Control method, device and domain controller of electronic control unit

Abstract

The application discloses a control method and device of an electronic control unit and a control method of a domain controller. The control method of the electronic control unit comprises the following steps: after a first boot loader is successfully initialized, the first boot loader identifies whether a reprogramming flag bit of a second boot loader is valid; if not, the first boot loader initializes the second boot loader; after the second boot loader is successfully initialized, the second boot loader identifies whether there is a refreshing instruction of an APP application program and whether a reprogramming flag bit of the APP application program is valid; if not, the second boot loader initializes the APP application program; and if the APP application program is successfully initialized, the APP application program is started. The application can meet the requirements of different ECUs on the basis of ensuring the basic boot loading function of the ECU, and solves the problems of single function and poor expansibility.

Description

Technical Field

[0001] This invention relates to the field of vehicle control technology, and in particular to a control method, device, and domain controller for an electronic control unit. Background Technology

[0002] As automotive architectures upgrade, MCUs are integrating more and more logic functions and peripherals, and their memory is becoming larger, making multi-core ECUs a growing trend. Domain controllers have become a top priority in automotive development, and the functions integrated into automotive electronic ECUs are becoming increasingly complex. To meet the needs of remote (online) software upgrades and bug fixes, the demand for bootloaders is also increasing.

[0003] Automotive components contain an Electronic Control Unit (ECU) that contains both an application program (APP) and a bootloader. The APP works with the corresponding hardware to implement the component's functions. The bootloader, acting as the ECU's bootloader, has the functions of guiding the application to run and self-updating the program. After the ECU is powered on or restarted, it determines whether to run the bootloader or the APP by combining the reprogramming flag and the application validity flag. When the ECU is running the bootloader, it communicates with the host computer via the vehicle communication bus to obtain update instructions and data packets, thereby upgrading the APP.

[0004] However, traditional bootloader software programs are burned onto the ECU chip before leaving the factory. They have limited functionality and poor expandability, and cannot meet the diverse needs of ECUs with different functions. Summary of the Invention

[0005] In view of the above, the present invention aims to provide a control method, device and domain controller for an electronic control unit. It adds a customizable second bootloader to the general first bootloader, which can meet the needs of different ECUs while ensuring the basic bootloader function of the ECU, and solves the problems of single function and poor scalability.

[0006] The technical solution adopted in this invention is as follows:

[0007] In a first aspect, the present invention provides a control method for an electronic control unit, comprising:

[0008] After the electronic control unit is powered on, it checks whether the reprogramming flag of the first bootloader is valid;

[0009] If not, initialize the first bootloader;

[0010] After the first bootloader is successfully initialized, it checks whether the reprogramming flag of the second bootloader is valid.

[0011] If not, the first bootloader initializes the second bootloader;

[0012] After the second bootloader is successfully initialized, it identifies whether there is a refresh command for the APP application and whether the reprogramming flag of the APP application is valid.

[0013] If none of the above applies, the second bootloader initializes the APP application. If the APP application is successfully initialized, it is then launched.

[0014] The first bootloader is a general program, while the second bootloader is a customized program corresponding to the electronic control unit.

[0015] In one possible implementation, the control method of the electronic control unit further includes:

[0016] The second bootloader diagnoses the APP application and writes the diagnostic results to non-volatile memory.

[0017] In one possible implementation, if the reprogramming flag of the first bootloader is valid, the first bootloader is updated.

[0018] If the reprogramming flag of the second bootloader is valid, then update the second bootloader.

[0019] In one possible implementation, the first bootloader is initialized, specifically including:

[0020] Check whether the validity flag of the first bootloader is valid;

[0021] If so, then perform firmware verification on the first bootloader;

[0022] If the firmware verification of the first bootloader passes, then the first bootloader initialization is successful.

[0023] In one possible implementation, if there is a refresh command from the APP application, the system enters the normal mode of the second bootloader, which then guides the APP application to perform a refresh operation.

[0024] In one possible implementation, if there is no refresh instruction from the APP, the validity of the APP's reprogramming flag is checked.

[0025] If so, then enter the APP application's upgrade mode.

