Software design method for supporting OTA upgrade of electric vehicle thermal management controller

Abstract

The invention discloses a software design method for supporting OTA upgrade of a thermal management controller of an electric vehicle, which comprises the following steps of: firstly, electrifying / resetting an MCU, automatically loading a stack pointer and a program entry point by a hardware circuit, waiting for frequency stabilization and release of the MCU, providing takt for a bus, latching MCU start configuration, entering the program entry point x (x = A, B... N), reading an option byte [0] of an internal reserved memory, and starting the program entry point x (x = A, B... N); judging whether the partition number of the current bootstrap program is consistent with the option bytes or not, if not, skipping to a target partition number to re-enter a program entry point, if yes, entering a main program main (), determining program updating states (including resetting, updating, updating completion and updating failure), MCU hardware drive initialization and system parameter initialization according to the option byte partition number, and if not, executing the next step; and finally, entering a transaction processing cycle, and feeding a watchdog. The method is high in flashing speed, high in updating degree and good in safety, the using intelligence and convenience of the electric vehicle can be remarkably improved, and the vehicle using experience is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of remote control of electric vehicle thermal management systems, and in particular to a software design scheme for supporting OTA upgrades of an electric vehicle thermal management system controller. Background Art

[0002] The thermal management system controller is one of the core components of electric vehicles and an indispensable tool for the energy management of the entire electric vehicle. The upgrade of its controller is particularly important. At present, many vehicles have the ability to upgrade software via OTA. However, the traditional upgrade solutions generally have the following problems: (1) the software design is complex; (2) the update time is long; (3) the Boot and the corresponding communication protocol parts cannot be self-updated; (4) the occurrence of incorrect flashing leads to software and hardware incompatibility; (5) because the Boot program remains fixed, there are serious risks such as intellectual property infringement and malware cracking attacks. Therefore, the research on OTA upgrade technology of electric vehicle thermal management controllers is of great significance. Summary of the invention

[0003] The present invention provides an OTA upgrade software design scheme for an electric vehicle thermal management controller to solve the problems of existing OTA upgrade schemes, such as complexity, long update time, inability to self-update, software and hardware incompatibility, and susceptibility to attacks. It can reduce the difficulty of OTA upgrades and the cost of platform applications, in order to achieve large-scale application in the industry.

[0004] To achieve the above objectives, the present invention provides the following software design scheme: A software design method supporting OTA upgrade of an electric vehicle thermal management controller includes: When the MCU is powered on / reset, the hardware circuit automatically loads the stack pointer and program entry point, waits for the MCU to stabilize and release, provides a beat for the bus, and latches the MCU startup configuration; Enter the program entry point _x, (x=A, B...N), where _x is the program version, A is the first version of the program, B is the second version of the program, and N is the Nth version of the program. If the performance of the previous version of the program is not as good as the next version, jump to the next version. If the performance of the previous version is worse than the next version, stay in the previous version; Read the internal reserved memory_option byte [0] and determine whether the current boot program partition number is consistent with the option byte; If they are inconsistent, jump to the target partition number and re-enter the program entry point; If they are consistent, enter the main program main(), determine the program update status, MCU hardware driver initialization and system parameter initialization according to the option byte partition number; Enter the transaction processing loop and feed the watchdog.

[0005] Furthermore, the program entry point _x (x=A, B...N) adopts a multi-independent partition architecture including area A, area B...N, and cancels the connection between the modules of the A, B...N partitions to achieve Boot program upgrade including the bottom level.

[0006] Further, after reading the internal reserved memory_option byte [0], it is determined whether the current boot program partition number is consistent with the option byte. If they are consistent, the main program main() is entered; If they are inconsistent, jump to the target partition number and re-enter the program entry point, and Boot will update itself.

[0007] Further, the entering into the transaction processing cycle further comprises: Determine whether it is in the updating state. If so, parse the UDS service request and response, provide UDS unified diagnostic service, real-time monitoring of update interruption, and real-time monitoring of update timeout; If not, parse the UDS service request and response, control the subroutine, buffer the message sending, and provide the UDS unified diagnostic service; After providing the UDS unified diagnostic service, regularly monitor data transmission interruptions caused by communication disconnections and regularly monitor update timeouts.

