OTA upgrade methods and storage media

Abstract

This application provides an OTA upgrade method and storage medium. The method includes: a vehicle gateway responding to a segmented flashing instruction and determining at least one flashing logical address corresponding to the segmented flashing instruction; the vehicle gateway determining a flashing network segment corresponding to each flashing logical address based on the at least one flashing logical address and a pre-configured address network segment mapping table, and forwarding the segmented flashing instruction to each flashing network segment; for each flashing network segment, upon receiving the segmented flashing instruction, closing the communication corresponding to the flashing network segment; each controller to be flashed within the flashing network segment responding to the segmented flashing instruction and performing flashing; and after all controllers to be flashed have completed flashing, the flashing network segment opening the communication corresponding to the flashing network segment. This application eliminates the need to mute all communication network segments of the vehicle during OTA upgrades, thereby providing communication data support for other functions that do not require upgrades and improving user experience.

Description

Technical Field

[0001] This application relates to the field of automotive electronic systems technology, specifically to an OTA upgrade method and storage medium. Background Technology

[0002] The vehicle controller integrates an OTA Manager (Over-the-Air Technology Manager) that uses the UDS (Unified Diagnostic Services) diagnostic protocol to flash the software of other controllers in the vehicle, thereby enabling the vehicle controller software to be upgraded.

[0003] However, during the entire OTA software flashing process, the vehicle's communication is muted, which prevents the vehicle from providing users with more functional experiences during the OTA upgrade process, resulting in a poor user experience. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, this application aims to provide an OTA upgrade method and storage medium to solve the problem that other functions cannot be used due to the mute processing of all communication network segments during the OTA upgrade process.

[0005] This application embodiment provides a vehicle gateway that, in response to a segmented flashing instruction, determines at least one flashing logical address corresponding to the segmented flashing instruction;

[0006] The vehicle gateway determines the flashing network segment corresponding to each of the flashing logical addresses based on the at least one flashing logical address and a pre-configured address network segment mapping table, and forwards the segmented flashing instruction to each of the flashing network segments.

[0007] For each of the aforementioned flashing segments, when the flashing segment receives the segmented flashing instruction, it closes the communication corresponding to the flashing segment.

[0008] Each controller to be written within the writing network segment responds to the segmented writing command and performs writing;

[0009] Once all the controllers to be written have completed the writing process, the writing network segment initiates communication corresponding to that writing network segment.

[0010] Optionally, before the vehicle gateway determines at least one flashing logical address corresponding to the segmented flashing instruction in response to the segmented flashing instruction, the method further includes:

[0011] The vehicle controller sends the segmented flashing command to the vehicle gateway via the Ethernet flashing protocol;

[0012] Accordingly, in response to the segmented flashing instruction, the vehicle gateway determines at least one flashing logical address corresponding to the segmented flashing instruction, including:

[0013] The vehicle gateway responds to the segmented flashing command by parsing the segmented flashing command according to the Ethernet flashing protocol to determine at least one flashing logical address carried by the segmented flashing command.

[0014] Optionally, the controller to be flashed is a dual-partition controller. After each controller to be flashed within the flashing network segment responds to the segmented flashing command and performs flashing, the system further includes:

[0015] The dual-partition controller responds to a partition-splitting instruction and determines the partition-splitting operation of the dual-partition controller based on the partition-splitting instruction; wherein the partition-splitting instruction includes blocking a partition-splitting instruction and / or executing a partition-splitting instruction.

[0016] Optionally, the partition-splitting instruction includes a partition-blocking instruction. The dual-partition controller includes a first partition and a second partition, where the first partition is the currently running partition and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-blocking flag. In response to the partition-splitting instruction, the dual-partition controller determines the partition-splitting operation based on the instruction, including:

[0017] In response to the block partitioning command, the dual-partition controller controls the running area flag to correspond to the first area, and the block partitioning flag is set to true.

[0018] The dual-partition controller determines that the partition cutting operation of the dual-partition controller is slicing and executes the program in the first partition based on the running area flag bit and the partition cutting prevention flag bit.

[0019] Optionally, the partition-splitting instruction includes executing a partition-splitting instruction. The dual-partition controller includes a first partition and a second partition, where the first partition is the currently running partition and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-splitting prevention flag. In response to the partition-splitting instruction, the dual-partition controller determines the partition-splitting operation based on the partition-splitting instruction, including:

[0020] In response to the execution partition switching command, the dual-partition controller controls the running area flag to correspond to the second area, while the partition switching prevention flag remains unchanged.

