OTA upgrading method of new energy commercial vehicle and related equipment

Abstract

The invention provides an OTA upgrading method for a new energy commercial vehicle, and the method comprises the steps: receiving an OTA upgrading data package sent by a cloud server, and carrying out the signature verification and decryption; in response to the fact that the OTA upgrading data packet passes the signature verification, executing a preset flashing process according to the decrypted OTA upgrading data packet; in the process of executing the preset flashing process, in response to the fact that abnormal disconnection of the slave control management module SDA and the vehicle-mounted terminal occurs, sending a 28-silence message according to a preset period, and maintaining the silence state of the whole vehicle; at the moment, the vehicle does not respond to gear shifting or power-on and power-off operation of a driver, and the safety of the vehicle during upgrading abnormal disconnection is guaranteed; in response to the detected abnormal power failure of the vehicle, after the vehicle is powered on again, upgrading of the upgrading component continues to be executed according to the current upgrading state determined by the vehicle control unit VCU; therefore, each upgrade is guaranteed to start and end, and the safety risk caused by the fact that the vehicle is out of control due to abnormal power failure in the upgrade process is avoided.

Description

Technical Field

[0001] The present invention relates to an OTA upgrade method for a new energy commercial vehicle and related equipment, belonging to the field of vehicle engineering. Background Art

[0002] With the development of battery technology, both new energy passenger vehicles and new energy commercial vehicles are showing a trend of rapid development. In order to meet the growing and unpredictable market demand, each OEM has to accelerate the development of vehicles and shorten the testing cycle. At the same time, compared with traditional fuel vehicles, new energy vehicles have more extensive and in-depth applications of new technologies and new functions, which leads to some problems that need to be improved by engineers after the vehicles are put on the market. However, the recall of vehicles on the market or the offline vehicle upgrade by the service personnel of the car factory will bring huge expenses to the OEM, and will also affect the owner's use of the car and affect the brand image. In order to deal with the above problems, OTA remote upgrade technology came into being.

[0003] The application of OTA technology in passenger cars has become relatively mature. From January to June 2023, the OTA installation volume of passenger cars in China was 5.274 million units, a year-on-year increase of 31.8%. A total of about 696 OTA upgrades were carried out. In particular, new passenger car companies such as Tesla and NIO almost maintain the frequency of OTA upgrades every month.

[0004] However, the application of OTA technology in new energy commercial vehicles is still lagging behind. There are very few new energy commercial vehicle models on the market that can support vehicle OTA capabilities. In addition to the influence of many factors such as the large number of new energy commercial vehicle models, diverse vehicle configurations, complex application scenarios, a wide variety of parts, and the underlying software development capabilities of parts, the safety issues of vehicle OTA upgrades by OEMs are also an important reason for the lag in the application of OTA technology in new energy commercial vehicles. The security issues involved in OTA upgrades include: 1. During the remote upgrade of the vehicle, due to software vulnerabilities, insufficient power, poor network signal, improper operation, etc., there is an abnormal disconnection or abnormal power outage. At this time, the vehicle function is still in an abnormal state. If the driver operates the vehicle at this time, there will be a major safety hazard; 2. Security issues of software packages and communication links during the remote vehicle upgrade process. The upgrade package is sent from the cloud, and the vehicle downloads it before upgrading. There are risks in the data package itself and the vehicle-cloud communication link, such as forging an identity to participate in vehicle-cloud communication operations; 3. During the remote upgrade of the vehicle, the vehicle power cannot support the completion of the ECU upgrade. Since the high-voltage architecture of commercial vehicles is quite different from that of passenger vehicles, such as the integration of DC / DC modules with other high-voltage modules, if DC / DC is used to store power in the vehicle's small battery during OTA upgrade, other high-voltage modules will be in a high-voltage state, resulting in safety risks during the vehicle upgrade process. Therefore, during the OTA upgrade process, commercial vehicle OEMs often only rely on a small battery to provide 24V low-voltage electricity to complete the ECU upgrade. However, this may cause the ECU upgrade time to be too long, which may exhaust the small battery power, resulting in ECU upgrade failure and vehicle breakdown. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies in the prior art and provide an OTA upgrade method and related equipment for new energy commercial vehicles. By setting corresponding protection strategies when an abnormal disconnection occurs between the SDA and the on-board terminal or an abnormal power outage occurs in the vehicle, the safe upgrade of the vehicle is ensured to avoid harm to the vehicle or the driver due to abnormal upgrades.