[0008] Furthermore, the provision of UDS unified diagnostic services also includes: VCU sends an update request to MCU; The MCU processes the request according to the current status and, if allowed, performs a consistency check on the software and hardware versions; If they are consistent, the MCU responds to the update request, and the VCU receives the update response and downloads the update data; The MCU performs CRC check on the data during frame-by-frame transmission and determines whether the check passes; If yes, after receiving 512kB bytes of update data or receiving the VCU transmission completion notification, perform a Check Sum check and determine whether the check passes; If yes, monitor in real time whether the VCU issues an active rollback or partition jump request; If yes, the rollback request sequence is checked, and if it passes, an active rollback or partition jump operation is performed.

[0009] Furthermore, after the VCU sends an update request to the MCU, the MCU processes the request according to the current status. If it is allowed, it performs a consistency check on the software and hardware versions. If they are inconsistent, the request is ignored; If they are consistent, the MCU responds to the update request, and the VCU receives the update response and downloads the update data; The MCU performs CRC check on the data during frame-by-frame transmission and determines whether the check passes. If not, it means that the data is contaminated or interfered, the update is canceled, and the MCU restarts; If yes, a Check Sum check is performed after receiving 512kB bytes of updated data or receiving a notification of transmission completion from the VCU.

[0010] Furthermore, after receiving 512kB bytes of update data or receiving a notification of transmission completion from the VCU, a Check Sum check is performed to determine whether the check passes. If not, it indicates that the data is contaminated or interfered with, the update is canceled, and the MCU is restarted; If yes, monitor whether the VCU issues an active rollback or partition jump request; The real-time monitoring of whether the VCU issues an active rollback or partition jump request also includes: Monitor in real time whether the VCU issues an active rollback or partition jump request; If not, first erase the Flash sector to be flashed, then flash by page and by half-word; Perform CRC check on the received data and the flash content to determine whether the flash is successful; If yes, continue with CRC check and determine whether the check passes; If yes, it indicates that the flashing is successful, the option byte [0] is updated, the activation partition number is written, the option byte [1] is updated, and the update status is marked. The update operation is now completed and the MCU is restarted.

[0011] Further, monitor in real time whether the VCU issues an active rollback or partition jump request, and if so, perform the active rollback or partition jump operation and then restart; If not, first erase the Flash sector to be flashed, then flash by page and by half-word.

[0012] Further, a CRC check is performed on the received data and the flashing content to determine whether the flashing is successful. If yes, a CRC check is continued; If not, it means that the data flashing process is abnormal, the update is canceled, and the MCU is restarted; Continue to perform CRC check to determine whether the check passes. If not, update option byte [0], write the original partition number, update option byte [1], mark the update failure, and restart the MCU. If yes, it indicates that the flashing is successful, the option byte [0] is updated, the activation partition number is written, the option byte [1] is updated, and the update status is marked. The update operation is now completed and the MCU is restarted.

[0013] Specifically, the entering the transaction processing cycle also includes: First, determine whether to execute the normal business process or the update process based on the comparison result; If the update process is used, the UDS request is parsed and an update response is made to it, and the UDS unified diagnostic service I is run to monitor communication disconnection, data transmission interruption and timeout failure in real time; If the normal business process is executed, the UDS request is parsed and a non-update response is made to it, the subroutine is controlled, the cache message is sent, and the UDS unified diagnostic service II is run.

[0014] Specifically, the provision of UDS unified diagnostic service II (program update service) further includes the following steps: The vehicle control unit (VCU) sends an update request to the thermal management controller (MCU), and the MCU decides whether to process the update request based on the current state. If not, the request is ignored; If yes, perform software and hardware version consistency check. If they are inconsistent, restart; If they are consistent, the MCU responds to the update request, and the VCU accepts the update response and downloads the update data; In order to prevent errors in received data caused by erroneous transmission, the MCU performs CRC check on the data during frame-by-frame transmission of the data and determines whether the check passes. If not, it means that the data is contaminated or interfered, the update is canceled, and the MCU is restarted; If yes, after receiving 512kB bytes of updated data or receiving the VCU transmission completion notification, the Check Sum checksum value is sent; To ensure the consistency of data between the receiving end and the sending end, the MCU performs a Check Sum check and determines whether the check passes. If not, it restarts; If yes, the demonstration waits for 5 seconds and monitors whether the VCU issues an active rollback or partition jump request during this period. If not, the VCU performs data flushing; If yes, the rollback request sequence is checked, and if it passes, an active rollback or partition jump operation is performed.

