Vehicle remote upgrading method and device and related equipment

Abstract

The invention provides a vehicle remote upgrading method and device and related equipment, an upgrading master control redundancy architecture of a vehicle is configured, the redundancy architecture at least comprises an upgrading master control unit and a backup master control unit, and when the upgrading master control unit executes an FOTA upgrading task, the backup master control unit performs the FOTA upgrading task; monitoring the working state information of the upgrading main control unit by using the backup main control unit, and synchronously receiving an upgrading instruction of an FOTA upgrading task; when it is determined that the upgrading main control unit is abnormal, the backup main control unit is switched to a temporary upgrading main control unit so as to recover the state of the upgrading main control unit; and when it is determined that the state of the upgrading main control unit is recovered, providing an upgrading instruction and working state information before the exception to the upgrading main control unit, and continuing to execute the FOTA upgrading task through the upgrading main control unit. The probability that the whole vehicle loses the remote upgrading capability due to the single-point failure risk is effectively reduced, and the upgrading and running stability and reliability of the vehicle system are improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle networking technology, and in particular to a vehicle remote upgrade method, device and related equipment. Background Art

[0002] With the rapid development of intelligent connected vehicle technology, remote firmware online upgrade (Firmware Over the Air, FOTA) has become an important technical means to promptly repair automotive software failures and security vulnerabilities, continuously optimize the use experience of automotive functions, and quickly release new functional applications. Compared with traditional offline upgrade technology, remote online upgrade technology does not require customers to enter the station to refresh their vehicles. It is efficient, time-saving, and cost-saving, and has been widely recognized and applied. However, in the existing FOTA upgrade system, a single upgrade master control program on the vehicle side is generally relied on to realize the upgrade process management and execution of the entire vehicle. This means that if the upgrade master control program fails, the entire vehicle will lose the ability to upgrade remotely, there is a single point of failure risk, and it will seriously affect the stability and reliability of the vehicle and affect the user experience. In the existing technology, there is no effective redundancy mechanism to deal with such problems. Summary of the invention

[0003] In view of this, embodiments of the present application provide a vehicle remote upgrade method, device and storage medium to at least partially solve the above-mentioned problems.

[0004] In a first aspect, an embodiment of the present application provides a vehicle remote upgrade method, comprising:

[0005] Configure the vehicle's upgrade master control redundant architecture, the redundant architecture includes at least one upgrade master control unit and a backup master control unit, the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle;

[0006] When the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task;

[0007] When it is determined that an exception occurs when the upgrade main control unit performs the FOTA upgrade task, the backup main control unit is switched to a temporary upgrade main control unit to restore the state of the upgrade main control unit where the exception occurs;

[0008] When it is determined that the state of the upgrade main control unit where the exception occurred has been restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the exception occurred, so that the FOTA upgrade task can be continued through the upgrade main control unit.

[0009] Optionally, in an embodiment of the present application, the using the backup main control unit to monitor the working status information of the upgrade main control unit includes:

[0010] Based on the preset operation status monitoring and fault monitoring algorithm, one or more of the communication status, software and hardware resource occupancy rate, and functional status information of the upgrade main control unit are analyzed in real time to realize real-time monitoring of the working status information of the upgrade main control unit.

[0011] Optionally, in an embodiment of the present application, the method further includes: when it is determined that an abnormality occurs when the upgrade main control unit executes the FOTA upgrade task, stopping the operation of the upgrade main control unit where the abnormality occurs by the backup main control unit.

[0012] Optionally, in one embodiment of the present application, the method further includes, before continuing to execute the FOTA upgrade task through the main control unit, performing a security check on one or more of the vehicle's current operating environment, upgrade task and upgrade data.

[0013] Optionally, in an embodiment of the present application, the method further comprises: after determining that the main control unit completes the security check, controlling the backup main control unit to recover to a state of monitoring the working state of the upgrade main control unit;

[0014] Optionally, in an embodiment of the present application, the method further includes: continuously reporting upgrade result information and monitoring information to a remote upgrade platform through the upgrade master control redundant architecture.

