OTA update rollback method and device, storage medium and program product

Abstract

One or more embodiments of the present specification provide an OTA update fallback method, device, storage medium and program product, the method being applied to a vehicle, the vehicle comprising at least one electronic control unit, the at least one electronic control unit being configured with a built-in memory and a plug-in memory, the plug-in memory is used for backing up original software in the built-in memory; the method comprises the following steps: acquiring an updating request for a target electronic control unit, and acquiring corresponding software updating data according to the updating request; updating original software in a target built-in memory of a target electronic control unit according to the software updating data; and under the condition that the update operation fails to be executed, synchronizing original software of a target plug-in memory of the target electronic control unit to the target built-in memory.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of OTA (Over-the-air) update technology, and more particularly, to an OTA update rollback method, device, storage medium, and program product. Background Art

[0002] OTA is a technology that remotely updates software or adjusts the configuration of devices through wireless networks. With the growth of the new energy vehicle market, the number of vehicles has increased year by year, so the demand for OTA updates has also increased. However, the OTA update operation itself may also fail, especially in the vehicle's critical Electronic Control Unit (ECU). The above failures may cause serious safety issues, such as vehicle abandonment, power supply, or inability to drive.

[0003] In the related technology, a rollback flashing method is usually used to roll back the OTA update operation for the ECU that failed the OTA update. However, this method requires the old version of the software to be completely re-downloaded to the corresponding ECU, and the device may need to be restarted to complete the flashing process. The whole process is time-consuming and the OTA update rollback efficiency is low. Summary of the invention

[0004] In view of this, one or more embodiments of this specification provide the following technical solutions: According to a first aspect of one or more embodiments of the present specification, an OTA update rollback method is proposed, which is applied to a vehicle, wherein the vehicle includes at least one electronic control unit, and the at least one electronic control unit is configured with a built-in memory and an external memory, and the external memory is used to back up the original software in the built-in memory; the method includes: Obtaining an update request for a target electronic control unit, and obtaining corresponding software update data according to the update request; performing an update operation on the original software in the target built-in memory of the target electronic control unit according to the software update data; In case the update operation fails to be executed, the original software of the target external memory of the target electronic control unit is synchronized to the target built-in memory.

[0005] Optionally, the electronic control unit is a master electronic control unit or a controlled electronic control unit, and the master electronic control unit is used to control the OTA update of each controlled electronic control unit; and obtaining the update request for the target electronic control unit includes: In a case where the target electronic control unit is the controlled electronic control unit, an update request for the target electronic control unit is obtained through the master electronic control unit.

[0006] Optionally, the update request at least includes a unit identifier of the target electronic control unit; and acquiring corresponding software update data according to the update request includes: Determine software update data matching the target electronic control unit from the OTA server according to the unit identifier in the update request, download the matched software update data to the master electronic control unit and then distribute it to the target electronic control unit; or, Software update data matching the target electronic control unit is determined from an OTA server according to the unit identifier in the update request, and the matched software update data is downloaded to the target electronic control unit.

[0007] Optionally, the vehicle further includes other electronic control units that are not configured with external memory; memory configuration information of the other electronic control units and the at least one electronic control unit are recorded in the OTA server; synchronizing the original software of the target external memory of the target electronic control unit to the target built-in memory includes: Obtaining a unit identification of the target electronic control unit; querying memory configuration information of the target electronic control unit from the OTA server according to the unit identifier; In the case that the queried memory configuration information indicates that the target electronic control unit is configured with an external memory, the original software of the target external memory of the target electronic control unit is synchronized to the target built-in memory.

[0008] Optionally, synchronizing the original software of the target external memory of the target electronic control unit to the target built-in memory includes: Generate software synchronization instructions corresponding to the target built-in memory and the target external memory by the main electronic control unit; The software synchronization instruction is executed based on the unified diagnostic service of the vehicle to synchronize the original software of the target external memory to the target built-in memory.

[0009] Optionally, the update request is generated by an OTA server, the master electronic control unit or the controlled electronic control unit.

[0010] Optionally, the method further includes: In the case where the update operation is successfully executed, the updated software in the built-in memory is synchronized to the external memory as new original software.