[0026] In one possible implementation, the second bootloader is initialized, specifically including:

[0027] Check whether the valid flag of the second bootloader is valid;

[0028] If so, then perform firmware verification on the second bootloader;

[0029] If the firmware verification of the second bootloader fails, it will enter the normal mode of the first bootloader.

[0030] In one possible implementation, if the valid flag of the second bootloader is invalid, the system enters the normal mode of the first bootloader.

[0031] In one possible implementation, the APP application is initialized, specifically including:

[0032] Identify whether the valid flags of the APP application are valid;

[0033] If so, then perform firmware verification on the APP application;

[0034] If the firmware verification of the APP application fails, it will enter the normal mode of the second bootloader.

[0035] In one possible implementation, if the valid flag of the APP application is invalid, the normal mode of the second bootloader is entered.

[0036] In one possible implementation, after at least one of the first bootloader and the second bootloader is successfully updated, the first bootloader backs up the firmware of the second bootloader as the first backup firmware.

[0037] In one possible implementation, after the electronic control unit is reset or powered on, if the reprogramming flag of the second bootloader is valid, it is determined whether the update of the second bootloader has timed out.

[0038] If so, the first bootloader controls the second bootloader to roll back to the first backup firmware.

[0039] In one possible implementation, the second bootloader is updated and the application is upgraded locally or remotely.

[0040] In one possible implementation, after the APP application is successfully refreshed or upgraded, the second bootloader backs up the APP application's firmware as a second backup firmware.

[0041] After the electronic control unit is reset or powered on, if the APP application has a restart flag, the second bootloader controls the APP application to roll back to the second backup firmware.

[0042] In a second aspect, the present invention provides a control device for an electronic control unit, including a boot loading module and a control module, wherein the boot loading module includes a first boot loading module, a second boot loading module and a security verification driver;

[0043] The first bootloader module runs the first bootloader program, which is a general program; the second bootloader module runs the second bootloader program, which is a customized program corresponding to the electronic control unit; the control module runs the APP application.

[0044] The security verification driver is used to initialize and update the first bootloader;

[0045] The first bootloader module is used to initialize and update the second bootloader;

[0046] The second bootloader module is used to initialize, refresh, and upgrade the APP application and control its startup.

[0047] In one possible implementation, the second bootloader module is also used to diagnose the APP application and write the diagnostic results into non-volatile memory.

[0048] In one possible implementation, initialization includes firmware verification.

[0049] In one possible implementation, the first bootloader module backs up the firmware of the second bootloader as the first backup firmware, and controls the second bootloader to roll back to the first backup firmware after the second bootloader update fails.

[0050] Thirdly, the present invention provides a control method for a domain controller, which performs distributed verification on multiple electronic control units using the principle of first verification and first release, with each electronic control unit executing the above-described control method.

[0051] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the method as described in the first aspect or any possible implementation thereof.

[0052] The core concept of this invention lies in adding a customizable second bootloader to a general first bootloader. This ensures the basic bootloader functionality of the ECU while meeting the needs of different ECUs. Furthermore, by performing distributed initialization verification and distributed hierarchical control on the first bootloader, second bootloader, and APP application, the ECU startup speed is accelerated. Moreover, this invention can perform comprehensive updates to both bootloader levels separately, improving the compatibility between the bootloader and requirements. Additionally, this invention can autonomously verify the firmware of the bootloader, improving firmware security; after the second bootloader and APP application are updated and upgraded, the firmware is backed up, enabling self-recovery from bricked devices. Attached Figure Description

[0053] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described below with reference to the accompanying drawings, wherein:

[0054] Figure 1 A schematic diagram of the structure of the control device for the electronic control unit provided by the present invention;

[0055] Figure 2 A flowchart of the control method for the electronic control unit provided by the present invention;

[0056] Figure 3 A schematic diagram of the structure of the control device for the electronic control unit provided by the present invention. Detailed Implementation

[0057] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0058] The core concept of this invention lies in adding a customizable second bootloader to a general first bootloader. This ensures the basic bootloader functionality of the ECU while meeting the needs of different ECUs. Furthermore, by performing distributed initialization verification and distributed hierarchical control on the first bootloader, second bootloader, and APP application, the ECU startup speed is accelerated. Moreover, this invention can perform comprehensive updates to both bootloader levels separately, improving the compatibility between the bootloader and requirements. Additionally, this invention can autonomously verify the firmware of the bootloader, improving firmware security; after the second bootloader and APP application are updated and upgraded, the firmware is backed up, enabling self-recovery from bricked devices.

