OTA guarantee upgrading method and device, equipment and storage medium

Abstract

The invention discloses an OTA guarantee upgrading method and device, equipment and a storage medium, and relates to the technical field of vehicle-mounted upgrade.The method comprises the steps that an upgrading task, a controller upgrading sequence and vehicle state information are obtained, upgrading parameters in the upgrading task are analyzed, upgrading preconditions are obtained, flashing parameters in the upgrading task are analyzed, and the upgrading preconditions are obtained; the method comprises the steps of obtaining a flashing precondition, starting an upgrading mode when an upgrading task is received and the vehicle state information meets the upgrading precondition, and completing upgrading of a plurality of controllers according to a controller upgrading sequence when the upgrading mode is started and the vehicle state information meets the flashing precondition. Tasks are issued through the cloud end and include preconditions, the vehicle end analyzes the tasks and upgrades the ECUs in sequence, it is ensured that the vehicle state is executed after meeting the safety requirement, the safety and reliability of OTA upgrading are improved, and potential safety hazards during multi-ECU upgrading are avoided.

Description

Technical Field

[0001] The present invention relates to the field of vehicle-mounted upgrade technology, and in particular to an OTA guaranteed upgrade method, device, equipment and storage medium. Background Art

[0002] With the continuous development of automobile intelligence and networking, it is becoming more and more common to quickly iterate and upgrade vehicle software through OTA (Over-The-Air) remote upgrade. This method can not only save costs and improve user experience, but also effectively avoid the risk of vehicle recalls caused by software problems. However, since the OTA upgrade is performed by ordinary car owners rather than professional after-sales engineers, it is particularly important to ensure the reliability and security of the OTA upgrade process to ensure a good user experience.

[0003] At present, some existing technical solutions are mainly applied to vehicle-mounted Tbox devices. After receiving the upgrade request from the OTA server, the upgrade process is triggered in response to the user's operation. Check whether the current vehicle meets the upgrade conditions; if so, disable the one-button start system and all CAN bus application message communication functions. Upgrade the ECU software according to the upgrade package provided by the OTA server. Determine whether the upgrade is successful and feedback the results to the server. If the upgrade is successful, restore the normal use environment of the vehicle.

[0004] The existing OTA upgrade method only considers the upgrade scenario of a single ECU, and fails to fully cover the needs of simultaneous or continuous upgrades of multiple ECUs in the vehicle. In the case of multiple ECU upgrades, there may be a gap between the upgrades of two ECUs, during which the user can still use the vehicle, which may cause the user to suddenly start a new upgrade after starting to use the vehicle, thus bringing potential risks. Therefore, there is an urgent need for a more accurate and secure OTA upgrade method to improve the security of OTA upgrades. Summary of the invention

[0005] The main purpose of this application is to provide an OTA guaranteed upgrade method, device, equipment and storage medium, aiming to solve the technical problem of how to improve the security of OTA upgrades.

[0006] To achieve the above objectives, the present application proposes an OTA guaranteed upgrade method, the method comprising:

[0007] Get upgrade tasks, controller upgrade sequence and vehicle status information;

[0008] Parsing the upgrade parameters in the upgrade task to obtain upgrade preconditions, wherein the upgrade parameters include vehicle speed, vehicle gear position, power-on and power-off status, vehicle battery power and voltage, and diagnostic instrument access status;

[0009] Parsing the flashing parameters in the upgrade task to obtain flashing preconditions, wherein the flashing parameters include vehicle speed, vehicle gear position, power-on and power-off status, and vehicle battery power and voltage;

[0010] When the upgrade task is received and the vehicle status information meets the upgrade precondition, starting the upgrade mode;

[0011] When the upgrade mode is turned on and the vehicle status information meets the flashing precondition, the upgrade of multiple controllers is completed according to the controller upgrade sequence.

[0012] In one embodiment, when the upgrade mode is turned on and the vehicle status information satisfies the flashing precondition, the step of completing the upgrade of multiple controllers according to the controller upgrade sequence includes:

[0013] After completing the upgrade of a single controller, the upgrade result is obtained;

[0014] When the upgrade result is successful, continue to upgrade the next controller;

[0015] When the upgrade result is an upgrade failure, retry the flashing according to a preset flashing strategy or skip the current controller to upgrade the next controller;

[0016] When multiple controllers have completed upgrading, exit the upgrade mode and restore the vehicle status.

[0017] In one embodiment, when the upgrade mode is turned on and the vehicle status information satisfies the flashing precondition, the step of completing the upgrade of multiple controllers in the controller upgrade sequence further includes:

[0018] During the upgrade process, real-time monitoring of vehicle status information;

[0019] When the vehicle status information does not meet the upgrade precondition or the vehicle status information does not meet the flashing precondition, the upgrade mode is turned off, and the upgrade is continued when the vehicle status information meets the conditions again.