[0011] According to a second aspect of one or more embodiments of this specification, an electronic device is proposed, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor implements the steps of the method described in the first aspect by running the executable instructions.

[0012] According to a third aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0013] According to a fourth aspect of one or more embodiments of the present specification, a computer program product is provided, comprising a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0014] In the technical solution provided in the present specification, on the basis of the built-in memory already configured in at least one electronic control unit, an additional external memory for backing up the original software in the above-mentioned built-in memory is configured, so that after the target electronic control unit obtains the corresponding software update data according to the update request and performs an update operation on the original software in the target built-in memory of the target electronic control unit according to the software update data, even if the update fails, the original software backed up in the target external memory of the target electronic control unit can be directly synchronized to the target built-in memory, avoiding the traditional rollback and flashing steps, shortening the overall time of OTA rollback, and improving the OTA update rollback efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 It is a schematic diagram of the architecture of a vehicle OTA update system provided by an exemplary embodiment; Figure 2 It is a flowchart of an OTA update rollback method provided by an exemplary embodiment; Figure 3 It is a flowchart of a method for flashing software update data provided by an exemplary embodiment; Figure 4 It is a flowchart of another OTA update rollback method provided by an exemplary embodiment; Figure 5 is a schematic structural diagram of an electronic device provided by an exemplary embodiment; Figure 6 It is a structural diagram of an OTA update rollback device provided by an exemplary embodiment. DETAILED DESCRIPTION

[0017] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the present invention.

[0018] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0019] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0020] Figure 1 FIG. 1 is a schematic diagram of an OTA update rollback system provided by an exemplary embodiment. Figure 1 As shown, the system includes a built-in memory 11 and an external memory 12 configured in an electronic control unit 10 of the vehicle.

[0021] The electronic control unit 10 is a microcomputer device inside the car, which is responsible for controlling specific subsystems or components. The electronic control unit 10 is usually composed of a microprocessor, memory, input / output modules and other necessary hardware. A vehicle can be equipped with multiple different electronic control units, each of which is responsible for monitoring and controlling specific functions, receiving information from sensors, and issuing instructions to adjust the behavior of the vehicle according to preset programs. For example, in electric vehicles, the battery management system (BMS) can be composed of a single electronic control unit or multiple electronic control units working together to manage the charging and discharging of the battery, as well as battery status monitoring, or manage the status of the vehicle's lights, door locks, windows and other facilities through the electronic control unit corresponding to the body control function.

[0022] The memory in the above-mentioned electronic control unit 10 can be divided into built-in memory and external memory. In the OTA update scenario, the built-in memory may refer to the read-only memory (ROM) integrated inside the main control chip of the electronic control unit 10, which is used to store specific software, such as boot programs, firmware, etc. The external memory may refer to the flash memory (Flash Memory) outside the built-in memory in the electronic control unit 10, which can be used to back up the original software normally stored in the built-in memory and ensure that the data will not be lost after power failure. During the operation of the above-mentioned system, the software in the built-in memory can be updated using the software update data obtained by the vehicle. If the update fails, the original software stored in the external memory can be synchronized to the target built-in memory, thereby restoring the data before the built-in memory was updated.

[0023] In addition, compared to the traditional dual partition mechanism (Dual Partition Mechanism) that divides the built-in memory of the electronic control unit 10 into an active partition that is currently in use and a backup partition for installing new firmware or software, the above-mentioned built-in memory and external memory have low storage cost, simple structural design, and low development and maintenance costs, and are more suitable for the rapid promotion of related products.

[0024] It should be noted that OTA technology, as a broad concept, refers to any remote update technology performed over a wireless network. It can be applied to a variety of devices, including smartphones, tablets, IoT devices, and cars. In short, OTA technology allows devices to download update packages from a server without physical connection and automatically install updates to keep the device up to date. Under this broad concept, it can be further divided into FOTA (Firmware Over-The-Air) and SOTA (Software Over-The-Air) based on specific application examples. The former focuses on the update of the underlying firmware, which is usually the core control program of the device and is directly related to the basic functions and safety of the device, such as the engine control unit, brake system control unit, battery management system, airbag control unit, etc. The latter focuses on the update of the device's operating system and application programs, which is related to user experience and vehicle functionality, such as updating the in-vehicle infotainment system, navigation software, multimedia player, and user interface. The two correspond to the same basic process framework in the update process, so the fallback method after OTA update failure in this manual can also be applied to FOTA and SOTA. To avoid ambiguity, the OTA updates mentioned in this manual are all FOTA updates by default.