[0015] Specifically, the request for active rollback or partition jump operation further includes the following steps: Detect whether the VCU issues an active rollback or partition jump request. If yes, perform the active rollback or partition jump operation and then restart; If not, first erase the Flash sector to be flashed, then flash by page and by half-word; By performing CRC check on the received data and the flash content, it is determined whether the flash is successful. If not, it means that the flash data process is abnormal, the update is canceled, and the MCU is restarted; If yes, continue to perform CRC check and determine whether the check passes. If not, update option byte [0], write the original partition number, update option byte [1], mark the update failure, and restart the MCU. If yes, it indicates that the flashing is successful, the option byte [0] is updated, the activation partition number is written, the option byte [1] is updated, and the update status is marked. The update operation is now completed and the MCU is restarted.

[0016] Compared with the prior art, the beneficial effects of the present invention are: providing a software design method that supports OTA upgrade of electric vehicle thermal management controller, intervening in the boot at the user's Boot entry, cooperating with A / B independent partitioning technology, being able to perform replacement and rollback, and realizing Boot self-refresh, being able to completely replace the Boot flashed by the control manufacturer at the factory, being simple and efficient, and having a fast flashing speed, and adopting a multi-stage and multi-level verification method in the process of program flashing, including software and hardware version consistency detection, CRC verification and Check Sum verification, to support anti-mis-flash, active rollback, timeout rollback, communication disconnection rollback, and verification failure rollback mechanism, eliminating the risk of software leakage and cracking attacks, and ensuring the safety of OEM customers and car users. The entire process of this technology is transparent, safe and efficient, and can significantly reduce the after-sales maintenance workload of OEMs, users, and repair stations. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below.

[0018] Figure 1 The present invention is a flowchart of a software design method for supporting OTA upgrade of a thermal management controller of an electric vehicle provided in accordance with an embodiment of the present invention.

[0019] Figure 2 The figure is a flowchart of a transaction processing cycle provided according to an embodiment of the present invention.

[0020] Figure 3 The present invention is a flowchart of a program update service for running a UDS unified diagnostic service according to an embodiment of the present invention.

[0021] Figure 4 The present invention is a flowchart of actively requesting a rollback operation according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable persons skilled in the art to better understand the solutions of the embodiments of the present invention, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings and implementation modes.

[0023] like Figure 1As shown in the figure, a software design scheme supporting OTA upgrade of electric vehicle thermal management system controller is provided, which includes the following steps: Step 1: The thermal management controller (MCU) is powered on / reset, and the MCU hardware circuit automatically loads the stack pointer and program entry point, waits for the MCU clock to stabilize and release, provides a beat for the bus, and latches the MCU startup configuration (remaps the user Flash).

[0024] Step 2: Enter the MCU program entry point __x (x=A, B...N), read the internal reserved memory - option byte [0], and determine whether the current boot program partition number is consistent with the option byte [0] partition number.

[0025] It should be noted that the method further includes: determining whether the current boot program partition number is consistent with the option byte, if not, the current boot partition number jumps to the target partition, and re-reads the internal reserved memory - option byte [0] for determination.

[0026] Step 3: If yes, enter the MCU main program main(), determine the program partition number, program update status (including reset, updating, update completed, update failed), MCU hardware driver initialization, and system parameter initialization according to option bytes [0] and [1].

[0027] Step 4: Enter the transaction processing loop and feed the watchdog.

[0028] Specifically, Figure 2 As shown in FIG. 1 , a flow chart of a transaction processing cycle provided according to an embodiment of the present invention is shown. After entering the sub-flow, firstly, it is determined to execute the normal business flow or the update flow according to the comparison result. If the update flow is used, the UDS request is parsed and an update response is made to it, and the UDS unified diagnostic service is run (see the specific flow for details). Figure 3 ), and simultaneously monitor communication disconnections, data transmission interruptions, and timeout failures in real time; if the normal business process is executed, the UDS request is parsed and a non-update response is made to it, the subroutine is controlled, the cache message is sent, and the UDS unified diagnostic service is run.

