Vehicle safety OTA upgrade method and device

Abstract

The present application relates to a vehicle safety OTA upgrade method and device, wherein the method includes: receiving an over-the-air download technology OTA upgrade task and an OTA upgrade software package sent by an OTA cloud server; sending an upgrade instruction to an OTA master control node according to the OTA upgrade task, and judging whether the current vehicle is in a preset safety state according to the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction; if the current vehicle is in a preset safety state, writing at least one target upgrade object of the current vehicle according to the OTA upgrade software package. The embodiment of the present application can judge whether it is in a safe state according to the safety signal collected by the OTA master control node, so that when it is in a safe state, the upgrade object is written according to the OTA upgrade software package, thereby ensuring that the vehicle achieves the purpose of safety upgrade in the event of controller failure, improving the safety and reliability of OTA upgrades, and ensuring the intelligence and practicality of the vehicle.

Description

Technical Field

[0001] The present application relates to the technical field of OTA upgrade, and in particular to a vehicle safety OTA upgrade method and device. Background Art

[0002] At present, with the development of Internet of Vehicles technology and the introduction of software-defined concepts, sustainable upgrades of automotive software are becoming increasingly important. OTA (Over-the-Air Technology) upgrades, as the main upgrade method after vehicle mass production, can solve the system upgrade and optimization problems of smart terminals, and are increasingly being used by various automobile manufacturers.

[0003] In the related technology, the cloud can store application upgrade packages, resource upgrade packages, and software upgrade packages updated through OTA respectively, receive the upgrade content customized by the car owner, and select or edit it for OTA upgrade by the mobile terminal or the car.

[0004] However, the OTA detection technology used in related technologies to ensure safety upgrades is unable to cope with scenarios in which there is a lack of controller failure. It is unable to receive signals and determine the safety status when a safety-related controller fails, making it difficult to perform OTA safety upgrades and unable to effectively ensure vehicle safety, and this urgently needs to be improved. Summary of the invention

[0005] The present application provides a vehicle safety OTA upgrade method and device to solve the problems that the OTA detection technology for ensuring safety upgrades in the related technology is difficult to cope with the scenario of lack of controller failure, cannot receive signals and determine the safety status when the safety-related controller fails, is difficult to perform OTA safety upgrades, and cannot effectively ensure vehicle safety.

[0006] The first aspect of the present application provides a vehicle safety OTA upgrade method, comprising the following steps: receiving an over-the-air download technology OTA upgrade task and an OTA upgrade software package sent by an OTA cloud server; sending an upgrade instruction to an OTA master control node according to the OTA upgrade task, and judging whether the current vehicle is in a preset safety state based on a vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction; and if the current vehicle is in the preset safety state, flashing at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0007] According to the above-mentioned technical means, the embodiment of the present application can receive the over-the-air download technology OTA upgrade tasks and OTA upgrade software packages sent by the OTA cloud server, determine whether it is in a safe state according to the security signal of the OTA master control node, and when the vehicle is in a certain safe state, flash the upgrade object according to the OTA upgrade software package, thereby ensuring that the vehicle achieves the purpose of safe upgrade in the event of controller failure, improving the safety and reliability of OTA upgrades, and ensuring the intelligence and practicality of the vehicle.

[0008] Optionally, in one embodiment of the present application, after receiving the OTA upgrade task and the OTA upgrade software package, it also includes: controlling the current vehicle to power on, and sending a wake-up command to multiple vehicle controllers of the current vehicle.

[0009] According to the above-mentioned technical means, the embodiment of the present application can control the power-on of the current vehicle and send a wake-up command to multiple vehicle controllers of the current vehicle, thereby ensuring that the purpose of safety upgrade can be achieved in the event of controller failure.

[0010] Optionally, in one embodiment of the present application, the determining whether the current vehicle is in a preset safety state based on the vehicle safety signal collected after the OTA master control node receives the upgrade instruction includes: determining whether the safety signal of each vehicle controller is received; if the safety signal of each vehicle controller is received and they are all in a safe state, determining that they are in the preset safety state; if the safety signal of any vehicle controller is not received or is not in the safe state, determining that it is not in the preset safety state, and determining that the vehicle controller that has not received the safety signal is invalid.

[0011] According to the above-mentioned technical means, the embodiment of the present application can determine whether the safety signal of each vehicle controller is received. By receiving the safety signal and safety status information of each vehicle controller, the vehicle safety is further ensured to deal with the scenario of controller failure.

