Remote updating device and method for system updating

Abstract

The invention relates to the technical field of system updating, and provides a remote updating device for system updating, which comprises a system program running module, a program starting module and a system program storage module, and is characterized in that the program starting module is connected with the system program running module and the system program storage module; the system program operation module is connected with the system program storage module; the system program storage module stores a first mirror image and a second mirror image of a system program; the program starting module is used for determining one of the first mirror image and the second mirror image as a target mirror image based on a currently set running mirror image identifier, and sending an address identifier of the target mirror image to the system program running module; and the system program running module is used for running the target mirror image and updating a non-target mirror image in the first mirror image and the second mirror image when a remote updating message is received. In the updating process of the system program, the running system program is not stopped, and normal running of the current system program is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of system updating, and in particular to a remote updating device and method for system updating. Background Art

[0002] The original equipment manufacturer (OEM) hardware and system software of traditional cars are fixed when customers purchase them. System updates need to be done at dealers or service centers for offline system updates. This system update method is time-consuming for customers and a very complicated process for dealers or service providers. At present, most of them use online remote updates, such as Over the Air update (OTA) technology, but during the system update process, the system cannot run and can only be restarted after the update is completed. For example, after the vehicle is started, if the vehicle's autonomous driving system is in the update state, the autonomous driving system cannot be used. Summary of the invention

[0003] The present invention provides a remote updating device and method for system updating, which are used to solve the problem in the prior art that the system program cannot be run simultaneously when the system program is updated.

[0004] The present invention provides a remote updating device for system updating, comprising: a system program running module, a program starting module and a system program storage module, wherein the program starting module is connected to the system program running module and the system program storage module, and the system program running module is connected to the system program storage module.

[0005] The system program storage module stores a first image and a second image of the system program.

[0006] The program startup module is used to determine that one of the first image and the second image is a target image based on the currently set running image identifier, and send the address identifier of the target image to the system program running module.

[0007] The system program running module is used to run the target image, and when receiving a remote update message, update the non-target image in the first image and the second image.

[0008] According to a remote update device for system update provided by the present invention, the first image and the second image both include: a boot program part and a software program part of the system program, and the system program running module is used to execute the boot program to load the corresponding software program.

[0009] According to a remote update device for system update provided by the present invention, the system program storage module includes: a first flash memory, a second flash memory and an embedded multimedia card, the first flash memory and the second flash memory are both connected to the program startup module, the system program running module and the embedded multimedia card, and the system program running module is connected to the embedded multimedia card.

[0010] The first flash memory is used to store the boot program of the first image, the second flash memory is used to store the boot program of the second image, the embedded multimedia card includes a first partition and a second partition, the first partition is used to store the software program of the first image, the second partition is used to store the software program of the second image, the boot program of the first image is used to guide the software program of the first image to run, and the boot program of the second image is used to guide the software program of the second image to run.

[0011] The program startup module is used to determine that the first flash memory or the second flash memory is the target flash memory based on the currently set running image identifier, and send the address identifier of the target flash memory to the system program running module. The system program running module is used to execute the boot program in the target flash memory to load the corresponding software program, and when a remote update message is received, update the boot program and the corresponding software program in the non-target flash memory.

[0012] According to a remote update device for system update provided by the present invention, the program startup module includes: a startup control module and a startup selection module, the startup control module is connected to the startup selection module, and the startup selection module is connected to the system program running module, the first flash memory and the second flash memory.

[0013] The startup control module sends a selection signal to the startup selection module based on the currently set running image identifier.

[0014] The boot selection module selects the first flash memory or the second flash memory as the target flash memory based on the selection signal, and sends the address identifier of the target flash memory to the system program running module.

[0015] According to a remote update device for system update provided by the present invention, the startup control module is a secure microcontroller Aurix, the startup selection module is an integrated circuit switching switch TS5A23157, the secure microcontroller Aurix and the integrated circuit switching switch TS5A23157 are connected through a GPIO pin, the secure microcontroller Aurix sends an XSPI_CS signal to the integrated circuit switching switch TS5A23157 based on the currently set running image identifier, the integrated circuit switching switch TS5A23157 selects the first flash memory or the second flash memory as the target flash memory based on the XSPI_CS signal, and sends the address identifier of the target flash memory to the system program running module.

