Bootstrap program refreshing method based on redundant architecture

Abstract

The invention discloses a bootstrap program refreshing method based on a redundant architecture, the bootstrap program comprises bootstrap programs in a redundant A area and a redundant B area, and the bootstrap program refreshing method comprises the following steps: step 1, resetting an ECU (Electronic Control Unit); step 2, loading a boot partition starting parameter set from the nonvolatile storage area; and 3, selecting the bootstrap program in the area A or the area B to be started according to the starting parameters. And 4, judging whether an external reprogramming request exists or not, if the external reprogramming request exists, downloading a flashing drive, starting a flashing process, and executing the flashing of the bootstrap program. According to the invention, stable bootstrap program refreshing and starting can be realized.

Description

Technical Field

[0001] The invention relates to the technical field of EPS application software development, and in particular to a boot program refresh method based on a redundant architecture. Background Art

[0002] The software boot program, or Bootloader, plays a very important role and significance in the embedded system software development process. For EPS, it guides its program update, operation and maintenance. At present, with the prosperous development of the automobile market and the increasing popularity of smart devices, cars have gradually evolved into an intelligent platform with continuously iterated functions and uses, providing drivers and passengers with a more excellent driving experience. EPS is the safety key of the whole vehicle, so it is crucial that the Bootloader program also needs to be continuously iterated and updated to support the stable boot of EPS function and update of EPS application programs.

[0003] The traditional flashing architecture stores the Bootloader in a non-volatile memory segment, which does not support later updates and will not be able to better adapt to new hardware platforms and new software development trends. Although non-volatile memory provides a stable storage environment for the Bootloader, it is also accompanied by potential risks, mainly reflected in the accidental damage or erase of the Bootloader program storage area, which will cause the Bootloader program to be unable to normally guide the EPS application to start and unable to perform software updates on the EPS application, which will have a serious impact on the normal use of the EPS. Summary of the invention

[0004] The technical problem to be solved by the present invention is how to provide a technical solution that can achieve stable boot program refresh and startup.

[0005] In order to solve the above technical problems, the present invention provides a boot program refresh method based on a redundant architecture, wherein the boot program includes redundant boot programs in area A and area B, and the boot program refresh method includes the following steps:

[0006] Step 1, reset ECU;

[0007] Step 2, loading the boot partition startup parameter set from the non-volatile storage area;

[0008] Step 3: Select the boot program in area A or area B to start according to the startup parameters.

[0009] Step 4, determine whether there is an external reprogramming request. If there is a request, download the flash driver and start the flash process to execute the boot program flash.

[0010] Preferably, the boot partition startup parameter set includes the current running partition, the startup boot mode, the validity of the A area and the B area, and the activation of the new Boot flag.

[0011] Preferably, in step 3, the specific method of selecting the A zone program or the B zone program to be started according to the startup parameters is:

[0012] Step c, determine the loading result of the startup parameter set, if the loading fails, go to step d, if the loading is successful, go to step e;

[0013] Step d, starting the sleep timer, when the sleep timer reaches the set time, the ECU enters the shutdown program;

[0014] Step e, detecting boot partition startup parameters;

[0015] Condition 1: If the validity of area A is that there is an executable program in area A, and the boot mode is to boot area A, then load the boot program in area A;

[0016] Condition 2: If the validity of area B is that there is an executable program in area B, and the boot mode is to boot area B, then load the boot program in area B;

[0017] If conditions 1 and 2 are not met, go to step d.

[0018] Preferably, when condition 1 is met, the currently running partition is set to the currently running zone A boot program.

[0019] Preferably, when condition 2 is met, the currently running partition is set to the currently running zone B boot program.

[0020] Preferably, the specific method of step 4 is:

[0021] Step S1, starting the flashing process according to the reprogramming request;

[0022] Step S2, executing unified diagnostic service;

[0023] Step S3, executing driver download;

[0024] Step S4, determining the value of the "currently running partition" to start different partitions and erase the partition to be reprogrammed;

[0025] Step S5, downloading Boot data to memory and completing integrity and compatibility verification;

[0026] Step S6, according to the flashing result, configure the "boot partition startup parameter set" and set the "activate new Boot flag" to True;

[0027] Step S7, resetting the ECU through a built-in program command, re-entering the boot program, and entering a new Boot partition according to the boot partition startup parameter set value;

[0028] Step S8, judging "activate new Boot flag", if "activate new Boot flag" is "Ture", set it to "False", and store the boot parameter set in the non-volatile storage area;

[0029] Step S9, stay in the boot program and enter the programming session through the UDS service;

[0030] Step S10, guiding the App to start and perform post-programming processing;

[0031] Step S11, completing the flashing.

