OTA upgrading high-voltage maintaining method, system and product

Abstract

The embodiment of the invention provides a high-voltage maintaining method and system for OTA upgrading and a product, the method is applied to a takeover controller, a high-voltage redundancy control program is deployed in the takeover controller, and the method comprises the following steps: responding to an upgrading mark signal of OTA upgrading of a target domain controller, and under the condition that the target domain controller can receive a high-voltage switch signal, starting a high-voltage redundancy control program; sending a high-pressure takeover ready signal to a target domain controller within a first duration; when it is determined that the target domain controller does not conduct high-voltage control, high-voltage control is conducted on the vehicle according to the received high-voltage switch signal; when it is determined that the target domain controller stops sending the high-voltage control instruction within the second duration, the high-voltage control instruction is sent within the third duration so as to take over high-voltage control over the vehicle; and under the condition that the high-voltage control over the vehicle is taken over, continuously sending a high-voltage take-over state signal to the target domain controller so as to control the target domain controller to carry out OTA upgrading. The method aims at maintaining high voltage of a vehicle when OTA upgrading is carried out on a domain controller.

Description

Technical Field

[0001] The present application relates to the technical field of OTA upgrade of vehicle-mounted domain controllers, and specifically to a high-voltage maintenance method, system and product for OTA upgrade. Background Art

[0002] At present, when the domain controller containing high-voltage control is not partitioned, the domain controller will lose high-voltage control of the entire vehicle during the OTA upgrade of the domain controller. That is, when upgrading the domain controller containing high-voltage control logic, the entire vehicle will reduce high voltage during the OTA upgrade and upgrade at low voltage, which will result in limited use of the vehicle's high-voltage function in a static state. Summary of the invention

[0003] In view of this, the embodiments of the present application provide a method, system and product for maintaining high voltage during OTA upgrade, which is intended to maintain vehicle high voltage when performing OTA upgrade on a domain controller including high voltage control logic for controlling vehicle high voltage.

[0004] A first aspect of an embodiment of the present application provides a high voltage maintenance method for OTA upgrade, the method comprising:

[0005] Applied to a takeover controller, in which a high voltage redundant control program is deployed, the method comprises:

[0006] In response to an upgrade flag signal of the target domain controller for OTA upgrade, when the target domain controller can receive a high-voltage switch signal, a high-voltage takeover ready signal is sent to the target domain controller within a first time period to control the target domain controller to stop sending high-voltage control instructions, where the target domain controller is a domain controller for high-voltage control;

[0007] When it is determined through monitoring that the target domain controller does not perform high voltage control, performing high voltage control on the vehicle according to the received high voltage switch signal;

[0008] In the case where it is determined through monitoring that the target domain controller stops issuing the high-voltage control instruction within the second time period, the high-voltage control instruction is sent within a third time period to take over the high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the suspension of issuing the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller;

[0009] When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

[0010] Optionally, the method further includes:

[0011] When the target domain controller does not receive the high-voltage takeover ready signal and the takeover refusal signal sent by the takeover controller within the first time period, the target domain controller performs an OTA upgrade after powering off the high voltage of the entire vehicle.

[0012] Optionally, the method further includes:

[0013] When the target domain controller does not receive the high-voltage takeover status signal sent by the takeover controller within the third time period, the target domain controller performs an OTA upgrade after powering off the high voltage of the entire vehicle.

[0014] Optionally, the method further includes:

[0015] When monitoring determines that the target domain controller has not stopped issuing high-voltage control instructions within the second time period, a high-voltage takeover failure signal is sent to the target domain controller to control the target domain controller to perform an OTA upgrade after the high voltage of the entire vehicle is powered off if an OTA upgrade is still required.

[0016] Optionally, the method further includes:

[0017] In response to an upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within a fourth time period, sending an exit takeover signal to the target domain controller to control the target domain controller to start taking over high-voltage control of the vehicle;

[0018] In response to a takeover signal sent by the target domain controller based on the exit takeover signal, the high-voltage control instruction is stopped to control the target domain controller to send the high-voltage control instruction within a third time period.

[0019] Optionally, controlling the target domain controller to send a high-voltage control instruction within a third time period includes:

[0020] Controlling the target domain controller to run the software to a high-pressure state in advance;

[0021] Based on the high-voltage state in which the software runs, the target domain controller is controlled to send a high-voltage control instruction within a third time period.

[0022] Optionally, the method further includes:

[0023] In response to a takeover refusal signal sent by the target domain controller based on the takeover exit signal, the entire vehicle is controlled to power off at high voltage.

[0024] Optionally, the method further includes:

[0025] In response to not receiving the upgrade completion flag signal within the fourth time period, controlling the entire vehicle to power off the high voltage;

[0026] In response to an upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period, controlling the entire vehicle to power off at high voltage;

[0027] When monitoring determines that a fault occurs during the upgrade process of the target domain controller, the entire vehicle is controlled to power off at high voltage.