[0006] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0007] In a first aspect, the present invention provides an OTA upgrade method for a new energy commercial vehicle, which is executed by a vehicle-mounted terminal, including: receiving an OTA upgrade data packet sent by a cloud server, and performing signature verification and decryption; in response to the OTA upgrade data packet passing the signature verification, executing a preset flashing process according to the decrypted OTA upgrade data packet; in the process of executing the preset flashing process, in response to detecting an abnormal disconnection between a slave control management module SDA and the vehicle-mounted terminal, sending a vehicle silent instruction according to a preset period to maintain the silent state of the vehicle; in response to detecting an abnormal power failure of the vehicle, after the vehicle is powered on again, continuing to upgrade the upgrade component according to the current upgrade state determined by the vehicle controller VCU; wherein, the slave control management module SDA refers to an SDA used to execute data upload, program download, upgrade program and human-computer interaction functions; the current upgrade state is determined by the VCU according to a flag bit stored in the upgrade component when the vehicle is abnormally powered off.

[0008] Furthermore, the signature verification includes: completing identity security verification through certificate judgment; the certificate includes: root certificate, CA certificate and user certificate, among which the user certificate includes: SSL server certificate applied by the OTA platform to the PKI system, SSL client certificate applied by the vehicle side to the PKI system and OTA code signing certificate; the PKI system generates an OTA encryption key for encrypting the OTA upgrade package data and an OTA signing key for signing the client certificate.

[0009] Furthermore, the receiving of OTA upgrade data packets sent by the cloud server includes: for the upgrade of unrelated components, only one component's OTA upgrade data packet is allowed to be received at one time; and for the upgrade of related components, one upgrade is allowed to receive OTA upgrade data packets of multiple components; but for the upgrade of multiple components, when one of the components in the same upgrade fails to upgrade, it is necessary to roll back to the version before the upgrade even if the other components are upgraded successfully.

[0010] Furthermore, before executing the preset flashing process according to the decrypted OTA upgrade data packet, it also includes: in response to detecting that the small battery voltage is less than a preset threshold, controlling the BMS main negative relay, PDU auxiliary drive pre-charging relay and PDU auxiliary drive relay to close, and controlling the DC / DC module to charge the small battery until the small battery voltage is higher than the preset threshold; wherein the PDU is a high-voltage power distribution unit.

[0011] Furthermore, before executing the preset flashing process according to the decrypted OTA upgrade data packet, it also includes: obtaining the preconditions corresponding to the vehicle from the precondition pool preset in the cloud according to the vehicle type; judging in turn whether the vehicle satisfies the obtained preconditions; in response to the vehicle not satisfying any precondition, displaying the unsatisfied precondition on the instrument, and prompting the user to complete the corresponding operation within the preset time so that the vehicle satisfies the precondition.

[0012] Furthermore, the cloud-preset precondition pool includes: the small battery voltage is not less than a preset threshold, the vehicle speed is 0 km / h, the gear is N, the parking information is valid, the charging gun is in a disconnected state, and the vehicle state is in a Wait state.

[0013] Furthermore, before executing the preset flashing process according to the decrypted OTA upgrade data packet, it also includes: sending an irrelevant ECU silencing instruction to silence the ECUs that are irrelevant to the ECU to be upgraded in the network segment where the ECU to be upgraded is located, to ensure that there are no irrelevant application messages on the bus during the upgrade process; wherein, the irrelevant ECU silencing is implemented through the 28 service in the UDS protocol.

[0014] Furthermore, before sending the irrelevant ECU silent command, it also includes: disconnecting the PDU main positive relay, disconnecting the PDU auxiliary drive relay, forcing the N gear request and prohibiting the TCU shift operation.