[0029] Specifically, Figure 3 FIG. 1 is a flow chart of a program update service for running a UDS unified diagnostic service according to an embodiment of the present invention. The process includes the following steps: Step 1: The vehicle control unit (VCU) sends an update request to the thermal management controller (MCU), and the MCU decides whether to process the update request based on the current status.

[0030] It should be noted that the method further includes: the MCU determines whether to process the update request according to the current state, and if not, ignores the request.

[0031] Step 2: If yes, perform software and hardware version consistency check.

[0032] It should be noted that the method further includes: performing consistency detection on the software and hardware versions, and if they are inconsistent, restarting.

[0033] Step 3: If they are consistent, the MCU responds to the update request, and the VCU accepts the update response and downloads the update data.

[0034] Step 4: To prevent errors in the received data caused by erroneous transmission, the MCU performs CRC check on the data during the frame-by-frame transmission of the data and determines whether the check passes.

[0035] It should be noted that the method further includes: performing a CRC check and determining whether the check passes. If not, it indicates that the data is contaminated or interfered with, the update is canceled, and the MCU is restarted.

[0036] Step 5: If yes, after receiving 512kB bytes of update data or receiving the VCU transmission completion notification, send the CheckSum checksum value.

[0037] Step 6: To ensure the consistency of the data at the receiving end and the sending end, the MCU performs a Check Sum check and determines whether the check passes.

[0038] It should be noted that the method further includes: performing a Check Sum check and determining whether the check passes, and if not, restarting.

[0039] Step 7: If yes, the demonstration waits for 5 seconds and monitors whether the VCU issues an active rollback or partition jump request during this period.

[0040] It should be noted that the method further includes: determining whether the VCU issues an active rollback or partition jump request, and if not, the VCU executes data flushing.

[0041] Step 8: If yes, verify the rollback request sequence, and perform active rollback or partition jump operation if it passes.

[0042] Specifically, Figure 4 As shown, it is a schematic diagram of a process of requesting active rollback or partition jump operation provided according to an embodiment of the present invention, comprising the following steps: Step 1: Detect whether the VCU issues an active rollback or partition jump request.

[0043] It should be noted that the method further includes: detecting whether the VCU issues an active rollback or partition jump request, and if so, executing the active rollback or partition jump operation and then restarting.

[0044] Step 2: If no, first erase the Flash sector to be flashed, then flash by page and by half-word.

[0045] Step 3: Determine whether the flashing is successful by performing CRC check on the received data and the flashing content.

[0046] It should be noted that the method further includes: determining whether the flashing is successful. If not, it indicates that the data flashing process is abnormal, the update is canceled, and the MCU is restarted.

[0047] Step 4: If yes, continue with CRC check and determine whether the check passes.

[0048] It should be noted that the method further includes: determining whether the verification is passed, if not, updating option byte [0], writing the original partition number, updating option byte [1], marking the update failure, and restarting the MCU.

[0049] Step 5: If yes, it indicates that the flashing is successful, update option byte [0], write the activation partition number, update option byte [1], mark the update status, and the update operation is completed. The MCU restarts.

[0050] The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. For those skilled in the art, the present invention can have various changes and modifications. Any changes made according to the concept of the present invention, or modified into equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. A software design method supporting OTA upgrade of electric vehicle thermal management controller, characterized in that: include: When the MCU is powered on / reset, the hardware circuit automatically loads the stack pointer and program entry point, waits for the MCU to stabilize and release, provides a beat for the bus, and latches the MCU startup configuration; Enter the program entry point _x, (x=A, B...N), where _x is the program version, A is the first version of the program, B is the second version of the program, and N is the Nth version of the program. If the performance of the previous version of the program is not as good as the next version, jump to the next version. If the performance of the previous version is worse than the next version, stay in the previous version; Read the internal reserved memory_option byte [0] and determine whether the current boot program partition number is consistent with the option byte; If they are inconsistent, jump to the target partition number and re-enter the program entry point; If they are consistent, enter the main program main(), determine the program update status, MCU hardware driver initialization and system parameter initialization according to the option byte partition number; Enter the transaction processing loop and feed the watchdog.

2. A software design method for supporting OTA upgrade of thermal management controller of electric vehicle according to claim 1, characterized in that: The entry point _x (x=A, B...N) is used, and _x adopts a multi-independent partition architecture including A zone, B zone...N zone, and cancels the connection between the modules of A, B...N partitions to realize the Boot program upgrade including the bottom level.