[0021] The dual-partition controller determines the partitioning operation of the dual-partition controller to execute the program in the second partition based on the running area flag bit and the partition blocking flag bit.

[0022] Optional, also includes:

[0023] The dual-zone controller initializes the operating zone flag bit and controls the operating zone flag bit to be the first zone;

[0024] The dual-partition controller initializes the blocking partition flag and controls the blocking partition flag to a false value.

[0025] Optionally, the dual-partition controller includes a first partition and a second partition, wherein the first partition is the running partition and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-blocking flag. After determining the partition-blocking operation of the dual-partition controller, the following steps are further included:

[0026] The dual-partition controller responds to a hardware reset command. If the partition blocking flag is true, it controls the partition blocking flag to be false, controls the running area flag to correspond to the first partition, and executes the program in the first partition. If the partition blocking flag is false, it controls the running area flag to correspond to the second partition and executes the program in the second partition.

[0027] Optionally, after the dual-partition controller responds to a partition-splitting command and determines the partition-splitting operation of the dual-partition controller based on the partition-splitting command, the method further includes:

[0028] The dual-zone controller obtains the execution result corresponding to the whether-zone-switching instruction and feeds the execution result back to the vehicle controller.

[0029] Optional, also includes:

[0030] If at least one of the controllers to be flashed has not completed the flashing process, for the controllers to be flashed that have not completed the flashing process, communication is initiated with respect to the controllers to be flashed that have not completed the flashing process, and the process returns to the step of executing the vehicle gateway in response to the segmented flashing instruction and determining at least one flashing logic address corresponding to the segmented flashing instruction.

[0031] This application also provides a computer-readable storage medium storing a program or instructions that cause a computer to perform the steps of the OTA upgrade method described in any embodiment.

[0032] In summary, this application proposes an OTA upgrade method. The vehicle gateway responds to a segmented flashing command, determines at least one flashing logical address corresponding to the command, and then, based on the at least one flashing logical address and a pre-configured address segment mapping table, determines the flashing network segment corresponding to each flashing logical address. The segmented flashing command is forwarded to each flashing network segment so that each segment can receive the command. For each flashing network segment, upon receiving the segmented flashing command, the corresponding communication is closed to achieve a demand-based mute effect. Each controller within the flashing network segment responds to the segmented flashing command and performs the flashing. Once all controllers have completed the flashing, the corresponding communication is reopened. This eliminates the need to mute all communication network segments of the vehicle during OTA upgrades, thus providing communication data support for other functions that do not require upgrades and improving user experience. Attached Figure Description

[0033] Figure 1 This is a flowchart of an OTA upgrade method provided in an embodiment of this application;

[0034] Figure 2 This is a schematic diagram illustrating an on-demand mute method provided in an embodiment of this application;

[0035] Figure 3 This is a flowchart of another OTA upgrade method provided in the embodiments of this application;

[0036] Figure 4 This is a schematic diagram of a dual-partition controller partitioning implementation method provided in an embodiment of this application;

[0037] Figure 5 This is a flowchart of another OTA upgrade method provided in the embodiments of this application. Detailed Implementation

[0038] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0039] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0040] As mentioned in the background section, in view of the problems in the prior art, this application proposes an OTA upgrade method, which is applicable to the situation where the communication of the vehicle gateway is processed during the OTA upgrade process.

[0041] Figure 1 This is a flowchart of an OTA upgrade method provided in an embodiment of this application. See also... Figure 1 The OTA upgrade method specifically includes:

[0042] S110, the vehicle gateway responds to the segmented flashing instruction and determines at least one flashing logical address corresponding to the segmented flashing instruction.

[0043] The vehicle gateway can be a core component of the vehicle's electronic and electrical architecture, used for information exchange between different electronic components in the vehicle. Segmented flashing commands are instructions used during OTA upgrades to flash (including mute) the electronic components involved in the upgrade. The flashing logical address is the logical address corresponding to the electronic component to be upgraded via OTA; for example, it can be a 2-byte data set, which can be customized as needed.

[0044] Specifically, when the vehicle gateway receives a segmented flashing command, it can respond to it, parse the segmented flashing command, and determine the logical address corresponding to at least one electronic component to be upgraded via OTA, i.e., at least one flashing logical address.

