A new energy bus and a whole vehicle OTA control method

Abstract

The present invention relates to a control method for a new energy bus and a whole vehicle OTA, and belongs to the technical field of new energy buses. The control method comprises: after receiving the whole vehicle OTA upgrade instruction, the whole vehicle controller determines whether the vehicle meets the vehicle locking condition; the upgrade instruction includes at least the upgrade instruction of one of the devices of BMS, motor controller, whole vehicle controller, instrument host, and vehicle terminal; if the vehicle meets the vehicle locking condition, the motor controller is controlled to be in shutdown mode, and the vehicle locking logic is executed; after the vehicle is locked, the upgrade package is downloaded, and the downloaded upgrade package is sent to the device to be upgraded; the device to be upgraded performs a flash write operation according to the received upgrade package to complete the upgrade. When the BMS, motor controller, whole vehicle controller, instrument host, and vehicle terminal are upgraded, the present invention executes the vehicle locking logic, and does not perform sleep control on these devices, thereby avoiding the danger of sleep control, and monitoring the status of the vehicle in real time to ensure the safety of the upgrade.

Description

Technical Field

[0001] The present invention relates to a new energy bus and a whole vehicle OTA control method, belonging to the technical field of new energy buses. Background Art

[0002] With the development of intelligent networking and autonomous driving technologies, software-defined vehicles (SDVs) will become an important development trend in the automotive industry. In the era of software-defined vehicles, vehicle OTA technology (OTA (Over The Air) air download technology, remote upgrade technology, vehicle OTA refers to the remote upgrade technology of the vehicle level (including multiple components)) is an effective guarantee for software-enabled vehicles. It can realize remote upgrades of vehicle software, bug fixes, and security improvements, and will become a standard feature of intelligent networked vehicles.

[0003] For vehicle-level OTA, especially new energy buses, as public transportation, different from private cars, if the timing of batch remote upgrades is only determined by the system to determine whether the conditions are met, there may be misjudgment scenarios (such as temporary parking due to waiting for traffic lights). At this time, if the program update state is entered, it will affect vehicle operations.

[0004] At the same time, in order to improve the safety of the vehicle during OTA, the existing method is generally to control all non-upgraded ECUs to be silent or dormant. For example, the Chinese invention patent application document with application publication number CN 106656565 A discloses a remote update method, device and system for automobile controllers, wherein the remote update method includes: when the vehicle meets the update conditions, control the non-updated ECUs to stop working and enter the dormant mode. However, requiring the non-upgraded ECUs to enter the dormant mode has the following problems:

[0005] 1. It is not suitable for commercial vehicle designated parts and complex network architecture scenarios, for example: a. Passenger vehicles are produced in a customer-ordered model. For example, components such as batteries, instruments, air conditioners, recorders, and assisted driving configurations often have materials from designated manufacturers, and their technical status varies, making it impossible to guarantee that all of them support the sleep function; b. There are many types of passenger vehicles, and the network structure varies with the vehicle configuration. The product development and order processing cycle cannot guarantee that all non-upgraded ECUs support the sleep function requirements.

[0006] 2. The vehicle safety and normal upgrade during the upgrade process cannot be guaranteed, for example:

[0007] a. After the vehicle is fully charged and during the upgrade of the motor controller, if the battery management system, fire extinguishing system, and VCU are all in sleep mode, the battery management system cannot effectively monitor the single cell voltage and temperature abnormalities. If the fire extinguishing device cannot be activated after reaching the temperature threshold, and the VCU cannot transmit the corresponding data to the on-board terminal, then the vehicle cannot protect itself after an accident and cannot upload an alarm to the background, resulting in an "accident blind spot".

[0008] b. For buses, if the VCU and motor controller support sleep mode, during batch upgrades, when another component is upgraded, the VCU and motor controller exit sleep mode, but the vehicle status is uncertain (such as handbrake, gear position, key ignition, etc.). This is an abnormal vehicle power-on and power-off process. If there is no definite vehicle locking protection mechanism, the vehicle will be at risk of driving.

[0009] c. For models with complex network structures, such as models with gateways, if some key upgrade information is forwarded through the gateway, the normal upgrade process will be affected after the gateway goes into sleep mode.

