can be considered as a hardware component, and the devices, modules, units included therein for achieving various functions can also be considered as structures within the hardware component; the devices, modules, units for achieving various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0065] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be arbitrarily combined with each other without conflict.

Claims

1. A program and boot layer self-updating method, characterized by, The method comprises the following steps: Step S1: the main control unit places three layers of software in three independent non-overlapping areas; Step S2: the first layer of boot program is written by a burner, the first layer of boot program comprises a first layer of boot program one and a first layer of boot program two, and the first layer of boot program one and the first layer of boot program two are stored in two non-overlapping addresses; the same boot function means that the steps of writing the upper layer program are completely the same, and the running state is also completely the same, only the jump address and the checksum are different; Step S3: if the first layer boot function is normal, the second layer boot program or the synthetic program of the second layer boot program and the offline test program is written by the can box through the first layer boot program; Step S4: if the second layer boot function is normal, the function program or the synthetic program of the function program and the offline test program is written by the can box through the second layer boot program; Step S5: the first layer boot program is run first after the electric control unit is powered on, the checksum of the first layer boot program one is detected, the first layer boot program two is ignored after the first layer boot program one is normal, otherwise the first layer boot program two is jumped to; if the first layer boot program has a writing or updating program request, the first layer boot program is stopped, the second layer boot program and the function program are erased, and the second layer boot program is updated after the erasing is completed; the second layer boot program two checks whether the checksum is normal, and the software is forced to reset if the checksum is not normal; Step S6: when the main control unit is tested, the app written by the boot program comprises the offline test program and the app program; after the offline test program is executed for a fixed number of times, the boot program automatically deletes the offline test program, and then the app written by the boot program only comprises the app program; Step S7: during the normal function program running process, if an updating program request of the upper computer is received in the working condition allowing the updating program, a writing request mark is recorded in the non-volatile memory, and then the program is directly jumped to the first layer boot program or the second layer boot program to update the requested program.

2. The program and boot layer self-update method according to claim 1, wherein, The three layers of software in the step S1 are three independent functions, the boot program is run when the boot program receives a valid writing request after the electric control unit is powered on and during the function program running, the function program state is normal after the writing or updating is completed or there is no updating demand, and then the function program is executed.

3. The program and boot layer self-update method according to claim 1, wherein, The second layer boot program is updated after the step S3 detects a valid writing request of the first layer boot program, otherwise the second layer boot program is jumped to after the second layer boot program is normal, and the first layer boot program is remained until power off if the second layer boot program is not normal.

4. The program and boot layer self-update method according to claim 3, wherein, The function program is updated after the second layer boot program detects a valid updating function program demand, otherwise the function program is jumped to after the function program is normal, and the second layer boot program is remained until power off if the function program is not normal.

5. A program and boot layer self-updating system, characterized by, The system comprises the following modules: Module M1: the main control unit places three layers of software in three independent non-overlapping areas; Module M2: the first layer boot program is written by the burner, the first layer boot program includes the first layer boot program one and the first layer boot program two, the first layer boot program one and the first layer boot program two are stored in two non-overlapping addresses; the boot function is the same, the module written in the upper layer program is completely the same, the running state is also completely the same, only the jump address is different, and the check sum is different; Module M3: if the first layer boot function is normal, the second layer boot program or the synthetic program of the second layer boot program and the offline test program is written by the can box through the first layer boot program; Module M4: if the second layer boot function is normal, the function program or the synthetic program of the function program and the offline test program is written by the can box through the second layer boot program; Module M5: the first layer boot program is run first after the power-on of the electronic control unit, the check sum of the first layer boot program one is detected, the first layer boot program two is ignored after being normal, otherwise, the first layer boot program two is jumped to; if the first layer boot program has a writing or updating program request, the first layer boot program is stopped, the second layer boot program and the function program are erased, the second layer boot program is updated after being erased; the check sum is checked by the first layer boot program two, and the software is forced to reset if the check sum is not normal; Module M6: when the main control unit is tested, the app written by the boot program includes the offline test program and the app program; after the offline test program is executed for a fixed number of times, the boot program automatically deletes the offline test program, and then the app written by the boot program only includes the app program; Module M7: during the normal function program running process, if the updating program request of the upper computer is received in the working condition allowing the updating program, the non-volatile memory records the writing request mark, and then directly jumps to the first layer boot program or the second layer boot program to update the requested program.

6. The program and boot layer self-updating system according to claim 5, wherein, The three layers of software in the module M1 are three independent functions, the boot program is run when the power-on of the electronic control unit and the function program running process receive an effective writing request, the program is updated when the jump to the boot program, and the function program state is normal after the writing or updating is completed or there is no updating demand.

7. The program and boot layer self-updating system according to claim 5, wherein, The module M3 detects the effective writing request of the first layer boot program, updates the second layer boot program, otherwise, the second layer boot program is jumped to after being confirmed to be normal, and is left in the first layer boot program until power-off if it is not normal.

8. The program and boot layer self-refresh system of claim 7, wherein, The second layer boot program detects the effective refreshing function program demand, updates the function program if there is, otherwise, the function program is jumped to after being confirmed to be normal, and is left in the second layer boot program until power-off if it is not normal.

Images