[0028] Optionally, the method further includes:

[0029] In response to an upgrade flag signal of an OTA upgrade performed by a target domain controller, determining a vehicle state when the vehicle itself cannot receive a high-voltage switch signal;

[0030] When the vehicle is in a high-voltage state, sending a high-voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high-voltage control instructions;

[0031] In the case where it is detected that the target domain controller stops sending the high-voltage control instruction within the second time period, the high-voltage control instruction is sent within a third time period to take over the high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the stop of sending the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller;

[0032] When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

[0033] Optionally, the method further includes:

[0034] When the vehicle is not in a high-voltage state, a refusal to take over signal is sent to the target domain controller within a first time period to control the target domain controller to perform OTA upgrade.

[0035] Optionally, the takeover controller includes one of other on-board domain controllers, a controller having a communication link with the high-voltage component controller and the target domain controller, and a high-voltage component controller over which the target domain controller performs high-voltage control.

[0036] Optionally, in a case where the takeover controller is a high-voltage component controller on which the target domain controller performs high-voltage control, the takeover controller performs high-voltage control through internal signal interaction when performing high-voltage control on itself.

[0037] A second aspect of an embodiment of the present application provides a high-voltage maintenance system for OTA upgrade, the system comprising:

[0038] A takeover signal sending module, configured to respond to an upgrade flag signal of an OTA upgrade of a target domain controller, and to send a high-voltage takeover ready signal to the target domain controller within a first time period when the target domain controller can receive a high-voltage switch signal, so as to control the target domain controller to stop sending high-voltage control instructions, wherein the target domain controller is a domain controller that performs high-voltage control;

[0039] A monitoring module, configured to perform high voltage control on the vehicle according to a received high voltage switch signal when it is determined through monitoring that the target domain controller does not perform high voltage control;

[0040] The high-voltage control module is configured to send a high-voltage control instruction within a third time period to take over the high-voltage control of the vehicle when it is determined through monitoring that the target domain controller stops sending the high-voltage control instruction within a second time period, and the sum of the third time period and the time period corresponding to the stop of sending the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller;

[0041] The status signal sending module is used to continuously send a high-voltage takeover status signal to the target domain controller when taking over the high-voltage control of the vehicle, so as to control the target domain controller to perform OTA upgrade.

[0042] A third aspect of an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and running on the processor, wherein when the computer program is executed by the processor, the steps in a high-voltage maintenance method for OTA upgrade as described in the first aspect of the present application are implemented.

[0043] The fourth aspect of an embodiment of the present application provides a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps in the high-voltage maintenance method for OTA upgrade as described in the first aspect of the present application are implemented.

[0044] The high voltage maintenance method for OTA upgrade provided in this application has the following advantages:

[0045] The embodiment of the present application provides a high-voltage maintenance method for OTA upgrade, which is applied to a takeover controller, in which a high-voltage redundant control program is deployed. The high-voltage redundant control program is used to take over the high-voltage control of the vehicle through the high-voltage redundant control program in the process of determining that the target domain controller is performing an OTA upgrade. First, in response to the upgrade flag signal of the target domain controller performing an OTA upgrade, when the target domain controller can receive a high-voltage switch signal, a high-voltage takeover ready signal is sent to the target domain controller within a first time period to control the target domain controller to stop issuing high-voltage control instructions, and the target domain controller is a domain controller for high-voltage control; when it is determined by monitoring that the target domain controller does not perform high-voltage control, the vehicle is controlled at high voltage according to the received high-voltage switch signal; when it is determined by monitoring that the target domain controller stops issuing high-voltage control instructions within a second time period, a high-voltage control instruction is sent within a third time period to take over the high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the stop of issuing the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller; when taking over the high-voltage control of the vehicle, a high-voltage takeover state signal is continuously sent to the target domain controller to control the target domain controller to perform an OTA upgrade. Therefore, the present application introduces a takeover controller configured with a high-voltage redundant control program. During the OTA upgrade of the target domain controller originally used to perform high-voltage control of the vehicle, the takeover controller actively takes over the high-voltage control of the vehicle, so that even if the target domain controller does not have a partition, it can maintain the high voltage of the vehicle when the vehicle is in a high-voltage power-on state during its own OTA upgrade, thereby ensuring that the use of related functions of the vehicle in a static state is not restricted, such as air conditioning cooling and heating, seat heating and other functions. That is, during the OTA upgrade process, the vehicle can be used without being affected by the OTA upgrade for functions that require high voltage. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor.

[0047] Figure 1 A flowchart of a high voltage maintenance method for OTA upgrade shown in one embodiment of the present application;

[0048] Figure 2 A schematic diagram of a domain controller ring network structure in a high voltage maintenance method for OTA upgrade according to an embodiment of the present application;

[0049] Figure 3Another flow chart of a high voltage maintenance method for OTA upgrade shown in one embodiment of the present application;

[0050] Figure 4 A flowchart of high voltage power-off in a high voltage maintenance method for OTA upgrade shown in one embodiment of the present application;

[0051] Figure 5 A schematic diagram of a high-voltage maintenance system for OTA upgrades according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] refer to Figure 1 , Figure 1 The following is a flow chart of a high voltage maintenance method for OTA upgrade according to an embodiment of the present application. Figure 1 As shown, the present application provides a high-voltage maintenance method for OTA upgrade, which is applied to a takeover controller in which a high-voltage redundant control program is deployed. The method includes:

[0054] Step S1: In response to the upgrade flag signal of the target domain controller for OTA upgrade, when it can receive the high-voltage switch signal, it sends a high-voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop issuing high-voltage control instructions. The target domain controller is a domain controller that performs high-voltage control; the takeover controller includes one of other on-board domain controllers, a controller that has a communication link with the high-voltage component controller and the target domain controller, and a high-voltage component controller over which the target domain controller performs high-voltage control.