[0016] According to a remote update device for system update provided by the present invention, the boot program part includes: the firmware of the system program running module, and the software program part includes: a configuration file and a program body of the software program, and the configuration file and the program body are respectively located in different sub-partitions of the partition where the software program is located.

[0017] According to a remote update device for system update provided by the present invention, the system program running module is also used to feedback an update completion signal to the program startup module after the non-target image update is completed, and the program startup module switches the currently set running image identifier to the image identifier of the non-target image based on the update completion signal.

[0018] According to a remote update device for system update provided by the present invention, the program startup module is used to control the system program running module and the system program storage module to power on after determining that one of the first image and the second image is the target image.

[0019] According to a remote updating device for system updating provided by the present invention, when the system program running module runs the system program, a heartbeat connection signal is sent to the program starting module.

[0020] According to a remote update device for system update provided by the present invention, the program startup module is used to change the currently set running image identifier to the image identifier of the non-target image and restart the system program running module when the heartbeat connection signal is not received. After the system program running module is restarted, the target image corresponding to the switched running image identifier is run.

[0021] The present invention also provides a remote updating method for system updating, which is implemented based on any of the above-mentioned remote updating devices for system updating, and the method includes the following steps.

[0022] The program startup module determines that one of the first image and the second image is a target image based on the currently set running image identifier, and sends the address identifier of the target image to the system program running module.

[0023] The system program running module is used to run the target image, and when receiving a remote update message, update the non-target image in the first image and the second image.

[0024] According to a remote update method for system update provided by the present invention, after the system program running module completes the update of the non-target image, it also includes: the system program running module feeds back an update completion signal to the program startup module; the program startup module switches the currently set running image identifier to the image identifier of the non-target image based on the update completion signal.

[0025] According to a remote update method for system update provided by the present invention, after the program startup module determines that one of the first image and the second image is the target image, it also includes: the program startup module controls the system program running module and the system program storage module to power on.

[0026] A remote update method for system update provided according to the present invention further includes: when the system program running module runs the system program, sending a heartbeat connection signal to the program starting module.

[0027] According to a remote update method for system update provided by the present invention, the method further includes: when the program startup module does not receive the heartbeat connection signal, switching the currently set running image identifier to an image identifier of a non-target image, and restarting the system program running module, after the system program running module is restarted, running the target image corresponding to the switched running image identifier.

[0028] In the remote update device and method for system update of the present embodiment provided by the present invention, the system program storage module stores the first image and the second image of the system program. When the system program needs to be run, the program startup module determines that one of the first image and the second image is the target image based on the currently set running image identifier, and the system program running module runs the target image, and when receiving a remote update message, updates the non-target image in the first image and the second image. Therefore, during the system program update process, the running system program is not stopped, thereby ensuring the normal operation of the current system program. For users, the effect of running and updating the system program at the same time is achieved, providing a better user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 It is a structural schematic diagram of a remote updating device for system updating provided by the present invention.

[0031] Figure 2 It is a flow chart of a remote updating method for system updating provided by the present invention.

[0032] The reference numerals are as follows.

[0033] 100: system program running module; 200: program starting module; 300: system program storage module; 210: starting control module; 220: starting selection module; 310: first flash memory; 320: second flash memory; 330: embedded multimedia card; 331: first partition; 332: second partition. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] The remote update device for system update according to the embodiment of the present invention is as follows: Figure 1 As shown, it includes: a system program running module 100, a program startup module 200 and a system program storage module 300, wherein the program startup module 200 is connected to the system program running module 100 and the system program storage module 300, and the system program running module 100 is connected to the system program storage module 300. Among them, the system program running module 100 is a hardware module for running the system program, for example, a hardware module for running the automatic driving program in the vehicle system, and different manufacturers will provide different hardware modules.

[0036] The system program storage module 300 stores a first image and a second image of the system program, that is, the system program storage module 300 stores two copies of the system program with basically the same functions. It can be understood that the first image and the second image are different versions of the system program, and the first image and the second image are located in different storage areas of the system program storage module 300 and have different address identifiers.