[0020] In one embodiment, the necessary conditions in the flashing preconditions are that the vehicle speed is a preset value, the vehicle gear is in P gear, the vehicle is in a power-off state, the vehicle battery power is higher than the minimum battery power and the vehicle battery voltage is higher than the minimum battery voltage.

[0021] In one embodiment, the necessary conditions in the upgrade preconditions are that the vehicle speed is a preset value, the vehicle gear is in P gear, the vehicle is in a power-off state, the vehicle battery power is higher than the minimum battery power, the vehicle battery voltage is higher than the minimum battery voltage and the vehicle is not connected to the diagnostic instrument.

[0022] In one embodiment, when the upgrade task is received and the vehicle status information satisfies the upgrade precondition, the step of starting the upgrade mode includes:

[0023] When the upgrade task is received and the vehicle status information meets the upgrade precondition, entering the upgrade mode;

[0024] After entering the upgrade mode, obtain the signal broadcast by the vehicle entering the upgrade mode;

[0025] After receiving the signal, the one-touch start button function or the buttonless start function is disabled, the vehicle is prohibited from entering the start state and the central control screen touch operation is disabled, and the touch screen is allowed to display upgrade-related information.

[0026] In one embodiment, when the upgrade mode is turned on and the vehicle status information satisfies the flashing precondition, before the step of completing the upgrade of multiple controllers in the controller upgrade sequence, the step includes:

[0027] When the vehicle status information meets the flashing precondition, all CAN application message communications are prohibited, all CAN communications of the entire vehicle are disabled, and fault diagnostic code records caused by disabling CAN communications are prevented and processed;

[0028] Execute the flashing operation and perform the flashing according to the preset flashing standard.

[0029] In addition, to achieve the above purpose, the present application also proposes an OTA guarantee upgrade device, the OTA guarantee upgrade device comprising:

[0030] An acquisition module is used to obtain upgrade tasks, controller upgrade sequence and vehicle status information;

[0031] The acquisition module is also used to parse the upgrade parameters in the upgrade task to obtain the upgrade preconditions, wherein the upgrade parameters include vehicle speed, vehicle gear position, power on and off status, vehicle battery power voltage and diagnostic instrument access status;

[0032] The acquisition module is further used to parse the flashing parameters in the upgrade task to obtain the flashing preconditions, wherein the flashing parameters include vehicle speed, vehicle gear position, power-on and power-off status, and vehicle battery power voltage;

[0033] An execution module, configured to start an upgrade mode when the upgrade task is received and the vehicle status information meets the upgrade precondition;

[0034] The execution module is also used to complete the upgrade of multiple controllers according to the controller upgrade sequence when the upgrade mode is turned on and the vehicle status information meets the flashing precondition.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable medium, and a computer program is stored on the medium. When the computer program is executed by the processor, the steps of the OTA guaranteed upgrade method described above are implemented.

[0036] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the OTA guaranteed upgrade method described above are implemented.

[0037] This application obtains the upgrade task, controller upgrade sequence and vehicle status information, parses the upgrade parameters in the upgrade task, obtains the upgrade preconditions, parses the flashing parameters in the upgrade task, obtains the flashing preconditions, and turns on the upgrade mode when the upgrade task is received and the vehicle status information meets the upgrade preconditions. When the upgrade mode is turned on and the vehicle status information meets the flashing preconditions, the upgrade of multiple controllers is completed in the controller upgrade sequence. By sending tasks with preconditions from the cloud, the vehicle side parses and upgrades the ECU in sequence, ensuring that the vehicle status meets the safety requirements before execution, which improves the security and reliability of OTA upgrades and avoids safety hazards when upgrading multiple ECUs. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 This is a flowchart of the first embodiment of the OTA upgrade method of this application;

[0040] Figure 2 This is a flow chart of the second embodiment of the OTA upgrade method of this application;

[0041] Figure 3 This is a flowchart of the third embodiment of the OTA upgrade method of this application;

[0042] Figure 4 This is a schematic diagram of the module structure of the OTA security upgrade device according to an embodiment of the present application;

[0043] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the OTA upgrade method in the embodiment of the present application;

[0044] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The main solution of the embodiment of the present application is: by acquiring the upgrade task, the controller upgrade sequence and the vehicle status information, the upgrade parameters in the upgrade task are parsed to obtain the upgrade preconditions, the flashing parameters in the upgrade task are parsed to obtain the flashing preconditions, and when the upgrade task is received and the vehicle status information meets the upgrade preconditions, the upgrade mode is turned on; when the upgrade mode is turned on and the vehicle status information meets the flashing preconditions, the upgrade of multiple controllers is completed in accordance with the controller upgrade sequence.

[0048] Based on this, the embodiment of the present application provides an OTA guarantee upgrade method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the OTA guaranteed upgrade method of the present application.

[0049] In this embodiment, the OTA guaranteed upgrade method includes steps S10 to S50:

[0050] Step S10, obtaining upgrade tasks, controller upgrade sequence and vehicle status information.

