Software upgrading method, storage medium, domain controller and vehicle

Abstract

The invention relates to a software upgrading method, a storage medium, a domain controller and a vehicle, and the software upgrading method comprises the following steps: determining a main control program of the domain controller stored in a first partition of a nonvolatile memory to be upgraded; the first backup program stored in the second partition of the nonvolatile memory can be further updated to a program corresponding to the main control program. By updating the first backup program as the program corresponding to the main control program, the function of the main control program can be provided by running the first backup program when the main control program is abnormal in the subsequent upgrading process, so that the normal function of the main control program is ensured, and the basic use of the vehicle is maintained.

Description

Technical Field

[0001] The present disclosure relates to the field of vehicle technology, and in particular, to a software upgrade method, a storage medium, a domain controller and a vehicle. Background Art

[0002] There are many sensors in the vehicle, which have higher requirements for control logic and data interaction. The domain controller can centrally process many sensor signals and use a high-computing microprocessor to complete data processing and data interaction, making the vehicle more efficient and intelligent. With the rapid update and iteration of various technologies, the control program upgrade process of the domain controller is also highly valued.

[0003] However, when the control program of the domain controller in the related art is upgraded, there is a possibility that the control program may be damaged, resulting in the vehicle being unable to be used normally. Summary of the invention

[0004] The purpose of the present disclosure is to provide a software upgrade method, a storage medium, a domain controller and a vehicle.

[0005] In order to achieve the above object, according to a first aspect of the present disclosure, a software upgrade method is provided, which is applied to a domain controller, wherein the domain controller includes a non-volatile memory, and the method includes:

[0006] Determine that a master control program of the domain controller is upgraded, wherein the master control program is stored in a first partition;

[0007] Updating a first backup program of the domain controller so that the first backup program corresponds to the upgraded master control program, wherein the first backup program is stored in the second partition;

[0008] The first partition and the second partition are different data storage areas of the non-volatile memory.

[0009] Optionally, the first backup program includes all or part of the functional modules in the upgraded main control program.

[0010] Optionally, the method further comprises:

[0011] When a preset abnormal event occurs when the main control program is running, the domain controller is controlled according to the first backup program.

[0012] Optionally, the method further comprises:

[0013] When the state of the boot loader is normal, upgrading the main control program through the boot loader;

[0014] The boot loader is stored in the first partition.

[0015] Optionally, the method comprises:

[0016] When the state of the boot loader is abnormal, updating the boot loader through the second backup program to make the state of the boot loader normal;

[0017] The second backup program is stored in the second partition.

[0018] Optionally, updating the boot loader program by using a second backup program includes:

[0019] Acquiring first update data from a host computer that is in communication with the domain controller through the second backup program;

[0020] The boot loader is updated based on the first update data.

[0021] Optionally, before the main control program is upgraded by the boot loader, the method further includes:

[0022] Execute a startup program, wherein the startup program is stored in the first partition; wherein the startup program is used to determine a target address according to a state of the boot loader and jump to the target address.

[0023] Optionally, determining the target address according to the state of the boot loader includes:

[0024] When the state of the boot loader is normal, determining the target address to be the address of the boot loader;

[0025] When the state of the boot loader is abnormal, the target address is the address of the second backup program.

[0026] Optionally, the method further comprises:

[0027] receiving a non-volatile memory drive data packet, wherein the non-volatile memory drive data packet is configured to be sent by a host computer that is communicatively connected to the domain controller;

[0028] The main control program is upgraded based on the non-volatile memory driving data packet.

[0029] Optionally, the domain controller further includes a volatile memory, and the non-volatile memory driving data packet is used to be stored in the volatile memory.

[0030] Optionally, the method further comprises:

[0031] In response to receiving a forced upgrade instruction sent by a host computer that is in communication with the domain controller and determining that the boot loader is in a forced upgrade mode, upgrading the main control program;

[0032] Among them, the forced upgrade instruction is sent by the host computer when a first number of upgrade instructions are sent and the main control program fails to be upgraded. When the number of times the main control program saved in the first partition executes automatic reset is greater than a second number, the boot loader is in the forced upgrade mode.