[0059] In view of the aforementioned core concept, the present invention provides an embodiment of at least one control device for an electronic control unit, such as... Figure 1 As shown, it may include a bootloader module 110 and a control module 120. The bootloader module 110 is used to run the bootloader program, and the control module 120 is used to run the APP application.

[0060] In one possible implementation, the bootloader module 110 includes a first bootloader module 1101, a second bootloader module 1102, a security verification driver 1103, and a memory programming driver 1104.

[0061] The first bootloader module 1101 runs a first bootloader (boot1), which is a general-purpose program for the chip platform. This general-purpose program is independent of peripheral hardware and is stored in a non-erasable memory area inside the chip. This general-purpose program can be ported to the same platform. The second bootloader module 1102 runs a second bootloader (boot2), which is a customized program corresponding to the electronic control unit (ECU). The ECU's certificate can be flexibly customized as needed, and this customized program can meet the requirements of different ECUs.

[0062] It should be noted that only the first-level bootloader module 1101 can update the root certificate inside the chip.

[0063] The security verification driver 1103 is used to perform security verification on boot1 running by the first boot loading module 1101 and boot2 running by the second boot loading module 1102, to achieve initialization, and to check whether the refresh request flag is valid. If the refresh request flag is valid (i.e., an update instruction exists), the boot loading module continues to run. The initialization of boot1 includes at least the validity judgment of the valid flag of boot1 and the verification of the firmware of boot1. The initialization of boot2 includes at least the validity judgment of the valid flag of boot2 and the verification of the firmware of boot2.

[0064] The first bootloader module 1101 is used to update and initialize boot2 running by the second bootloader module 1102 to unlock a valid boot2. The initialization of boot2 includes at least determining the validity of the boot2's valid flag bit and verifying the firmware of boot2.

[0065] In one possible implementation, the first bootloader module 1101 can implement both local and remote updates of boot2.

[0066] In a preferred implementation, the first bootloader module 1101 backs up the firmware of the second bootloader as the first backup firmware, and controls the second bootloader to roll back to the first backup firmware after the second bootloader fails to update, thereby improving the ability to prevent bricking.

[0067] The second bootloader module 1102 is used to initialize, refresh, and upgrade the APP application running by the control module 120 and control the startup of the APP application. The initialization of the APP application includes at least determining the validity of the APP application's valid flag bit and verifying the APP application's firmware.

[0068] The second bootloader module 1102 can enable local and remote upgrades of the APP application. During local upgrades, the second bootloader module 1102 performs caching and firmware security verification. During remote upgrades, the OTA component in the control module 120 performs firmware caching and then jumps to the second bootloader module 1102 to perform firmware security verification.

[0069] In a preferred implementation, the second bootloader module 1102 is also used to diagnose the APP application and write the diagnostic results into the non-volatile memory NVM. For example, the second bootloader module 1102 obtains hardware information and security unlocking through the CAN diagnostic service, such as disabling DTC storage in the 0x85 service. It should be noted that different services correspond to different diagnostic functions.

[0070] In a preferred implementation, the second bootloader module backs up the firmware of the APP application as a second backup firmware, and controls the APP application to roll back to the second backup firmware by resetting when the APP application fails to update or fails to start.

[0071] The memory programming driver 1104 is used to establish CAN communication after receiving an update command, check the Flash and EEPROM addresses, and erase or write data in the Flash or EEPROM according to the communication content.

[0072] The above should be understood Figure 1The division of components in the control device of the illustrated electronic control unit is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. These components can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some components can be implemented in software via processing element calls, while others are implemented in hardware. For example, a particular module can be a separate processing element or integrated into a chip within the electronic device. The implementation of other components is similar. Furthermore, these components can be fully or partially integrated together, or implemented independently. During implementation, each step of the above method or each of the above components can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0073] For example, these components can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, these components can be integrated together to form a System-On-a-Chip (SOC).