[0015] In a second aspect, the present invention provides a computer-readable storage medium having an OTA upgrade program stored thereon, and when the OTA upgrade program is executed by a processor, the OTA upgrade method as described in the first aspect is implemented.

[0016] In a third aspect, the present invention provides a vehicle-mounted terminal, comprising a memory, a processor, and an OTA upgrade program stored in the memory and executable on the processor, wherein when the processor executes the OTA upgrade program, the OTA upgrade method as described in the first aspect is implemented.

[0017] Compared with the prior art, the present invention has the following beneficial effects: (1) In the OTA upgrade method provided by the present invention, when an abnormal disconnection occurs between the SDA and the vehicle terminal, resulting in the SDA being unable to obtain the vehicle upgrade status in time, the vehicle terminal sends a vehicle silent command according to a preset period to keep the vehicle silent. At this time, the vehicle will not respond to the driver's gear shifting or power on and off operations, thereby ensuring the vehicle safety when the upgrade is abnormal. In addition, the vehicle controller VCU sets a flag bit. When the vehicle is abnormally powered off during the upgrade process, the upgrade status at the time of abnormal power off is stored in the VCU. When the vehicle is powered on again, the VCU determines the current upgrade status through the flag bit, maintains the upgrade status, and notifies the vehicle terminal to continue the upgrade, thereby ensuring that each upgrade has a beginning and an end, and the vehicle can return to a safe state, thereby avoiding the harm of power failure during the upgrade process to vehicle safety. (2) The OTA upgrade method provided by the present invention adopts a three-layer certificate system, using a PKI system to generate an OTA signature key for signing a client certificate and an OTA encryption key for encrypting OTA upgrade package data, and sends the signature verification public key to the vehicle terminal to ensure the authenticity and integrity of the upgrade package; (3) The OTA upgrade method provided by the present invention adopts an intelligent power replenishment strategy to ensure that the small battery is fully charged before each upgrade, thereby preventing ECU upgrade failure due to battery exhaustion and avoiding vehicle breakdown due to insufficient power during the vehicle upgrade process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a schematic flow chart of the OTA upgrade method for new energy commercial vehicles provided in Embodiment 1 of the present invention;

[0019] Figure 2 It is a schematic block diagram of the vehicle-side upgrading device provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0020] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0021] Example 1

[0022] According to a first aspect of the present invention, the present invention provides an OTA upgrade method for a new energy commercial vehicle. Figure 1 A schematic flow chart of an OTA upgrade method for a new energy commercial vehicle according to an embodiment of the present invention is shown. Figure 1 As shown, with T-BOX as the vehicle-mounted terminal, the method includes the following steps:

[0023] Step 1: Receive the OTA upgrade data packet sent by the cloud server, and perform signature verification and decryption.

[0024] Specifically, each ECU included in the vehicle has a unique identification code, and the ECU unique identification code includes: a hardware version number, a supplier code, and a material number.

[0025] T-BOX obtains the version information of each ECU based on the unique identification code of the ECU and sends it to the cloud server; the cloud server compares the version information of each ECU with the version information stored locally to determine the ECU to be upgraded; the cloud server determines the upgrade version corresponding to each ECU to be upgraded; the cloud server makes the upgrade version corresponding to each ECU to be upgraded into an OTA upgrade data packet and sends it to T-BOX.

[0026] T-BOX receives the OTA upgrade data packet sent by the cloud server, verifies the signature based on the signature key, and decrypts the encrypted OTA upgrade data packet.

[0027] Step 2: In response to the OTA upgrade data packet passing the signature verification, a preset flashing process is executed according to the decrypted OTA upgrade data packet.

[0028] Specifically, T-BOX sends the corresponding upgrade version to the corresponding ECU to be upgraded; and executes the preset Bootloader flashing process to upgrade the ECU to be upgraded; if the flashing fails, it will be re-flashed. If the number of flashing failures reaches the preset number, the upgrade will be exited, the ECU partition will be rolled back, and the instrument will prompt that the flashing failed; if the upgrade is successful, the instrument will prompt that the flashing is successful; finally, T-BOX will send the flashing log back to the OTA platform.