[0033] According to a second aspect of the present disclosure, a non-temporary computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the software upgrade method described in the first aspect of the present disclosure are implemented.

[0034] According to a third aspect of an embodiment of the present disclosure, a domain controller is provided, including:

[0035] A non-volatile memory, wherein the non-volatile memory includes a first partition and a second partition;

[0036] The processor is used to execute a computer program to implement the steps of the software upgrade method described in the first aspect of the present disclosure.

[0037] According to a fourth aspect of an embodiment of the present disclosure, a vehicle is provided, comprising the domain controller described in the third aspect of the present disclosure.

[0038] Through the above technical solution, when it is determined that the main control program of the domain controller stored in the first partition of the non-volatile memory is upgraded, the first backup program stored in the second partition of the non-volatile memory can be further updated to a program corresponding to the main control program. By updating the first backup program to a program corresponding to the main control program, when an abnormality occurs in the main control program during the subsequent upgrade process, the function of the main control program can be provided by running the first backup program to ensure that the main control program functions normally, so as to maintain the basic use of the vehicle.

[0039] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0041] Figure 1 The figure is a flowchart of a software upgrading method according to an exemplary embodiment.

[0042] Figure 2The diagram is a schematic diagram of memory partitioning of a domain controller according to an exemplary embodiment.

[0043] Figure 3 The figure is a flowchart of a software upgrading method according to an exemplary embodiment.

[0044] Figure 4 is a block diagram of a vehicle according to an exemplary embodiment. DETAILED DESCRIPTION

[0045] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0046] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0047] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0048] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0049] In the related technologies, in order to improve the security, stability and efficiency of domain controller control program upgrades, the current solutions mainly include the following:

[0050] 1. Reduce the probability of upgrade failure by strengthening the connection between the host computer and the domain controller;

[0051] 2. Improve the security of upgrade package parsing and transmission process;

[0052] 3. Improve the security of storage media;

[0053] 4. Add an auxiliary microprocessor to monitor whether the upgrade process is successful;

[0054] 5. Determine whether an upgrade is needed by checking the upgrade flag bit.

[0055] The applicant has found in long-term research that although there are many solutions to improve the security, stability and efficiency of the domain controller master program upgrade in the relevant technology, most of the above solutions are concentrated on the host computer. On the one hand, the communication handshake mechanism and data encryption transmission method between the host computer and the slave computer are enhanced to increase the stability of the connection to enhance the success rate in the upgrade process. On the other hand, the upgrade package parsing algorithm is modified to improve the security of the upgrade package parsing. These methods are relatively limited and do not involve data writing methods, software versatility, etc. The upgrade of the domain controller requires the host computer and the domain controller (i.e., the slave computer) to be implemented together. It is possible to consider adding the optimization of the slave computer, thereby improving the security, stability and efficiency of the domain controller master program upgrade process as a whole, and also improving the versatility of the upgrade file corresponding to the master program. On the other hand, the storage medium in the domain controller is an internal or external non-volatile memory. Improving the security of the non-volatile memory is more about enhancing the confidentiality of the code, which has little effect on the upgrade process of the domain controller master program. On the other hand, adding an auxiliary microprocessor will make the hardware circuit more complicated, and the communication and data interaction between the main microprocessor and the auxiliary microprocessor will bring new problems.

[0056] In addition, when the main control program of the domain controller is upgraded, there is a possibility that the main control program may be damaged, causing the vehicle to be unable to be used normally.

[0057] In response to the above findings of the applicant, the applicant proposed the software upgrade method, storage medium, domain controller and vehicle of the embodiments of the present disclosure to at least partially solve the above technical problems.