[0032] Preferably, in step S3, after executing the driver download, the bytes of the downloaded data are checked using a "check programming integrity" routine.

[0033] Preferably, the step S3 also performs data writing, using a data identifier to write "fingerprint" information.

[0034] Preferably, in step S4, if the current running partition is the current running area A boot program, the validity of area B is written as there is no executable program in area B; if the current running partition is the current running area B boot program, the validity of area A is written as there is no executable program in area A.

[0035] Preferably, in step S6, if the current running partition is the current running area A boot program, the validity of area B is written as area B has an executable program; if the current running partition is the current running area B boot program, the validity of area A is written as area A has an executable program.

[0036] Compared with the prior art, the present invention has the following technical effects:

[0037] 1. Aiming at the potential risk that the EPS cannot start normally and cannot enable EPS functions due to the failure of Bootloader update and the damage of storage blocks, a dual redundant Bootloader flashing method is proposed. The dual redundant Bootloader program refresh will perform redundant processing on the Bootloader, which can solve or avoid the above risk situations.

[0038] 2. Select Boot partition to start, which means that the boot refresh program starts from the latest version or stable version of the boot program according to the settings of the corresponding boot partition startup parameter set, thereby ensuring the subsequent startup and update of the EPS software to ensure the stable implementation of the overall functions.

[0039] 3. There is no need to expand the original EPS storage hardware, it has high adaptability, and has the function of logical block division of flash memory space. It can realize the function of a logical block being independent of other blocks and reprogramming, avoiding reprogramming of the entire refresh memory, and can be extended to related applications of other ECU startup software.

[0040] 4. In the preferred solution, the sleep / wake-up mechanism can be that after the ECU enters the dual-redundancy boot program PreBoot and is successfully initialized, if the boot partition startup parameter set is not successfully loaded or the boot partition startup parameter set is not set, PreBoot will start sleep and the ECU will be shut down to ensure that the controller is at the lowest power consumption. When the ECU receives the next KL15 power-on, it will wake up the ECU. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments:

[0042] Figure 1 The schematic diagram of the EPS ECU software architecture for applying the method of the first embodiment;

[0043] Figure 2 This is a schematic diagram of the startup parameter set structure in Example 1;

[0044] Figure 3 This is a schematic diagram of the specific method steps of step 3 in Example 1;

[0045] Figure 4 This is a schematic diagram of the specific method steps of step 4 in Example 1. DETAILED DESCRIPTION

[0046] The following describes the implementation methods of the present invention through specific specific embodiments, and those skilled in the art can fully understand other advantages and technical effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through different specific implementation methods, and the details in this specification can also be applied based on different viewpoints, and various modifications or changes can be made without deviating from the overall design concept of the invention. It should be noted that the following embodiments and the features in the embodiments can be combined with each other in the absence of conflict. The following exemplary embodiments of the present invention can be implemented in a variety of different forms and should not be interpreted as being limited to the specific embodiments described herein. It should be understood that these embodiments are provided to make the disclosure of the present invention thorough and complete, and to fully convey the technical solutions of these exemplary specific embodiments to those skilled in the art.

[0047] Example 1

[0048] This embodiment provides a boot program refresh method based on a redundant architecture, wherein the boot program includes boot programs in redundant areas A and B, and the boot program refresh method includes the following steps:

[0049] Step 1, reset ECU;

[0050] Step 2, loading the boot partition startup parameter set from the non-volatile storage area;

[0051] Step 3: Select the boot program in area A or area B to start according to the startup parameters.

[0052] Step 4, determine whether there is an external reprogramming request. If there is a request, download the flash driver and start the flash process to execute the boot program flash.

[0053] This embodiment is described by applying the above method to the EPS ECU of the automobile steering system.

[0054] like Figure 1 As shown, Figure 1 The following is a schematic diagram of the EPS ECU software architecture to which the method of this embodiment is applied. It mainly includes a diagnostic instrument, a PreBoot module, a flash driver, a Boot A\B partition module (i.e., A\B area), and an App application module. For ease of description, the software that boots the dual redundant Bootloader is represented by PreBoot (PreBoot is the abbreviation of the dual redundant Bootloader boot program).