[0037] The program startup module 200 is used to determine that one of the first image and the second image is the target image based on the currently set running image identifier, and send the address identifier of the target image to the system program running module 100. Specifically, the program startup module 200 stores the currently set running image identifier, and the currently set running image identifier indicates which system program image the system program running module 100 is to run. For example, the identifier 0 indicates the first image, and the identifier 1 indicates the second image. If the currently set running image identifier is 0, the first image is the target image, indicating that the system program running module 100 runs the first image. The program startup module 200 is connected to the system program storage module 300, and the address identifier of the target image can be obtained. The mapping relationship between different running image identifiers and the address identifiers of the corresponding images can also be pre-set in the program startup module 200, and the address identifier of the target image can be obtained through the mapping relationship.

[0038] The system program running module 100 is used to run the target image, and when receiving a remote update message, update the non-target image in the first image and the second image. Specifically, the system program running module 100 locates, loads and runs the target image in the system program storage module 300 according to the address identifier of the target image. During the process of running the program, if there is a new version of the system program in the cloud, the remote update message of the system program will be pushed to the system program running module 100. After receiving the remote update message, the system program running module 100 updates the non-target image in the first image and the second image, that is, downloads the latest version of the system program from the cloud to update the non-target image.

[0039] In the remote update device for system update of this embodiment, the system program storage module 300 stores the first image and the second image of the system program. When the system program needs to be run, the program startup module 200 determines that one of the first image and the second image is the target image based on the currently set running image identifier. The system program running module 100 runs the target image, and when receiving a remote update message, updates the non-target image in the first image and the second image. Therefore, during the system program update process, the running system program is not stopped, thereby ensuring the normal operation of the current system program. For users, the effect of running and updating the system program at the same time is achieved, providing a better user experience.

[0040] In some embodiments, both the first image and the second image include: a boot program part and a software program part of the system program, and the system program running module 100 is used to execute the boot program to load the corresponding software program. Specifically, the boot program part includes: the firmware of the system program running module 100, and the software program part includes: a configuration file and a program body of the software program, and the configuration file and the program body are respectively located in different sub-partitions of the partition where the software program is located. For example: the system program running module 100 is an NXP LX2160 device, the boot program part can be the firmware of the NXP LX2160 device, the software program part is an autonomous driving program running on the NXP LX2160 device, and the firmware can be an adaptive configuration program for the software program part to the NXP LX2160 device or a firmware update for the NXP LX2160 device by the manufacturer.

[0041] This embodiment realizes the simultaneous update of the firmware of the system program running module 100 and the corresponding software program, and the software program part includes a configuration file and a program body, which are located in different sub-partitions. If only the configuration parameters and other information related to the software program need to be updated, only the sub-partition of the configuration file needs to be updated. There is no need to download a large amount of program body code, which reduces the amount of updated data and improves update efficiency.

[0042] In one embodiment, based on the update of the boot program and the software program part, the system program storage module 300 includes: a first flash memory 310, a second flash memory 320 and an embedded multimedia card 330, the first flash memory 310 and the second flash memory 320 are both connected to the program startup module 200, the system program running module 100 and the embedded multimedia card 330, and the system program running module 100 is connected to the embedded multimedia card 330.

[0043] The first flash memory 310 is used to store the boot program of the first image, the second flash memory 320 is used to store the boot program of the second image, the embedded multimedia card 330 includes a first partition 331 and a second partition 332, the first partition 331 is used to store the software program of the first image, and the second partition 332 is used to store the software program of the second image. The boot program of the first image is used to guide the software program of the first image to run, and the boot program of the second image is used to guide the software program of the second image to run.

[0044] Based on the above hardware structure, the program startup module 200 is used to determine that the first flash memory 310 or the second flash memory 320 is the target flash memory based on the currently set running image identifier, and send the address identifier of the target flash memory to the system program running module 100. The system program running module 100 is used to execute the boot program in the target flash memory to load the corresponding software program, and when a remote update message is received, update the boot program in the non-target flash memory and the software program in the corresponding partition.

[0045] Specifically, the address identifier of the target flash memory is sent to the system program running module 100, that is, the program startup module 200 establishes a connection between the system program running module 100 and the target flash memory in the first flash memory 310 and the second flash memory 320 through circuit switching, so that the system program running module 100 executes the boot program in the target flash memory and loads the corresponding software program. When the system program running module 100 receives the remote update message, it updates the boot program in the non-target flash memory and the software program in the corresponding partition. It should be noted that: when the system program is updated, it knows its own primary / backup storage address, and finds the non-target flash memory and the corresponding partition through the connection between the system program running module 100 and the system program storage module 300, thereby realizing remote system update.