[0058] Figure 1 is a flowchart of a software upgrade method according to an exemplary embodiment. Figure 1 As shown, the method is applied to a domain controller, the domain controller may include a non-volatile memory, and the software upgrade method includes:

[0059] In step S101, it is determined that the main control program of the domain controller is upgraded, and the main control program is stored in the first partition.

[0060] In step S102, the first backup program of the domain controller is updated so that the first backup program corresponds to the upgraded main control program, and the first backup program is stored in the second partition.

[0061] The first partition and the second partition are different data storage areas of the non-volatile memory.

[0062] In some implementations, the first partition may also be called a primary partition, a primary program area, etc., and may be used to store a master control program of a domain controller. The second partition may also be called a backup program area, a backup area, etc., and may be used to store a backup program corresponding to the master control program.

[0063] In the embodiment of the present disclosure, software upgrade can be understood as updating the main control program of the domain controller stored in the first partition. The main control program can also be called a control program, which is used to provide the functions of the domain controller.

[0064] By adopting the above method, when it is determined that the main control program of the domain controller stored in the first partition of the non-volatile memory is upgraded, the first backup program stored in the second partition of the non-volatile memory can be further updated to a program corresponding to the main control program. By updating the first backup program to a program corresponding to the main control program, when an abnormality occurs in the main control program during the subsequent upgrade process, the function of the main control program can be provided by running the first backup program to ensure that the main control program functions normally, so as to maintain the basic use of the vehicle.

[0065] In some implementations, the first backup program includes all or part of the functions of the upgraded main control program.

[0066] In the embodiment of the present disclosure, the first backup program may include some functions in the upgraded main control program, or may include all functions in the upgraded main control program, wherein some functions may be some basic functions to maintain basic use of the vehicle.

[0067] When the first backup program is a partial function of the upgraded main control program, since the second partition stores the first backup program that implements part of the functions of the upgraded main control program, compared to storing the complete upgraded main control program, while ensuring the basic functions of the upgraded main control program, it reduces the time for each software upgrade and reduces the consumption of non-volatile memory storage space.

[0068] In some implementations, the method of the embodiment of the present disclosure may further include the following steps:

[0069] When the operation of the main control program causes a preset abnormal event, the domain controller is controlled according to the first backup program.

[0070] In the embodiment of the present disclosure, the preset abnormal events may include abnormal reset of the master control program of the domain controller, startup failure, upgrade failure and other events.

[0071] Considering that running the main control program may cause abnormal reset, startup failure, upgrade failure and other events, which may cause the loss of certain vehicle functions or even the inability to activate the vehicle, therefore, in some embodiments, when there is a startup failure, abnormal reset, upgrade failure and the like when running the main control program, the domain controller can run the first backup program to ensure the vehicle functions.

[0072] In combination with the foregoing content, it can be seen that when the first backup program is a partial function of the upgraded main control program, the domain controller can also be controlled according to the first backup program to at least ensure the basic functions of the vehicle, for example, at least ensure that the vehicle can be started.

[0073] In some implementations, the domain controller can feed back the upgrade status to the host computer that is in communication with the domain controller in real time. When the domain controller determines that the master control program of the domain controller has been successfully upgraded, it can send the upgrade status of the successful upgrade to the host computer, so that the host computer can show the user a prompt of the successful upgrade, and can further provide the user with an option of whether to update the first backup program in the second partition, and the user decides whether to update the second partition. Furthermore, the host computer can send a backup instruction to the domain controller in response to the update operation triggered by the user, so that the domain controller can update the program corresponding to the upgraded master control program to the second partition.

[0074] In some implementations, the first backup program may be obtained from the host computer after the main control program is successfully upgraded, or may be obtained from the host computer together with the main control program data package to be upgraded.

[0075] By adopting the above method, after determining that the main control program of the domain controller has been upgraded, the backup version program corresponding to this upgrade (i.e., the program corresponding to the upgraded main control program) can be used to update the first backup program in the second partition. In this way, when the operation of the main control program in the first partition causes a preset abnormal event, some functions of the main control program can be provided by running the first backup program to ensure that some basic functions of the main control program are normal to maintain the basic use of the vehicle. Moreover, since the second partition stores the first backup software that realizes some functions of the main control program, compared with storing the complete main control program, while ensuring the basic functions, the time of each software upgrade is reduced and the consumption of non-volatile memory storage space is reduced.