[0015] Optionally, in one embodiment of the present application, the method further includes: when there are multiple backup main control units, determining a backup main control unit for monitoring the working status of the upgrade main control unit according to a set backup main control unit preference strategy, so as to participate in the FOTA upgrade task.

[0016] In a second aspect, based on a vehicle remote upgrade method provided in the first aspect of the present application, an embodiment of the present application further provides a vehicle remote upgrade device, comprising:

[0017] A configuration module, used to configure the upgrade master control redundant architecture of the vehicle, wherein the redundant architecture includes at least one upgrade master control unit and a backup master control unit, and the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle;

[0018] A synchronization module, used to monitor the working status information of the upgrade main control unit by using the backup main control unit when the upgrade main control unit executes the FOTA upgrade task, and synchronously receive the upgrade instruction of the FOTA upgrade task;

[0019] A repair module, configured to, when determining that an abnormality occurs when the upgrade main control unit performs the FOTA upgrade task, switch the backup main control unit to a temporary upgrade main control unit to restore the state of the abnormal upgrade main control unit;

[0020] The recovery module is used to use the temporary main control unit to provide the upgrade main control unit with the upgrade instructions and working status information before the exception occurs, so as to continue to execute the FOTA upgrade task through the upgrade main control unit after determining that the state of the upgrade main control unit where the exception occurs is restored.

[0021] In a third aspect, an embodiment of the present application also provides a computer storage medium having computer executable instructions stored thereon, and when the computer executable instructions are executed, any one of the vehicle remote upgrade methods described in the first aspect or the second aspect of the present application is performed.

[0022] In a fourth aspect, an embodiment of the present application further provides an electronic device, including:

[0023] one or more processors;

[0024] a memory for storing one or more programs,

[0025] When the one or more programs are executed by the one or more processors, the one or more processors implement any one of the vehicle remote upgrade methods described in the first aspect of the present application.

[0026] The present application provides a vehicle remote upgrade method, device and related equipment, which configures the vehicle's upgrade main control redundant architecture, wherein the redundant architecture includes at least one upgrade main control unit and a backup main control unit, and the upgrade main control unit is used to execute the FOTA upgrade task sent from the service end to the vehicle end; when the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task; when it is determined that an exception occurs when the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is switched to a temporary upgrade main control unit for restoring the state of the upgrade main control unit where the exception occurs; when it is determined that the state of the upgrade main control unit where the exception occurs is restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the exception occurs, so that the FOTA upgrade task can continue to be executed through the upgrade main control unit. It effectively overcomes the single point failure risk caused by failure in the upgrade of the main control program in the existing technology, reduces the probability of the vehicle losing the ability to remotely upgrade due to the single point failure risk, improves the stability and reliability of vehicle system upgrades and operations, and brings a better user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0028] Figure 1 A schematic diagram of a workflow of a vehicle remote upgrade method provided in an embodiment of the present application;

[0029] Figure 2 A schematic diagram of the structure of a vehicle remote upgrade device provided in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0032] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0033] Embodiment 1

[0034] The present application embodiment provides a vehicle remote upgrade method, such as Figure 1 As shown, Figure 1 A flowchart of a vehicle remote upgrade method provided in an embodiment of the present application, the vehicle remote upgrade method comprising:

[0035] Step S101, configure the vehicle's upgrade master control redundant architecture, which includes at least one upgrade master control unit and a backup master control unit, wherein the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle. Specifically, for example, the upgrade master control unit can receive new release tasks for upgrading vehicle-side service functions or systems from a server such as an operator's remote upgrade cloud platform, download upgrade packages, and execute upgrade operations on upgraded components. This ensures the convenience of vehicle system upgrades and the stability of operation. The upgrade master control unit and the backup master control unit are communicatively connected, and the backup active unit serves as an upgrade redundancy for the upgrade master control unit to improve the stability of vehicle system upgrades.