[0074] Corresponding to the above embodiments and preferred solutions, the present invention also provides embodiments of at least one control method for an electronic control unit, such as... Figure 2 As shown, the specific steps may include the following:

[0075] S2010: Electronic Control Unit (ECU) powered on. After the ECU is powered on, the first bootloader (boot1) checks for an update command from the host computer. This update command can be an update command from the first bootloader (boot1), the second bootloader (boot2), or the application program. If an update command from the first bootloader (boot1) is present, the reprogramming flag of the first bootloader (boot1) is valid. The same applies to the second bootloader (boot2) and the application program.

[0076] S2020: Check if the reprogramming flag of the first bootloader boot1 is valid; if yes, execute S2130: Update the first bootloader boot1; otherwise, execute S2030.

[0077] S2030: Initialize the first bootloader boot1.

[0078] In one possible implementation, if the valid flag of the first bootloader boot1 is valid, then the first bootloader boot1 is successfully initialized.

[0079] In a preferred implementation, the first bootloader boot1 is initialized, specifically including:

[0080] S20301: Check if the validity flag of the first bootloader boot1 is valid. If yes, execute S20302; otherwise, the initialization of the first bootloader boot1 fails, and execute S2140, as explained below.

[0081] S20302: Perform firmware verification on the first bootloader boot1. If the firmware verification passes, the first bootloader boot1 is successfully initialized; otherwise, the first bootloader boot1 fails to initialize, and S2140 is executed, as explained below.

[0082] S2040: Determine whether the first bootloader boot1 has been successfully initialized. If yes, execute S2050; otherwise, execute S2140: Exit the process.

[0083] S2050: The first boot loader, boot1, checks whether the reprogramming flag of the second boot loader, boot2, is valid. If yes, then execute S2150: Update the second boot loader, boot2. Otherwise, execute S2060.

[0084] S2060: The first boot loader boot1 initializes the second boot loader boot2.

[0085] In one possible implementation, if the valid flag of the second bootloader boot2 is valid, then the second bootloader boot2 is successfully initialized.

[0086] In a preferred implementation, the second bootloader boot2 is initialized, specifically including:

[0087] S20601: Check if the valid flag of the second bootloader boot2 is valid. If yes, execute S20602; otherwise, the initialization of the second bootloader boot2 fails, and the system enters the normal mode of the first bootloader (see S2160).

[0088] S20602: Perform firmware verification on the second bootloader boot2. If the verification passes, the second bootloader boot2 is successfully initialized; otherwise, the second bootloader boot2 fails to initialize and enters the normal mode of the first bootloader (see S2160). In the normal mode of the first bootloader, if a refresh or upgrade command for the second bootloader is received, the first bootloader updates the second bootloader.

[0089] S2070: Determine whether the second bootloader boot2 has been successfully initialized. If yes, execute S2080; otherwise, execute S2160: Enter the normal mode of the first bootloader boot1.

[0090] S2080: The second bootloader boot2 identifies whether there is a refresh command for the APP application. If yes, then execute S2170: enter the normal mode of the second bootloader boot2, and the second bootloader boot2 guides the APP application to perform a refresh operation; otherwise, execute S2090.

[0091] S2090: The second bootloader boot2 identifies whether the reprogramming flag of the APP application is valid. If yes, execute S2180: Enter APP upgrade mode; otherwise, execute S2100.

[0092] S2100: The second bootloader boot2 initializes the APP application.

[0093] In one possible implementation, if the valid flag of the APP application is valid, then the APP application initialization is successful.

[0094] In another preferred implementation, the APP application is initialized, specifically including:

[0095] S21001: Check if the valid flag of the APP application is valid. If yes, execute S21002; otherwise, the APP application initialization fails, and enters the normal mode of the second bootloader boot2, see S2170.