[0046] In some embodiments, the program startup module 200 includes: a startup control module 210 and a startup selection module 220 , the startup control module 210 is connected to the startup selection module 220 , and the startup selection module 220 is connected to the system program running module 100 , the first flash memory 310 and the second flash memory 320 .

[0047] The startup control module 210 sends a selection signal to the startup selection module 220 based on the currently set running image identifier.

[0048] The boot selection module 220 selects the first flash memory 310 or the second flash memory 320 as the target flash memory based on the selection signal, and sends the address identifier of the target flash memory to the system program running module 100 .

[0049] In some embodiments, the startup control module 210 is a secure microcontroller Aurix, and the startup selection module 220 is an integrated circuit switch (IC Switch) TS5A23157. The secure microcontroller Aurix and the integrated circuit switch TS5A23157 are connected through a GPIO pin. The secure microcontroller Aurix sends an XSPI_CS signal to the integrated circuit switch TS5A23157 based on the currently set running image identifier. For example, when the currently set running image identifier is 0, a low-level XSPI_CS signal is sent to the integrated circuit switch TS5A23157 through the GPIO pin. When the currently set running image identifier is 1, a high-level XSPI_CS signal is sent to the integrated circuit switch TS5A23157 through the GPIO pin.

[0050] The integrated circuit switch TS5A23157 selects the first flash memory 310 or the second flash memory 320 as the target flash memory based on the XSPI_CS signal, and sends the address identifier of the target flash memory to the system program running module 100, that is, the integrated circuit switch TS5A23157 establishes a circuit connection between the system program running module 100 and the target flash memory, so that the system program running module 100 executes the boot program in the target flash memory and loads the corresponding software program. For example: if the integrated circuit switch TS5A23157 receives a low-level XSPI_CS signal, the first flash memory 310 is selected as the target flash memory, and if a high-level XSPI_CS signal is received, the second flash memory 320 is selected as the target flash memory.

[0051] In this embodiment, a combination of a security microcontroller Aurix and an integrated circuit switch TS5A23157 is selected to form a program startup module 200, which has a simple hardware structure, is easy to implement, and has low cost.

[0052] In some embodiments, the system program running module 100 is also used to feedback an update completion signal to the program startup module 200 after the non-target image is updated. The program startup module 200 switches the currently set running image identifier to the image identifier of the non-target image based on the update completion signal. In this way, the next time the system program running module 100 needs to run the system program, the program startup module 200 can automatically select the latest updated system program image address and give it to the system program running module 100, without manually modifying the currently set running image identifier in the program startup module 200. For example: After receiving the update completion signal fed back by NXP LX2160, the secure microcontroller Aurix changes the currently set running image identifier from 0 to 1, or from 1 to 0.

[0053] In some embodiments, the program startup module 200 is used to control the system program running module 100 and the system program storage module 300 to power on after determining that one of the first image and the second image is the target image. Specifically, the startup control module 210 is connected to the system program running module 100, and after the startup control module 210 sends a selection signal to the startup selection module 220, it sends a power on signal to the system program running module 100, so that the system program running module 100 is powered on. For example, after the secure microcontroller Aurix sends an XSPI_CS signal to the integrated circuit switching switch TS5A23157, it sends a power on signal to the NXP LX2160 device, that is, the NXP LX2160 is powered on. After the NXP LX2160 is powered on, the startup read-only memory (LX2160 Boot Rom) of the NXP LX2160 is first started, and then the entire NXP LX2160 device is started. Since the system program running module 100 is connected to the system program storage module 300, after the system program running module 100 is powered on, the system program storage module 300 is powered on to ensure that the system program running module 100 is powered on when the system program is running. On the one hand, when the system program is not running, the corresponding system program running module 100 is not started, thereby reducing power consumption. On the other hand, it is avoided that after the system program running module 100 is started in advance, when a remote update message is received, it is impossible to determine which system program image to update.