[0036] Step S102: When the upgrade main control unit performs the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task. In the embodiment of the present application, after the vehicle is started, the upgrade main control unit and the backup main control unit are initialized and data is synchronized to ensure that each system on the vehicle side can be in a normal working state during the operation of the vehicle, and reduce the probability of the vehicle system not being able to work stably due to an abnormal upgrade.

[0037] Optionally, in one embodiment of the present application, the backup main control unit is used to monitor the working status information of the upgrade main control unit, including: based on a preset operation status monitoring and fault monitoring algorithm, real-time analysis of the communication status, software and hardware resource occupancy rate, and one or more of the functional status information of the upgrade main control unit, so as to realize real-time monitoring of the working status information of the upgrade main control unit. In an embodiment of the present application, the operation status hardship and fault monitoring algorithm is pre-configured, and can be flexibly configured according to the baseline information of the vehicle or the service function carried by the vehicle, and at least one or more operating parameters of the communication status, software and hardware resource occupancy rate, and functional status information of the upgrade main control unit are monitored and analyzed, so as to quickly and accurately realize real-time monitoring of the working status information of the upgrade main control unit, which is used to support the judgment of whether the FOTA upgrade task sent to the vehicle can be executed normally, so as to ensure the execution efficiency of the upgrade task and the reliability of the vehicle system.

[0038] Step S103: When it is determined that an abnormality occurs when the upgrade main control unit performs the FOTA upgrade task, the backup main control unit is switched to a temporary upgrade main control unit to restore the state of the upgrade main control unit that has an abnormality. In an embodiment of the present application, the abnormality includes, when it is determined that the vehicle end is in an abnormal state or meets a preset fault working mode according to the monitored working state information, the backup main control unit is switched to a temporary upgrade main control unit, and the preset fault diagnosis and repair mechanism is started by the temporary upgrade main control unit to try to restore the original upgrade main control unit that has an abnormality. In the actual application scenario of the embodiment of the present application, the backup main control unit does not directly participate in the execution of the FOTA upgrade task on the vehicle side, but monitors and records the working status of the original upgrade main control unit, such as the execution process of the FOTA upgrade task, in real time, and synchronously receives upgrade instructions, thereby ensuring the consistency of the execution subject when the entire upgrade task is executed on the vehicle side, and the backup main control unit within the same local structural architecture of the vehicle side is responsible for repairing the status of the upgrade main control unit, so as to more reasonably utilize the local hardware resources of the vehicle side to perform the recovery work of the upgrade main control unit, thereby improving the reliability of the original upgrade main control unit in the vehicle-side system while reducing the complexity of the upgrade system on the vehicle side.

[0039] Step S104, when it is determined that the state of the upgrade main control unit where the exception occurred has been restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the exception occurred, so as to continue to execute the FOTA upgrade task through the upgrade main control unit. In the embodiment of the present application, after receiving the upgrade instruction and working status information of the exception, the upgrade main control unit can be restored to the state before the exception occurred according to the received information, and the upgrade main control continues to take over the unfinished FOTA upgrade task for execution. Through this breakpoint-resume execution mode, the reliability of the upgrade main control unit is guaranteed, the integrity of the upgrade task execution is improved, and the probability of the vehicle's stability and reliability being affected by a single point failure during the upgrade process is reduced.

[0040] Optionally, in an embodiment of the present application, the method further includes: when it is determined that an abnormality occurs in the execution of the FOTA upgrade task by the upgrade main control unit, the operation of the abnormal upgrade main control unit is stopped by the backup main control unit. In an embodiment of the present application, when the backup active unit is switched to a temporary upgrade main control unit, the original upgrade main control unit is controlled to stop working in order to save system resources. At the same time, this process can also reduce the possibility of more system instability on the vehicle side due to the execution of abnormal upgrade instructions by the original upgrade main control unit, thereby further improving the stability and operational reliability of the vehicle system.