[0012] Optionally, in one embodiment of the present application, while determining that the vehicle controller that has not received the safety signal is invalid, it also includes: if the current vehicle is not in the preset safety state, prompting the user with a prompt message generated by the vehicle controller that has not received the safety signal, and after receiving the upgrade instruction generated by the user by the prompt message, flashing at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0013] According to the above-mentioned technical means, the embodiment of the present application can prompt the user that the prompt information generated by the vehicle controller has not received the safety signal when the current vehicle is not in a certain safety state, and after receiving the upgrade instruction generated by the prompt information from the user, it can flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package, thereby reminding the user of the current vehicle safety information and ensuring the safety and reliability of the vehicle OTA upgrade.

[0014] Optionally, in one embodiment of the present application, it also includes: if the current vehicle is not in the preset safety state, detecting whether the current vehicle meets the preset minimum safety conditions; if it is detected that the preset minimum safety conditions are met, flashing at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0015] According to the above-mentioned technical means, the embodiment of the present application can detect whether the current vehicle meets certain minimum safety conditions when the current vehicle is not in a certain safety state, and flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package, thereby ensuring that when certain controllers of the vehicle fail and all safety signals cannot be received, the vehicle safety is guaranteed through a minimum safety check, thereby solving the problem of being unable to confirm the vehicle safety status when the controller fails.

[0016] Optionally, in one embodiment of the present application, the preset minimum safety condition includes at least two of the vehicle gear is in P gear, the vehicle engine is not running, and the vehicle handbrake is in a pulled-up state.

[0017] According to the above-mentioned technical means, at least two of the vehicle gear position in the embodiment of the present application, namely, the P gear, the vehicle engine is not running, and the vehicle handbrake is in the pulled-up state, meet the minimum safety conditions, thereby ensuring that when the vehicle controller fails and cannot receive all safety signals, the minimum safety check is passed to ensure vehicle safety.

[0018] The second aspect of the present application provides a vehicle safety OTA upgrade device, including: a receiving module, used to receive an over-the-air download technology OTA upgrade task and an OTA upgrade software package sent by an OTA cloud server; a judgment module, used to send an upgrade instruction to an OTA master control node according to the OTA upgrade task, and judge whether the current vehicle is in a preset safety state according to the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction; and a flashing module, used to flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package if the current vehicle is in the preset safety state.

[0019] Optionally, in one embodiment of the present application, it also includes: a control module, which is used to control the power-on of the current vehicle and send a wake-up command to multiple vehicle controllers of the current vehicle after receiving the OTA upgrade task and the OTA upgrade software package.

[0020] Optionally, in one embodiment of the present application, the judgment module includes: a judgment unit, used to judge whether the safety signal of each vehicle controller is received; a first judgment unit, used to judge that the vehicle controllers are in the preset safety state when the safety signal of each vehicle controller is received and they are all in the safe state; a second judgment unit, used to judge that the vehicle controllers are not in the preset safety state when the safety signal of any vehicle controller is not received or is not in the safe state, and to judge that the vehicle controller that has not received the safety signal is invalid.

[0021] Optionally, in one embodiment of the present application, it also includes: a prompt module, which is used to prompt the user with the prompt information generated by the vehicle controller that has not received the safety signal when it is determined that the vehicle controller that has not received the safety signal is invalid, if the current vehicle is not in the preset safety state, and after receiving the upgrade instruction generated by the user by the prompt information, flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0022] Optionally, in one embodiment of the present application, it also includes: a detection module, which is used to detect whether the current vehicle meets the preset minimum safety conditions when the current vehicle is not in the preset safety state; and a flashing object module, which is used to flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package if it is detected that the preset minimum safety conditions are met.

[0023] Optionally, in one embodiment of the present application, the preset minimum safety condition includes at least two of the vehicle gear is in P gear, the vehicle engine is not running, and the vehicle handbrake is in a pulled-up state.

[0024] The third aspect of the present application provides a vehicle, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the vehicle safety OTA upgrade method as described in the above embodiment.

[0025] The fourth aspect of the present application provides a computer-readable storage medium, which stores a computer program that, when executed by a processor, implements the above-mentioned vehicle safety OTA upgrade method.

[0026] Beneficial effects of the embodiments of the present application:

[0027] (1) The embodiments of the present application can determine whether the vehicle is in a safe state based on the security signals collected by the OTA master control node, and when the vehicle is in a certain safe state, the upgrade object is flashed according to the OTA upgrade software package, thereby ensuring that the vehicle can achieve the purpose of safe upgrade in the event of controller failure, improving the safety and reliability of OTA upgrades, and ensuring the intelligence and practicality of the vehicle.