[0045] Optionally, before the vehicle gateway responds to the segmented flashing command and determines at least one flashing logic address corresponding to the segmented flashing command, the vehicle controller can also send the segmented flashing command to the vehicle gateway. Specifically, this can be:

[0046] The vehicle controller sends segmented flashing commands to the vehicle gateway via the Ethernet flashing protocol.

[0047] The vehicle controller can be a host computer integrated with OTA (Over-The-Air) flashing technology, used to control various electronic components of the vehicle to achieve various functions. The Ethernet flashing protocol (Diagnostic Communication over Internet Protocol, DoIP) can be based on in-vehicle Ethernet for diagnostics, and the diagnostic data it transmits is also based on UDS (Unified Diagnostic Services). That is, DoIP is a transmission protocol for transmitting UDS diagnostic data over Ethernet networks.

[0048] Specifically, the vehicle controller sends segmented flashing commands to the vehicle gateway via DoIP, enabling the vehicle gateway to respond to the segmented flashing commands and achieve the effects of segmented mute and subsequent flashing.

[0049] Accordingly, the vehicle gateway can respond to the segmented flashing command in the following way to determine at least one flashing logic address corresponding to the segmented flashing command:

[0050] The vehicle gateway responds to the segmented flashing command by parsing the segmented flashing command according to the Ethernet flashing protocol and determining at least one flashing logical address carried by the segmented flashing command.

[0051] Specifically, after receiving the segmented flashing command sent by the vehicle controller, the vehicle gateway can respond to the segmented flashing command, and then parse the segmented flashing command to obtain at least one flashing logic address carried by the segmented flashing command, which can be used for subsequent segmented mute and flashing processing.

[0052] S120: The vehicle gateway determines the flashing network segment corresponding to each flashing logical address based on at least one flashing logical address and a pre-configured address network segment mapping table, and forwards the segmented flashing instruction to each flashing network segment.

[0053] The address segment mapping table can be a pre-configured table in the vehicle gateway, used to map the logical address to the segment to be flashed. The segment to be flashed can be a CAN (Controller Area Network) segment or a CAN FD (CAN with Flexible Data-rate) segment.

[0054] Specifically, an address segment mapping table can be pre-configured in the vehicle gateway. Then, when the vehicle gateway receives at least one flashing logical address, it can look up the flashing logical address in the address segment mapping table to find the corresponding network segment, i.e., the flashing network segment. After determining each flashing network segment, the segmented flashing command can be forwarded to each flashing network segment to stop communication between them.

[0055] S130. For each flashing segment, when the flashing segment receives the segment flashing command, it closes the communication corresponding to the flashing segment.

[0056] Specifically, for each flashing network segment, when the segment flashing command is received, the communication of the flashing network segment can be muted to achieve the effect of "mute on demand" so as to facilitate subsequent flashing and OTA upgrades.

[0057] An example diagram of on-demand muting is shown below. Figure 2As shown, VCU stands for Vehicle Control Unit, which integrates UA (Update Agent, OTA upgrade program) and Installer (diagnostic flashing program) and is responsible for OTA flashing; GW stands for Vehicle Gateway, which is responsible for communication protocol conversion and signal routing; OTAM stands for OTA Manager, the OTA master control program; Ethernet stands for Ethernet; WCM stands for Wireless Charge Module; AC stands for Air Conditioner; EPS stands for Electric Power Steering; ECAS stands for Electric Control Air Suspension System; BMS stands for Battery Management System; and MCU stands for Motor Control Unit. It is understood that other modules besides the above-mentioned electronic modules can be connected to each network segment, which will not be elaborated here.

[0058] like Figure 2 As shown, the DoIP information parsing result is a logical address: 0x0001, which is the logical address to be flashed; the segmented flashing command is 28 83 03 (function addressing disabled). The flashing network segment corresponding to the logical address to be flashed is network segment 1. Therefore, the segmented flashing command is sent to network segment 1.

[0059] S140. Each controller within the flashing segment responds to the segmented flashing command and performs the flashing.

[0060] The controller to be flashed can be any controller corresponding to the flashing network segment, and can be a single-partition controller or a dual-partition controller. The segmented flashing command can also be a command used to trigger the flashing of the program within the controller to be flashed.

[0061] Specifically, each controller within the network segment to be flashed can perform flashing processing according to the segmented flashing instructions upon receiving them, in order to perform upgrade processing.

[0062] S150. When all controllers to be flashed have completed the flashing process, the flashing network segment starts communication with the corresponding flashing network segment.

[0063] Specifically, if all controllers to be flashed have completed the flashing process, it indicates that the flashing was successful and communication between the flashed network segments can be restored, that is, communication corresponding to the flashed network segments can be started.