[0041] Optionally, in one embodiment of the present application, the method further includes, before continuing to execute the FOTA upgrade task through the main control unit, performing a safety check on one or more of the vehicle's current operating environment, upgrade tasks, and upgrade data. In the embodiment of the present application, in general, there are certain preconditions for the vehicle side to issue FOTA upgrade tasks and execute upgrade tasks. For example, the vehicle is in a non-road driving state such as parking or parking, the vehicle side and the upgrade task issuing service side can stably transmit data, and the issued upgrade data, that is, the upgrade software package data, is complete and safe and reliable. Only in this case, the upgrade task is allowed to be executed on the vehicle side, so as to avoid the temporary downtime of a certain service function of the system or the lack of upgrade data due to the above situation, and the illegal upgrade affects the safety and stable operation of the vehicle system, causing accidents. Therefore, in the embodiment of the present application, after the upgrade main control unit resumes the working state, the vehicle's current operating environment, upgrade tasks, and one or more of the upgrade data are safety checked, and the upgrade task is allowed to continue to be executed only after passing the safety check. Thereby effectively reducing the probability of the above-mentioned accidents, ensuring the safety of the vehicle and the user's car experience.

[0042] Optionally, in an embodiment of the present application, the method further includes: after determining that the main control unit has completed the safety check, controlling the backup main control unit to recover to a state of monitoring the working state of the upgrade main control unit. In the embodiment of the application, when it is determined that the original upgrade main control unit is able to perform a safe and reliable breakpoint-resume upgrade task, the backup upgrade unit is controlled to exit the working state of the temporary upgrade main control unit and recover to a working state of still continuously monitoring the upgrade main control unit, thereby better reducing the probability of the vehicle system stability and reliability being affected by the risk of single point failure during the vehicle upgrade process.

[0043] Optionally, in one embodiment of the present application, the method further includes: continuously reporting upgrade result information and monitoring information to the remote upgrade platform through the upgrade master redundant architecture. For example, the upgrade result information may include whether the upgrade task issued to the vehicle is received by the vehicle, whether it is executed after being received, and the execution result and other related information, so that the FOTA upgrade task issued to the vehicle can be executed in an orderly and complete manner, while ensuring the stability and reliability of the vehicle system, avoiding the occurrence of erroneous upgrades, upgrade omissions, etc., and at the same time reducing the probability of wasting software and hardware resources on the vehicle or service side during the upgrade process.

[0044] Optionally, in one embodiment of the present application, the method further includes: when there are multiple backup main control units, according to the set backup main control unit preference strategy, determining the backup main control unit used to monitor the working status of the upgrade main control unit, for participating in the FOTA upgrade task. For example, by setting a single main control unit preference strategy, combined with the load of the monitored vehicle system, hardware performance and other factors, dynamically select the backup main control unit with better performance in the current redundant architecture to perform monitoring of the upgrade main control unit, and the state recovery condition when an abnormality occurs in the upgrade main control unit, so as to further improve the work efficiency of the system.

[0045] Optionally, in one embodiment of the present application, the backup main control unit is switched to a temporary upgrade main control unit for restoring the state of the abnormal upgrade main control unit, including: with the help of the data analysis capability of the remote upgrade platform, a vehicle-side upgrade software upgrade fault neural network judgment big data model is established to monitor the execution of the FOTA upgrade task on the vehicle side, and timely determine the details of the abnormality of the upgrade main control unit, and issue an alarm in time to provide the backup upgrade main control unit with complete upgrade program recovery file data in time, so as to ensure that the abnormal upgrade main control unit can be technically accurately repaired to restore to normal working state, so as to better and cost-effectively ensure the stability and reliability of the vehicle system.