[0096] S21002: Perform firmware verification on the APP application. If the verification passes, the APP application initializes successfully. Otherwise, the APP application initialization fails, and the system enters the normal mode of the second bootloader boot2, see S2170.

[0097] S2110: Determine whether the APP application has been initialized successfully. If yes, execute S2120; otherwise, execute S2170.

[0098] S2120: Jump to the APP application and launch the APP application.

[0099] This invention allows for comprehensive updates to both levels of the bootloader, improving the compatibility between the bootloader and requirements. Furthermore, by performing distributed initialization verification and distributed step-by-step control on the first bootloader, second bootloader, and APP application, the ECU startup speed is accelerated. Additionally, this invention can autonomously verify the bootloader firmware, enhancing firmware security.

[0100] In a preferred implementation, after at least one of the first bootloader boot1 and the second bootloader boot2 is successfully updated, the first bootloader boot1 backs up the firmware of the second bootloader boot2 as the first backup firmware. After the electronic control unit is reset or powered on, if the reprogramming flag of the second bootloader boot2 is valid, it is determined whether the update of the second bootloader has timed out (including whether the erase has timed out, whether the write has timed out, etc.). If the erase timed out and / or the write timed out, it indicates that the upgrade has failed, and the first bootloader boot1 controls the second bootloader boot2 to roll back to the first backup firmware.

[0101] In existing technology, after each power-on / reset, the bootloader first performs some basic initializations, then checks if the update request flag is valid. If the update request flag is valid, the bootloader will continue to run even if the application is valid. If the current update request flag is invalid, it checks if the application is valid; if so, it executes the application; otherwise, it continues to execute the bootloader code. However, there are cases where the application is valid but its operation encounters an error (e.g., crashes). In this case, the application will perform a reset (the application remains valid after the reset), and then the bootloader will re-enter the application to run, which will then perform another reset, thus entering an infinite loop. In this situation, the ECU will never be able to use the bootloader to update the application.

[0102] Based on the above considerations, in a preferred implementation, after the APP application is successfully refreshed or upgraded, the second bootloader boot2 backs up the firmware of the APP application as the second backup firmware. After the electronic control unit is reset or powered on, if the restart flag of the APP application exists (for example, when the memory data is changed due to electromagnetic interference, long ECU running time, or when the ECU enters an infinite loop, causing it to fail to start), the second bootloader boot2 controls the APP application to roll back to the second backup firmware, ensuring the safe operation of the ECU.

[0103] Based on the control method of the above electronic control unit, in one possible implementation, in a domain controller with multi-core ECUs, each ECU is controlled according to the above method, and multiple ECUs are distributed for verification using the principle of first verification and first release to ensure that important functional cores are started first.

[0104] Based on the above embodiments and preferred solutions, those skilled in the art will understand that, in practice, the present invention is applicable to various implementation methods. The present invention is illustrated by the following carrier:

[0105] (1) A control device for an electronic control unit, which may include:

[0106] One or more processors, a memory, and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform the steps / functions of the foregoing embodiments or equivalent embodiments.

[0107] Figure 3 This is a schematic diagram illustrating the structure of a control device for the electronic control unit of the present invention. The device can be an electronic device or a circuit device built into such an electronic device. The electronic device can be a robot, drone, intelligent vehicle, or in-vehicle equipment, etc. This embodiment does not limit the specific form of the control device for the electronic control unit.

[0108] Specifically, such as Figure 3As shown, the control device 900 of the electronic control unit includes a processor 910 and a memory 930. The processor 910 and the memory 930 can communicate with each other via an internal connection to transmit control and / or data signals. The memory 930 stores computer programs, and the processor 910 retrieves and runs these programs from the memory 930. The processor 910 and memory 930 can be combined into a single processing device, but more commonly they are independent components. The processor 910 executes the program code stored in the memory 930 to achieve the aforementioned functions. In specific implementations, the memory 930 can be integrated into the processor 910, or it can be independent of the processor 910.

[0109] In addition, to further enhance the functionality of the electronic control unit's control device 900, the device 900 may also include one or more of the following: an input unit 960, a display unit 970, an audio circuit 980, a camera 990, and a sensor 901. The audio circuit may also include a speaker 982, a microphone 984, etc. The display unit 970 may include a display screen.