[0054] In some embodiments, when the system program running module 100 runs the system program, a heartbeat connection signal is sent to the program startup module 200 to prove that the system program running module 100 is in a state of normal operation of the system program, for example: NXP LX2160 sends a heartbeat connection signal to the security microcontroller Aurix every 10 seconds. Consider a scenario where, after the system program is updated, the system program running module 100 will run the updated system program image. For some reason, the newly updated system program may have some problems that prevent it from running normally, causing the system program running module 100 to enter a downtime state, and no heartbeat connection signal will occur after the downtime. In this embodiment, the program startup module 200 determines whether the system program running module 100 is running normally by whether the heartbeat connection signal is received, and an alarm prompt may be issued when the heartbeat connection signal is not received.

[0055] In some embodiments, the program startup module 200 is used to change the currently set running image identifier to the image identifier of the non-target image, and restart the system program running module 100 when the heartbeat connection signal is not received. After the system program running module 100 is restarted, it runs the target image corresponding to the switched running image identifier. Specifically, since the program startup module 200 does not receive the heartbeat connection signal, it means that the system program running module 100 is down, and the reason for the downtime is that there is a problem with the updated system program. Therefore, at this time, the currently set running image identifier is changed to the image identifier of the non-target image, that is, the currently set running image identifier is switched to another system program image running before the update, and then the system program running module 100 is restarted, so that the system program running module 100 runs another system program image before the update to ensure the normal execution of the system program.

[0056] Furthermore, after the system program running module 100 crashes and restarts, it feeds back a message to the cloud that a problem has occurred in the update program so that cloud maintenance personnel can handle the problem in a timely manner.

[0057] The remote update method for system update provided by the present invention is described below. The remote update method for system update described below is implemented by using the remote update device for system update described above, and they can be referenced to each other.

[0058] The remote update method for system update of the embodiment of the present invention is implemented based on the remote update device for system update of any of the above embodiments. The specific process of the method is as follows: Figure 2 As shown, the following steps are included.

[0059] Step S210: the program startup module determines that one of the first image and the second image is a target image based on the currently set running image identifier, and sends the address identifier of the target image to the system program running module.

[0060] Step S220: the system program running module is used to run the target image, and when receiving a remote update message, updates the non-target image in the first image and the second image.

[0061] In the remote update method for system update of the present embodiment, the system program storage module stores the first image and the second image of the system program. When the system program needs to be run, the program startup module determines that one of the first image and the second image is the target image based on the currently set running image identifier. The system program running module runs the target image, and when receiving the remote update message, updates the non-target image in the first image and the second image. Therefore, during the system program update process, the running system program is not stopped, thereby ensuring the normal operation of the current system program. For users, the effect of running and updating the system program at the same time is achieved, providing a better user experience.

[0062] In some embodiments, after the system program running module completes updating the non-target image, it also includes: the system program running module feeds back an update completion signal to the program startup module; the program startup module switches the currently set running image identifier to the image identifier of the non-target image based on the update completion signal.

[0063] In some embodiments, after the program startup module determines that one of the first image and the second image is the target image, it also includes: the program startup module controls the system program running module and the system program storage module to power on to ensure the correct running sequence of the target image.

[0064] In some embodiments, the remote update method for system update further includes: when the system program running module runs the system program, sending a heartbeat connection signal to the program startup module to provide real-time feedback on the current running status of the system program running module.

[0065] In some embodiments, the remote update method for system update also includes: when the program startup module does not receive the heartbeat connection signal, switching the currently set running image identifier to an image identifier of a non-target image, and restarting the system program running module, after the system program running module is restarted, running the target image corresponding to the switched running image identifier.

[0066] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A remote update device for system update, characterized in that: include: A system program running module, a program starting module and a system program storage module, wherein the program starting module is connected to the system program running module and the system program storage module, and the system program running module is connected to the system program storage module; The system program storage module stores a first image and a second image of the system program; The program startup module is used to determine that one of the first image and the second image is the target image based on the currently set running image identifier, and send the address identifier of the target image to the system program running module; The system program running module is used to run the target image, and when receiving a remote update message, update the non-target image in the first image and the second image.

2. The remote update device for system update according to claim 1, characterized in that: The first image and the second image both include: a boot program part and a software program part of the system program, and the system program running module is used to execute the boot program to load the corresponding software program.