[0076] In some implementations, the method of the embodiment of the present disclosure may further include the following steps:

[0077] When the boot loader is in a normal state, the main control program is upgraded through the boot loader;

[0078] The boot loader is stored in the first partition.

[0079] In the disclosed embodiment, a boot loader may also be stored in the first partition. The boot loader may be BootLoader, referred to as boot. The boot loader is used to rewrite the main control program in the first partition, thereby upgrading the main control program in the first partition.

[0080] Therefore, in the embodiment of the present disclosure, before upgrading the master control program in the domain controller, the status of the boot loader can be obtained first, and when the status of the boot loader is normal, the master control program can be upgraded through the boot loader.

[0081] In addition, in some cases, the state of the boot loader may also be abnormal. In this case, in some implementations, the method of the embodiment of the present disclosure may further include the following steps:

[0082] When the state of the boot loader is abnormal, updating the boot loader through the second backup program to make the state of the boot loader normal;

[0083] The second backup program is stored in the second partition.

[0084] In the disclosed embodiment, a second backup program may also be stored in the second partition, so that when the state of the boot loader is abnormal, the boot loader may be updated through the second backup program to restore the state of the boot loader to normal.

[0085] In some implementations, updating the boot loader program by using the second backup program may include the following steps:

[0086] Acquiring first update data from a host computer that is in communication with the domain controller through a second backup program;

[0087] The boot loader is updated based on the first update data.

[0088] In the disclosed embodiment, the second backup program can communicate with the host computer and obtain the first update data from the host computer to update the boot loader, so that the status of the boot loader is normal. Then, the main control program in the first partition can be further upgraded through the updated boot loader.

[0089] That is to say, in the embodiment of the present disclosure, the backup version program may include a first backup program and a second backup program, that is, after each successful upgrade of the master control program of the domain controller in the first partition, the first backup program and the second backup program corresponding to each upgrade may be simultaneously updated to the second partition.

[0090] In other implementations, considering that the update frequency of the second backup program may be lower than that of the first backup program, the second backup program may be updated when the second backup program is actually updated or after each specific number of program upgrades.

[0091] In some implementations, before the main control program is upgraded through the boot loader, the method of the embodiment of the present disclosure may further include the following steps:

[0092] The startup program is executed, and the startup program is stored in the first partition; wherein the startup program is used to determine the target address according to the state of the boot loader and jump to the target address.

[0093] In the disclosed embodiment, before the main control program is upgraded through the boot loader, a startup program may be executed first to determine the target address according to the state of the boot loader and jump to the target address to start the program at the target address.

[0094] In the disclosed embodiment, the startup program is equivalent to setting up a two-level program. The first-level program is used to determine the target address according to the state of the boot loader, and the second-level program is used to jump to the target address and start the program corresponding to the target address.

[0095] In some implementations, determining the target address based on a state of a boot loader includes:

[0096] When the state of the boot loader is normal, determining the target address to be the address of the boot loader;

[0097] When the status of the boot loader is abnormal, the target address is the address of the second backup program.

[0098] In the disclosed embodiment, if the status of the boot loader is normal, the target address is determined to be the address where the boot loader is stored in the first partition, so that the startup program can jump to start the boot loader according to the target address and upgrade the main control program in the first partition through the boot loader.

[0099] If the status of the boot loader is abnormal, the target address is determined to be the address of the second backup program stored in the second partition. Thus, the startup program can jump to start the second backup program in the second partition according to the target address, so as to update the boot loader through the second backup program to make the status of the boot loader normal. Subsequently, the main control program in the first partition can be further upgraded through the updated boot loader.