[0029] During the execution of the preset flashing process, in response to detecting an abnormal disconnection between the slave control management module SDA and the vehicle terminal, a vehicle silent command is sent according to a preset period to maintain the vehicle silent state;

[0030] In response to an abnormal power failure of the vehicle, after power is restored, the upgrade of the upgrade components is continued according to the current upgrade status determined by the vehicle controller VCU.

[0031] Specifically, SDA is a slave control management module, which is used to perform data upload, program download, program upgrade and human-computer interaction functions. SDA is an important component of OTA upgrade; the maintenance of vehicle 28 silent service is heavily dependent on SDA. T-BOX, as the host environment of SDA, may have abnormal killing of SDA application, or abnormal call of SDA and T-BOX internal interface, resulting in SDA unable to obtain vehicle upgrade status in time, ECU 28 silent cannot be maintained. If the owner changes gears or powers on and off at this time, the vehicle will respond, which will put the owner and the vehicle in a very dangerous state. In response to this, T-BOX is designed with timeout protection. When SDA and T-BOX are abnormally disconnected, T-BOX executes abnormal scenario protection strategy, that is, T-BOX periodically sends vehicle silent instructions to maintain the vehicle silent state.

[0032] In addition, the upgrade process is changeable, and commercial vehicles are often parked without stopping. In this scenario, it also brings certain risks to the reliable upgrade of the vehicle. The user may directly power off and restart the vehicle before the upgrade is completed. VCU, as the vehicle controller, sets a flag bit when upgrading other components other than VCU to ensure the safety of the vehicle in the event of abnormal power failure. When the vehicle has abnormal power-off behavior during the upgrade process, VCU executes the abnormal scenario protection strategy, that is, the upgrade status of the upgraded components is stored in VCU. When the vehicle is powered on again, VCU reads the flag bit, determines the current upgrade status, maintains the upgrade mode status, and notifies T-BOX to continue the upgrade.

[0033] The above method, on the one hand, maintains the whole vehicle in a silent state when SDA cannot obtain the vehicle upgrade status in time. At this time, the vehicle will not respond to the driver's gear shifting or power on and off operations, ensuring the safety of the vehicle when the upgrade is abnormally disconnected. On the other hand, when the vehicle restarts after an abnormal power outage, the upgrade status is maintained through the VCU flag, which facilitates the continuation of the upgrade after the restart, ensuring that each upgrade has a beginning and an end, avoiding the harm to vehicle safety caused by power outages during the upgrade process.

[0034] Example 2

[0035] Based on Example 1, the OTA upgrade method for new energy commercial vehicles in this embodiment further includes the following optional steps:

[0036] Optionally, signature verification uses a three-tier certificate system.

[0037] Specifically, according to the commercial vehicle business scenario, a three-layer certificate authentication system including root certificate, CA certificate and user certificate is designed. Among them, user certificate includes SSL server certificate, SSL client certificate and OTA code signing certificate; SSL server certificate is first applied for by OTA platform to PKI system and deployed in SSL gateway, and then PKI system generates OTA code signing key pair and OTA code signing certificate, and configures them in OTA platform. SSL client certificate is applied for and downloaded by T-BOX from PKI platform, and certificate judgment is performed when T-BOX is powered on and self-tested. OTA signature key and OTA encryption key are generated by PKI system, among which OTA encryption key is used to encrypt OTA upgrade package data, OTA signature key is used to sign client certificate, and public key that can perform signature verification is sent to T-BOX along with SSL client certificate, so as to ensure that upgrade package information will not be leaked or tampered, ensure the authenticity and integrity of upgrade package, and provide security protection for program package and vehicle-cloud communication.

[0038] Optionally, for the upgrade of unrelated components, only one component's OTA upgrade data packet is allowed to be received in one upgrade; for the upgrade of related components, one upgrade is allowed to receive OTA upgrade data packets of multiple components, such as the vehicle controller VCU and the transmission controller TCU; but for multi-component upgrades such as VCU, when one of the components in the same upgrade task fails, the entire upgrade task fails, and it is necessary to roll back to the version before the upgrade even if other components are successfully upgraded.