[0051] It should be noted that the cloud server first generates a detailed upgrade task based on the current status of the vehicle and the software version that needs to be updated, which includes key information such as the identification of the target ECU controller, the upgrade software package link, and the corresponding upgrade conditions. These conditions may include vehicle upgrade preconditions in many aspects such as power status, gear status, vehicle speed, and power, to ensure that the vehicle is in a safe and suitable state before starting the upgrade. In addition, the cloud will also configure flashing preconditions, such as the minimum battery power and voltage requirements, to prevent insufficient power during the upgrade process. When the vehicle receives the upgrade task issued by the cloud, it will first prompt the user through the human-computer interaction interface, and start the upgrade process after the user confirms. At this time, the vehicle-side system will automatically detect whether the current state parameters meet the upgrade preconditions. When all mandatory items meet the standards, it will officially enter the upgrade mode. In this mode, the system will further check whether more stringent flashing preconditions are met, such as ensuring that the vehicle is stationary (vehicle speed is 0), the handbrake is tightened, and the ignition status is Not Ready, so as to avoid potential safety hazards during the upgrade process.

[0052] Step S20, parsing the upgrade parameters in the upgrade task to obtain upgrade preconditions, the upgrade parameters include vehicle speed, vehicle gear, power on and off status, vehicle battery power voltage and diagnostic instrument access status.

[0053] It should be noted that when the cloud server issues an upgrade task, it will also send a series of key upgrade parameters to the vehicle side. These parameters include but are not limited to power status, gear status, vehicle speed, power and other information. By parsing these parameters, the upgrade preconditions can be obtained, which together constitute the upgrade precondition table shown in Table 1.

[0054] Table 1 Upgrade prerequisites

[0055]

[0056]

[0057] In the table above, the column "Whether to be checked" is explained. "Yes" represents a condition, and "Optional" represents an optional condition. The necessary conditions in the upgrade preconditions are that the vehicle speed is the preset value, the vehicle gear is in P gear, the vehicle is in a power-off state, the vehicle battery power is higher than the minimum battery power, the vehicle battery voltage is higher than the minimum battery voltage, and the vehicle is not connected to the diagnostic instrument. Specifically, the necessary conditions in the upgrade preconditions can be seen from the table above. First, the vehicle speed is 0 to avoid safety risks caused by vehicle movement during the upgrade process. Secondly, the vehicle gear must be in P gear (parking gear), which can further prevent vehicle movement caused by misoperation or unexpected situations. In addition, the vehicle is required to be in a power-off state, that is, the engine is turned off and the ignition switch is turned off, in order to avoid unnecessary power consumption and potential electrical system interference during the upgrade. At the same time, the vehicle battery power and voltage are also higher than the set minimum threshold, which not only ensures the stable power supply during the upgrade process, but also reserves enough power to support the restoration of basic functions of the vehicle after the upgrade is completed. Finally, confirming that the vehicle is not connected to the diagnostic instrument is another important prerequisite, because external devices may affect the transmission of upgrade data or communication with the vehicle system, thereby interfering with the entire upgrade process.

[0058] Once the vehicle confirms that its actual status meets all the upgrade preconditions, it will be allowed to proceed to the next step of the operation process. This precondition setting can not only effectively improve the overall security of OTA remote upgrades, but also significantly enhance user trust and satisfaction.

[0059] Step S30, analyzing the flashing parameters in the upgrade task to obtain the flashing preconditions, the flashing parameters include vehicle speed, vehicle gear position, power on and off status, and vehicle battery power voltage.

[0060] It should be noted that in addition to the basic upgrade information, the upgrade task sent from the cloud also specifies in detail the specific requirements for flashing a specific ECU. When the vehicle receives the upgrade task and meets the preliminary upgrade preconditions, the system will further parse the flash parameters in the task and obtain the flash preconditions, which together constitute the flash precondition table shown in Table 2.

[0061] Table 2 Flashing preconditions

[0062]

[0063]

[0064] In the above table, the column "Whether to be checked" is explained. "Yes" represents a condition and "Optional" represents an optional condition. The necessary conditions in the flashing preconditions are that the vehicle speed is the preset value, the vehicle gear is in P gear, the vehicle is in a power-off state, the vehicle battery power is higher than the minimum battery power and the vehicle battery voltage is higher than the minimum battery voltage. Specifically, the necessary conditions in the flashing preconditions can be seen from the above table. First, the vehicle speed is 0, which ensures that the vehicle is completely stationary and avoids any potential risks caused by movement. Secondly, the vehicle gear must be in P gear (parking gear) to further prevent the vehicle from moving due to accidents or misoperation during the upgrade process. In addition, the vehicle should be in a power-off state, that is, the engine is turned off and the ignition switch is turned off, so as to avoid interference with the electrical system and unnecessary power consumption during the upgrade. At the same time, the vehicle battery power and voltage are higher than the set minimum threshold, which is to ensure that there is a stable power supply throughout the long upgrade process, and the vehicle can still start and run normally after the upgrade is completed. By strictly complying with the flashing preconditions, not only can the success rate of each ECU software update be greatly improved, but also the potential safety hazards that may occur during the upgrade can be effectively reduced.