[0046] The present application provides a vehicle remote upgrade method, by configuring the vehicle's upgrade main control redundant architecture, the redundant architecture includes at least one upgrade main control unit and a backup main control unit, the upgrade main control unit is used to execute the FOTA upgrade task sent from the service end to the vehicle end; when the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task; when it is determined that the upgrade main control unit executes the FOTA upgrade task abnormally, the backup main control unit is switched to a temporary upgrade main control unit for state recovery of the abnormal upgrade main control unit; when it is determined that the abnormal upgrade main control unit is restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the abnormality occurs, so as to continue to execute the FOTA upgrade task through the upgrade main control unit. It effectively overcomes the single point failure risk caused by the failure of the upgrade main control program in the prior art, reduces the probability of the whole vehicle losing the ability to remotely upgrade due to the single point failure risk, improves the stability and reliability of vehicle system upgrade and operation, and brings a better user experience to users.

[0047] Embodiment 2

[0048] Based on the vehicle remote upgrade method described in the first embodiment of the present application, the present embodiment also provides a vehicle remote upgrade device 20, such as Figure 2 As shown, Figure 2 The present invention provides a schematic diagram of a vehicle remote upgrade device 20 according to an embodiment of the present invention. The vehicle remote upgrade device 20 includes:

[0049] Configuration module 201, used to configure the upgrade master control redundant architecture of the vehicle, the redundant architecture includes at least one upgrade master control unit and a backup master control unit, the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle;

[0050] A synchronization module 202 is used to monitor the working status information of the upgrade main control unit by using the backup main control unit when the upgrade main control unit executes the FOTA upgrade task, and synchronously receive the upgrade instruction of the FOTA upgrade task;

[0051] The repair module 203 is used to switch the backup main control unit to a temporary upgrade main control unit when it is determined that an abnormality occurs when the upgrade main control unit performs the FOTA upgrade task, so as to restore the state of the upgrade main control unit in which the abnormality occurs;

[0052] The recovery module 204 is used to use the temporary main control unit to provide the upgrade main control unit with the upgrade instructions and working status information before the exception occurs, so as to continue to execute the FOTA upgrade task through the upgrade main control unit after determining that the state of the upgrade main control unit where the exception occurs is restored.

[0053] Optionally, in one embodiment of the present application, the synchronization module 202 is also used to analyze in real time one or more of the communication status, software and hardware resource occupancy, and functional status information of the upgrade main control unit based on a preset operation status monitoring and fault monitoring algorithm, so as to realize real-time monitoring of the working status information of the upgrade main control unit.

[0054] Optionally, in one embodiment of the present application, the device 20 also includes a control module (not shown in the drawings), which is used to stop the operation of the upgrade main control unit where the abnormality occurs through the backup main control unit when it is determined that an abnormality occurs when the upgrade main control unit executes the FOTA upgrade task.

[0055] Optionally, in one embodiment of the present application, the device 20 also includes a verification module (not shown in the drawings), which is used to perform a security check on one or more of the vehicle's current operating environment, upgrade tasks and upgrade data before continuing to execute the FOTA upgrade task through the main control unit.

[0056] Optionally, in one embodiment of the present application, the device 20 also includes an exit module (not shown in the drawings), which is used to control the backup main control unit to restore to a state of monitoring the working status of the upgraded main control unit after determining that the main control unit has completed the security check.

[0057] Optionally, in an embodiment of the present application, the device 20 further includes a feedback module (not shown in the drawings), which is used to continuously report upgrade result information and monitoring information to the remote upgrade platform through the upgrade master control redundant architecture.

[0058] Optionally, in one embodiment of the present application, the device 20 also includes a optimization module (not shown in the drawings), which is used to determine the backup main control unit for monitoring the working status of the upgrade main control unit according to the set backup main control unit optimization strategy when there are multiple backup main control units, so as to participate in the FOTA upgrade task.