[0100] By adopting the above method, by setting the startup program and using the address of the boot loader or the second backup program as the address to which the startup program can jump, it is possible to realize the function of upgrading the main control program normally when the state of the boot loader is normal, and to realize the function of updating the boot loader through the second backup program and further upgrading the main control program based on the updated boot loader when the state of the boot loader is abnormal. On the one hand, the software upgrade method has a double guarantee of safety and ensures the stability of the software upgrade. On the other hand, since the first-level program of the startup program is only used to complete the target address acquisition function, it occupies less non-volatile memory storage space and will not damage the program data of the first partition.

[0101] In some implementations, the method of the embodiment of the present disclosure may further include the following steps:

[0102] receiving a non-volatile memory drive data packet, the non-volatile memory drive data packet being configured to be sent by a host computer that is in communication with the domain controller;

[0103] The main control program is upgraded based on the non-volatile memory drive data package.

[0104] In the disclosed embodiment, the domain controller may receive a non-volatile memory drive data packet sent by the host computer, and then the domain controller may upgrade the main control program based on the non-volatile memory drive data packet.

[0105] In some implementations, the domain controller may receive non-volatile memory driver and update program data packets sent by the host computer, and then the domain controller may upgrade the main control program based on the boot loader, non-volatile memory driver and update program data packets.

[0106] In some implementations, the domain controller further includes a volatile memory, and the non-volatile memory drives the data packet to be stored in the volatile memory.

[0107] In the disclosed embodiment, by storing the non-volatile memory driving data packet in the volatile memory, memory space can be saved.

[0108] In some implementations, after receiving the non-volatile memory driver sent by the host computer, the domain controller can load the non-volatile memory driver into the random access memory (RAM), and then call the non-volatile memory driver through the boot loader to write the master control program data packet to the first partition, thereby realizing the function of upgrading the master control program in the first partition.

[0109] In some implementations, after the main control program is upgraded, the received non-volatile memory driver is not permanently stored.

[0110] Considering that the non-volatile memory driver always exists in the memory of the lower computer, there is a risk of memory misoperation, causing unexpected failures. Therefore, the operation of the non-volatile memory is implemented by sending the non-volatile memory driver from the upper computer when the master control program is upgraded. This can improve the security of the domain controller. In addition, since the non-volatile memory driver is sent by the upper computer only when the master control program is upgraded and will not be permanently stored in the non-volatile memory, storage space can also be saved.

[0111] In some implementations, the non-volatile memory driver is determined by the host computer according to the size of the main control program data packet, and the main control program data packet is parsed by the host computer by selecting a corresponding parsing algorithm according to the attributes of the main control program data packet.

[0112] In the disclosed embodiment, considering that the formats of burning files generated by chips of different brands or compiled by different compilers may be different, a plurality of file parsing algorithms are preset on the host computer side. After importing the main control program data packet to be upgraded, the host computer can automatically select the corresponding parsing algorithm for parsing according to the attributes of the main control program data packet, thereby improving the versatility of the software upgrade method.

[0113] In addition, in the embodiments of the present disclosure, the host computer can automatically adapt the type of non-volatile memory driver according to the size of the main control program data packet. For example, it can automatically adapt the drivers corresponding to the sector erase mode, page erase mode or block erase mode to select the best driver type. This can improve the accuracy of memory operations, increase the speed, and shorten the upgrade time.

[0114] In addition, in some implementations, the host computer can disassemble the data packet according to the size of the master control program data packet. For particularly large data packets, they can be split into multiple packets of data and sent to the domain controller in batches to prevent the domain controller from being unresponsive for a long time when writing data, causing the upgrade process to be terminated.

[0115] In addition, in some implementations, the host computer may determine the integrity of the data in the master control program data package itself, and initiate an upgrade instruction of the master control program to the domain controller when the data in the master control program data package is complete.

[0116] In addition, in some implementations, the host computer can perform address determination on the master control program data packet, and provide feedback prompts for the address space involving special functions of the chip, thereby reducing the probability of erroneous operation.