[0065] Step S40, when an upgrade task is received and the vehicle status information meets the upgrade preconditions, the upgrade mode is turned on.

[0066] It should be noted that when the vehicle receives the upgrade task sent from the cloud and confirms through a series of checks that the current vehicle status information meets all the necessary upgrade preconditions, the system will automatically start the upgrade mode. This process first involves a comprehensive status assessment of the vehicle, ensuring that the speed is 0, the gear is in P gear, the vehicle is in a power-off state, the battery power and voltage are above the set safety threshold, and confirming that there is no diagnostic instrument connected. Once all these conditions are met, the vehicle will enter a specially designed upgrade mode, in which the system will perform a series of operations to ensure the safety and smoothness of the upgrade process.

[0067] Furthermore, first, the vehicle will disable the one-button start function and all CAN bus application message communications to prevent any external interference or misoperation during the upgrade. Then, the central control screen may display relevant upgrade information, but its main control functions will be temporarily disabled to avoid unnecessary user intervention during this period. In addition, the vehicle will send a signal to notify each ECU controller to prepare to receive the new software version. Throughout the process, the system continuously monitors the vehicle status to ensure that all parameters are always kept within a safe range.

[0068] Step S50, when the upgrade mode is turned on and the vehicle status information meets the flashing precondition, the upgrade of multiple controllers is completed according to the controller upgrade sequence.

[0069] It should be noted that when the vehicle successfully enters the upgrade mode and further confirms that the vehicle status information meets all the flashing preconditions, the system will start to perform software updates for multiple ECUs in the pre-set controller upgrade order. This process usually starts with the controller that has the least impact on vehicle safety and function, and gradually transitions to more critical components. First, the vehicle will check again to ensure that the vehicle speed is 0, the gear is in P gear, the vehicle is in a power-off state, and the battery power and voltage are higher than the minimum requirements. These conditions are the basis for ensuring stable power supply and avoiding any potential movement risks during the entire upgrade process. Once confirmed, the system will send a new software package to the first ECU to be upgraded through the vehicle network and start the installation process. During this period, the system will continue to monitor the status of each ECU to ensure that the data transmission is accurate and the installation is smooth. After completing the update of one ECU, the system will automatically verify whether the new software is installed correctly and operates normally, and will only continue to upgrade the next ECU after confirming that the current ECU has been successfully upgraded. This one-by-one processing method not only helps to reduce the risk of upgrade failure, but also effectively manages resource allocation during the upgrade process to avoid system overload caused by operating multiple controllers at the same time. In addition, during the entire upgrade process, the vehicle will maintain communication with the cloud server, report progress in a timely manner and receive necessary command adjustments to ensure that it can respond quickly even in emergencies.

[0070] Further, before the upgrade in step S50, when the vehicle status information meets the flashing precondition, all CAN application message communications are prohibited, all CAN communications of the whole vehicle are disabled, and the fault diagnostic code records caused by disabling CAN communication are prevented and processed. When the vehicle status information meets the flashing precondition, the system will immediately take measures to prohibit all CAN application message communications and disable all CAN communications of the whole vehicle. The purpose of this operation is to ensure that there will be no external interference or misoperation during the software flashing process, thereby improving the safety and success rate of the upgrade. Specifically, the system will disable all communication functions on the CAN bus by sending specific CAN messages or setting relevant flags, including but not limited to sensor data transmission, control command issuance, and interaction with other ECUs. After disabling CAN communication, the system will also take preventive measures to prevent the recording of fault diagnostic codes (DTCs) caused by disabling communication. Normally, when CAN communication is disabled, some ECUs may detect communication anomalies and generate DTCs. To avoid this, the system will send a special "silent" instruction to all relevant ECUs before disabling CAN communication, informing them that they are about to enter a special mode during which no DTCs related to communication interruption should be recorded. In addition, after restoring CAN communication, the system will clear temporary DTCs that may have been generated due to disabled communication to ensure that these error codes do not interfere with subsequent vehicle diagnosis and maintenance. Then perform the flashing operation according to the preset flashing standards. Specifically, after completing the above preparations, the system will perform a specific flashing operation. According to the preset flashing standards, the system will first verify the integrity and correctness of the downloaded software package, then transfer it to the target ECU and start the installation process. During the flashing process, the system will continuously monitor the status of the entire process to ensure that the data is transmitted correctly and the installation proceeds smoothly. If any errors or anomalies are detected during the flashing process, the system will attempt to automatically repair or re-flash. Once the flashing is successfully completed, the system will once again verify that the new software is correctly installed and can operate normally.