[0010] d. The existing industry mostly relies on silent commands in the UDS (Unified Diagnostic Services) protocol to achieve "sleep". However, the effective sending of this command can be achieved without going through a security authentication service. The "sleep" mode can be directly modified through external devices, which poses an information security risk and creates uncertain safety hazards for vehicles. Summary of the invention

[0011] The purpose of this application is to provide a control method for new energy buses and whole vehicle OTA, so as to solve the problem that the existing control method is not suitable for buses and has low safety.

[0012] To achieve the above purpose, the present application proposes a technical solution for a control method of OTA for a new energy bus, the control method comprising the following steps:

[0013] 1) After receiving the vehicle OTA upgrade instruction, the vehicle controller determines whether the vehicle meets the vehicle locking conditions; the upgrade instruction includes at least one of the upgrade instructions of the BMS, motor controller, vehicle controller, instrument host, and vehicle terminal;

[0014] 2) If the vehicle meets the locking conditions, the motor controller is controlled to the stop mode and the locking logic is executed;

[0015] 3) After the vehicle is locked, the upgrade package is downloaded and sent to the device to be upgraded; the device to be upgraded performs a flashing operation according to the received upgrade package to complete the upgrade. During the downloading of the upgrade package, the low-voltage power supply is obtained by the power battery through DC / DC conversion. During the flashing process, the low-voltage power supply is provided by the battery.

[0016] The beneficial effect of the technical solution of the control method for OTA of the whole vehicle of new energy passenger bus of the present invention is: when the BMS, motor controller, whole vehicle controller, instrument host, and on-board terminal are upgraded, the present invention executes the vehicle locking logic and does not perform sleep control on these devices, thus avoiding the danger of sleep control, and the operation of these devices can also monitor the status of the vehicle in real time to ensure the safety of the upgrade.

[0017] Furthermore, in order to avoid false triggering of the upgrade instruction, in the step 1), after receiving the whole vehicle OTA upgrade instruction, the step of confirming the upgrade instruction is also included.

[0018] Furthermore, the upgrade command is confirmed through human-computer interaction or vehicle-side operation.

[0019] Furthermore, the vehicle locking conditions include: the vehicle speed is 0, the gear is in neutral, the parking is valid, the vehicle is not in limp home mode, and the vehicle is not in charging state.

[0020] Furthermore, in order to avoid the power battery feeding and affecting the normal starting of the vehicle, the BMS is in working state during the download of the upgrade package, and monitors the remaining power of the power battery in real time. When the remaining power of the power battery reaches the SOC lower limit threshold for the next normal start of the vehicle, the DC / DC is controlled to be turned off and the upgrade is suspended.

[0021] Furthermore, after the upgrade is completed, the locked state can be released by restarting the vehicle.

[0022] In addition, the present application also proposes a technical solution for a new energy bus, the new energy bus includes a vehicle body and a BMS, a motor controller, a vehicle controller, an instrument host, and a vehicle terminal communicating via CAN;

[0023] After receiving the vehicle OTA upgrade command, the vehicle terminal sends a vehicle lock command to the vehicle controller, and the vehicle controller determines whether the vehicle meets the vehicle lock conditions; the upgrade command includes at least one of the upgrade commands of the BMS, motor controller, vehicle controller, instrument host, and vehicle terminal;

[0024] If the vehicle meets the locking conditions, the motor controller is controlled to the stop mode and the locking logic is executed;

[0025] After the vehicle is locked, the upgrade package is downloaded and sent to the device to be upgraded. The device to be upgraded performs a flashing operation according to the received upgrade package to complete the upgrade. During the downloading of the upgrade package, the low-voltage power supply is obtained by the power battery through DC / DC conversion. During the flashing process, the low-voltage power supply is provided by the battery.

[0026] The beneficial effect of the technical solution of the new energy bus of the present invention is that when the BMS, motor controller, vehicle controller, instrument host, and on-board terminal of the new energy bus of the present invention are upgraded, the vehicle locking logic is executed and these devices are not put into sleep mode, thus avoiding the danger of sleep mode control. Moreover, the operation of these devices can also monitor the status of the vehicle in real time to ensure the safety of the upgrade.