[0117] In some implementations, obtaining the state of the boot loader stored in the non-volatile memory may include the following steps:

[0118] In response to receiving an upgrade instruction of a master control program sent by a host computer that is communicatively connected to the domain controller, acquiring a state of a boot loader program stored in a non-volatile memory; or

[0119] It is determined that the upgrade of the main control program in the first partition fails, and the state of the boot loader program stored in the non-volatile memory is obtained.

[0120] In the embodiment of the present disclosure, there are two opportunities to obtain the status of the boot loader program stored in the first partition.

[0121] The first opportunity is when receiving an upgrade instruction sent by a host computer that is connected to the domain controller. At this time, the upgrade of the main control program is about to begin. Therefore, in order to ensure the subsequent successful upgrade of the main control program, the status of the boot loader can be obtained first.

[0122] The second opportunity is when it is determined that the upgrade of the master control program in the first partition has failed. At this time, the upgrade has been executed when the status of the boot loader is normal, but considering that the upgrade failure may cause the boot loader data to be damaged, therefore, when it is determined that the upgrade of the master control program in the first partition has failed, the status of the boot loader can be obtained again to ensure the success of the subsequent master control program upgrade process.

[0123] In some implementations, the method of the disclosed embodiment further includes the following steps:

[0124] In response to receiving a forced upgrade instruction sent by a host computer in communication with the domain controller and determining that the boot loader is in a forced upgrade mode, upgrading the main control program;

[0125] Among them, the forced upgrade instruction is sent by the upper computer when the first number of upgrade instructions are sent and the main control program fails to be upgraded. When the number of times the main control program saved in the first partition executes automatic reset is greater than the second number, the boot loader is in forced upgrade mode.

[0126] In the disclosed embodiment, when the upper computer determines that the upgrade of the master control program has failed, it can send an upgrade instruction to the domain controller again. If the master control program still fails to upgrade after the upper computer sends the first number of upgrade instructions, the upper computer can send a forced upgrade instruction to the domain controller.

[0127] In the disclosed embodiment, considering that when the master control program cannot run normally, the master control program in the domain controller may fall into an infinite loop, and the automatic reset mechanism in the master control program causes the master control program in the domain controller to be reset all the time, making it impossible for the domain controller to communicate normally with the host computer, and thus unable to upgrade the master control program. In this case, the boot loader can enter the forced upgrade mode.

[0128] In the disclosed embodiment, the domain controller can respond to receiving a forced upgrade instruction sent by a host computer that is in communication with the domain controller and determining that the boot loader is in a forced upgrade mode, keep running the boot loader, and upgrade the main control program in the first partition through the boot loader. In this way, the program of the domain controller can stay in the boot loader and wait for the upgrade command of the host computer, so as to realize the function of upgrading the main control program in the first partition through the boot loader.

[0129] In addition, in the embodiment of the present disclosure, the forced upgrade process is only started when both the host computer and the domain controller enter the forced upgrade mode. That is, by setting a response to receiving a forced upgrade instruction sent by the host computer that is connected to the domain controller for communication and determining that the boot loader is in the forced upgrade mode, the main control program is upgraded to prevent erroneous operations.

[0130] In some implementations, when the state of the boot loader is normal, upgrading the main control program through the boot loader may include the following steps:

[0131] When the state of the boot loader is normal, in response to receiving a forced upgrade instruction sent by a host computer that is in communication with the domain controller and determining that the boot loader is in a forced upgrade mode, the main control program is upgraded.

[0132] Combine the following Figure 2 as well as Figure 3 , the software upgrade method of the present disclosure is described with a complete embodiment:

[0133] Figure 2 This is a schematic diagram of a domain controller memory partition shown in the present disclosure, such as Figure 2 As shown, the domain controller includes a random access memory and a non-volatile memory, and the random access memory can be used to load the non-volatile memory driver and load the reserved area of ​​other programs. The non-volatile memory can include a startup program area, a boot loader area, a first partition, a second partition, and a reserved area for storing other programs.