[0071] This embodiment provides an OTA guaranteed upgrade method, which obtains the upgrade task, controller upgrade sequence and vehicle status information, parses the upgrade parameters in the upgrade task, obtains the upgrade preconditions, parses the flashing parameters in the upgrade task, obtains the flashing preconditions, and when the upgrade task is received and the vehicle status information meets the upgrade preconditions, the upgrade mode is turned on. When the upgrade mode is turned on and the vehicle status information meets the flashing preconditions, the upgrade of multiple controllers is completed in the controller upgrade sequence. By sending tasks with preconditions from the cloud, the vehicle side parses and upgrades the ECUs in sequence, ensuring that the vehicle status meets the safety requirements before execution, which improves the safety and reliability of OTA upgrades and avoids safety hazards when upgrading multiple ECUs.

[0072] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 The OTA guarantee upgrade method step S40 also includes steps S401 to S403:

[0073] Step S401, when an upgrade task is received and the vehicle status information meets the upgrade preconditions, enter the upgrade mode.

[0074] It should be noted that when the vehicle receives the upgrade task sent from the cloud and confirms through system checks that the current vehicle status information meets all necessary upgrade preconditions, it will automatically enter the upgrade mode. These preconditions include the vehicle speed is 0, the gear is in P gear, the vehicle is in a power-off state, the battery power and voltage are higher than the set safety threshold, etc. After entering the upgrade mode, the vehicle will disable the one-button start function and all CAN bus application message communications to prevent any external interference or misoperation. At the same time, the central control screen will display the upgrade progress and related information, but the main control functions will be temporarily disabled to ensure that the user will not intervene unnecessarily during the upgrade process. In addition, the vehicle will also send a signal to notify each ECU controller to prepare to receive the new software version and start a series of initialization operations to prepare for subsequent software updates.

[0075] Step S402, after entering the upgrade mode, obtain a signal broadcast by the vehicle entering the upgrade mode.

[0076] It should be understood that after the vehicle enters the upgrade mode, the system will send a broadcast signal to the vehicle network to notify all relevant controllers and subsystems that the current vehicle has entered the upgrade state. This broadcast signal is usually transmitted via the CAN bus or other vehicle network protocols to ensure that the information can be quickly and reliably delivered to each ECU. After receiving the signal, each controller will enter a special standby mode, suspend the operation of non-critical functions, and be ready to receive new software updates. At the same time, other subsystems of the vehicle, such as the instrument panel and the central control screen, will also display corresponding prompts to inform the driver that the vehicle is undergoing a software upgrade and not to operate the vehicle. In addition, some safety-related functions may be temporarily disabled or restricted to prevent unexpected situations during the upgrade process. Throughout the process, the vehicle will continue to monitor key parameters such as battery power and voltage to ensure that they are always within a safe range, thereby ensuring the smooth progress of the upgrade process.

[0077] Step S403, after receiving the signal, disable the one-touch start button function or the buttonless start function, prohibit the vehicle from entering the start state and disable the touch operation of the central control screen, and allow the touch screen to display upgrade-related information.

[0078] It should be noted that after receiving the signal to enter the upgrade mode, the vehicle will immediately disable the one-touch start button function or the buttonless start function to ensure that the vehicle cannot be accidentally started during the upgrade process. This measure effectively prevents safety risks caused by misoperation and ensures stability during the upgrade process. At the same time, the touch operation function of the central control screen will also be disabled to prevent users from performing any operations that may interfere with the upgrade process during the upgrade. Although the touch function is disabled, the central control screen can still display various information related to the upgrade, such as the current upgrade progress, remaining time, and any important prompts or warnings. This information helps users understand the upgrade status and provides necessary guidance so that users know when they can use the vehicle again. In addition, the vehicle will further remind the driver through the dashboard or other indicator lights that it is currently in upgrade mode and should not try to move the vehicle or perform other operations. This multi-level security measure not only improves the success rate of OTA remote upgrades, but also enhances users' trust and satisfaction.

[0079] This embodiment enters the upgrade mode when an upgrade task is received and the vehicle status information meets the upgrade preconditions. After entering the upgrade mode, a signal is obtained for the vehicle broadcast to enter the upgrade mode. After receiving the signal, the one-touch start button function or the buttonless start function is disabled, the vehicle is prohibited from entering the start state and the central control screen touch operation is disabled, and the touch screen is allowed to display upgrade related information. After receiving the upgrade task and meeting the preconditions, the upgrade mode is entered, the start function and the central control screen operation are disabled, and the upgrade information is displayed, ensuring that the upgrade process is safe and controllable, and improving the user experience and the upgrade success rate.

[0080] Based on the first embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 3 The OTA guaranteed upgrade method step S50 also includes steps S501 to S504:

[0081] Step S501, after completing the upgrade of a single controller, obtain the upgrade result.