[0059] Optionally, in one embodiment of the present application, the synchronization module 202 is also used to establish a vehicle-side software upgrade fault neural network judgment big data model with the help of the data analysis capability of the remote upgrade platform, monitor the execution of the FOTA upgrade task on the vehicle side, and promptly determine the details of the abnormality of the upgrade main control unit, and promptly issue an alarm to provide the backup upgrade main control unit with complete upgrade program recovery file data in a timely manner, so as to ensure that the abnormal upgrade main control unit can be technically and accurately repaired to restore to normal working state, so as to better and cost-effectively ensure the stability and reliability of the vehicle system.

[0060] The present application provides a vehicle remote upgrade device, which configures the vehicle's upgrade main control redundant architecture through a configuration module, and the redundant architecture includes at least one upgrade main control unit and a backup main control unit, and the upgrade main control unit is used to execute the FOTA upgrade task sent from the service end to the vehicle end; a synchronization module is set to use the backup main control unit to monitor the working status information of the upgrade main control unit when the upgrade main control unit executes the FOTA upgrade task, and synchronously receive the upgrade instruction of the FOTA upgrade task; a repair module is set to switch the backup main control unit to a temporary upgrade main control unit when it is determined that an abnormality occurs when the upgrade main control unit executes the FOTA upgrade task, so as to restore the state of the upgrade main control unit that has an abnormality; a recovery module is set to use the temporary main control unit to provide the upgrade main control unit with the upgrade instruction and working status information before the abnormality occurs after determining that the state of the upgrade main control unit that has an abnormality has been restored, so as to continue to execute the FOTA upgrade task through the upgrade main control unit. It effectively overcomes the single point failure risk caused by failure in the upgrade of the main control program in the existing technology, reduces the probability of the vehicle losing the ability to remotely upgrade due to the single point failure risk, improves the stability and reliability of vehicle system upgrades and operations, and brings users a better car experience.

[0061] Embodiment 3

[0062] The embodiment of the present application further provides a storage medium on which a computer program is stored. When the program is executed by a processor, any one of the vehicle remote upgrade methods described in the first embodiment of the present application is implemented. The vehicle remote upgrade method includes but is not limited to:

[0063] Configure the vehicle's upgrade master control redundant architecture, the redundant architecture includes at least one upgrade master control unit and a backup master control unit, the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle;

[0064] When the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task;

[0065] When it is determined that an exception occurs when the upgrade main control unit performs the FOTA upgrade task, the backup main control unit is switched to a temporary upgrade main control unit to restore the state of the upgrade main control unit where the exception occurs;

[0066] When it is determined that the state of the upgrade main control unit where the exception occurred has been restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the exception occurred, so that the FOTA upgrade task can be continued through the upgrade main control unit.

[0067] The present application also provides an electronic device, such as Figure 3 As shown, the electronic device includes:

[0068] One or more processors 301;

[0069] The memory 303 is used to store one or more programs.

[0070] When the one or more programs are instructed to be executed by the one or more processors 301 through the communication bus 304 based on the operation command received through the communication interface 302, the one or more processors 301 implement the vehicle remote upgrade method as described in any one of the above embodiments. The vehicle remote upgrade method includes but is not limited to:

[0071] Configure the vehicle's upgrade master control redundant architecture, the redundant architecture includes at least one upgrade master control unit and a backup master control unit, the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle;

[0072] When the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task;

[0073] When it is determined that an exception occurs when the upgrade main control unit performs the FOTA upgrade task, the backup main control unit is switched to a temporary upgrade main control unit to restore the state of the upgrade main control unit where the exception occurs;

[0074] When it is determined that the state of the upgrade main control unit where the exception occurred has been restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the exception occurred, so that the FOTA upgrade task can be continued through the upgrade main control unit.

[0075] So far, the application has described specific embodiments of the subject matter. Other embodiments are within the scope of the appended claims. In some cases, the actions recorded in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing can be advantageous.