[0134] Figure 3 is a flowchart of a software upgrade method shown in the present disclosure, such as Figure 3As shown, the software upgrade method includes the following steps:

[0135] S301, the domain controller runs the main control program or jumps to the first backup program through the startup program to ensure that the vehicle can be started and upgraded.

[0136] S302, the host computer loads and parses the main control program data packet to determine the non-volatile memory driver.

[0137] S303, the host computer determines whether the main control program in the domain controller is normal. If yes, execute step S305, if not, execute step S304.

[0138] S304, the host computer sends a forced upgrade instruction to the domain controller, and jumps to step S305.

[0139] S305, the domain controller determines whether the state of the boot loader is normal. If it is normal, step S307 is executed, and if it is abnormal, step S306 is executed.

[0140] S306, the domain controller jumps to the second partition through the startup program, and updates the boot loader program through the second backup program of the second partition. At this time, after the boot loader program is updated, the state of the boot loader program is normal, and the process jumps to step S307.

[0141] S307, the domain controller jumps to the boot loader through the startup program.

[0142] S308, the host computer sends the master control program data packet and the non-volatile memory driver to the domain controller.

[0143] S309, the domain controller upgrades the master control program and determines whether the upgrade is normal. If normal, execute step S310, if abnormal, return to execute step S305.

[0144] S310, the domain controller updates the second partition and ends the upgrade process.

[0145] The detailed description of the above steps S301-S310 can refer to the above embodiments and will not be repeated here.

[0146] Figure 4 4 is a block diagram of a vehicle 400 according to an exemplary embodiment. For example, the vehicle 400 may be a hybrid vehicle, a non-hybrid vehicle, an electric vehicle, a fuel cell vehicle, or other types of vehicles. The vehicle 400 may be an autonomous vehicle, a semi-autonomous vehicle, or a non-autonomous vehicle.

[0147] Reference Figure 4, the vehicle 400 may include various subsystems, such as an infotainment system 410, a perception system 420, a decision control system 430, a drive system 440, and an onboard computing platform 450. The vehicle 400 may also include more or fewer subsystems, and each subsystem may include multiple components. In addition, each subsystem and each component of the vehicle 400 may be interconnected by wire or wireless means.

[0148] In some embodiments, the infotainment system 410 may include a communication system, an entertainment system, and a navigation system, among others.

[0149] The perception system 420 may include several sensors for sensing information about the environment around the vehicle 400. For example, the perception system 420 may include a global positioning system (the global positioning system may be a GPS system, or a Beidou system or other positioning systems), an inertial measurement unit (IMU), a laser radar, a millimeter wave radar, an ultrasonic radar, and a camera.

[0150] The decision control system 430 may include a computing system, a domain controller, a vehicle controller, a steering system, a throttle and a braking system, wherein the domain controller is used to execute all or part of the steps of the above-mentioned software upgrade method.

[0151] The drive system 440 may include components that provide power movement for the vehicle 400. In one embodiment, the drive system 440 may include an engine, an energy source, a transmission system, and wheels. The engine may be one or a combination of an internal combustion engine, an electric motor, and an air compression engine. The engine is capable of converting energy provided by the energy source into mechanical energy.

[0152] Some or all functions of the vehicle 400 are controlled by an onboard computing platform 450. The onboard computing platform 450 may include at least one processor 451 and a memory 452, and the processor 451 may execute instructions 453 stored in the memory 452.

[0153] The processor 451 may be any conventional processor, such as a commercially available CPU. The processor may also include a graphics processor (Graphic Process Unit, GPU), a field programmable gate array (Field Programmable Gate Array, FPGA), a system on chip (System on Chip, SOC), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC) or a combination thereof.

[0154] Memory 452 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0155] In addition to the instructions 453 , the memory 452 may also store data, such as road maps, route information, and data such as the vehicle's location, direction, and speed. The data stored in the memory 452 may be used by the vehicle-mounted computing platform 450 .