[0064] Optionally, if at least one controller to be flashed has not completed the flashing process, for the controller to be flashed that has not completed the flashing process, communication corresponding to the controller to be flashed that has not completed the flashing process is initiated, and the process of executing the vehicle gateway in response to the segmented flashing instruction is returned to determine at least one flashing logic address corresponding to the segmented flashing instruction.

[0065] Specifically, if at least one controller to be flashed has not completed the flashing process, it indicates that a flashing controller has failed to flash. In this case, communication can be initiated with the controller to be flashed that has not completed the flashing process. Then, the process returns to the step of the vehicle gateway responding to the segmented flashing instruction and determining at least one flashing logic address corresponding to the segmented flashing instruction, so as to re-flash the controller to be flashed that has not completed the flashing process.

[0066] The OTA upgrade method provided in this application embodiment involves a vehicle gateway responding to a segmented flashing command, determining at least one flashing logical address corresponding to the segmented flashing command, and then determining a flashing network segment corresponding to each flashing logical address based on the at least one flashing logical address and a pre-configured address network segment mapping table. The vehicle gateway then forwards the segmented flashing command to each flashing network segment so that each flashing network segment can receive the segmented flashing command. For each flashing network segment, upon receiving the segmented flashing command, the flashing network segment closes the communication corresponding to it, achieving the effect of muting as needed. Each controller to be flashed within the flashing network segment responds to the segmented flashing command and performs flashing. Once all controllers to be flashed have completed flashing, the flashing network segment opens the communication corresponding to it. This eliminates the need to mute all communication network segments of the vehicle during OTA upgrades, thereby providing communication data support for other functions that do not require upgrades and improving the user experience.

[0067] Figure 3 This is a flowchart of another OTA upgrade method provided in an embodiment of this application. Based on the above embodiments, when the controller to be flashed is a dual-partition controller, an illustrative explanation is provided regarding whether to issue a partition-switching command for the dual-partition controller, and the process of determining the partition-switching operation based on the partition-switching command. See [link to documentation]. Figure 3 The OTA upgrade method specifically includes:

[0068] S210, the vehicle gateway responds to the segmented flashing instruction and determines at least one flashing logical address corresponding to the segmented flashing instruction.

[0069] S220, the vehicle gateway determines the flashing network segment corresponding to each flashing logical address based on at least one flashing logical address and a pre-configured address network segment mapping table, and forwards the segmented flashing command to each flashing network segment.

[0070] S230. For each flashing segment, when the flashing segment receives the segment flashing command, it closes the communication corresponding to the flashing segment.

[0071] S240, each controller to be flashed within the flashing network segment responds to the segmented flashing command and performs the flashing.

[0072] S250. If the controller to be flashed is a dual-partition controller, the dual-partition controller responds to the partition switching command and determines the partition switching operation of the dual-partition controller based on the partition switching command.

[0073] A dual-partition controller typically includes a running partition and a backup partition. The partition-splitting command includes a prevent partition-splitting command and / or an execute partition-splitting command. The prevent partition-splitting command can be used to prevent the dual-partition controller from switching partitions, while the execute partition-splitting command can be used to trigger the dual-partition controller to switch partitions. The partition-splitting operation includes whether partition-splitting can be performed and the currently running partition.

[0074] Specifically, if the controller to be flashed is a dual-partition controller, the dual-partition controller can respond to the instruction after receiving it, and then perform the corresponding partition cutting operation on the dual-partition controller according to the instruction.

[0075] Optionally, if the partition-splitting command includes a partition-blocking command, and the dual-partition controller includes a first partition and a second partition, where the first partition is the running partition and the second partition is a non-running backup partition, and the dual-partition controller also includes a running partition flag and a partition-blocking flag, then the dual-partition controller can respond to the partition-splitting command in the following way, determining the partition-splitting operation of the dual-partition controller based on the partition-splitting command:

[0076] In response to a block partitioning command, the dual-partition controller controls the operating area flag to correspond to the first partition, and sets the block partitioning flag to true. Based on the operating area flag and the block partitioning flag, the dual-partition controller determines that the partitioning operation is to block partitioning and execute the program in the first partition.

[0077] The running partition flag indicates the currently running partition. The partition blocking flag indicates whether partition blocking should be prevented. A true value indicates that partition blocking is prevented, meaning the dual-partition controller cannot block partitions autonomously; it can only block partitions when it receives an execute partition blocking command (e.g., True). A false value indicates that partition blocking is allowed, meaning the dual-partition controller can block partitions autonomously and can execute partition blocking when it receives an execute partition blocking command (e.g., False).