3. The remote update device for system update according to claim 2, characterized in that: The system program storage module includes: a first flash memory, a second flash memory and an embedded multimedia card, the first flash memory and the second flash memory are both connected to the program startup module, the system program running module and the embedded multimedia card, and the system program running module is connected to the embedded multimedia card; The first flash memory is used to store the boot program of the first image, the second flash memory is used to store the boot program of the second image, the embedded multimedia card includes a first partition and a second partition, the first partition is used to store the software program of the first image, the second partition is used to store the software program of the second image, the boot program of the first image is used to guide the software program of the first image to run, and the boot program of the second image is used to guide the software program of the second image to run; The program startup module is used to determine that the first flash memory or the second flash memory is the target flash memory based on the currently set running image identifier, and send the address identifier of the target flash memory to the system program running module. The system program running module is used to execute the boot program in the target flash memory to load the corresponding software program, and when a remote update message is received, update the boot program and the corresponding software program in the non-target flash memory.

4. The remote update device for system update according to claim 3, characterized in that: The program startup module includes: a startup control module and a startup selection module, the startup control module is connected to the startup selection module, and the startup selection module is connected to the system program running module, the first flash memory and the second flash memory; The startup control module sends a selection signal to the startup selection module based on the currently set running image identifier; The boot selection module selects the first flash memory or the second flash memory as the target flash memory based on the selection signal, and sends the address identifier of the target flash memory to the system program running module.

5. The remote update device for system update according to claim 4, characterized in that: The startup control module is the secure microcontroller Aurix, and the startup selection module is the integrated circuit switching switch TS5A23157. The secure microcontroller Aurix and the integrated circuit switching switch TS5A23157 are connected through a GPIO pin. The secure microcontroller Aurix sends an XSPI_CS signal to the integrated circuit switching switch TS5A23157 based on the currently set running image identifier. The integrated circuit switching switch TS5A23157 selects the first flash memory or the second flash memory as the target flash memory based on the XSPI_CS signal, and sends the address identifier of the target flash memory to the system program running module.

6. The remote update device for system update according to claim 3, characterized in that: The boot program part includes: the firmware of the system program running module, and the software program part includes: a configuration file and a program body of the software program, and the configuration file and the program body are respectively located in different sub-partitions of the partition where the software program is located.

7. The remote update device for system update according to claim 1, characterized in that: The system program running module is also used to feed back an update completion signal to the program starting module after the non-target image is updated. The program starting module switches the currently set running image identifier to the image identifier of the non-target image based on the update completion signal.

8. The remote update device for system update according to claim 1, characterized in that: The program startup module is used to control the system program running module and the system program storage module to power on after determining that one of the first image and the second image is the target image.

9. The remote update device for system update according to any one of claims 1 to 8, characterized in that: When the system program running module runs the system program, a heartbeat connection signal is sent to the program starting module.

10. The remote update device for system update according to claim 7, characterized in that: When the program startup module does not receive the heartbeat connection signal, it is used to change the currently set running image identifier to the image identifier of the non-target image, and restart the system program running module. After the system program running module is restarted, it runs the target image corresponding to the switched running image identifier.

11. A remote update method for system update, characterized in that: Based on the remote update device for system update according to any one of claims 1 to 10, the method includes: The program startup module determines that one of the first image and the second image is the target image based on the currently set running image identifier, and sends the address identifier of the target image to the system program running module; The system program running module is used to run the target image, and when receiving a remote update message, update the non-target image in the first image and the second image.

12. The remote update method for system update according to claim 11, characterized in that: After the system program running module completes updating the non-target image, the method further includes: The system program running module feeds back an update completion signal to the program starting module; The program startup module switches the currently set running image identifier to an image identifier of a non-target image based on the update completion signal.

13. The remote update method for system update according to claim 11, characterized in that: After the program startup module determines that one of the first image and the second image is the target image, the method further includes: The program startup module controls the system program running module and the system program storage module to power on.

14. The remote update method for system update according to claim 11, characterized in that: Also includes: When the system program running module runs the system program, a heartbeat connection signal is sent to the program starting module.

15. The remote update method for system update according to claim 14, characterized in that: Also includes: When the program startup module does not receive the heartbeat connection signal, it switches the currently set running image identifier to the image identifier of the non-target image, and restarts the system program running module. After the system program running module is restarted, it runs the target image corresponding to the switched running image identifier.

Images