[0055] In this embodiment, the target domain controller refers to a domain controller in the vehicle used to perform high-voltage control on the vehicle. At the same time, the target domain controller does not have partitions. In the existing control logic, when the target domain controller is OTA upgraded, the entire vehicle will be under high voltage and upgraded under low voltage, which will limit the use of the vehicle's high-voltage function in a static state. The present application configures a takeover controller for the vehicle, and deploys a high-voltage redundant control program in the takeover controller, which is used to take over the high-voltage control of the vehicle through the takeover control program when the target domain controller is OTA upgraded. Among them, in order to reduce the implementation cost, the takeover controller can be a controller that the vehicle itself already has, and the controller can be other domain controllers on the vehicle except the target domain controller; it can also be a controller that has a communication link with both the high-voltage component controller and the target domain controller. The high-voltage component controller refers to a related execution controller that is subject to the high-voltage control of the target domain controller; it can also be a high-voltage component controller that is subject to the high-voltage control of the target domain controller. The high-voltage component controller needs to have a communication link with other high-voltage component controllers and the target domain controller. Figure 2 As shown, when the takeover controller is another domain controller, the control architecture is a ring network architecture, and the high-voltage component controllers include but are not limited to a battery controller, a motor controller, and a thermal management controller.

[0056] In this embodiment, the new energy vehicle has a high-voltage state and a low-voltage state. The high-voltage state means that the high-voltage components of the vehicle start to work, the relevant high-voltage relays are closed, the high-voltage circuit is connected, and the relevant high-voltage components can use the power in the high-voltage battery, such as air conditioners, DCDC and other high-voltage electrical appliances. The high-voltage control is generally unified by the vehicle controller, and then each high-voltage controller executes the relevant vehicle controller instructions. The low-voltage state means that the relevant low-voltage relays are closed, and some controllers are running normally. However, since the high-voltage relays are not closed, the power in the high-voltage battery cannot be used at this time. The relevant controllers rely on the power in the low-voltage battery of the vehicle to support operation. The low-voltage battery has a small capacity and a short support time. Generally, after the vehicle is high-voltage, DCDC charges the low-voltage battery. The high-voltage state of the vehicle can only be achieved under the premise of the low-voltage state of the vehicle. The high-voltage voltage range of new energy vehicles is roughly between 200V and 750V, but this range will vary for different models. For example, the voltage of ordinary electric vehicles is mostly 336V or 384V, while the voltage of electric buses is usually between 580V and 600V. In addition, the high voltage of some models may approach or exceed the upper limit of this range.

[0057] In this embodiment, if Figure 3As shown, the target domain controller will monitor in real time whether it needs to perform an OTA upgrade. When it is determined that it needs to perform an OTA upgrade, it will send an upgrade flag signal to the takeover controller to notify the takeover controller that it will perform an OTA upgrade.

[0058] In this embodiment, when the takeover controller is a controller that can receive the high-voltage switch signal, in response to the upgrade mark signal received by itself, a high-voltage takeover ready signal is sent to the target domain controller within the first time period to inform the target domain controller that it is ready for high-voltage takeover. The first time period can be set according to the actual application scenario, and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting the first time period is that the target domain controller will not always wait for the takeover controller to give feedback to the target domain controller. If the takeover controller does not receive feedback from the takeover controller within the first time period after the target domain controller sends the upgrade mark signal, the target domain controller will execute the subsequent control logic. Among them, some optional implementations in which the takeover controller can receive the emitted high-voltage switch signal are: the takeover controller belongs to a redundant domain controller on the vehicle, and the redundant domain controller originally has a communication link for transmitting the high-voltage switch signal to the redundant domain controller; the takeover controller belongs to a high-voltage component controller on the vehicle that is originally controlled by the target domain controller, and the high-voltage switch signal is transmitted to the takeover controller by additionally setting up a communication link. The communication link can be a line from a control button on the vehicle that emits a high-voltage switch signal to the takeover controller. When the takeover controller supports Bluetooth communication, the communication link can be a link from a car key to the takeover controller via Bluetooth communication.

[0059] Step S2: When it is determined through monitoring that the target domain controller is not performing high voltage control, high voltage control is performed on the vehicle according to the received high voltage switch signal.

[0060] In this embodiment, when the takeover controller detects and determines that the current vehicle is in a low-voltage state, it indicates that the target domain controller is not currently performing high-voltage control. At this time, the takeover controller directly takes over the high-voltage control of the vehicle, and receives the high-voltage switch signal of the vehicle, and directly starts high-voltage control after receiving it.

[0061] Step S3: When monitoring determines that the target domain controller stops issuing high-voltage control instructions within the second time period, a high-voltage control instruction is sent within a third time period to take over high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the suspension of issuing high-voltage control instructions is less than the agreed time period between the target domain controller and the high-voltage component controller.