[0078] Specifically, when the dual-partition controller receives a partition blocking command, it responds by setting the running partition flag to the first partition and setting the partition blocking flag to true. Thus, the dual-partition controller can determine the current partition blocking based on the running partition flag and the partition blocking flag. The currently running partition is the first partition, meaning that the partition blocking operation of the dual-partition controller is to block partition blocking and execute the program in the first partition.

[0079] For example, in a dual-zone controller, the running area flag is set to RunningArea, and the blocking area switching flag is set to BlockExchange. After the vehicle controller finishes flashing the dual-zone controller, it sends a diagnostic routine of 31 01DD 0F, which is a blocking partition command. After the dual-zone controller responds positively, it sets BlockExchange = True and RunningArea = Zone 1.

[0080] Optionally, if the partition-splitting command includes executing a partition-splitting command, and the dual-partition controller includes a first partition and a second partition, where the first partition is the currently running partition and the second partition is a non-running backup partition, and the dual-partition controller also includes a running partition flag and a partition-splitting prevention flag, then the dual-partition controller can respond to the partition-splitting command in the following way, determining the partition-splitting operation of the dual-partition controller based on the partition-splitting command:

[0081] In response to the execution of the partition switching command, the dual-partition controller controls the running area flag to correspond to the second partition, while the partition switching prevention flag remains unchanged. Based on the running area flag and the partition switching prevention flag, the dual-partition controller determines that the partition switching operation is to execute the program in the second partition.

[0082] Specifically, when the dual-partition controller receives an execution partition switching command, it responds to the command by setting the running partition flag to the second partition and keeping the partition switching blocking flag unchanged. Thus, the dual-partition controller can determine that the currently running partition is the second partition based on the running partition flag and the partition switching blocking flag. In other words, the partition switching operation of the dual-partition controller is to execute the program in the second partition.

[0083] For example, in the dual-zone controller, the running area flag is RunningArea and the blocking area switching flag is BlockExchange. The vehicle controller sends the diagnostic routine 31 01DD 04 (executes the area switching command) to the dual-zone controller. After the dual-zone controller responds positively, it sets RunningArea to the second zone and enters the second zone running program after restarting.

[0084] Optionally, the running zone flag and the prevent zone switching flag in the dual-zone controller can also be initialized. Specifically, this can be done as follows:

[0085] The dual-zone controller initializes the operating zone flag bit, controlling the operating zone flag bit to be the first zone; the dual-zone controller initializes the zone-blocking flag bit, controlling the zone-blocking flag bit to be an False value.

[0086] Specifically, before flashing the dual-partition controller, you can perform an initialization operation on the dual-partition controller, initialize the running area flag to the first partition, and initialize the partition-blocking flag to a false value.

[0087] Optionally, the dual-partition controller includes a first partition and a second partition. The first partition is the currently running partition, and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-blocking flag. After determining the partition-blocking operation of the dual-partition controller, a hardware reset operation can also be performed, specifically:

[0088] The dual-zone controller responds to a hardware reset command. If the blocking partition flag is true, it controls the blocking partition flag to be false, controls the running zone flag to correspond to the first zone, and executes the program in the first zone. If the blocking partition flag is false, it controls the running zone flag to correspond to the second zone, and executes the program in the second zone.

[0089] The hardware reset instruction can be an instruction used to trigger a hardware reset of the dual-partition controller.

[0090] Specifically, when the dual-zone controller receives a hardware reset command, it responds to the hardware reset command. If the blocking partition flag is true, it sets the blocking partition flag to false, sets the running zone flag to the first zone, and executes the program in the first zone. If the blocking partition flag is false, it sets the running zone flag to the second zone and executes the program in the second zone.

[0091] For example, in the dual-zone controller, the running area flag is RunningArea and the blocking area flag is BlockExchange. The vehicle controller sends 11 01, i.e., a hardware reset command, to the dual-zone controller. After responding to the hardware reset command, the dual-zone controller determines whether BlockExchange is True. If it is True, it still enters the first zone running program and sets BlockExchange to False. If it is False, it enters the second zone running program.

[0092] Optionally, after the dual-zone controller responds to a zone-switching command and determines the zone-switching operation based on the command, it can also report the execution status of the zone-switching operation to the vehicle controller. Specifically, this can be done as follows:

[0093] The dual-zone controller obtains the execution result corresponding to the zone switching command and feeds the execution result back to the vehicle controller.