[0025] Figure 2 The present invention is a flowchart of an OTA update rollback method provided by an exemplary embodiment. The method is applied to a vehicle. The vehicle includes at least one electronic control unit. The at least one electronic control unit is configured with a built-in memory and an external memory. The external memory is used to back up the original software in the built-in memory. The method may include the following steps: Step S202: obtaining an update request for a target electronic control unit, and obtaining corresponding software update data according to the update request.

[0026] When performing an OTA update on a vehicle, the vehicle can obtain an update request for a target electronic control unit, and can obtain software update data corresponding to the target electronic control unit according to the update request, thereby updating the software in the target electronic control unit. The update request can be generated in response to an update operation actively triggered by a user, or in response to an update operation automatically triggered based on preset update conditions in the target electronic control unit or other units or devices, and this is not limited in this specification.

[0027] The above-mentioned electronic control unit can be further divided into a master electronic control unit or a controlled electronic control unit, wherein the master electronic control unit can be used to control the OTA update of each controlled electronic control unit. Then, in the case where the above-mentioned target electronic control unit is the above-mentioned controlled electronic control unit, the vehicle can obtain an update request for the above-mentioned target electronic control unit through the master electronic control unit. At this time, the above-mentioned update request can be generated by an OTA server for providing software update data, a master electronic control unit or a controlled electronic control unit.

[0028] Taking the vehicle control unit (VCU) as an example, when it is used as the master electronic control unit, the corresponding powertrain control unit, chassis control unit, and body control unit can be used as the corresponding controlled electronic control units; or taking the power management system as an example, when it is used as the master electronic control unit, the corresponding power battery control unit and low-voltage battery control unit can be used as the corresponding controlled electronic control units. In short, at this time, the master electronic control unit can obtain the corresponding update request instead of the controlled electronic control unit that needs to be updated, and distribute it to the corresponding controlled electronic control unit.

[0029] In addition, the same controlled electronic control unit can correspond to a single master electronic control unit or multiple different master electronic control units according to actual conditions, which is not limited in this specification.

[0030] When the master electronic control unit successfully obtains the update request, it can obtain the corresponding software update data according to the information in the update request, wherein the so-called update request may at least include the unit identification of the target electronic control unit.

[0031] In one embodiment, the master electronic control unit can determine the software update data matching the target electronic control unit from the OTA server according to the unit identifier, and download the matched software update data to the master electronic control unit before distributing it to the target electronic control unit. In this embodiment, the master electronic control unit can uniformly manage and coordinate the entire OTA update process, simplify the update process, and facilitate centralized monitoring and control; and because only the master electronic control unit needs to establish a connection with the OTA server and download the update, the network traffic required by other controlled electronic control units is reduced, especially in the internal network of the vehicle, which can avoid network congestion caused by simultaneous downloads of multiple electronic control units.

[0032] In another embodiment, the master electronic control unit can determine the software update data matching the target electronic control unit from the OTA server according to the unit identification, and download the matched software update data to the target electronic control unit. In this embodiment, each target electronic control unit can download and install updates independently, reducing the pressure on the master electronic control unit. And because each ECU only needs to store its own update data, the storage space requirement is reduced.

[0033] The above-mentioned update request may also include other additional information. Taking the update version number and update signature as examples, in the matching process of the above-mentioned software update data, the above-mentioned update version number can specify a specific version among multiple software update versions corresponding to the unit identifier, thereby realizing more accurate OTA update operations such as software downgrade; the above-mentioned update signature can help verify whether the update request comes from a legitimate sender, thereby preventing unauthorized third parties from tampering with or forging the update request.