[0055] Figure 1 The flash driver is used to provide memory interfaces and functions for Bootloader, Boot, and App programs to ensure that they can communicate with the memory correctly. The ECU memory of EPS is protected by a protection mechanism to prevent it from being accidentally erased or overwritten by rewrite operations, which may cause the function to fail to start. Therefore, a software interlock mechanism is adopted, and the flash driver will not be stored in the NVM of the ECU, but will be downloaded to the RAM of the ECU when the software needs to be refreshed. When all programs are refreshed and reset, the driver code will be automatically removed from the ECU RAM buffer, thereby ensuring that the flash driver will not be abused and cause unexpected erasure and writing.

[0056] The boot partition startup parameter set includes the current running partition, the startup boot mode, the validity of area A and area B, and the activation of the new Boot flag. In this embodiment, the parameter name, data type, data value range and parameter value corresponding to the startup parameter set are shown in Figure 2 shown.

[0057] like Figure 3As shown, in step 3, the specific method of selecting the A zone program or the B zone program to be started according to the startup parameters is:

[0058] Step c, determine the loading result of the startup parameter set, if the loading fails, go to step d, if the loading is successful, go to step e;

[0059] Step d, starting the sleep timer, when the sleep timer reaches the set time, the ECU enters the shutdown program;

[0060] Step e, detecting boot partition startup parameters;

[0061] Condition 1: If the validity of area A is that there is an executable program in area A, and the boot mode is to boot area A (i.e., "BootableA==0x01&&BootMode==0x00"), load the boot program in area A;

[0062] Condition 2: If the validity of area B is that there is an executable program in area B, and the boot mode is to boot area B (i.e., "BootableB==0x01&&BootMode==1"), load the boot program in area B;

[0063] If condition 1 and condition 2 are not met (ie, "(BootableA==0x00&&BootMode==0x00)&&(BootableB==0x00&&BootMode==0x01)"), go to step d.

[0064] When condition 1 is met, the current running partition is set to the current running A area boot program ("Active Slot == 0x00"), and enters the A area to run the Bootloader A program.

[0065] When condition 2 is met, the current running partition is set to the current running B area boot program ("Active Slot == 0x01"), and enters the B area to run the Bootloader B program.

[0066] like Figure 4 As shown, in step 4, download the flash driver and start the flash process. The specific method for executing the boot program flash is:

[0067] Step S1, power on to enter the valid Boot partition, and start the flashing process according to the reprogramming request;

[0068] Step S2, executing the unified diagnostic service (UDS), realizing session jump, secure access, and completing the conventional programming pre-processing procedures;

[0069] Step S3, execute driver download; (34h, 36h, 37h, 31h, 2Eh), download the driver file in this order: request download, transfer data, request transfer, exit download. After the download is completed, use the "check programming integrity" routine to check the bytes of the downloaded data to ensure correct transmission. And execute data writing, use the data identifier, and write the "fingerprint" information.

[0070] Step S4, determining the value of the "currently running partition" to start different partitions and erase the partition to be reprogrammed;

[0071] If "ActiveSlot" is A (0x00), then write "BootableB" to invalid (0x00);

[0072] If "ActiveSlot" is B (0x01), "BootableA" is written as invalid (0x00).

[0073] Step S5, downloading Boot data to memory and completing integrity and compatibility verification;

[0074] Step S6, according to the flashing result, configure the "boot partition startup parameter set" and set the "activate new Boot flag" to True "0x01";

[0075] Step S7, resetting the ECU through a built-in program command, re-entering the boot program, and entering a new Boot partition according to the boot partition startup parameter set value;

[0076] Step S8, judging "activate new Boot flag", if "activate new Boot flag" is "Ture", set it to "False", and store the boot parameter set in the non-volatile storage area;

[0077] Step S9, stay in the boot program and enter the programming session through the UDS service;

[0078] Step S10, guiding the App to start and perform post-programming processing;

[0079] Step S11, completing the flashing.