[0039] Optionally, before executing the preset flashing process according to the decrypted OTA upgrade data packet, if the voltage of the small battery is less than the preset value of 24V, the BMS main negative relay is closed, the VCU controls the PDU auxiliary drive pre-charge relay to be closed, the VCU controls the PDU auxiliary drive relay to be closed, the VCU controller DC / DC is enabled, and the DC / DC module starts charging the small battery until the small battery is higher than 24V. The intelligent charging strategy ensures that the small battery is fully charged before each upgrade, preventing the ECU upgrade from failing due to battery exhaustion, and avoiding the vehicle from breaking down due to insufficient power during the upgrade process.

[0040] Optionally, before executing the preset flashing process according to the decrypted OTA upgrade data packet, the preconditions corresponding to the vehicle are obtained from a precondition pool preset in the cloud according to the vehicle type.

[0041] Specifically, the precondition pool preset in the cloud includes: the small battery voltage is not less than the preset threshold, the vehicle speed is 0 km / h, the gear is N gear, the parking information is valid, the charging gun is in the disconnected state, the vehicle state is in the Wait state, and other preconditions, and each commercial vehicle model forms a unique mapping relationship with all the preconditions under the model.

[0042] T-BOX obtains the preconditions that match the commercial vehicle model from the cloud precondition pool according to the commercial vehicle model; it determines in turn whether the vehicle meets the obtained preconditions; if not, the unsatisfied preconditions are displayed on the instrument panel, and the user is prompted to complete the corresponding operation within the specified time. For example, if the gear position is not N, the user is prompted to switch the gear to N within 10 seconds. The upgrade can only be performed when all the preconditions that match the vehicle model are met.

[0043] Optionally, before executing a preset flashing process according to the decrypted OTA upgrade data packet, an irrelevant ECU silent command is sent.

[0044] Specifically, during the OTA upgrade process, irrelevant ECUs in the network segment are required to be silent, and irrelevant application messages are not allowed on the bus to prevent ECUs from responding to application messages, which would cause abnormal interruption of ECU flashing.

[0045] Preferably, in this embodiment, the silence of irrelevant ECUs is implemented through the 28 service in the UDS protocol.

[0046] Optionally, before sending the irrelevant ECU silent command, disconnect the PDU main positive relay, disconnect the PDU auxiliary drive relay, force the N gear request and prohibit the TCU shift operation.

[0047] Example 3

[0048] According to the second aspect of the present invention, this embodiment provides a computer storage medium on which OTA upgrade program instructions are stored. The OTA upgrade program instructions are used to execute the OTA upgrade method for new energy commercial vehicles as described in Example 1 or Example 2 when running.

[0049] The storage medium may include, for example, a storage component of a tablet computer, a hard disk of a computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disk read-only memory (CD-ROM), a USB memory, or any combination of the above storage media. The computer storage medium may be any combination of one or more computer storage media.

[0050] Example 4

[0051] According to a third aspect of the present invention, this embodiment provides a vehicle-mounted terminal. Figure 2 FIG. 4 shows a schematic block diagram of a vehicle-mounted terminal in Embodiment 4. Figure 2 As shown, the vehicle-mounted terminal includes a processor and a memory; wherein the memory stores computer program instructions, and the computer program instructions are used by the processor to execute the OTA upgrade method for new energy commercial vehicles as described in Example 1 or Example 2 when the processor is running.