[0034] It is understandable that the master electronic control unit itself can also be regarded as a special controlled electronic control unit. When the master electronic control unit obtains an update request for its own unit, it can also obtain the corresponding software update data through any of the above methods. This manual does not limit this.

[0035] Step S204: performing an update operation on the original software in the target built-in memory of the target electronic control unit according to the software update data.

[0036] After obtaining the software update data for the target electronic control unit, the software update data can be written to the above-mentioned target built-in memory to implement the software update operation. Among them, the above-mentioned software update data can only be the difference between the software to be updated and the original version. In this case, the update operation corresponding to the above-mentioned software update data can be regarded as an incremental update (Delta Update); the above-mentioned software update data can also be a small update to fix specific problems or add specific functions. In this case, the update operation corresponding to the above-mentioned software update data can be regarded as a patch update; the above-mentioned software update data can also be an update package containing all the contents of the new version. In this case, the update operation corresponding to the above-mentioned software update data can be regarded as a full installation package (Full Package) update. In short, the update operation of this manual can be changed according to the specific form of the software update data, and this manual does not limit it.

[0037] In addition, since the above software update data is updated in the target built-in memory at the first time, it has a significant advantage in efficiency compared to the method of first updating in other memories such as the target external memory and then synchronizing to the target built-in memory.

[0038] The flashing process of the above software update data can be implemented based on the vehicle's unified diagnostic services (UDS). Figure 3 Make an introduction, Figure 3 This is a flowchart of a method for flashing software update data provided by an exemplary embodiment. As shown in the figure, the process of flashing software update data includes the following steps: Step S302, checking whether the pre-programming conditions for flashing the target ECU are met.

[0039] In one embodiment, the master electronic control unit can check whether the target electronic control unit meets the prerequisites for starting flashing. This may include checking whether the ECU status, power status, network connection status are specified, etc. This step can be based on the Read DTCs and Read Data by Identifier services in the UDS to ensure that the ECU is in a programmable state. If it is determined that the pre-programming conditions for flashing the target ECU are met, step S304 can be executed, otherwise step S302 can be attempted again after a preset time until the above pre-programming conditions are met, or the number of consecutive attempts exceeds the preset retry threshold.

[0040] Step S304, requesting the target ECU to enter a programming session.

[0041] In one embodiment, the master electronic control unit can request the target electronic control unit to enter a programming session through functional addressing. In other words, the master electronic control unit can send a specific command to the target electronic control unit to make it enter programming mode. The above specific command can be implemented by a specific routine started by the RoutineControl service in the UDS. The above specific command can be sent in a preset sending mode, such as 16 frames, one frame every second, etc.; Step S306, determining whether all target ECUs have entered programming session mode.

[0042] In one embodiment, the master electronic control unit can determine whether all target electronic control units that need to be flashed have entered the correct programming session mode through the Session Control service in the UDS. The Session Control service allows the session mode of the target ECU to be changed to ensure that the ECU is in the mode required for programming. If the judgment result is yes, step S308 can be executed, otherwise, step S304 can be tried again after a preset time, that is, the session mode is re-requested.

[0043] Of course, if some target electronic control units do not enter the session mode, in addition to re-requesting the session mode, other solutions may be provided, such as checking the network connection, diagnosing the fault, and resetting the power supply, which are not limited in this manual.

[0044] Step S308, unlocking the target ECU.

[0045] In one embodiment, the master ECU can unlock the target ECU through the Security Access service in the UDS to make it ready to accept new firmware or software.

[0046] Step S310, installing and activating the boot loader.

[0047] In one embodiment, the master ECU may install a new boot program in the target ECU through a programming service in the UDS to ensure that a subsequent flashing process can be performed correctly.

[0048] Step S312: transmitting software update data to the target ECU.

[0049] In one embodiment, the master ECU can transmit a vehicle binary file (VBF) package containing new firmware or software to the target ECU via the Transmission of Data service in UDS. This can be achieved by allowing data files to be uploaded to the ECU.

[0050] Step S314, verifying the software after OTA update.