[0082] It should be noted that after completing the upgrade of a single controller, the system will immediately verify and record the upgrade results. First, the vehicle will self-check the updated ECU to ensure that the new software has been correctly installed and can operate normally. This includes checking the software version number, performing basic functional tests, and confirming that there are no error codes or fault indications. If the self-check results show that everything is normal, the system will mark the upgrade status of the controller as successful and record relevant log information, such as upgrade time, version number, etc. This information will not only be stored locally in the vehicle, but also sent to the cloud server through the vehicle network for subsequent data analysis and monitoring. If any problems are found during the self-check process, such as incorrect software installation or functional abnormalities, the system will try to automatically repair or re-flash the ECU. If multiple attempts still fail to solve the problem, the system will record the failure in detail and issue a warning prompt to the user, suggesting that the service center be contacted for further processing. In addition, regardless of whether the upgrade is successful or not, the central control screen will display the current upgrade status and the next step of the operation guide to ensure that the user is always aware of the vehicle's condition.

[0083] Step S502: When the upgrade result is successful, continue to upgrade the next controller.

[0084] It should be noted that when the upgrade result of a single controller is displayed as successful, the system will automatically enter the upgrade process of the next controller. First, the vehicle will check the current status information again to ensure that key parameters such as vehicle speed, gear, battery power and voltage still meet the flashing preconditions to ensure that the next upgrade process is carried out in a safe environment. After confirmation, the system will send a new software package to the next ECU to be upgraded through the vehicle network and start the installation process. During this period, the system will continue to monitor the data transmission and installation progress to ensure that the whole process goes smoothly. Once the new software package is successfully downloaded and installed, the vehicle will continue to display relevant upgrade progress information to let the user know the current upgrade status. If any problems are encountered during the upgrade process, the system will try to automatically repair or re-flash the controller; if multiple attempts still cannot solve the problem, the failure will be recorded and a warning will be issued to the user. In the entire upgrade sequence, the successful upgrade of each controller is a prerequisite for the subsequent steps. Only after the previous controller is successfully upgraded and verified, the next controller will be updated. This step-by-step approach not only improves the success rate of the overall upgrade, but also ensures that the vehicle remains stable and safe throughout the OTA process, ultimately improving the user experience.

[0085] Step S503: when the upgrade result is an upgrade failure, a flash retry is performed according to a preset flash strategy or the current controller is skipped to upgrade the next controller.

[0086] It should be noted that when the upgrade result of a single controller is displayed as failed, the system will handle it according to the preset flashing strategy. First, the system will try to automatically retry the upgrade process of the current controller. This usually includes re-downloading the software package, verifying data integrity, and re-performing the installation steps. During the retry process, the system will record the log information of each attempt in detail for subsequent analysis of the cause of the problem. If the controller cannot be successfully upgraded after multiple retries, the system will decide whether to skip the current controller and continue to upgrade the next controller according to the preset strategy. The skipping strategy can be based on importance grading, that is, some critical controllers can only continue after successful upgrade, while some non-critical controllers can be temporarily skipped after recording failures. Regardless of the strategy adopted, the system will issue a clear prompt to the user to inform the current upgrade status and the next step of the operation recommendation. In addition, all failures and related logs will be sent to the cloud server for further analysis and processing by technicians.

[0087] Step S504: when multiple controllers have completed upgrading, the upgrading mode is exited and the vehicle status is restored.

[0088] It should be noted that when all scheduled controllers have successfully completed the upgrade, the system will automatically exit the upgrade mode and restore the vehicle to normal status. First, the vehicle will send a broadcast signal through the vehicle network to notify all ECUs and subsystems that the upgrade has been completed and is ready to resume normal operation. Next, the system will re-enable previously disabled functions, such as the one-touch start button or the buttonless start function, allowing the vehicle to enter the start state. At the same time, the touch operation function of the central control screen will also be reactivated, and users can use all the functions of the central control screen normally. In addition, the system will unblock the CAN bus communication and restore the normal transmission of all CAN application messages to ensure smooth data exchange and communication between the various controllers.

[0089] During the process of exiting the upgrade mode, the system will also perform a series of self-checks to ensure that the new software version of all controllers has been correctly installed and can operate normally. If any abnormal situation is found, the system will record the relevant logs and remind the user through the central control screen or other means. Finally, the vehicle will clear the temporary settings and restrictions related to the upgrade and return to the state before the upgrade. After the whole process is completed, the vehicle will be fully restored to normal operation and the user can safely use all the functions of the vehicle.

[0090] After completing the upgrade of a single controller, this embodiment obtains the upgrade result. When the upgrade result is a successful upgrade, the next controller is upgraded. When the upgrade result is a failed upgrade, the next controller is upgraded by retrying the flashing according to the preset flashing strategy or skipping the current controller. When multiple controllers are upgraded, the upgrade mode is exited and the vehicle status is restored. After upgrading a single controller, continue or retry / skip according to the result. After all controllers are upgraded, the mode is exited and the vehicle status is restored, ensuring the continuity and reliability of the upgrade process and improving user experience and system stability.