[0027] Furthermore, in order to improve the safety of the upgrade, the BMS, motor controller, vehicle controller, instrument, and vehicle terminal all include two CAN communication lines, one for body CAN communication and the other for OTA CAN communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a network architecture diagram of the control system of the new energy bus OTA of the present invention;

[0029] Figure 2 This is a flow chart of the OTA upgrade of the new energy bus of the present invention;

[0030] Figure 3 It is a control block diagram of the whole vehicle OTA of the new energy passenger car of the present invention. DETAILED DESCRIPTION

[0031] New energy bus implementation example:

[0032] The main idea of ​​the present invention lies in the OTA control process of the whole vehicle of new energy vehicles: before the upgrade process of key components: BMS, motor controller, vehicle controller, instrument host, and on-board terminal, it is judged whether the vehicle meets the safe locking conditions. After the locking conditions are met, the motor controller is controlled to enter the parking mode. After the whole vehicle OTA upgrade command is issued on the server side, in order to realize the monitoring of the vehicle status, these devices are not in a dormant state and need to be upgraded while working. Since the upgrade process includes downloading the upgrade package and flashing, therefore, when downloading the upgrade package, these devices are in a working state to monitor the vehicle, and the flashing operation can be flashed as needed to ensure the safety of the vehicle during the upgrade process.

[0033] Specifically, during the vehicle OTA process, the sleep / non-sleep status of each device at different stages is shown in Table 1:

[0034] Table 1 List of device sleep states during vehicle OTA process

[0035]

[0036] Note: For the components marked as “dormant” in the above table, if the upgraded component is itself, it needs to respond normally to the upgrade command.

[0037] Specifically, new energy buses such as Figure 1As shown, it includes the vehicle body, BMS, motor controller, vehicle controller, instrument host, and vehicle terminal. The server side (platform / mobile terminal) communicates wirelessly with the vehicle terminal, and the vehicle controller, motor controller, BMS, instrument host and vehicle terminal are connected through CAN communication, where CAN communication is two independent communications, including the vehicle body communication channel and the OTA upgrade channel, such as Figure 1 As shown, the body communication channel is isolated from the OTA upgrade channel. The vehicle terminal is connected to the gateway through diagnostic CAN communication; the instrument host is connected to the gateway through interactive CAN communication; the vehicle controller, motor controller, and BMS are connected to the gateway through power CAN communication; the gateway communicates wirelessly with the server; at the same time, the vehicle terminal, the vehicle controller, the motor controller, the BMS, and the instrument host are also connected to the gateway through the OTA CAN upgrade channel to complete the equipment upgrade through the OTA CAN upgrade channel. The significance of isolating the vehicle terminal, the vehicle controller, the motor controller, the BMS, and the body communication channel of the instrument from the OTA upgrade channel is that the body communication channel monitors the vehicle status, and the OTA upgrade channel transmits the upgrade data to avoid too much data in one channel, and ensure that the communication control channel of key components works normally during the upgrade to respond to the reporting and emergency handling of serious faults.

[0038] Specifically, the vehicle OTA upgrade process is as follows: Figure 2 , Figure 3 As shown, the following steps are included:

[0039] 1) The server sends batch OTA upgrade instructions to the vehicle terminal and confirms the upgrade instructions. The upgrade instructions include at least one of the upgrade instructions for the BMS, motor controller, vehicle controller, instrument host, and vehicle terminal.

[0040] In this step, after the server sends the batch OTA upgrade task for the entire vehicle, the corresponding reminder can be received on the mobile phone APP or the instrument interface. For vehicles with OTA HMI human-computer interaction scenes on the vehicle side, customers can confirm the upgrade according to the instrument prompts; for vehicles without OTA HMI human-computer interaction scenes on the vehicle side, customers can perform vehicle-side confirmation operations according to the unified notification requirements of the management personnel who issued the upgrade command, such as opening and closing the door 3 times within 10 seconds.

[0041] 2) After confirming the upgrade, the vehicle terminal sends a vehicle lock command to the vehicle controller, and the vehicle controller determines whether the vehicle lock conditions are met. If the vehicle lock conditions are met, the vehicle controller controls the motor controller to the stop mode and executes the vehicle lock control.