[0080] The method of the present invention establishes a boot program fault tolerance mechanism, which is implemented through the boot judgment program of the Bootloader. The PreBoot software always starts from the stable and valid partition of the bootloader software by judging the boot flag of the boot partition, thereby ensuring the subsequent App startup or update. The boot program software partition validity judgment module is mainly based on a Bootloader startup parameter set defined inside the ECU, which sets the validity of the software reprogramming and allows its Bootloader software to run. At the same time, when the flag is invalid, it can stay in PreBoot and record invalid faults and send them to the diagnostic instrument. When the active boot partition is started, the corresponding startup parameter set is modified through the diagnostic service routine to select the partition to be started to ensure that the Bootloader implements the version rollback function.

[0081] The present invention has been described in detail above through specific implementation modes and embodiments, but these do not constitute limitations of the present invention. Without departing from the principles of the present invention, those skilled in the art may also make many variations and improvements, which should also be regarded as the protection scope of the present invention.

Claims

1. A boot program refresh method based on redundant architecture, It is characterized in that The boot program includes redundant boot programs in area A and area B, and the boot program refresh method includes the following steps: Step 1, reset ECU; Step 2, loading the boot partition startup parameter set from the non-volatile storage area; Step 3: Select the boot program in area A or area B to start according to the startup parameters. Step 4, determine whether there is an external reprogramming request. If there is a request, download the flash driver and start the flash process to execute the boot program flash.

2. The boot program refresh method based on redundant architecture according to claim 1, It is characterized in that The boot partition startup parameter set includes the current running partition, the startup boot mode, the validity of the A area and the B area, and the activation of the new Boot flag.

3. The boot program refresh method based on redundant architecture according to claim 2, It is characterized in that In step 3, the specific method of selecting the A zone program or the B zone program to be started according to the startup parameters is: Step c, determine the loading result of the startup parameter set, if the loading fails, go to step d, if the loading is successful, go to step e; Step d, starting the sleep timer, when the sleep timer reaches the set time, the ECU enters the shutdown program; Step e, detecting boot partition startup parameters; Condition 1: If the validity of area A is that there is an executable program in area A, and the boot mode is to boot area A, then load the boot program in area A; Condition 2: If the validity of area B is that there is an executable program in area B, and the boot mode is to boot area B, then load the boot program in area B; If conditions 1 and 2 are not met, go to step d.

4. The boot program refresh method based on redundant architecture according to claim 3, It is characterized in that When condition 1 is met, the current running partition is set to the current running A zone boot program.

5. The boot program refresh method based on redundant architecture according to claim 3, It is characterized in that When condition 2 is met, the current running partition is set to the current running B zone boot program.

6. The boot program refresh method based on redundant architecture according to claim 1, It is characterized in that The specific method of step 4 is: Step S1, starting the flashing process according to the reprogramming request; Step S2, executing unified diagnostic service; Step S3, executing driver download; Step S4, determining the value of the "currently running partition" to start different partitions and erase the partition to be reprogrammed; Step S5, downloading Boot data to memory and completing integrity and compatibility verification; Step S6, according to the flashing result, configure the "boot partition startup parameter set" and set the "activate new Boot flag" to True; Step S7, resetting the ECU through a built-in program command, re-entering the boot program, and entering a new Boot partition according to the boot partition startup parameter set value; Step S8, judging "activate new Boot flag", if "activate new Boot flag" is "True", set it to "False", and store the boot parameter set in the non-volatile storage area; Step S9, stay in the boot program and enter the programming session through the UDS service; Step S10, guiding the App to start and perform post-programming processing; Step S11, completing the flashing.

7. The boot program refresh method based on redundant architecture according to claim 6, It is characterized in that In step S3, after executing the driver download, the bytes of the downloaded data are checked using the "check programming integrity" routine.

8. The boot program refresh method based on redundant architecture according to claim 7, It is characterized in that The step S3 also performs data writing, using the data identifier to write the "fingerprint" information.

9. The boot program refresh method based on redundant architecture according to claim 6, It is characterized in that In step S4, if the current running partition is the current running area A boot program, the validity of area B is written as no executable program in area B; if the current running partition is the current running area B boot program, the validity of area A is written as no executable program in area A.

10. The boot program refresh method based on redundant architecture according to claim 6, It is characterized in that In step S6, if the current running partition is the current running area A boot program, the validity of area B is written as area B has an executable program; if the current running partition is the current running area B boot program, the validity of area A is written as area A has an executable program.

Images