[0052] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An OTA upgrade method for a new energy commercial vehicle, executed by a vehicle-mounted terminal, characterized in that: include: Receive OTA upgrade data packets sent by the cloud server, and perform signature verification and decryption; In response to the OTA upgrade data packet passing the signature verification, executing a preset flashing process according to the decrypted OTA upgrade data packet; During the execution of the preset flashing process, in response to detecting an abnormal disconnection between the slave control management module SDA and the vehicle terminal, a vehicle silent command is sent according to a preset period to maintain the vehicle silent state; In response to abnormal power failure of the vehicle, the vehicle is powered on again and the upgrade of the upgrade components is continued according to the current upgrade status determined by the vehicle controller VCU; Among them, the slave control management module SDA refers to the SDA used to execute data upload, program download, program upgrade and human-computer interaction functions; the current upgrade status is determined by the VCU according to the flag stored by the upgrade component when the vehicle is abnormally powered off.

2. The OTA upgrade method for a new energy commercial vehicle according to claim 1, characterized in that: The signature verification includes: executing certificate judgment to complete identity security verification; the certificate includes: root certificate, CA certificate and user certificate, among which the user certificate includes: SSL server certificate applied by OTA platform to PKI system, SSL client certificate applied by vehicle side to PKI system and OTA code signing certificate; PKI system generates OTA encryption key for encrypting OTA upgrade package data and OTA signing key for signing client certificate.

3. The OTA upgrade method for a new energy commercial vehicle according to claim 1, characterized in that: The receiving of OTA upgrade data packets sent by the cloud server includes: for the upgrade of unrelated components, only one component's OTA upgrade data packet is allowed to be received at one time; and for the upgrade of related components, one upgrade is allowed to receive OTA upgrade data packets of multiple components; but for the upgrade of multiple components, when one of the components in the same upgrade fails to upgrade, it is necessary to roll back to the version before the upgrade even if the other components are successfully upgraded.

4. The OTA upgrade method for a new energy commercial vehicle according to claim 1, characterized in that: Before executing the preset flashing process according to the decrypted OTA upgrade data packet, it also includes: in response to detecting that the small battery voltage is less than a preset threshold, controlling the BMS main negative relay, PDU auxiliary drive pre-charging relay and PDU auxiliary drive relay to close, and controlling the DC / DC module to charge the small battery until the small battery voltage is higher than the preset threshold; wherein the PDU is a high-voltage power distribution unit.

5. The OTA upgrade method for a new energy commercial vehicle according to claim 1, characterized in that: Before executing the preset flashing process according to the decrypted OTA upgrade data packet, it also includes: obtaining the preconditions corresponding to the vehicle from the precondition pool preset in the cloud according to the vehicle type; judging in turn whether the vehicle meets the obtained preconditions; in response to the vehicle not meeting any precondition, displaying the unsatisfied precondition on the instrument, and prompting the user to complete the corresponding operation within a preset time so that the vehicle meets the precondition.

6. The OTA upgrade method for a new energy commercial vehicle according to claim 5, characterized in that: The cloud-preset precondition pool includes: the small battery voltage is not less than a preset threshold, the vehicle speed is 0 km / h, the gear is N, the parking information is valid, the charging gun is in a disconnected state, and the vehicle state is in a Wait state.

7. The OTA upgrade method for a new energy commercial vehicle according to claim 1, characterized in that: Before executing the preset flashing process according to the decrypted OTA upgrade data packet, the method further includes: sending an irrelevant ECU silencing instruction to silence the irrelevant ECUs in the network segment where the ECU to be upgraded is located, so as to ensure that there are no irrelevant application messages on the bus during the upgrade process; The irrelevant ECU silence is implemented through the 28 services in the UDS protocol.

8. The OTA upgrade method for a new energy commercial vehicle according to claim 7, characterized in that: Before sending the irrelevant ECU silent command, the method also includes: disconnecting the PDU main positive relay, disconnecting the PDU auxiliary drive relay, forcing the N gear request and prohibiting the TCU shift operation.

9. A computer-readable storage medium, characterized in that: An OTA upgrade program is stored thereon, and when the OTA upgrade program is executed by the processor, the OTA upgrade method as described in any one of claims 1-8 is implemented.

10. A vehicle-mounted terminal, characterized in that: It includes a memory, a processor, and an OTA upgrade program stored in the memory and executable on the processor. When the processor executes the OTA upgrade program, the OTA upgrade method according to any one of claims 1 to 8 is implemented.

Images