[0028] (2) The embodiment of the present application can control the power-on of the current vehicle and send a wake-up command to multiple vehicle controllers of the current vehicle, thereby ensuring that the purpose of safety upgrade can be achieved in the event of controller failure.

[0029] (3) The embodiments of the present application can detect whether the current vehicle meets certain minimum safety conditions when the current vehicle is not in a certain safety state, and flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package, thereby ensuring that when some controllers of the vehicle fail and cannot receive all safety signals, the minimum safety check is performed to improve the safety and reliability of the OTA upgrade and ensure vehicle safety.

[0030] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0032] Figure 1 A flowchart of a vehicle safety OTA upgrade method provided according to an embodiment of the present application;

[0033] Figure 2 A schematic diagram of the principle of vehicle safety OTA upgrade according to an embodiment of the present application;

[0034] Figure 3 A flowchart of a vehicle safety OTA upgrade according to an embodiment of the present application;

[0035] Figure 4 A schematic diagram of the structure of a vehicle safety OTA upgrade device provided according to an embodiment of the present application;

[0036] Figure 5 It is a schematic diagram of the structure of a vehicle provided according to an embodiment of the present application.

[0037] Among them, 10-vehicle safety OTA upgrade device: 100-receiving module, 200-judgment module, 300-flashing module. DETAILED DESCRIPTION

[0038] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0039] The following describes the vehicle safety OTA upgrade method and device of the embodiment of the present application with reference to the accompanying drawings. In view of the problem that the OTA detection technology for ensuring safety upgrade in the related technology mentioned in the background technology center is difficult to cope with the scenario of lacking controller failure, it is impossible to receive signals and determine the safety state when the safety-related controller fails, it is difficult to perform OTA safety upgrade, and it is impossible to effectively ensure the safety of the vehicle, the present application provides a vehicle safety OTA upgrade method, in which the safety signal collected by the OTA master control node can be used to determine whether it is in a safe state, so that when it is in a safe state, the upgrade object is flashed according to the OTA upgrade software package, so as to ensure that the vehicle achieves the purpose of safety upgrade in the case of controller failure, improve the safety and reliability of OTA upgrade, and ensure the intelligence and practicality of the vehicle. Thus, the detection technology for ensuring safety upgrade in the related technology is solved, it is difficult to cope with the scenario of lacking controller failure, it is impossible to receive signals and determine the safety state when the safety-related controller fails, it is difficult to perform OTA safety upgrade, and it is impossible to effectively ensure the safety of the vehicle.

[0040] Specifically, Figure 1 A flowchart of a vehicle safety OTA upgrade method provided in an embodiment of the present application.

[0041] like Figure 1 As shown, the vehicle security OTA upgrade method is applied to the OTA client, which includes the following steps:

[0042] In step S101, an over-the-air OTA upgrade task and an OTA upgrade software package sent by an OTA cloud server are received.

[0043] It can be understood that the OTA cloud server in the embodiment of the present application can be responsible for the upgrade management of vehicle information and vehicle version, and can manage the latest software version collection of the vehicle controller. The embodiment of the present application can download the required OTA upgrade software package and OTA upgrade tasks through the OTA client.

[0044] In some embodiments, over-the-air technology OTA upgrade tasks and OTA upgrade software packages sent by the OTA cloud server can be received. The OTA cloud server is responsible for software and upgrade task management and vehicle version information management. The OTA cloud server can interact with the OTA client in real time, where the OTA client can be responsible for collecting the software version of the entire vehicle, including version upload and software package download. The OTA cloud server can send over-the-air technology OTA upgrade tasks and OTA upgrade software packages to the OTA client.

[0045] The embodiment of the present application can receive OTA upgrade tasks and OTA upgrade software packages sent by the cloud server. After the OTA client downloads the required upgrade tasks and upgrade packages, it receives the upgrade instructions of the OTA master control node through the OTA master control node, collects safety signals to determine the safety status of the vehicle, and ensures the safety of the vehicle OTA upgrade.

[0046] Optionally, in one embodiment of the present application, after receiving the OTA upgrade task and the OTA upgrade software package, it also includes: controlling the current vehicle to power on, and sending a wake-up command to multiple vehicle controllers of the current vehicle.

[0047] It can be understood that the embodiments of the present application can wake up the controller of the entire vehicle, such as controlling the vehicle to power on through the OTA master control node and sending a wake-up command to wake up the controller of the entire vehicle.