[0051] In one embodiment, the master electronic control unit can verify the software version after OTA update in the built-in memory of the target electronic control unit to ensure that the update is successful and the software version is correct. This can be achieved through the Read Data by Identifier service in UDS, which can read the software version information in the ECU and compare it with the expected version. As for the execution method of different verification results, please refer to the introduction of step S206, which is not described in detail in this manual.

[0052] Step S206, when the update operation fails, synchronizing the original software of the target external memory of the target electronic control unit to the target built-in memory.

[0053] In the event that the update operation fails, the original software flashed in the target built-in memory will be lost. Therefore, the original software pre-backed up in the target external memory of the target electronic control unit can be synchronized to the target built-in memory, thereby achieving OTA update rollback of the target electronic control unit.

[0054] Specifically, the vehicle can generate software synchronization instructions corresponding to the target built-in memory and the target external memory through the main electronic control unit, and execute the software synchronization instructions based on the UDS to synchronize the original software in the above target external memory to the above target built-in memory. Among them, the synchronization of the original software can be achieved through the routine identifier (Routine Identifier, RID) synchronization instruction corresponding to the routine control service in the UDS to achieve rapid rollback, which greatly reduces the rollback time and success rate compared to the traditional rollback flash process, thereby improving the overall OTA rollback efficiency.

[0055] As mentioned above, the above-mentioned vehicle includes at least one electronic control unit configured with built-in memory and external memory. This also means that there are some vehicles that may also include other electronic control units configured with basic built-in memory but not configured with external memory. When the update operation of the above-mentioned other electronic control units fails, it is impossible to rely on the corresponding external memory for fast OTA update rollback, but can only use traditional rollback flashing. Under this premise, it will be difficult for each model to determine which electronic control unit uses external memory for rollback when the update operation fails, and which electronic control unit rolls back based on built-in memory when the update operation fails. This manual proposes unified management of corresponding memory configuration information for the above situations.

[0056] In one embodiment, the other electronic control units can be recorded in the OTA server together with the memory configuration information of the at least one electronic control unit. At this time, the master electronic control unit can obtain the unit identification of the target electronic control unit, and query the memory configuration information of the target electronic control unit from the OTA server according to the unit identification. If the memory configuration information obtained indicates that the target electronic control unit is configured with an external memory, the master electronic control unit can obtain the unit identification of the target electronic control unit and query the memory configuration information of the target electronic control unit from the OTA server according to the unit identification. Figure 3 The original software of the target external memory of the target electronic control unit is synchronized to the target built-in memory in a manner. If the query result is empty, or the queried memory configuration information indicates that the target electronic control unit is not configured with an external memory, a rollback and flash can be performed based on the built-in memory. The memory configuration information can be used to describe the memory configuration status of each electronic control unit of different vehicle types. For example, electronic control unit A is configured with both built-in memory and external memory, while electronic control unit B is only configured with built-in memory. The memory configuration information can be uniformly maintained and managed by the vehicle manufacturer.

[0057] Of course, in addition to obtaining the above-mentioned memory configuration information after the update operation fails, the vehicle can also obtain it in advance through methods such as timing programs, thereby shortening the time required from the failure of the update operation to the synchronization of the original software of the target external memory to the target built-in memory, thereby improving the efficiency of update rollback.

[0058] If the above-mentioned update operation is successfully executed, the updated software in the above-mentioned built-in memory can be synchronized to the external memory as the new original software, thereby ensuring that the target external memory of the target electronic control unit can still provide the most recently updated original software for fallback when the next OTA update operation fails.

[0059] Combine the following Figure 4 The overall process of the OTA update rollback method is introduced. As shown in the figure, the method includes the following steps: Step S402: The OTA server sets the memory configuration information of each ECU and sends an OTA update request for the target ECU.

[0060] In one embodiment, the OTA server provided by the vehicle manufacturer can pre-set the memory configuration information of each electronic control unit under each model, including memory size, type, etc., and generate a corresponding OTA update request when the firmware of the target electronic control unit of the target model is updated. For example: suppose there are multiple ECUs in a smart car, including an engine control unit, a body control module, etc. The OTA server can generate corresponding update requests based on the firmware update status of these ECUs, and send them to the main control ECU in the vehicle through the wireless network.