[0091] This application also provides an OTA security upgrade device, please refer to Figure 4 , the device comprises:

[0092] The acquisition module 10 is used to acquire the upgrade task, controller upgrade sequence and vehicle status information.

[0093] The acquisition module 10 is also used to parse the upgrade parameters in the upgrade task to obtain the upgrade preconditions. The upgrade parameters include vehicle speed, vehicle gear, power on and off status, vehicle battery power voltage and diagnostic instrument access status.

[0094] The acquisition module 10 is also used to parse the flashing parameters in the upgrade task to obtain the flashing preconditions. The flashing parameters include vehicle speed, vehicle gear position, power-on and power-off status, and vehicle battery power and voltage.

[0095] The execution module 20 is used to start the upgrade mode when an upgrade task is received and the vehicle status information meets the upgrade preconditions.

[0096] The execution module 20 is also used to complete the upgrade of multiple controllers in the controller upgrade sequence when the upgrade mode is turned on and the vehicle status information meets the flashing precondition.

[0097] The OTA guaranteed upgrade device provided by the present application adopts the OTA guaranteed upgrade method in the above embodiment, which can solve the technical problem of how to improve the security of OTA upgrade. Compared with the prior art, the beneficial effects of the OTA guaranteed upgrade device provided by the present application are the same as the beneficial effects of the OTA guaranteed upgrade method provided by the above embodiment, and the other technical features in the OTA guaranteed upgrade device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0098] In one embodiment, the execution module 20 is also used to obtain an upgrade result after completing the upgrade of a single controller; when the upgrade result is a successful upgrade, continue to upgrade the next controller; when the upgrade result is a failed upgrade, retry the flashing according to a preset flashing strategy or skip the current controller to upgrade the next controller; when multiple controllers have completed the upgrade, exit the upgrade mode and restore the vehicle status.

[0099] In one embodiment, the execution module 20 is also used to monitor the vehicle status information in real time during the upgrade process; when the vehicle status information does not meet the upgrade pre-conditions or the vehicle status information does not meet the flashing pre-conditions, the upgrade mode is turned off, and the upgrade is continued when the vehicle status information meets the conditions again.

[0100] In one embodiment, the acquisition module 10 is also used to enter the upgrade mode when an upgrade task is received and the vehicle status information meets the upgrade pre-conditions; after entering the upgrade mode, obtain the signal broadcast by the entire vehicle to enter the upgrade mode; after receiving the signal, disable the one-touch start button function or the buttonless start function, prohibit the vehicle from entering the start state and disable the touch operation of the central control screen, and allow the touch screen to display upgrade-related information.

[0101] In one embodiment, the acquisition module 10 is also used to prohibit all CAN application message communications and all CAN communications of the entire vehicle when the vehicle status information meets the flashing preconditions, to prevent and process fault diagnostic code records caused by disabling CAN communications; and to perform a flashing operation according to a preset flashing standard.

[0102] The present application provides an OTA guaranteed upgrade device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the OTA guaranteed upgrade method in the above-mentioned embodiment one.

[0103] Reference below Figure 5 , which shows a schematic diagram of the structure of an OTA guarantee upgrade device suitable for implementing the embodiment of the present application. The OTA guarantee upgrade device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The OTA guaranteed upgrade device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0104] like Figure 5As shown, the OTA guarantee upgrade device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the OTA guarantee upgrade device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the OTA security upgrade device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an OTA security upgrade device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0105] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0106] The OTA guaranteed upgrade device provided by this application adopts the OTA guaranteed upgrade method in the above embodiment, which can solve the technical problem of how to improve the security of OTA upgrade. Compared with the prior art, the beneficial effects of the OTA guaranteed upgrade device provided by this application are the same as the beneficial effects of the OTA guaranteed upgrade method provided by the above embodiment, and the other technical features in the OTA guaranteed upgrade device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0107] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0108] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0109] The present application provides a computer-readable medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the OTA guaranteed upgrade method in the above-mentioned embodiment.

[0110] The computer-readable medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0111] The computer-readable medium may be included in the OTA upgrade guarantee device; or may exist independently without being assembled into the OTA upgrade guarantee device.

[0112] The computer-readable medium carries one or more programs. When the one or more programs are executed by the OTA upgrade device, the OTA upgrade device can be written in one or more programming languages ​​or a combination thereof to write computer program codes for performing the operations of the present application. The programming languages ​​include object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0113] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0114] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0115] The readable medium provided by the present application is a computer-readable medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned OTA guaranteed upgrade method, and can solve the technical problem of how to improve the security of OTA upgrades. Compared with the prior art, the beneficial effects of the computer-readable medium provided by the present application are the same as the beneficial effects of the OTA guaranteed upgrade method provided by the above-mentioned embodiment, and will not be repeated here.

[0116] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned OTA guaranteed upgrade method when executed by a processor.

[0117] The computer program product provided by this application can solve the technical problem of how to improve the security of OTA upgrades. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the OTA guaranteed upgrade method provided by the above embodiment, which will not be repeated here.