[0048] In some cases, after receiving the OTA upgrade task and OTA upgrade software package sent by the OTA cloud server, the OTA master control node controller of the embodiment of the present application powers on the entire vehicle and sends a wake-up command to wake up the controller of the entire vehicle. The OTA master control node in the embodiment of the present application can receive the upgrade command and collect the safety signals of the entire vehicle after the OTA client downloads the upgrade task and upgrade package. After the OTA master control node wakes up the vehicle controller, it can continue to receive safety-related signals sent by each controller from the network.

[0049] The embodiment of the present application can control the power-on of the current vehicle and send wake-up commands to multiple vehicle controllers of the current vehicle, thereby ensuring that after the vehicle controller is woken up, the safety signal sent by the controller can be continuously received, providing a basis for determining whether the current vehicle is in a safe state, and further improving the safety and reliability of OTA upgrades.

[0050] In step S102, an upgrade instruction is sent to the OTA master control node according to the OTA upgrade task, and a determination is made as to whether the current vehicle is in a preset safety state based on the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction.

[0051] It can be understood that the OTA master control node in the embodiment of the present application can be responsible for controlling the OTA upgrade process, determining the safety status of the entire vehicle, and flashing the upgrade object.

[0052] For example, an embodiment of the present application can send an upgrade instruction to the OTA master control node according to the OTA upgrade task. After the OTA master control node wakes up the vehicle controller, it can continuously collect safety-related signals emitted by each controller from the network. After the OTA master control node continues to collect for 5 seconds, the OTA host node determines whether all signals are collected and whether all signals meet safety requirements. If the OTA master control node collects all safety signals, it determines whether all safety signals meet the safety state. If all safety signals meet the safety state, it determines that the current vehicle is in a safe state and OTA upgrade can be performed. If there are some safety signals that do not meet the safety state, the current vehicle is in an unsafe state and does not meet the conditions for OTA upgrade.

[0053] The embodiment of the present application can send an upgrade instruction to the OTA master control node according to the OTA upgrade task, and determine whether it is in a safe state based on the security signal collected by the OTA master control node, perform OTA security upgrade, and further improve the security and reliability of OTA upgrade.

[0054] It should be noted that the preset safety state can be set by those skilled in the art according to actual conditions and is not specifically limited here.

[0055] Among them, in one embodiment of the present application, whether the current vehicle is in a preset safety state is determined based on the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction, including: determining whether the safety signal of each vehicle controller is received; if the safety signal of each vehicle controller is received and they are all in a safe state, then it is determined to be in a preset safety state; if the safety signal of any vehicle controller is not received or is not in a safe state, then it is determined that it is not in the preset safety state, and it is determined that the vehicle controller that has not received the safety signal is invalid.

[0056] It can be understood that the safety signal in the embodiment of the present application can be collected by the OTA master control node, and whether to perform OTA upgrade is determined by judging whether the current vehicle is in a safe state.

[0057] In some cases, the embodiments of the present application can determine whether the OTA master control node has received the safety signal of each vehicle controller. If the safety signal of each vehicle controller is received and the safety state is met, it is determined that the current vehicle is in a certain safety state and an OTA upgrade can be performed; if the safety signal of any vehicle controller is not received or there are certain safety signals that do not meet the safety state, it is determined that the current vehicle is in an unsafe state and does not meet the conditions for OTA upgrade.

[0058] Furthermore, during the signal collection process, if there is a safety signal that has not been collected, where "not collected" means that the safety signal has never been collected since wake-up, then it is determined that the controller sending the safety signal is in a failed state.

[0059] The embodiment of the present application can determine whether the safety signal of each vehicle controller is received. By receiving the safety signal and safety status information of each vehicle controller, the vehicle safety is further ensured to deal with the scenario of controller failure.

[0060] Optionally, in one embodiment of the present application, while determining that the vehicle controller that has not received the safety signal is invalid, it also includes: if the current vehicle is not in a preset safety state, prompting the user with a prompt message generated by the vehicle controller that has not received the safety signal, and after receiving the upgrade instruction generated by the prompt message from the user, flashing at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0061] It is understandable that the prompt information in the embodiment of the present application may be information prompting the user that the safety signal has not been received when the current vehicle is not in a certain safety state.

[0062] For example, an embodiment of the present application can prompt the user that the vehicle controller has not received a safety signal when it detects that the current vehicle is not in a certain safety state. After receiving the instruction generated by the prompt information from the user, the OTA master control node monitors the upgrade status of each upgrade object and serially flashes the key controllers to flash at least one target upgrade object of the current vehicle. If the flashing of a key controller fails, the flashing of subsequent key controllers is stopped to ensure that the flashing of more than two key controllers does not fail at the same time.