[0062] In this embodiment, when the takeover controller detects and determines that the current vehicle is in a high-voltage state, it indicates that the target domain controller is currently performing high-voltage control, and the takeover controller will take over the high-voltage controller of the vehicle from the target domain controller through the takeover logic. Specifically, when the target domain controller receives the high-voltage takeover ready signal sent by the takeover controller within the first time period, it is determined that the takeover controller will perform high-voltage takeover. At this time, the target domain controller will stop sending high-voltage control instructions within the second time period. The second time period can be set according to the actual application scenario, and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting the second time period is that the takeover controller will not always wait for the target domain controller to stop sending high-voltage control instructions. If the target domain controller does not stop sending high-voltage control instructions within the second time period after the takeover controller sends the high-voltage takeover ready signal, the takeover controller will execute the subsequent control logic.

[0063] In this embodiment, when the takeover controller monitors and determines that the target domain controller has stopped issuing high-voltage control instructions within the second time length, the takeover controller immediately sends high-voltage control instructions within the third time length to take over the high-voltage control of the vehicle. The takeover controller determines whether the target domain controller has stopped issuing high-voltage control instructions by the following determination rule: monitor and determine whether the target domain controller has not issued high-voltage control instructions within the set time length, and if the target domain controller has not issued high-voltage control instructions within the set time length, it is determined that the target domain controller has stopped issuing high-voltage control instructions. The set time length is less than the agreed time length between the target domain controller and the high-voltage component controller. The agreed time length refers to when the high-voltage component controller does not receive the high-voltage control instruction from the target domain controller within the agreed time length, the high-voltage component controller will maintain the state corresponding to the high-voltage control instruction received last time, and when the high-voltage control instruction from the target domain controller is not received beyond the agreed time length, the high-voltage component controller will believe that the vehicle has a certain fault, and the high-voltage component controller will execute its own fault response strategy. In this case, the target domain controller does not meet the OTA upgrade conditions and cannot perform OTA upgrade. The purpose of limiting the set duration to be less than the agreed duration between the target domain controller and the high-voltage component controller is to prevent the target domain controller from stopping issuing high-voltage control instructions for a long time before the takeover controller issues the high-voltage control instruction, causing the high-voltage component controller to think that the vehicle has a fault and execute its own fault response strategy, which further leads to failure to meet the OTA upgrade conditions and inability to perform OTA upgrade. For the same reason, the present application limits the sum of the third duration and the set duration to be less than the agreed duration, because the target domain controller has stopped issuing high-voltage control instructions for a certain period of time. If the takeover controller cannot complete the sending of high-voltage control instructions within the third duration, then the final duration of stopping issuing high-voltage control instructions will exceed the agreed duration, which will cause the high-voltage component controller to think that the vehicle has a fault and execute its own fault response strategy, which further leads to failure to meet the OTA upgrade conditions and inability to perform OTA upgrade.

[0064] Step S4: When taking over the high-voltage control of the vehicle, continuously sending a high-voltage takeover status signal to the target domain controller to control the target domain controller to perform OTA upgrade.

[0065] In this embodiment, when the takeover controller issues a high-voltage control instruction, the takeover controller also takes over the high-voltage control of the vehicle. In order to let the target domain controller know that the takeover controller has taken over the high-voltage control so that the target domain controller can safely perform OTA upgrades, when the takeover controller issues the first high-voltage control instruction to the high-voltage component controller, it will simultaneously send the first high-voltage takeover status signal to the target domain controller, informing the target domain controller that the takeover controller has taken over the high-voltage control of the vehicle. At this time, the target domain controller performs OTA upgrades based on the received first high-voltage takeover status signal. At the same time, in order to avoid the target domain controller starting high-voltage control of the vehicle immediately after completing the OTA upgrade like the existing control logic, the present application will continue to send high-voltage takeover status signals to the target domain controller to inform the target domain controller that the takeover controller is currently performing high-voltage control of the vehicle. In this way, after the OTA upgrade is completed, the target domain controller will know that the takeover controller is taking over the high-voltage control of the vehicle at this time. The target domain controller will not immediately start high-voltage control of the vehicle, but will first obtain the high-voltage control authority for the vehicle from the takeover controller before performing high-voltage control.

[0066] The embodiment of the present application provides a high-voltage maintenance method for OTA upgrade, which is applied to a takeover controller, in which a high-voltage redundant control program is deployed. The high-voltage redundant control program is used to take over the high-voltage control of the vehicle through the high-voltage redundant control program in the process of determining that the target domain controller is performing an OTA upgrade. First, in response to the upgrade flag signal of the target domain controller performing an OTA upgrade, when the target domain controller can receive a high-voltage switch signal, a high-voltage takeover ready signal is sent to the target domain controller within a first time period to control the target domain controller to stop issuing high-voltage control instructions, and the target domain controller is a domain controller for high-voltage control; when it is determined by monitoring that the target domain controller does not perform high-voltage control, the vehicle is controlled at high voltage according to the received high-voltage switch signal; when it is determined by monitoring that the target domain controller stops issuing high-voltage control instructions within a second time period, a high-voltage control instruction is sent within a third time period to take over the high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the stop of issuing the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller; when taking over the high-voltage control of the vehicle, a high-voltage takeover state signal is continuously sent to the target domain controller to control the target domain controller to perform an OTA upgrade. Therefore, the present application introduces a takeover controller configured with a high-voltage redundant control program. During the OTA upgrade of the target domain controller originally used to perform high-voltage control of the vehicle, the takeover controller actively takes over the high-voltage control of the vehicle, so that even if the target domain controller does not have a partition, it can maintain the high voltage of the vehicle when the vehicle is in a high-voltage power-on state during its own OTA upgrade, thereby ensuring that the use of related functions of the vehicle in a static state is not restricted, such as air conditioning cooling and heating, seat heating and other functions. That is, during the OTA upgrade process, the vehicle can be used without being affected by the OTA upgrade for functions that require high voltage.