[0076] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system layer on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0077] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0078] The system layers, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0079] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0080] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, system layers, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0081] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0082] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific transactions or implement specific abstract data types. The present application may also be practiced in distributed computing environments where transactions are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0083] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system layer embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0084] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A vehicle remote upgrade method, characterized in that: include: Configuring an upgrade master control redundant architecture of the vehicle, the upgrade master control redundant architecture comprising at least one upgrade master control unit and a backup master control unit, wherein the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle; When the upgrade main control unit executes the FOTA upgrade task, the backup main control unit is used to monitor the working status information of the upgrade main control unit, and synchronously receive the upgrade instruction of the FOTA upgrade task; When it is determined that an exception occurs when the upgrade main control unit performs the FOTA upgrade task, the backup main control unit is switched to a temporary upgrade main control unit to restore the state of the upgrade main control unit where the exception occurs; When it is determined that the state of the upgrade main control unit where the exception occurred has been restored, the temporary main control unit is used to provide the upgrade main control unit with the upgrade instruction and working status information before the exception occurred, so that the FOTA upgrade task can be continued through the upgrade main control unit.

2. The vehicle remote upgrade method according to claim 1, characterized in that: The using the backup main control unit to monitor the working status information of the upgrade main control unit includes: Based on the preset operation status monitoring and fault monitoring algorithm, one or more of the communication status, software and hardware resource occupancy rate, and functional status information of the upgrade main control unit are analyzed in real time to realize real-time monitoring of the working status information of the upgrade main control unit.

3. The vehicle remote upgrade method according to claim 1, characterized in that: The method further includes: when it is determined that an abnormality occurs when the upgrade main control unit executes the FOTA upgrade task, stopping the operation of the abnormal upgrade main control unit by the backup main control unit.

4. The vehicle remote upgrade method according to claim 1, characterized in that: The method also includes: before continuing to execute the FOTA upgrade task through the main control unit, performing a security check on one or more of the vehicle's current operating environment, upgrade tasks and upgrade data.

5. The vehicle remote upgrade method according to claim 4, characterized in that: The method further includes: after determining that the main control unit has completed the safety check, controlling the backup main control unit to recover to a state of monitoring the working state of the upgraded main control unit.

6. The vehicle remote upgrade method according to claim 1, characterized in that: The method further includes: continuously reporting upgrade result information and monitoring information to a remote upgrade platform through the upgrade master control redundant architecture.

7. The vehicle remote upgrade method according to claim 1, characterized in that: The method further includes: when there are multiple backup main control units, determining a backup main control unit for monitoring the working status of the upgrade main control unit according to a set backup main control unit preference strategy, so as to participate in the FOTA upgrade task.

8. A vehicle remote upgrade device, characterized in that: include: A configuration module, used to configure the upgrade master control redundant architecture of the vehicle, wherein the redundant architecture includes at least one upgrade master control unit and a backup master control unit, and the upgrade master control unit is used to execute the FOTA upgrade task sent from the server to the vehicle; A synchronization module, used to monitor the working status information of the upgrade main control unit by using the backup main control unit when the upgrade main control unit executes the FOTA upgrade task, and synchronously receive the upgrade instruction of the FOTA upgrade task; A repair module, configured to, when determining that an abnormality occurs when the upgrade main control unit performs the FOTA upgrade task, switch the backup main control unit to a temporary upgrade main control unit to restore the state of the abnormal upgrade main control unit; The recovery module is used to use the temporary main control unit to provide the upgrade main control unit with the upgrade instructions and working status information before the exception occurs, so as to continue to execute the FOTA upgrade task through the upgrade main control unit after determining that the state of the upgrade main control unit where the exception occurs is restored.

9. A computer storage medium, characterized in that The computer storage medium stores computer executable instructions, and when the computer executable instructions are executed, the vehicle remote upgrade method according to any one of claims 1 to 7 is executed.

10. An electronic device, characterized in that: include: a communication interface, a memory, and one or more processors; The memory is used to store one or more programs. When the operation command received by the communication interface instructs the one or more programs to be executed by the one or more processors through the system communication bus, the one or more processors implement the vehicle remote upgrade method as described in any one of claims 1-7.

Images