[0063] The embodiments of the present application can prompt the user with a prompt message generated by the vehicle controller that has not received a safety signal when the current vehicle is not in a certain safety state, and after receiving the upgrade instruction generated by the prompt message from the user, flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package, thereby reminding the user of the current vehicle safety information, ensuring the safety OTA upgrade of the vehicle, and improving the safety and reliability of the OTA upgrade.

[0064] In step S103, if the current vehicle is in a preset safety state, at least one target upgrade object of the current vehicle is flashed according to the OTA upgrade software package.

[0065] It can be understood that the essence of OTA in the embodiment of the present application lies in the software flashing process, so that the vehicle software upgrade is not limited by space, and at least one upgrade object can be flashed when the vehicle is in a certain safety state.

[0066] As a possible implementation method, in the embodiment of the present application, if the OTA master control node receives all security signals, it determines whether all signals meet the security status. If they meet a certain security status, the OTA upgrade is performed. When performing the OTA upgrade, the OTA master control node needs to monitor the upgrade status of each upgrade object and serially flash the key controllers. If the flashing of a key controller fails, the flashing of subsequent key controllers is stopped to ensure that the flashing of more than two key controllers does not fail at the same time.

[0067] The embodiment of the present application can flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package when the current vehicle is in a certain safety state, thereby ensuring that the vehicle can achieve the purpose of safe upgrade in the event of controller failure, improving the safety and reliability of OTA upgrades, and ensuring the intelligence and practicality of the vehicle.

[0068] Optionally, in one embodiment of the present application, it also includes: if the current vehicle is not in a preset safety state, detecting whether the current vehicle meets a preset minimum safety condition; if it is detected that the preset minimum safety condition is met, flashing at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0069] It can be understood that the minimum safety condition in the embodiment of the present application can be at least two of the following: the handbrake of the current vehicle is pulled up, the current vehicle is in the parking gear position, and the current vehicle is in the engine-off state.

[0070] In a specific embodiment, if the OTA master control node fails to collect all safety signals, a minimum safety condition check is performed. If the current vehicle is not in a certain safety state, a check is performed to determine whether the current vehicle meets certain minimum safety conditions, that is, whether the current vehicle meets at least two of the following conditions: the handbrake of the current vehicle is pulled up, the current vehicle is in the parking gear, and the current vehicle is in the engine-off state. If the minimum safety conditions are met, at least one target upgrade object of the current vehicle can be flashed according to the OTA upgrade software package to perform an OTA upgrade. The OTA master control node needs to map the minimum safety conditions to the controllers to which they belong, and record these controllers as key controllers.

[0071] The embodiments of the present application can detect whether the current vehicle meets certain minimum safety conditions when the current vehicle is not in a certain safety state, and flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package, thereby ensuring that when some controllers of the vehicle fail and cannot receive all safety signals, the vehicle safety is guaranteed through minimum safety checks, thereby solving the problem of difficulty in safe upgrades when the controller fails.

[0072] In one embodiment of the present application, the preset minimum safety conditions include at least two of the vehicle gear is in P gear, the vehicle engine is not running, and the vehicle handbrake is in the pulled-up state.

[0073] In some embodiments, an OTA upgrade can be performed when the minimum safety conditions are met, that is, when at least two of the following conditions are met: the vehicle gear is in P gear, the vehicle engine is not running, and the vehicle handbrake is in the pulled-up state, it means that the minimum safety conditions are met and an OTA upgrade can be performed.

[0074] The embodiments of the present application can improve the security of OTA upgrades by performing minimum safety checks when the vehicle controller fails and cannot receive all safety signals when at least two of the following conditions are met: the vehicle gear is in P gear, the vehicle engine is not running, and the vehicle handbrake is in the pulled up state.

[0075] Specifically, combined Figure 2 and Figure 3 As shown, a schematic diagram of the principle of vehicle safety OTA upgrade of the embodiment of the present application is described in detail with a specific embodiment.

[0076] like Figure 2 As shown, an embodiment of the present application may include: an OTA cloud server, an OTA client, an OTA master control node and an OTA upgrade object.