[0067] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high-voltage maintenance method for OTA upgrade. In the high-voltage maintenance method for OTA upgrade, the method also includes: in response to the upgrade flag signal of the target domain controller for OTA upgrade, when it cannot receive the high-voltage switch signal, determine the vehicle state; when the vehicle is in a high-voltage state, send a high-voltage takeover ready signal to the target domain controller within a first time length to control the target domain controller to stop issuing high-voltage control instructions; when it is detected that the target domain controller stops issuing high-voltage control instructions within a second time length, send a high-voltage control instruction within a third time length to take over the high-voltage control of the vehicle, and the sum of the third time length and the time length corresponding to the stop of the high-voltage control instruction is less than the agreed time length between the target domain controller and the high-voltage component controller; when taking over the high-voltage control of the vehicle, continue to send a high-voltage takeover status signal to the target domain controller to control the target domain controller to perform an OTA upgrade.

[0068] In another embodiment of the present application, the target domain controller will monitor in real time whether it needs to perform an OTA upgrade. When it is determined that it needs to perform an OTA upgrade, it will send an upgrade flag signal to the takeover controller to notify the takeover controller that it will perform an OTA upgrade. In the case where the takeover controller cannot receive the high-voltage switch signal sent by the controller, the takeover controller will only take over the high-voltage control of the vehicle when the vehicle is in a high-voltage state. Specifically, in response to the upgrade flag signal received by itself, when it cannot receive the high-voltage switch signal, it is determined whether the vehicle is currently in a high-voltage state. In the case of determining that the vehicle is in a high-voltage state, a high-voltage takeover ready signal is sent to the target domain controller within the first time length to inform the target domain controller that it is ready for high-voltage takeover. The first time length can be set according to the actual application scenario, and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting the first time length is that the target domain controller will not always wait for the takeover controller to give feedback to the target domain controller. If the takeover controller does not receive feedback from the takeover controller within the first time length after the target domain controller sends the upgrade flag signal, the target domain controller will execute the subsequent control logic.

[0069] In this embodiment, when the target domain controller receives the high-voltage takeover ready signal sent by the takeover controller within the first time length, it is determined that the takeover controller will perform high-voltage takeover. At this time, the target domain controller will stop sending high-voltage control instructions within the second time length. The second time length can be set according to the actual application scenario, and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting the second time length is that the takeover controller will not always wait for the target domain controller to stop sending high-voltage control instructions. If the target domain controller does not stop sending high-voltage control instructions within the second time length after the takeover controller sends the high-voltage takeover ready signal, the takeover controller will execute the subsequent control logic. When the takeover controller monitors and determines that the target domain controller stops sending high-voltage control instructions within the second time length, the takeover controller immediately sends high-voltage control instructions within the third time length to take over the high-voltage control of the vehicle. The determination rule for the takeover controller to determine whether the target domain controller has stopped sending high-voltage control instructions is: monitor and determine whether the target domain controller has not issued high-voltage control instructions within the set time length. If the target domain controller has not issued high-voltage control instructions within the set time length, it is determined that the target domain controller has stopped sending high-voltage control instructions. The set duration is less than the agreed duration between the target domain controller and the high-voltage component controller. The agreed duration means that when the high-voltage component controller does not receive the high-voltage control instruction from the target domain controller within the agreed duration, the high-voltage component controller will maintain the state corresponding to the last received high-voltage control instruction. When the high-voltage control instruction from the target domain controller is not received for more than the agreed duration, the high-voltage component controller will believe that the vehicle has a certain fault. At this time, the high-voltage component controller will execute its own fault response strategy. In this case, the target domain controller does not meet the OTA upgrade conditions and cannot perform an OTA upgrade. The purpose of limiting the set duration to be less than the agreed duration between the target domain controller and the high-voltage component controller is to prevent the target domain controller from stopping issuing high-voltage control instructions for a long time before the takeover controller issues the high-voltage control instruction, causing the high-voltage component controller to believe that the vehicle has a fault and execute its own fault response strategy, which further causes the OTA upgrade conditions to not be met and the OTA upgrade cannot be performed. For the same reason, the present application limits the sum of the third duration and the set duration to be less than the agreed duration, because the target domain controller has stopped sending high-voltage control instructions for a certain period of time. If the takeover controller cannot complete the sending of high-voltage control instructions within the third period of time, then the final duration of stopping sending high-voltage control instructions will exceed the agreed duration, which will cause the high-voltage component controller to think that the vehicle has a fault and execute its own fault response strategy, which will further lead to the failure to meet the OTA upgrade conditions and the inability to perform OTA upgrades. When the takeover controller issues a high-voltage control instruction, the takeover controller also takes over the high-voltage control of the vehicle, and in order to let the target domain controller know that the takeover controller has taken over the high-voltage control, so that the target domain controller can safely perform OTA upgrades.When the takeover controller sends the first high-voltage control instruction to the high-voltage component controller, it will also send the first high-voltage takeover status signal to the target domain controller, informing the target domain controller that the takeover controller has taken over the high-voltage control of the vehicle. At this time, the target domain controller performs an OTA upgrade based on the received first high-voltage takeover status signal. At the same time, in order to avoid the target domain controller starting the high-voltage control of the vehicle immediately after completing the OTA upgrade like the existing control logic, this application will continue to send high-voltage takeover status signals to the target domain controller to inform the target domain controller that the takeover controller is currently performing high-voltage control of the vehicle. In this way, after the OTA upgrade is completed, the target domain controller will know that it is the takeover controller that is taking over the high-voltage control of the vehicle. The target domain controller will not immediately start the high-voltage control of the vehicle, but will first obtain the high-voltage control authority for the vehicle from the takeover controller before performing high-voltage control.