[0061] Step S404: the main control ECU receives the update request and performs OTA upgrade.

[0062] In one embodiment, after receiving an update request actively sent by an OTA server, a main electronic control unit in the vehicle, such as a central gateway module (CGW), can start downloading new firmware to the built-in memory of the engine control unit with user permission and start the update process.

[0063] Step S406, the main control ECU verifies the original software after OTA update in the target built-in memory.

[0064] In one embodiment, the master electronic control unit can verify whether the updated software in the built-in memory of the target ECU is correct, thereby ensuring that the updated software is consistent with the firmware sent by the OTA server and has not been damaged or tampered with.

[0065] Step S408: The main control ECU verifies whether it is passed.

[0066] In one embodiment, if the verification result is correct, it means that the update operation is successfully executed, and step S410 can be executed. Otherwise, it means that the update operation fails, and step S412 needs to be executed.

[0067] Step S410: the main control ECU synchronizes the updated software in the built-in memory to the external memory as the new original software.

[0068] In one embodiment, since the update operation is successfully executed, the main electronic control unit can synchronize the updated software from the built-in memory to the external memory as the new original software.

[0069] Step S412: the master ECU determines whether the target electronic control unit is equipped with an external memory.

[0070] In one embodiment, since the update operation fails, the main electronic control unit can determine whether the memory configuration information of the unit identifier of the corresponding target electronic control unit pre-queried from the OTA server can represent that the target electronic control unit is configured with an external memory. If so, execute step S414, otherwise execute step S416.

[0071] Step S414, the master control ECU synchronizes the original software in the target external memory to the target built-in memory.

[0072] In one embodiment, assuming that the target ECU is configured with an external memory, the master electronic control unit can synchronize the firmware in the external memory as new original software to the target built-in memory, ready for use at the next startup.

[0073] Step S416: the master control ECU performs a rollback flash on the target built-in memory.

[0074] In one embodiment, assuming that the target ECU is not configured with an external memory, the master electronic control unit can perform a rollback flash on the target built-in memory to restore to the firmware version before the update operation fails.

[0075] Figure 5 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 5At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, a memory 508, and a non-volatile memory 510, and may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 502 reading the corresponding computer program from the non-volatile memory 510 into the memory 508 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0076] Corresponding to the above-mentioned OTA update rollback method embodiment, this specification also provides an OTA update rollback device embodiment. Figure 6 The OTA update rollback device is applied to a vehicle, the vehicle includes at least one electronic control unit, the at least one electronic control unit is configured with a built-in memory and an external memory, the external memory is used to back up the original software in the built-in memory; the device may include: The update data acquisition unit 602 is used to acquire an update request for a target electronic control unit, and acquire corresponding software update data according to the update request.

[0077] The built-in memory update operation 604 is used to perform an update operation on the original software in the target built-in memory of the target electronic control unit according to the software update data.

[0078] The external memory synchronization operation 606 is used to synchronize the original software of the target external memory of the target electronic control unit to the target built-in memory when the update operation fails.

[0079] Optionally, the electronic control unit is a master electronic control unit or a controlled electronic control unit, and the master electronic control unit is used to control the OTA update of each controlled electronic control unit; the update data acquisition unit 602 is specifically used to: In a case where the target electronic control unit is the controlled electronic control unit, an update request for the target electronic control unit is obtained through the master electronic control unit.

[0080] Optionally, the update request at least includes a unit identifier of the target electronic control unit; the update data acquisition unit 602 is specifically configured to: Determine software update data matching the target electronic control unit from the OTA server according to the unit identifier in the update request, download the matched software update data to the master electronic control unit and then distribute it to the target electronic control unit; or, Software update data matching the target electronic control unit is determined from an OTA server according to the unit identifier in the update request, and the matched software update data is downloaded to the target electronic control unit.