[0042] The vehicle terminal receives the vehicle status information in real time. When the upgrade confirmation operation is received within the set time t, it establishes communication with the vehicle controller through the security authentication of the UDS service, enters the extended session mode, and issues a lock command. The vehicle controller receives the lock command and determines whether the vehicle status meets the safe lock execution conditions. If so, it controls the motor controller to the shutdown mode and executes the lock control logic. After the motor controller stops, the result of the shutdown and lock and the speed of the motor are fed back to the vehicle controller, and then fed back to the vehicle terminal. After the car is locked successfully, the vehicle will be unable to drive.

[0043] The vehicle meets the safe locking execution conditions including: the vehicle speed is 0, the gear is in neutral, the parking is valid, it is not in limp home mode, and it is not charging.

[0044] 3) After the vehicle is locked, the upgrade package is downloaded and sent to the device to be upgraded. The device to be upgraded performs the flashing operation according to the received upgrade package to complete the upgrade. During the download of the upgrade package, the vehicle controller controls the DC / DC (high-voltage to low-voltage DC converter) to start, and the low-voltage power supply is obtained by the power battery through DC / DC conversion. When the download is completed, the vehicle controller controls the DC / DC to shut down during the flashing process, and the low-voltage power supply is provided by the battery to ensure that all high-voltage electrical equipment is in shutdown mode to ensure the safety of flashing.

[0045] During the upgrade package download process, that is, the DC / DC working process, the BMS is in working state, monitoring the remaining power of the power battery in real time and transmitting it to the vehicle controller. When the remaining power of the power battery reaches the SOC lower limit threshold for the next normal start of the vehicle (that is, under abnormal circumstances), the vehicle controller controls the DC / DC to shut down, reports to the on-board terminal, and suspends the upgrade.

[0046] In step 3), the entire upgrade process includes two processes: downloading and flashing, and a separate execution mechanism for downloading and flashing is adopted. The server sends the upgrade package to the vehicle terminal, and the vehicle terminal sends the upgrade package to each device to be upgraded. The devices to be upgraded all support the function of storing the upgrade package locally and then uniformly executing the flashing function.

[0047] Since the download process of the upgrade package takes a long time, in order to meet the low-voltage power consumption of the entire process, the vehicle controller will start the DC / DC operation when it detects that the upgrade status sent by the on-board terminal is "downloading", and provide low-voltage electricity through the power battery through DC / DC conversion, thereby achieving sufficient energy source during the download process; the flashing process takes a short time, and the battery alone can meet the energy source. In order to ensure the safety of the vehicle, all high-voltage electrical equipment is disconnected. When the vehicle controller detects that the upgrade status sent by the on-board terminal is "installing", the vehicle DC enable will be turned off, and the flashing operation will be completed by battery power supply.

[0048] During the flashing process of the above program, the control function status of related components is uncertain. To ensure vehicle safety, all high-voltage electrical equipment should be shut down to avoid safety risks caused by abnormal starting and driving of the vehicle.

[0049] For new energy buses, the onboard terminal is only a channel for reading, analyzing, storing, and uploading to the background, and does not participate in the vehicle control function. As the energy management unit at the vehicle level, the vehicle controller is the core control component of high and low voltage power supply, so the working state of DC / DC is controlled by the vehicle controller.

[0050] 4) After the upgrade is completed, the upgrade results will be reported. To avoid abnormal situations, customers can restart the vehicle by powering off, unlocking the vehicle, and resuming normal use.

[0051] The abnormal situation in step 4) refers to: the state of the parts after the upgrade is completed is the initialization state, and the vehicle itself has not undergone a restart process after the upgrade is completed, which affects the control timing of each component. If the vehicle is started at this time, the state is uncertain (taking the vehicle controller as an example, after the upgrade is completed, the key needs to be turned from OFF to ON to normally control the vehicle to perform the next action. Therefore, the abnormal situation here refers to the situation where the control function does not meet expectations due to the failure to restart the vehicle after the upgrade is completed). Therefore, the locked state of the vehicle is released by powering off and restarting.

[0052] Of course, if the vehicle itself is equipped with a power distribution management system that can interact with the vehicle terminal, then the vehicle terminal can directly send a remote command to the power distribution management system to execute a power-off restart, and the vehicle controller will automatically unlock after restarting; or the vehicle terminal sends an unlock command to the vehicle controller, and the vehicle controller can execute the unlock function. The present invention does not limit the specific implementation of how to unlock.