[0070] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high-voltage maintenance method for OTA upgrades. In the high-voltage maintenance method for OTA upgrades, the method further includes: when the vehicle is not in a high-voltage state, sending a refusal to take over signal to the target domain controller within a first time period to control the target domain controller to perform OTA upgrades.

[0071] In this embodiment, the takeover controller responds to the upgrade flag signal received by itself, and sends a takeover refusal signal to the target domain controller within the first time period when it cannot receive the high-voltage switch signal and the vehicle is not in a high-voltage state. The purpose of setting the first time period is that the target domain controller will not always wait for the takeover controller to give feedback to the target domain controller (high-voltage takeover ready signal and takeover refusal signal). If the takeover controller does not receive feedback from the takeover controller within the first time period after the target domain controller sends the upgrade flag signal, the target domain controller will execute subsequent control logic. When the target domain controller receives the takeover refusal signal sent by the takeover controller within the first time period after it sends the upgrade flag signal, it can be determined that the current vehicle is not in a high-voltage state. At this time, the target domain controller will directly perform OTA upgrade.

[0072] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high voltage maintenance method for OTA upgrade. In the high voltage maintenance method for OTA upgrade, the method also includes: when the target domain controller does not receive the high voltage takeover ready signal and the takeover refusal signal sent by the takeover controller within the first time period, the target domain controller performs the OTA upgrade after the high voltage of the whole vehicle is powered off.

[0073] In this embodiment, if the target domain controller does not receive the high-voltage takeover ready signal and the refusal to take over signal sent by the takeover controller within the first time period after it sends the upgrade flag signal, the target domain controller will no longer wait for the takeover controller to take over, and it will directly execute the vehicle's high-voltage power-off logic and then perform OTA upgrade.

[0074] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high voltage maintenance method for OTA upgrade. In the high voltage maintenance method for OTA upgrade, the method further includes: when the target domain controller does not receive the high voltage takeover status signal sent by the takeover controller within the third time period, the target domain controller performs the OTA upgrade after the high voltage of the whole vehicle is powered off.

[0075] In this embodiment, if the target domain controller stops sending high-voltage control instructions for a set period of time, and then waits for a third period of time without receiving a high-voltage takeover status signal sent by the takeover controller, it is determined that the takeover controller has not successfully taken over the high-voltage control of the vehicle for a long time. In order to prevent the target domain controller from failing to send high-voltage control instructions to the high-voltage component actuator for exceeding the agreed period of time, thereby causing the high-voltage component actuator to execute its own fault response strategy, and thus causing the OTA to be unable to be upgraded, the target domain controller will directly execute the high-voltage power-off logic of the entire vehicle, and then perform an OTA upgrade.

[0076] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high-voltage maintenance method for OTA upgrades. In the high-voltage maintenance method for OTA upgrades, the method further includes: when monitoring and determining that the target domain controller has not stopped issuing high-voltage control instructions within the second time period, sending a high-voltage takeover failure signal to the target domain controller to control the target domain controller to perform an OTA upgrade after the high voltage of the entire vehicle is powered off when an OTA upgrade is still required.

[0077] In this embodiment, when the takeover controller monitors and determines that the target domain controller has not stopped issuing high-voltage control instructions within the second time period, the takeover controller will exit the takeover. At this time, it will send a high-voltage takeover failure signal to the target domain controller to inform the target domain controller that the takeover controller will no longer take over the high-voltage control. At this time, if the target domain controller still needs to perform an OTA upgrade, it will directly execute the vehicle's high-voltage power-off logic based on the high-voltage takeover failure signal, and then perform an OTA upgrade.