[0110] Furthermore, the control device 900 of the aforementioned electronic control unit may also include a power supply 950 for providing electrical energy to various devices or circuits in the device 900.

[0111] It should be understood that Figure 3 The control device 900 of the electronic control unit shown is capable of implementing the various processes of the method provided in the foregoing embodiments. The operation and / or function of each component in the device 900 can respectively implement the corresponding processes in the above method embodiments. For details, please refer to the foregoing descriptions of the embodiments of methods, devices, etc.; to avoid repetition, detailed descriptions are appropriately omitted here.

[0112] It should be understood that Figure 3 The processor 910 in the control device 900 of the electronic control unit shown can be a system-on-a-chip (SoC). The processor 910 may include a central processing unit (CPU) and may further include other types of processors, such as a graphics processing unit (GPU), which will be described in detail below.

[0113] In summary, the various processors or processing units inside the processor 910 can work together to implement the previous method flow, and the corresponding software programs of each processor or processing unit can be stored in the memory 930.

[0114] (2) A readable storage medium storing a computer program or the above-described device, which, when executed, causes a computer to perform the steps / functions of the foregoing embodiments or equivalent embodiments.

[0115] In several embodiments provided by this invention, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, certain technical solutions of this invention, or the parts that contribute to the prior art, or parts of such technical solutions, can be embodied in the form of software products as described below.

[0116] (3) A computer program product (which may include the above-mentioned device), which, when running on a terminal device, causes the terminal device to execute the control method of the electronic control unit of the aforementioned embodiment or equivalent embodiment.

[0117] In this embodiment of the invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0118] Those skilled in the art will recognize that the modules, units, and method steps described in the embodiments disclosed in this specification can be implemented using electronic hardware, computer software, and a combination of electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0119] Furthermore, the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. In particular, for embodiments such as apparatus and devices, since they are basically similar to the method embodiments, the relevant parts can be referred to the description of the method embodiments. The apparatus, devices, and other embodiments described above are merely illustrative, and the modules, units, etc., described as separate components may or may not be physically separate, that is, they may be located in one place or distributed in multiple places, such as nodes in a system network. Specifically, some or all of the modules and units can be selected according to actual needs to achieve the purpose of the above-described embodiment solutions. Those skilled in the art can understand and implement this without creative effort.

[0120] The above description of the structure, features, and effects of the present invention is based on the embodiments shown in the figures. However, the above are only preferred embodiments of the present invention. It should be noted that the technical features involved in the above embodiments and their preferred methods can be reasonably combined and matched by those skilled in the art to form a variety of equivalent solutions without departing from or changing the design concept and technical effects of the present invention. Therefore, the present invention is not limited to the scope of implementation shown in the figures. Any changes made in accordance with the concept of the present invention, or modifications to equivalent embodiments, that do not exceed the spirit covered by the specification and figures, should be within the protection scope of the present invention.

Claims

1. A control method for an electronic control unit, characterized in that, include: After the electronic control unit is powered on, it checks whether the reprogramming flag of the first bootloader is valid; if not, it initializes the first bootloader. If so, update the first bootloader; After the first bootloader is successfully initialized, the first bootloader checks whether the reprogramming flag of the second bootloader is valid; If not, the first bootloader initializes the second bootloader; if yes, the second bootloader is updated. After the second bootloader is successfully initialized, the second bootloader identifies whether there is a refresh instruction for the APP application and whether the reprogramming flag of the APP application is valid, including: if there is no refresh instruction for the APP application, then identifying whether the reprogramming flag of the APP application is valid. If yes, then the application enters the upgrade mode; if no, then the second bootloader initializes the application. If the application is successfully initialized, then the application is launched. The first bootloader is a general program, and the second bootloader is a customized program corresponding to the electronic control unit.

2. The control method for the electronic control unit according to claim 1, characterized in that, Also includes: The second bootloader diagnoses the APP application and writes the diagnostic results into non-volatile memory.