[0118] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An OTA guaranteed upgrade method, characterized in that: The method comprises: Get upgrade tasks, controller upgrade sequence and vehicle status information; Parsing the upgrade parameters in the upgrade task to obtain upgrade preconditions, wherein the upgrade parameters include vehicle speed, vehicle gear position, power-on and power-off status, vehicle battery power and voltage, and diagnostic instrument access status; Parsing the flashing parameters in the upgrade task to obtain flashing preconditions, wherein the flashing parameters include vehicle speed, vehicle gear position, power-on and power-off status, and vehicle battery power and voltage; When the upgrade task is received and the vehicle status information meets the upgrade precondition, starting the upgrade mode; When the upgrade mode is turned on and the vehicle status information meets the flashing precondition, the upgrade of multiple controllers is completed according to the controller upgrade sequence.

2. The method according to claim 1, characterized in that When the upgrade mode is turned on and the vehicle status information meets the flashing precondition, the step of completing the upgrade of multiple controllers according to the controller upgrade sequence includes: After completing the upgrade of a single controller, the upgrade result is obtained; When the upgrade result is successful, continue to upgrade the next controller; When the upgrade result is an upgrade failure, retry the flashing according to a preset flashing strategy or skip the current controller to upgrade the next controller; When multiple controllers have completed upgrading, exit the upgrade mode and restore the vehicle status.

3. The method according to claim 1, characterized in that The step of completing the upgrade of multiple controllers according to the controller upgrade sequence when the upgrade mode is turned on and the vehicle status information meets the flashing preconditions also includes: During the upgrade process, real-time monitoring of vehicle status information; When the vehicle status information does not meet the upgrade precondition or the vehicle status information does not meet the flashing precondition, the upgrade mode is turned off, and the upgrade is continued when the vehicle status information meets the conditions again.

4. The method according to claim 1, characterized in that The necessary conditions in the flashing preconditions are that the vehicle speed is a preset value, the vehicle gear is in P gear, the vehicle is in a power-off state, the vehicle battery power is higher than the minimum battery power and the vehicle battery voltage is higher than the minimum battery voltage.

5. The method according to claim 1, characterized in that The necessary conditions in the upgrade preconditions are that the vehicle speed is a preset value, the vehicle gear is in P gear, the vehicle is in a power-off state, the vehicle battery power is higher than the minimum battery power, the vehicle battery voltage is higher than the minimum battery voltage, and the vehicle is not connected to the diagnostic instrument.

6. The method according to claim 1, characterized in that The step of starting the upgrade mode when the upgrade task is received and the vehicle status information meets the upgrade precondition includes: When the upgrade task is received and the vehicle status information meets the upgrade precondition, entering the upgrade mode; After entering the upgrade mode, obtain the signal broadcast by the vehicle entering the upgrade mode; After receiving the signal, the one-touch start button function or the buttonless start function is disabled, the vehicle is prohibited from entering the start state and the central control screen touch operation is disabled, and the touch screen is allowed to display upgrade-related information.

7. The method according to claim 1, characterized in that Before the step of completing the upgrade of multiple controllers in the controller upgrade sequence when the upgrade mode is turned on and the vehicle status information satisfies the flashing precondition, the method includes: When the vehicle status information meets the flashing precondition, all CAN application message communications are prohibited, all CAN communications of the entire vehicle are disabled, and fault diagnostic code records caused by disabling CAN communications are prevented and processed; Execute the flashing operation and perform the flashing according to the preset flashing standard.

8. An OTA security upgrade device, characterized in that: The device comprises: An acquisition module is used to obtain upgrade tasks, controller upgrade sequence and vehicle status information; The acquisition module is also used to parse the upgrade parameters in the upgrade task to obtain the upgrade preconditions, wherein the upgrade parameters include vehicle speed, vehicle gear position, power on and off status, vehicle battery power voltage and diagnostic instrument access status; The acquisition module is further used to parse the flashing parameters in the upgrade task to obtain the flashing preconditions, wherein the flashing parameters include vehicle speed, vehicle gear position, power-on and power-off status, and vehicle battery power voltage; An execution module, configured to start an upgrade mode when the upgrade task is received and the vehicle status information meets the upgrade precondition; The execution module is also used to complete the upgrade of multiple controllers according to the controller upgrade sequence when the upgrade mode is turned on and the vehicle status information meets the flashing precondition.

9. An OTA guarantee upgrade device, characterized in that: The device comprises: a memory, a processor, and an OTA guaranteed upgrade program stored in the memory and running on the processor, wherein the OTA guaranteed upgrade program is configured to implement the steps of the OTA guaranteed upgrade method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores an OTA guaranteed upgrade program, and when the OTA guaranteed upgrade program is executed by the processor, the steps of the OTA guaranteed upgrade method according to any one of claims 1 to 7 are implemented.

Images