[0078] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high-voltage maintenance method for OTA upgrades. In the high-voltage maintenance method for OTA upgrades, the method further includes: in response to an upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within the fourth time period, sending an exit takeover signal to the target domain controller to control the target domain controller to start taking over the high-voltage control of the vehicle; in response to a takeover signal sent by the target domain controller based on the exit takeover signal, stopping the issuance of high-voltage control instructions to control the target domain controller to send high-voltage control instructions within the third time period.

[0079] In this embodiment, the time taken by the target domain controller for OTA upgrade is basically the same, and there will not be a large deviation. Therefore, after the OTA upgrade is completed, the target domain controller sends an upgrade completion flag signal to the takeover controller. When the time between the time when the takeover controller receives the upgrade completion flag signal and the time when it issues the first high-voltage control instruction is less than or equal to the fourth time, the takeover controller will send an exit takeover signal to the target domain controller. After the target domain controller receives the exit takeover signal, the target domain controller will start to perform corresponding actions to take over the high-voltage control of the vehicle. At this time, the target domain controller sends a takeover signal to the takeover controller based on the exit takeover signal, and the takeover controller stops sending high-voltage control instructions after receiving the takeover signal. The target domain controller will monitor in real time whether the takeover controller has stopped sending high-voltage control instructions. When it is determined that the takeover controller has stopped sending high-voltage control instructions, the target domain controller will send high-voltage control instructions within the third time. The determination rule for determining whether the takeover controller has stopped sending high-voltage control instructions is: monitoring to determine whether the takeover controller has not issued high-voltage control instructions within the set time, if the takeover controller has not issued high-voltage control instructions within the set time, it is determined that the high-voltage redundant domain controller has stopped sending high-voltage control instructions. Among them, the fourth duration can be determined based on the OTA upgrade duration, which is not specifically limited here; the sum of the third duration and the set duration is less than the agreed duration.

[0080] In this embodiment, when the takeover controller itself does not stop issuing high-voltage control instructions within the second preset time period, it will directly execute the high-voltage power-off logic to control the high-voltage power-off of the entire vehicle.

[0081] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high-voltage maintenance method for OTA upgrades. In the high-voltage maintenance method for OTA upgrades, controlling the target domain controller to send high-voltage control instructions within a third time period includes: controlling the target domain controller to run the software to a high-voltage state in advance; and based on the high-voltage state to which the software runs, controlling the target domain controller to send high-voltage control instructions within the third time period.

[0082] In this embodiment, after the target domain controller determines that the takeover controller has stopped issuing high-voltage control instructions, since the vehicle is still in a high-voltage state at this time, the target domain controller will immediately run the internal software to the high-voltage state in advance, and then issue a high-voltage control instruction within a third time period, wherein the total time spent on running the internal software to the high-voltage state in advance and issuing the high-voltage control instruction needs to be less than the third time period.

[0083] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high voltage maintenance method for OTA upgrade. In the high voltage maintenance method for OTA upgrade, the method further includes: in response to a rejection takeover signal sent by the target domain controller based on the exit takeover signal, controlling the whole vehicle to power off the high voltage.

[0084] In this embodiment, due to the limitation of vehicle configuration, the target domain controller of some vehicle models does not have the logic to control the internal software of the target domain controller to run to a high-voltage state in advance. Therefore, after the target domain controller receives the exit takeover signal sent by the takeover controller, it will send a takeover refusal signal to the takeover controller based on the fact that it does not have the logic to control the internal software of the target domain controller to run to a high-voltage state in advance. The takeover controller controls the entire vehicle to power off the high voltage based on the received takeover refusal signal.

[0085] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high-voltage maintenance method for OTA upgrades. In the high-voltage maintenance method for OTA upgrades, the method further includes: in response to not receiving an upgrade completion flag signal within a fourth time period, controlling the entire vehicle to power off at high voltage; in response to an upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period, controlling the entire vehicle to power off at high voltage; in the event that a fault occurs during the upgrade process of the target domain controller, controlling the entire vehicle to power off at high voltage.

[0086] In this embodiment, if the target domain controller does not receive the upgrade completion flag signal sent by the target domain controller within the fourth time period, it is determined that an abnormality has occurred in the OTA upgrade of the target domain controller. At this time, the takeover controller will directly control the entire vehicle to power off at high voltage. If the target domain controller receives the upgrade failure flag signal sent by the target domain controller within the fourth time period, the takeover controller will directly control the entire vehicle to power off at high voltage. If the takeover controller monitors and determines that the target domain controller fails during the OTA upgrade process, the takeover controller will directly control the entire vehicle to power off at high voltage.

[0087] In this embodiment, the logic of the high voltage redundancy control program configured by the takeover controller to control the high voltage power on and off of the vehicle includes the following state jumps. Figure 4As shown, when the high-voltage takeover of the takeover controller is turned on and the high-voltage takeover state is met, it jumps from the initial state to the high-voltage activation state. At this time, the takeover controller can directly send a high-voltage control command according to the high-voltage activation state instruction agreed with the high-voltage component controller, without having to execute the high-voltage power-on control process (because the vehicle is already in a high-voltage state at this time, and will not execute the high-voltage power-on execution process like when it is just turned on).