[0094] The execution result can be an indicator of whether the partition cutting instruction was executed successfully.

[0095] Specifically, after responding to a zone-switching command, the dual-zone controller can determine the response result, i.e., the execution result corresponding to the zone-switching command. Then, it can feed back the execution result to the vehicle controller so that the vehicle controller can perform subsequent operations.

[0096] S260. When all controllers to be flashed have completed the flashing process, the flashing network segment starts communication corresponding to the flashing network segment.

[0097] An exemplary schematic diagram of a dual-partition controller partitioning implementation is shown below. Figure 4 As shown, in the dual-zone controller, the running area flag is RunningArea, the blocking area switching flag is BlockExchange, the first zone is denoted as Zone A, the second zone is denoted as Zone B, 31 01DD 0F indicates blocking area switching instruction, xx=00 indicates receiving and executing the corresponding whether to switch areas instruction, 71 01DD 0F xx indicates the execution result of blocking area switching instruction, 11 01 indicates hardware reset instruction, 71 01 indicates the execution result of hardware reset instruction, 31 01DD 04 indicates executing area switching instruction, and 31 01DD 04xx indicates the execution result of executing area switching instruction.

[0098] Understandably, if a flashing error occurs, the program in the first partition will continue to run normally because the dual-partition controller responds to the resistance switching command. No rollback operation is required; only the single-partition controller needs to be rolled back. This greatly reduces the complexity of OTA software version rollback and improves the success rate of version rollback.

[0099] The OTA upgrade method provided in this application embodiment, if the controller to be flashed is a dual-zone controller, the dual-zone controller responds to the whether to switch zones command, and determines the zone switching operation of the dual-zone controller according to the whether to switch zones command, so as to realize the vehicle controller actively controls whether the dual-zone controller switches zones, avoids the effect of the dual-zone controller switching zones unexpectedly, and at the same time reduces the complexity of OTA software version rollback and improves the rollback success rate.

[0100] Figure 5 This is a flowchart of another OTA upgrade method provided in an embodiment of this application. See also... Figure 5 The OTA upgrade method specifically includes:

[0101] (1) Domain-wide DTC (Diagnostic Trouble Code) disabling procedure: 1. Domain controller broadcasts function address 10 83; 2. Domain controller broadcasts function address 3E 80 (sent every 2 seconds); 3. Domain controller broadcasts function address 85 82 to disable DTC. Subsequently, respond to segmented flashing commands, determine the flashing network segment, and execute segmented flashing as needed.

[0102] (2) Flashing / Installation Preparation Process (within a single network segment, i.e., within each flashing network segment): 1. The domain controller sends physical address 31 01 02 03 to perform pre-programming condition detection on the controller to be upgraded; 2. The domain controller sends functional address 85 82 (disable DTC recording); 3. The domain controller sends functional address 28 83 01 (disable communication 1); 4. The domain controller sends functional address 28 83 03 (disable communication 2); 5. The domain controller sends physical address 22F0F0 (query activation area).

[0103] (3) Flashing / Installation Execution Process (within a single network segment): 1. Domain controller sends physical address 10 02 (enters programming session mode); 2. Domain controller sends physical address 27 09 / 27 0A (performs secure access); 3. Domain controller sends physical address 2E F1 84 (writes fingerprint information); 4. Domain controller performs software flashing or file transfer according to diagnostic flashing specifications; 5. (Optional, condition is dual-partition controller) Domain controller sends physical address 31 01DD 0F (prevents partition switching command sent to dual-partition controller); 6. Domain controller sends physical address 31 01FF 01 (data compatibility verification); 7. (Optional, condition is intelligent ECU (Electronic Control Unit)) Domain controller sends physical address 31 01DD 03 (start installation command sent to intelligent ECU); 8. (Optional, condition is intelligent ECU) Domain controller sends physical address 22F0F2 (for intelligent ECU installation progress query).

[0104] (4) The domain controller determines whether the flashing was successful. If it was, it executes (5); otherwise, it executes (7).

[0105] (5) Flashing / Installation Completion Process (within a single network segment): 1. Domain controller sends function address 28 80 01 (opens communication 1); 2. Domain controller sends function address 28 80 03 (opens communication 2); 3. Domain controller sends physical address 11 01 (ECU reset); 4. Domain controller sends function address 10 83 (enters extended mode); 5. Domain controller sends function address 85 82 (disables DTC). Then, (6) or (10) can be executed.