[0081] Optionally, the vehicle further includes other electronic control units that are not configured with external memory; memory configuration information of the other electronic control units and the at least one electronic control unit are recorded in the OTA server; the external memory synchronization operation 606 is specifically used for: Obtaining a unit identification of the target electronic control unit; querying memory configuration information of the target electronic control unit from the OTA server according to the unit identifier; In the case that the queried memory configuration information indicates that the target electronic control unit is configured with an external memory, the original software of the target external memory of the target electronic control unit is synchronized to the target built-in memory.

[0082] Optionally, the external memory synchronization operation 606 is specifically used to: Generate software synchronization instructions corresponding to the target built-in memory and the target external memory by the main electronic control unit; The software synchronization instruction is executed based on the unified diagnostic service of the vehicle to synchronize the original software of the target external memory to the target built-in memory.

[0083] Optionally, the update request is generated by an OTA server, the master electronic control unit or the controlled electronic control unit.

[0084] Optionally, the device further comprises: The external memory updating unit is used to synchronize the updated software in the built-in memory to the external memory as the new original software when the updating operation is successfully executed.

[0085] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.

[0086] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0087] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

[0088] Although the present invention includes many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of protection claimed, but are mainly used to describe the features of the specific embodiments of specific inventions. Certain features described in multiple embodiments of the present invention may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in multiple embodiments or in any suitable sub-combination. In addition, although features may work in certain combinations as described above and even initially claimed as such, one or more features from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of a sub-combination.

[0089] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that these operations be performed in the particular order shown or performed sequentially, or requiring that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into multiple software products.

[0090] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0091] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An OTA update rollback method, characterized in that: Applied to a vehicle, the vehicle comprises at least one electronic control unit, the at least one electronic control unit is configured with a built-in memory and an external memory, the external memory is used to back up the original software in the built-in memory; the method comprises: Obtaining an update request for a target electronic control unit, and obtaining corresponding software update data according to the update request; performing an update operation on the original software in the target built-in memory of the target electronic control unit according to the software update data; In case the update operation fails to be executed, the original software of the target external memory of the target electronic control unit is synchronized to the target built-in memory.

2. The method according to claim 1, characterized in that The electronic control unit is a master electronic control unit or a controlled electronic control unit, and the master electronic control unit is used to control the OTA update of each controlled electronic control unit; The obtaining of an update request for a target electronic control unit comprises: In a case where the target electronic control unit is the controlled electronic control unit, an update request for the target electronic control unit is obtained through the master electronic control unit.

3. The method according to claim 2, characterized in that The update request at least includes a unit identification of the target electronic control unit; and obtaining corresponding software update data according to the update request includes: Determine software update data matching the target electronic control unit from the OTA server according to the unit identifier in the update request, download the matched software update data to the master electronic control unit and then distribute it to the target electronic control unit; or, Software update data matching the target electronic control unit is determined from an OTA server according to the unit identifier in the update request, and the matched software update data is downloaded to the target electronic control unit.

4. The method according to claim 2, characterized in that The vehicle further includes other electronic control units that are not configured with external memory; memory configuration information of the other electronic control units and the at least one electronic control unit are both recorded in the OTA server; The step of synchronizing the original software of the target external memory of the target electronic control unit to the target built-in memory includes: Obtaining a unit identification of the target electronic control unit; querying memory configuration information of the target electronic control unit from the OTA server according to the unit identifier; In the case that the queried memory configuration information indicates that the target electronic control unit is configured with an external memory, the original software of the target external memory of the target electronic control unit is synchronized to the target built-in memory.

5. The method according to claim 2, characterized in that: The step of synchronizing the original software of the target external memory of the target electronic control unit to the target built-in memory includes: Generate, by the master electronic control unit, a software synchronization instruction corresponding to the target built-in memory and the target external memory; The software synchronization instruction is executed based on the unified diagnostic service of the vehicle to synchronize the original software of the target external memory to the target built-in memory.

6. The method according to claim 2, characterized in that The update request is generated by an OTA server, the master electronic control unit, or the controlled electronic control unit.

7. The method according to claim 1, characterized in that The method further comprises: In the case where the update operation is successfully executed, the updated software in the built-in memory is synchronized to the external memory as new original software.

8. An electronic device, characterized in that: include: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 7 by executing the executable instructions.

9. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images