[0077] Specifically, the OTA cloud server is responsible for software and upgrade task management, vehicle version information management, etc.; the OTA client can interact with the OTA cloud server in real time and is responsible for collecting the software version of the entire vehicle, including version upload and software package download; the hardware carrier of OTA is the gateway, and the OTA master control node is responsible for controlling the OTA upgrade process, determining the safety status of the entire vehicle, and flashing the upgrade object; the OTA upgrade object is composed of multiple ECUs, and the OTA upgrade object is the controller of the entire vehicle that supports OTA upgrade. The entire OTA process is that the OTA client uploads the vehicle version to the OTA cloud server, and then the OTA cloud server sends the upgrade task to the OTA client. The OTA client downloads the required upgrade package and upgrade task. After the download is complete, the OTA client sends the upgrade command to the OTA master control node. After receiving the upgrade command, the OTA master control node needs to collect the safety signal of the entire vehicle to determine whether the current vehicle is in a safe state.

[0078] Next, you can Figure 3 The vehicle safety OTA upgrade method of the embodiment of the present application is further elaborated in detail.

[0079] like Figure 3 As shown, the embodiment of the present application may include the following steps:

[0080] Step S301: receiving an installation instruction. In the embodiment of the present application, the OTA master control node may first receive an installation command.

[0081] Step S302: Controlling the power-on of the entire vehicle. In the embodiment of the present application, the power-on of the entire vehicle can be controlled by the OTA master node controller.

[0082] Step S303: Wake up the vehicle controller. In the embodiment of the present application, after the OTA master control node receives the installation command, the OTA master control node controller powers on the vehicle and wakes up the vehicle controller.

[0083] Step S304: Collecting safety signals. In the embodiment of the present application, after the OTA master control node wakes up the vehicle controller, the safety-related signals sent by each controller can be continuously collected from the network.

[0084] Step S305: Determine whether all safety signals have been received, if yes, execute step S306, otherwise execute step S307. In the embodiment of the present application, after the OTA master control node continues to collect for 5 seconds, the OTA host node determines whether all safety signals have been received.

[0085] Step S306: Determine whether all security signals meet the requirements, if yes, execute step S308, otherwise execute step S309. The embodiment of the present application can determine whether all signals of the OTA master control node meet the security requirements.

[0086] Step S307: Determine whether all received signals meet the safety state, if yes, execute step S310, otherwise execute step S309. In the embodiment of the present application, when the OTA master control node receives all safety signals, it can determine whether all safety signals meet the safety state.

[0087] Step S308: Execute OTA upgrade. In the embodiment of the present application, when all safety signals meet the safety conditions and it is determined that the current vehicle is in a safe state, OTA upgrade can be executed.

[0088] Step S309: If the condition is not met, the upgrade is terminated. In the embodiment of the present application, when some safety signals do not meet the safety state, that is, the current vehicle is in an unsafe state, it indicates that the OTA upgrade condition is not met, and the upgrade is terminated.

[0089] Step S310: Record abnormal installation status. In the embodiment of the present application, the OTA master control node continues to determine whether all received safety signals meet the safety status. If all received signals meet the safety status, the OTA master control node determines that the current vehicle is in a non-fully safe state, that is, some safety signals are not received and cannot be determined, and the OTA master control node records the abnormal installation status.

[0090] Step S311: Wait for the user to confirm the installation. In the embodiment of the present application, when the OTA master control node detects that the user is using the vehicle, it prompts the user with this information. If the user confirms the upgrade, the OTA master control node wakes up each controller and continues to collect various safety signals.

[0091] Step S312: Determine whether all safety signals are received, if yes, execute step S306, otherwise execute step S313. The embodiment of the present application can determine whether all safety signals are received, if yes, execute step S306, determine whether all signals meet the safety state, if yes, execute OTA upgrade, if not, do not execute OTA upgrade.

[0092] Step S313: Minimum condition detection. In the embodiment of the present application, if the OTA master control node fails to collect all safety signals, a minimum safety condition detection is performed.

[0093] Step S314: Determine whether the minimum condition is met, if yes, execute step S308, otherwise execute step S315. The embodiment of the present application can determine whether the minimum condition is met, and the minimum condition usually includes that the vehicle gear is in P gear, the vehicle engine is not running, the vehicle handbrake is in the pulled state, and three safety signals are met. If two, it is considered that the minimum condition is met, and step S308 is executed to perform OTA upgrade.

[0094] Step S315: End OTA. In the embodiment of the present application, if the minimum condition is not met, the OTA is ended.

[0095] Step S316: Monitor the upgrade status. In the embodiment of the present application, the OTA master control node needs to map the minimum safety conditions to the controllers to which it belongs, and record these controllers. As a key controller, when performing OTA upgrade, the OTA master control node needs to monitor the upgrade status of each upgrade object.