[0106] (6) Controller partition switching process (within a single network segment): Follow the partition switching process of the dual-partition controller, that is, respond to the partition switching command. It can be understood that (6) can be executed after (5) or after (12). If it is executed after (5), then (10) will be executed after (6); if it is executed after (12), then (6) will be executed after the judgment result is yes, and (17) will be executed.

[0107] (7) Check if the number of re-flashes is greater than the configured number. If not, execute (8); if yes, execute (9).

[0108] (8) Re-flashing process (within a single network segment): 1. Domain controller sends function address 28 80 01 (open communication 1); 2. Domain controller sends function address 28 80 03 (open communication 2); 3. Domain controller sends physical address 11 01 (ECU reset); 4. Domain controller sends function address 10 83 (enter extended mode); 5. Domain controller sends function address 85 82 (disable DTC); 6. Domain controller re-sends instructions according to the flashing / installation preparation process; 7. Domain controller re-sends instructions according to the flashing / installation execution process.

[0109] (9) Flashing / Installation Completion Process (within a single network segment): 1. Domain controller sends function address 28 80 01 (opens communication 1); 2. Domain controller sends function address 28 80 03 (opens communication 2); 3. Domain controller sends physical address 11 01 (ECU reset); 4. Domain controller sends function address 10 83 (enters extended mode); 5. Domain controller sends function address 85 82 (disables DTC). Then, execute (10).

[0110] (10) Domain controller sends physical address 22F1 89 (get software version information).

[0111] (11) The domain controller determines whether the version is correct. If yes, it executes (12); otherwise, it executes (13).

[0112] (12) The domain controller determines whether all ECUs have been flashed / installed. If yes, it executes (17) or executes (6) and (17) in sequence; otherwise, it executes (16).

[0113] (13) OTAMangner (vehicle upgrade control) reports the rollback reason and notification to the OTA platform; the rollback information is displayed on the large screen and executed (14).

[0114] (14) Version rollback process (flashing / installing the previous version of the software): For single-partition controllers: 1. The domain controller sends instructions according to the flashing / installation preparation process; 2. The domain controller sends instructions according to the flashing / installation execution process; 3. The domain controller sends instructions after the flashing / installation process is completed; For dual-partition controllers: 1. Follow the controller partition switching process. Then, execute (15).

[0115] (15) The domain controller determines whether all ECUs have been rolled back. If yes, it executes (17); otherwise, it returns to execute (14).

[0116] (16) Determine whether the VDC has been flushed. If yes, return to execute (1); otherwise, return to execute (2).

[0117] (17) Waiting to enter the OTA exit stage.

[0118] The OTA upgrade method provided in this application adds an "on-demand mute" strategy to the OTA flashing process. During the OTA upgrade process, it is not necessary to mute all network segments of the vehicle, providing a communication foundation for the various upgraded functions, thereby bringing users a better OTA upgrade experience. Furthermore, based on the OTA flashing process, "prevent partition switching" and "execute partition switching" strategies are added. The vehicle controller leads the dual-zone controller to perform partition switching, avoiding unexpected partition switching of the dual-zone controller. At the same time, it can also reduce the complexity of OTA software version rollback and improve the success rate of version rollback.

[0119] In addition to the methods described above, embodiments of this application may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps of the OTA upgrade method provided in any embodiment of this application.

[0120] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0121] Furthermore, embodiments of this application may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the OTA upgrade method provided in any embodiment of this application.

[0122] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0123] It should be noted that the terminology used in this application is for the purpose of describing specific embodiments only and is not intended to limit the scope of this application. As shown in the specification and claims of this application, unless the context clearly indicates otherwise, words such as "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, or apparatus. Without further limitations, an element defined by the phrase "comprising an..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element.

[0124] It should also be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on this application. Unless otherwise expressly specified and limited, the terms "installed," "connected," "linked," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication between two elements. For those skilled in the art, the specific meaning of the above terms in this application can be understood according to the specific circumstances.

[0125] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. The above descriptions are only preferred embodiments of this application. It should be noted that due to the limitations of written expression, while there are objectively infinite specific structures, those skilled in the art can make several improvements, modifications, or changes without departing from the principles of this invention, and can also combine the above technical features in an appropriate manner. These improvements, modifications, changes, or combinations, or the direct application of the inventive concept and technical solution to other situations without modification, should all be considered within the scope of protection of this application.