[0156] In another exemplary embodiment, a non-transitory computer-readable storage medium including a computer program is further provided. When the computer program is executed by a processor, the steps of the above-mentioned software upgrade method are implemented.

[0157] In this embodiment, the non-temporary computer-readable storage medium including the computer program may be the non-volatile memory including the first partition and the second partition in the above embodiment, or may be other non-temporary computer-readable storage media different from the above embodiment.

[0158] In another exemplary embodiment, a domain controller is provided, comprising:

[0159] A non-volatile memory, wherein the non-volatile memory includes a first partition and a second partition;

[0160] The processor is used to execute the computer program to implement the steps of the above software upgrade method.

[0161] In this embodiment, the computer program executed by the processor in the domain controller may be stored in the non-volatile memory including the first partition and the second partition, or may be stored in another non-temporary computer-readable storage medium.

[0162] In another exemplary embodiment, a vehicle is provided, comprising the above-mentioned domain controller.

[0163] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0164] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0165] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A software upgrade method, characterized in that: Applied to a domain controller, the domain controller includes a non-volatile memory, the method includes: Determine that a master control program of the domain controller is upgraded, wherein the master control program is stored in a first partition; Updating a first backup program of the domain controller so that the first backup program corresponds to the upgraded master control program, wherein the first backup program is stored in the second partition; The first partition and the second partition are different data storage areas of the non-volatile memory.

2. The method according to claim 1, characterized in that The first backup program includes all or part of the functional modules in the upgraded main control program.

3. The method according to claim 1, characterized in that The method further comprises: When a preset abnormal event occurs when the main control program is running, the domain controller is controlled according to the first backup program.

4. The method according to claim 1, characterized in that: The method further comprises: When the state of the boot loader is normal, upgrading the main control program through the boot loader; The boot loader is stored in the first partition.

5. The method according to claim 4, characterized in that The method comprises: When the state of the boot loader is abnormal, updating the boot loader through the second backup program to make the state of the boot loader normal; The second backup program is stored in the second partition.

6. The method according to claim 5, characterized in that The updating of the boot loader program by using the second backup program includes: Acquiring first update data from a host computer that is in communication with the domain controller through the second backup program; The boot loader is updated based on the first update data.

7. The method according to claim 5, characterized in that Before the main control program is upgraded by the boot loader, the method further includes: Execute a startup program, wherein the startup program is stored in the first partition; wherein the startup program is used to determine a target address according to a state of the boot loader and jump to the target address.

8. The method according to claim 7, characterized in that The determining the target address according to the state of the boot loader comprises: When the state of the boot loader is normal, determining the target address to be the address of the boot loader; When the state of the boot loader is abnormal, the target address is the address of the second backup program.

9. The method according to claim 1, characterized in that: The method further comprises: receiving a non-volatile memory drive data packet, wherein the non-volatile memory drive data packet is configured to be sent by a host computer that is communicatively connected to the domain controller; The main control program is upgraded based on the non-volatile memory driving data packet.

10. The method according to claim 9, characterized in that The domain controller further comprises a volatile memory, and the non-volatile memory driving data packet is used to be stored in the volatile memory.

11. The method according to claim 4, characterized in that The method further comprises: In response to receiving a forced upgrade instruction sent by a host computer that is in communication with the domain controller and determining that the boot loader is in a forced upgrade mode, upgrading the main control program; Among them, the forced upgrade instruction is sent by the host computer when a first number of upgrade instructions are sent and the main control program fails to be upgraded. When the number of times the main control program saved in the first partition executes automatic reset is greater than a second number, the boot loader is in the forced upgrade mode.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the software upgrade method described in any one of claims 1 to 11 are implemented.

13. A domain controller, characterized in that: include: A non-volatile memory, wherein the non-volatile memory includes a first partition and a second partition; A processor, configured to execute a computer program to implement the steps of the software upgrade method according to any one of claims 1 to 11.

14. A vehicle, characterized in that: Includes the domain controller as described in claim 13.

Images