3. The control method for the electronic control unit according to claim 1, characterized in that, Initializing the first bootloader specifically includes: Identify whether the validity flag of the first bootloader is valid; If so, then perform firmware verification on the first bootloader; If the firmware verification of the first bootloader passes, then the first bootloader initialization is successful.

4. The control method for the electronic control unit according to claim 1, characterized in that, If a refresh command is received from the APP application, the system enters the normal mode of the second bootloader, which then guides the APP application to perform a refresh operation.

5. The control method for the electronic control unit according to claim 1, characterized in that, The second bootloader is initialized, specifically including: Identify whether the validity flag of the second bootloader is valid; If so, then perform firmware verification on the second bootloader; If the firmware verification of the second bootloader fails, the system will enter the normal mode of the first bootloader.

6. The control method for the electronic control unit according to claim 5, characterized in that, If the valid flag of the second bootloader is invalid, the system enters the normal mode of the first bootloader.

7. The control method for the electronic control unit according to claim 1, characterized in that, Initializing the APP application specifically includes: Identify whether the valid flag of the APP application is valid; If so, then perform firmware verification on the APP application; If the firmware verification of the APP application fails, it will enter the normal mode of the second bootloader.

8. The control method for the electronic control unit according to claim 7, characterized in that, If the valid flag of the APP application is invalid, the system will enter the normal mode of the second bootloader.

9. The control method for the electronic control unit according to claim 1, characterized in that, After at least one of the first bootloader and the second bootloader is successfully updated, the first bootloader backs up the firmware of the second bootloader as the first backup firmware.

10. The control method for the electronic control unit according to claim 9, characterized in that, After the electronic control unit is reset or powered on, if the reprogramming flag of the second bootloader is valid, it is determined whether the update of the second bootloader has timed out. If so, the first bootloader controls the second bootloader to roll back to the first backup firmware.

11. The control method for the electronic control unit according to claim 1, characterized in that, The second bootloader and the APP application can be updated locally or remotely.

12. The control method for the electronic control unit according to claim 1, characterized in that, After the APP application is successfully refreshed or upgraded, the second bootloader backs up the firmware of the APP application as the second backup firmware. After the electronic control unit is reset or powered on, if the restart flag of the APP application exists, the second bootloader controls the APP application to roll back to the second backup firmware.

13. A control device for an electronic control unit, characterized in that, It includes a bootloader module and a control module, wherein the bootloader module includes a first bootloader module, a second bootloader module, and a security verification driver; The first bootloader module runs a first bootloader program, which is a general program; the second bootloader module runs a second bootloader program, which is a customized program corresponding to the electronic control unit. The control module runs the APP application; The security verification driver is used to initialize and update the first bootloader, including: identifying whether the reprogramming flag of the first bootloader is valid; if not, initializing the first bootloader; if yes, updating the first bootloader. The first bootloader module is used to initialize and update the second bootloader, including: the first bootloader identifies whether the reprogramming flag of the second bootloader is valid; if not, the first bootloader initializes the second bootloader; if yes, the second bootloader is updated. The second bootloader module is used to initialize, refresh, and upgrade the APP application and control the startup of the APP application. Specifically, the second bootloader identifies whether there is a refresh instruction for the APP application and whether the reprogramming flag of the APP application is valid. If there is no refresh instruction for the APP application, it identifies whether the reprogramming flag of the APP application is valid. If yes, it enters the upgrade mode of the APP application. If no, the second bootloader initializes the APP application. If the APP application is successfully initialized, it starts the APP application.

14. The control device for the electronic control unit according to claim 13, characterized in that, The second bootloader module is also used to diagnose the APP application and write the diagnostic results into non-volatile memory.

15. The control device for the electronic control unit according to claim 13, characterized in that, The initialization includes firmware verification.

16. The control device for the electronic control unit according to claim 13, characterized in that, The first bootloader module backs up the firmware of the second bootloader as the first backup firmware, and controls the second bootloader to roll back to the first backup firmware after the second bootloader update fails.

17. A control method for a domain controller, characterized in that, Multiple electronic control units are distributed for verification using the principle of first verification and first release, and each electronic control unit executes the control method as described in claims 1-12.

Images