Claims

1. An OTA upgrade method, characterized in that, include: The vehicle gateway responds to the segmented flashing instruction by determining at least one flashing logical address corresponding to the segmented flashing instruction; The vehicle gateway determines the flashing network segment corresponding to each of the flashing logical addresses based on the at least one flashing logical address and a pre-configured address network segment mapping table, and forwards the segmented flashing instruction to each of the flashing network segments. For each of the aforementioned flashing segments, when the flashing segment receives the segmented flashing instruction, it closes the communication corresponding to the flashing segment. Each controller to be written within the writing network segment responds to the segmented writing command and performs writing; When all the controllers to be flashed have completed the flashing process, the flashing network segment starts communication corresponding to the flashing network segment; the controller to be flashed is a dual-partition controller, and the dual-partition controller responds to a partition switching command, and determines the partition switching operation of the dual-partition controller according to the partition switching command; wherein, the partition switching command includes blocking the partition switching command or executing the partition switching command.

2. The method according to claim 1, characterized in that, Before the vehicle gateway determines at least one flashing logical address corresponding to the segmented flashing instruction in response to the segmented flashing instruction, the method further includes: The vehicle controller sends the segmented flashing command to the vehicle gateway via the Ethernet flashing protocol; Accordingly, in response to the segmented flashing instruction, the vehicle gateway determines at least one flashing logical address corresponding to the segmented flashing instruction, including: The vehicle gateway responds to the segmented flashing command by parsing the segmented flashing command according to the Ethernet flashing protocol to determine at least one flashing logical address carried by the segmented flashing command.

3. The method according to claim 1, characterized in that, The partition-splitting command includes a partition-blocking command. The dual-partition controller includes a first partition and a second partition, where the first partition is the currently running partition and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-blocking flag. In response to the partition-splitting command, the dual-partition controller determines the partition-splitting operation based on the partition-splitting command, including: In response to the block partitioning command, the dual-partition controller controls the running area flag to correspond to the first area, and the block partitioning flag is set to true. The dual-partition controller determines, based on the running area flag and the blocking partition flag, that the partition cutting operation of the dual-partition controller is to block partition cutting and execute the program in the first partition.

4. The method according to claim 1, characterized in that, The partition-splitting instruction includes executing a partition-splitting instruction. The dual-partition controller includes a first partition and a second partition, where the first partition is the currently running partition and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-splitting prevention flag. In response to the partition-splitting instruction, the dual-partition controller determines the partition-splitting operation based on the instruction, including: In response to the execution partition switching command, the dual-partition controller controls the running area flag to correspond to the second area, while the partition switching prevention flag remains unchanged. The dual-partition controller determines that the partitioning operation of the dual-partition controller is to execute the program in the second partition based on the running partition flag and the partition blocking flag.

5. The method according to claim 3 or 4, characterized in that, Also includes: The dual-zone controller initializes the operating zone flag bit and controls the operating zone flag bit to be the first zone; The dual-partition controller initializes the blocking partition flag and controls the blocking partition flag to a false value.

6. The method according to claim 1, characterized in that, The dual-partition controller includes a first partition and a second partition. The first partition is the running partition, and the second partition is a non-running backup partition. The dual-partition controller also includes a running partition flag and a partition-blocking flag. After determining the partition-blocking operation of the dual-partition controller, the following steps are also included: The dual-partition controller responds to a hardware reset command. If the partition blocking flag is true, it controls the partition blocking flag to be false, controls the running area flag to correspond to the first partition, and executes the program in the first partition. If the partition blocking flag is false, it controls the running area flag to correspond to the second partition and executes the program in the second partition.

7. The method according to claim 1, characterized in that, After the dual-partition controller responds to a partition-splitting command and determines the partition-splitting operation of the dual-partition controller based on the partition-splitting command, the method further includes: The dual-zone controller obtains the execution result corresponding to the whether-zone-switching instruction and feeds the execution result back to the vehicle controller.

8. The method according to claim 1, characterized in that, Also includes: If at least one of the controllers to be flashed has not completed the flashing process, for the controllers to be flashed that have not completed the flashing process, communication is initiated with respect to the controllers to be flashed that have not completed the flashing process, and the process returns to the step of executing the vehicle gateway in response to the segmented flashing instruction and determining at least one flashing logic address corresponding to the segmented flashing instruction.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that cause a computer to perform the steps of the OTA upgrade method as described in any one of claims 1 to 8.

Images