[0096] Step S317: Did the key controller fail to be flashed? If yes, execute step S315, otherwise execute step S318. The embodiment of the present application can determine whether the key controller fails to be flashed. If the flash fails, step S315 can be executed to end the OTA and stop the flashing of subsequent key controllers to ensure that more than two key controllers do not fail to be flashed at the same time.

[0097] Step S318: Upgrade completed. In the embodiment of the present application, if the flashing of the key controller is successful, it means that the upgrade is completed.

[0098] According to the vehicle safety OTA upgrade method proposed in the embodiment of the present application, the vehicle safety signal can be collected according to the OTA master control node, and the upgrade object can be flashed according to the OTA upgrade software package when the vehicle is in a certain safety state, thereby ensuring that the vehicle safety state is confirmed in the event of a controller failure, improving the safety and reliability of OTA upgrades, and ensuring the intelligence and practicality of the vehicle. Thus, the problem that the OTA detection technology for ensuring safety upgrades in the related technology is difficult to cope with the scenario of a lack of controller failure, unable to receive signals and determine the safety state when a safety-related controller fails, difficult to perform OTA safety upgrades, and unable to effectively ensure vehicle safety is solved.

[0099] Next, the vehicle safety OTA upgrade device proposed in accordance with the embodiment of the present application will be described with reference to the accompanying drawings.

[0100] Figure 4 It is a block diagram of a vehicle safety OTA upgrade device according to an embodiment of the present application.

[0101] like Figure 4 As shown, the vehicle safety OTA upgrade device 10 includes: a receiving module 100, a judging module 200 and a flashing module 300.

[0102] Specifically, the receiving module 100 is used to receive an over-the-air download technology OTA upgrade task and an OTA upgrade software package sent by an OTA cloud server.

[0103] The judgment module 200 is used to send an upgrade instruction to the OTA master control node according to the OTA upgrade task, and judge whether the current vehicle is in a preset safety state according to the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction.

[0104] The flashing module 300 is used to flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package if the current vehicle is in a preset safety state.

[0105] Optionally, in one embodiment of the present application, the vehicle safety OTA upgrade device 10 further includes: a control module.

[0106] Among them, the control module is used to control the power-on of the current vehicle after receiving the OTA upgrade task and the OTA upgrade software package, and send a wake-up command to multiple vehicle controllers of the current vehicle.

[0107] Optionally, in an embodiment of the present application, the judgment module 200 includes: a judgment unit, a first judgment unit and a second judgment unit.

[0108] The judging unit is used to judge whether the safety signal of each vehicle controller is received.

[0109] The first determination unit is used to determine that the vehicle is in a preset safety state when a safety signal from each vehicle controller is received and all are in a safe state.

[0110] The second determination unit is used to determine that the vehicle controller is not in a preset safety state when the vehicle controller does not receive a safety signal or is not in a safety state, and to determine that the vehicle controller that has not received the safety signal is invalid.

[0111] Optionally, in one embodiment of the present application, the vehicle safety OTA upgrade device 10 further includes: a prompt module.

[0112] Among them, the prompt module is used to prompt the user with the prompt information generated by the vehicle controller that has not received the safety signal when it is determined that the vehicle controller that has not received the safety signal has failed, if the current vehicle is not in a preset safety state, and after receiving the upgrade instruction generated by the prompt information from the user, flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package.

[0113] Optionally, in one embodiment of the present application, the vehicle safety OTA upgrade device 10 further includes: a detection module and a flash object module.

[0114] Among them, the detection module is used to detect whether the current vehicle meets the preset minimum safety conditions when the current vehicle is not in a preset safety state.

[0115] The flash object module is used to flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package if it is detected that the preset minimum safety condition is met.

[0116] Optionally, in one embodiment of the present application, the preset minimum safety conditions include at least two of the vehicle gear is in P gear, the vehicle engine is not running, and the vehicle handbrake is in a pulled-up state.

[0117] It should be noted that the aforementioned explanation of the vehicle safety OTA upgrade method embodiment is also applicable to the vehicle safety OTA upgrade device of this embodiment, and will not be repeated here.

[0118] According to the vehicle safety OTA upgrade device proposed in the embodiment of the present application, the vehicle safety signal can be collected according to the OTA master control node, and when the vehicle is in a certain safety state, the upgrade object can be flashed according to the OTA upgrade software package, thereby ensuring that the vehicle safety state is confirmed in the event of a controller failure, improving the safety and reliability of OTA upgrades, and ensuring the intelligence and practicality of the vehicle. Thus, the problem that the OTA detection technology for ensuring safety upgrades in the related technology is difficult to cope with the scenario of a lack of controller failure, unable to receive signals and determine the safety state when a safety-related controller fails, difficult to perform OTA safety upgrades, and unable to effectively ensure vehicle safety is solved.