[0053] In the above embodiment, in order to avoid false triggering of the upgrade process and effectively ensure the normal operation of the vehicle, after receiving the vehicle OTA upgrade instruction, the step of confirming the upgrade instruction is also included. Of course, the step of confirming the upgrade instruction can be omitted if it is guaranteed that false triggering will not occur.

[0054] The conditions for locking the car can be set according to the actual situation. The corresponding judgment parameters can be increased or reduced to ensure the safety of locking the car.

[0055] In the above embodiment, in order to avoid the power battery feeding during the download process, the power battery charge is monitored during the download process. As another implementation method, the power charge may not be monitored while ensuring the power battery charge.

[0056] The present invention realizes vehicle status monitoring by controlling key equipment after executing the vehicle locking logic during the upgrade process, thereby ensuring the safety of the upgrade.

[0057] Implementation example of control method for OTA of new energy bus:

[0058] The implementation process and effects of the control method for OTA of the whole new energy bus have been introduced in the above-mentioned new energy bus embodiment and will not be repeated here.

Claims

1. A control method for OTA of a new energy bus, characterized in that: The following steps are involved: 1) After receiving the vehicle OTA upgrade command, the vehicle controller determines whether the vehicle meets the vehicle locking conditions; the upgrade command includes at least one of the upgrade commands of the BMS, motor controller, vehicle controller, instrument host, and vehicle terminal. The device is not in a dormant state and is upgraded while working; 2) If the vehicle meets the locking conditions, the motor controller is controlled to stop mode and the locking logic is executed; 3) After the vehicle is locked, the upgrade package is downloaded and sent to the device to be upgraded; the device to be upgraded performs a flashing operation according to the received upgrade package to complete the upgrade. During the downloading of the upgrade package, the low-voltage power supply is obtained by the power battery through DC / DC conversion. During the flashing process, the vehicle controller controls the DC / DC to be turned off, and the low-voltage power supply is provided by the battery; During the upgrade package download process, the BMS is in working condition and monitors the remaining power of the power battery in real time. When the remaining power of the power battery reaches the SOC lower limit threshold for the next normal start of the vehicle, the DC / DC is controlled to be turned off and the upgrade is suspended.

2. The control method for OTA of a new energy bus according to claim 1 is characterized in that: In the step 1), after receiving the vehicle OTA upgrade instruction, the step of confirming the upgrade instruction is also included.

3. The control method for OTA of a new energy bus according to claim 2 is characterized in that: Confirm the upgrade command through human-computer interaction or vehicle-side operation.

4. The control method for OTA of a new energy bus according to claim 1, 2 or 3, characterized in that: The vehicle locking conditions include: the vehicle speed is 0, the gear is in neutral, the parking is valid, the vehicle is not in limp home mode, and the vehicle is not in charging state.

5. The control method for OTA of a new energy bus according to claim 1, characterized in that: After the upgrade is complete, restart the vehicle to unlock it.

6. A new energy bus, characterized in that: Including the vehicle body and BMS, motor controller, vehicle controller, instrument host, and vehicle terminal communicating through CAN; After receiving the vehicle OTA upgrade command, the vehicle terminal sends a vehicle lock command to the vehicle controller, and the vehicle controller determines whether the vehicle meets the vehicle lock conditions; the upgrade command includes at least one of the upgrade commands of the BMS, motor controller, vehicle controller, instrument host, and vehicle terminal, and the device is not in a dormant state and is upgraded while working; If the vehicle meets the locking conditions, the motor controller is controlled to the stop mode and the locking logic is executed; After the vehicle is locked, the upgrade package is downloaded and sent to the device to be upgraded. The device to be upgraded performs a flashing operation according to the received upgrade package to complete the upgrade. During the downloading of the upgrade package, the low-voltage power supply is obtained by the power battery through DC / DC conversion. During the flashing process, the vehicle controller controls the DC / DC to be turned off, and the low-voltage power supply is provided by the battery. During the upgrade package download process, the BMS is in working condition and monitors the remaining power of the power battery in real time. When the remaining power of the power battery reaches the SOC lower limit threshold for the next normal start of the vehicle, the DC / DC is controlled to be turned off and the upgrade is suspended.

7. The new energy bus according to claim 6, characterized in that: BMS, motor controller, vehicle controller, instrument, and vehicle terminal all include two CAN communication lines, one for body CAN communication and the other for OTA CAN communication.

Images