3. A software design method for supporting OTA upgrade of thermal management controller of electric vehicle according to claim 1, characterized in that: After reading the internal reserved memory_option byte [0], it is determined whether the current boot program partition number is consistent with the option byte. If they are consistent, the main program main() is entered; If they are inconsistent, jump to the target partition number and re-enter the program entry point, and Boot will update itself.

4. A software design method for supporting OTA upgrade of electric vehicle thermal management controller according to claim 1, characterized in that: The entering transaction processing cycle also includes: Determine whether it is in the updating state. If so, parse the UDS service request and response, provide UDS unified diagnostic service, real-time monitoring of update interruption, and real-time monitoring of update timeout; If not, parse the UDS service request and response, control the subroutine, buffer the message sending, and provide the UDS unified diagnostic service; After providing the UDS unified diagnostic service, regularly monitor data transmission interruptions caused by communication disconnections and regularly monitor update timeouts.

5. A software design method for supporting OTA upgrade of thermal management controller of electric vehicle according to claim 4, characterized in that: The provision of UDS unified diagnostic services also includes: VCU sends an update request to MCU; The MCU processes the request according to the current status and, if allowed, performs a consistency check on the software and hardware versions; If they are consistent, the MCU responds to the update request, and the VCU receives the update response and downloads the update data; The MCU performs CRC check on the data during frame-by-frame transmission and determines whether the check passes; If yes, after receiving 512kB bytes of update data or receiving the VCU transmission completion notification, perform a Check Sum check and determine whether the check passes; If yes, monitor in real time whether the VCU issues an active rollback or partition jump request; If yes, the rollback request sequence is checked, and if it passes, an active rollback or partition jump operation is performed.

6. A software design method for supporting OTA upgrade of thermal management controller of electric vehicle according to claim 5, characterized in that: After the VCU sends an update request to the MCU, the MCU processes the request according to the current status. If it is allowed, it performs a consistency check on the software and hardware versions. If they are inconsistent, the request is ignored. If they are consistent, the MCU responds to the update request, and the VCU receives the update response and downloads the update data; The MCU performs CRC check on the data during frame-by-frame transmission and determines whether the check passes. If not, it means that the data is contaminated or interfered, the update is canceled, and the MCU restarts; If yes, a Check Sum check is performed after receiving 512kB bytes of updated data or receiving a notification of transmission completion from the VCU.

7. A software design method for supporting OTA upgrade of an electric vehicle thermal management controller according to claim 6, characterized in that: After receiving 512kB bytes of update data or receiving the VCU transmission completion notification, a Check Sum check is performed to determine whether the check passes. If not, it means that the data is contaminated or interfered with, the update is canceled, and the MCU is restarted; If yes, monitor whether the VCU issues an active rollback or partition jump request; The real-time monitoring of whether the VCU issues an active rollback or partition jump request also includes: Monitor in real time whether the VCU issues an active rollback or partition jump request; If not, first erase the Flash sector to be flashed, then flash by page and by half-word; Perform CRC check on the received data and the flash content to determine whether the flash is successful; If yes, continue with CRC check and determine whether the check passes; If yes, it indicates that the flashing is successful, the option byte [0] is updated, the activation partition number is written, the option byte [1] is updated, and the update status is marked. The update operation is now completed and the MCU is restarted.

8. A software design method for supporting OTA upgrade of thermal management controller of electric vehicle according to claim 7, characterized in that: Monitor in real time whether the VCU issues an active rollback or partition jump request. If so, perform the active rollback or partition jump operation and then restart; If not, first erase the Flash sector to be flashed, then flash by page and by half-word.

9. A software design method for supporting OTA upgrade of thermal management controller of electric vehicle according to claim 8, characterized in that: Perform CRC check on the received data and the flash content to determine whether the flash is successful. If yes, continue to perform CRC check; If not, it means that the data flashing process is abnormal, the update is canceled, and the MCU is restarted; Continue to perform CRC check to determine whether the check passes. If not, update option byte [0], write the original partition number, update option byte [1], mark the update failure, and restart the MCU. If yes, it indicates that the flashing is successful, the option byte [0] is updated, the activation partition number is written, the option byte [1] is updated, and the update status is marked. The update operation is now completed and the MCU is restarted.

Images