[0119] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0120] A memory 501 , a processor 502 , and a computer program stored in the memory 501 and executable on the processor 502 .

[0121] When the processor 502 executes the program, the vehicle safety OTA upgrade method provided in the above embodiment is implemented.

[0122] Furthermore, the electronic device further comprises:

[0123] The communication interface 503 is used for communication between the memory 501 and the processor 502 .

[0124] The memory 501 is used to store computer programs that can be executed on the processor 502 .

[0125] The memory 501 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0126] If the memory 501, the processor 502 and the communication interface 503 are implemented independently, the communication interface 503, the memory 501 and the processor 502 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0127] Optionally, in a specific implementation, if the memory 501, the processor 502 and the communication interface 503 are integrated on a chip, the memory 501, the processor 502 and the communication interface 503 can communicate with each other through an internal interface.

[0128] The processor 502 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0129] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned vehicle safety OTA upgrade method.

[0130] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0131] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0132] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0133] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or N wirings (electronic devices), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways as necessary and then storing it in a computer memory.

[0134] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0135] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0136] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0137] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A vehicle safety OTA upgrade method, characterized in that: Applied to an OTA client, wherein the method comprises the following steps: Receive OTA upgrade tasks and OTA upgrade software packages sent by OTA cloud server; Sending an upgrade instruction to the OTA master control node according to the OTA upgrade task, and judging whether the current vehicle is in a preset safety state according to the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction; and If the current vehicle is in the preset safety state, flashing at least one target upgrade object of the current vehicle according to the OTA upgrade software package; If the current vehicle is not in the preset safety state, detecting whether the current vehicle meets a preset minimum safety condition; If it is detected that the preset minimum safety condition is met, at least one target upgrade object of the current vehicle is flashed according to the OTA upgrade software package.

2. The method according to claim 1, characterized in that: After receiving the OTA upgrade task and the OTA upgrade software package, the method further includes: Control the current vehicle to power on, and send a wake-up command to multiple vehicle controllers of the current vehicle.

3. The method according to claim 2, characterized in that The determining whether the current vehicle is in a preset safety state according to the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction includes: Determine whether the safety signal of each vehicle controller is received; If the safety signal of each vehicle controller is received and all are in a safe state, it is determined to be in the preset safe state; If the safety signal of any vehicle controller is not received or is not in the safety state, it is determined that it is not in the preset safety state, and it is determined that the vehicle controller that has not received the safety signal is invalid.

4. The method according to claim 3, characterized in that: While determining that the vehicle controller that has not received the safety signal is invalid, it also includes: If the current vehicle is not in the preset safety state, the user is prompted with a prompt message generated by the vehicle controller that has not received the safety signal, and after receiving an upgrade instruction generated by the user from the prompt message, at least one target upgrade object of the current vehicle is flashed according to the OTA upgrade software package.

5. The method according to claim 1, characterized in that The preset minimum safety conditions include at least two of the vehicle gear position being P gear, the vehicle engine not running, and the vehicle handbrake being in a pulled-up state.

6. A vehicle safety OTA upgrade device, characterized in that: Applied to an OTA client, wherein the device comprises: A receiving module is used to receive the OTA upgrade task and OTA upgrade software package sent by the OTA cloud server; A judgment module, used to send an upgrade instruction to the OTA master control node according to the OTA upgrade task, and judge whether the current vehicle is in a preset safety state according to the vehicle safety signal collected by the OTA master control node after receiving the upgrade instruction; and a flashing module, configured to flash at least one target upgrade object of the current vehicle according to the OTA upgrade software package if the current vehicle is in the preset safety state; If the current vehicle is not in the preset safety state, detecting whether the current vehicle meets a preset minimum safety condition; If it is detected that the preset minimum safety condition is met, at least one target upgrade object of the current vehicle is flashed according to the OTA upgrade software package.

7. The device according to claim 6, characterized in that Also includes: A control module is used to control the current vehicle to power on and send a wake-up command to multiple vehicle controllers of the current vehicle after receiving the OTA upgrade task and the OTA upgrade software package.

8. A vehicle, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the vehicle safety OTA upgrade method as described in any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the vehicle safety OTA upgrade method as described in any one of claims 1-5.

Images