[0088] When the takeover controller receives an upgrade completion signal within the fourth time period but also receives a takeover refusal signal, or the takeover controller does not receive an upgrade completion signal within the fourth time period, or the takeover controller receives an upgrade failure signal within the fourth time period, or monitoring determines that a fault occurs during the upgrade of the target domain controller, the takeover controller sends the agreed high-voltage unloading instruction to the high-voltage component controller to jump from the high-voltage activation state to the high-voltage load unloading state.

[0089] When there is no high-voltage fault in the whole vehicle and the high-voltage load unloading is completed, or there is no high-voltage fault in the whole vehicle and the high-voltage load unloading state exceeds the agreed maximum time, the takeover controller sends the agreed active short-circuit instruction to the high-voltage component controller and jumps to the active short-circuit state; in the event of a high-voltage fault in the whole vehicle, the takeover controller sends the agreed high-voltage cut-off instruction to the high-voltage component controller and jumps to the high-voltage cut-off state.

[0090] When a high-voltage fault occurs in the vehicle, or an active short circuit is completed, or the vehicle is in an active short circuit for more than the agreed maximum time, the takeover controller sends the agreed high-voltage cut-off instruction to the high-voltage component controller and jumps to the high-voltage cut-off state.

[0091] When the battery relay is disconnected for a certain period of time, or is in the high-voltage cut-off state for more than the agreed maximum time, the takeover controller sends the agreed high-voltage discharge instruction to the high-voltage component controller and jumps to the active discharge state.

[0092] When the high-voltage discharge is completed or the high-voltage discharge state exceeds the agreed maximum time, the takeover controller sends the agreed standby instruction to the high-voltage component controller, jumps to the standby state, and sends a corresponding signal to inform the target domain controller to exit the high-voltage takeover state.

[0093] When the takeover controller completes high-voltage power-off and is in standby state, there are two situations in which the target domain controller is informed to exit the high-voltage takeover state: if the target domain controller is successfully flashed, it will be in standby after receiving the signal, and will resume supplying high voltage to the entire vehicle by the target domain controller after receiving a user request; if the target domain controller is not successfully flashed, that is, the target domain controller cannot receive the signal, the safety of the high voltage of the entire vehicle can be effectively guaranteed, and the target domain controller will resume supplying high voltage to the entire vehicle after the maintenance personnel repairs the target domain controller to normal.

[0094] In combination with the above embodiments, in one implementation, the embodiment of the present application also provides a high voltage maintenance method for OTA upgrade. In the high voltage maintenance method for OTA upgrade, when the takeover controller is a high voltage component controller for which the target domain controller performs high voltage control, the takeover controller performs high voltage control on itself through internal signal interaction.

[0095] In this embodiment, when the takeover controller is a high-voltage component controller, the high-voltage component controller will not only serve as the main controller that takes over the high-voltage control, but also as the high-voltage component controller that is controlled by the high-voltage. When the high-voltage component controller performs high-voltage control on other high-voltage component controllers as a takeover controller, the high-voltage control is realized by directly interacting through the communication link between each other. When the high-voltage component controller performs high-voltage control on itself as a takeover controller, since the high-voltage component controller deploys a high-voltage redundant control program by dividing an internal area and performs high-voltage control through the high-voltage redundant control program, when controlling itself, the high-voltage component controller performs high-voltage control on other areas within itself through internal signal interaction based on the high-voltage redundant control program.

[0096] Based on the same inventive concept, an embodiment of the present application provides a high voltage maintenance system for OTA upgrade, such as Figure 5 As shown, the system 500 includes a takeover controller 501 and a target domain controller 502, and the takeover controller includes:

[0097] The takeover signal sending module 5011 is used to respond to the upgrade flag signal of the target domain controller for OTA upgrade, and when the target domain controller can receive the high-voltage switch signal, send a high-voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high-voltage control instructions. The target domain controller is the domain controller that performs high-voltage control.

[0098] The monitoring module 5012 is used to perform high voltage control on the vehicle according to the received high voltage switch signal when it is determined through monitoring that the target domain controller does not perform high voltage control;

[0099] The high-voltage control module 5013 is configured to send a high-voltage control instruction within a third time period to take over the high-voltage control of the vehicle when it is determined through monitoring that the target domain controller stops sending the high-voltage control instruction within the second time period, and the sum of the third time period and the time period corresponding to the stop of sending the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller;

[0100] The status signal sending module 5014 is used to continuously send a high-voltage takeover status signal to the target domain controller when taking over the high-voltage control of the vehicle, so as to control the target domain controller to perform OTA upgrade, wherein the takeover controller includes one of other on-board domain controllers, a controller having a communication link with the high-voltage component controller and the target domain controller, and a high-voltage component controller over which the target domain controller performs high-voltage control.

[0101] Optionally, the system 500 further includes:

[0102] The target domain controller is used to execute OTA upgrade after the high voltage of the whole vehicle is powered off when the target domain controller does not receive the high voltage takeover ready signal and the takeover refusal signal sent by the takeover controller within the first time period.

[0103] Optionally, the system 500 further includes:

[0104] The target domain controller is also used to execute OTA upgrade after the high voltage of the whole vehicle is powered off when the target domain controller does not receive the high voltage takeover status signal sent by the takeover controller within the third time period.

[0105] Optionally, the system 500 further includes:

[0106] The high-voltage takeover failure signal sending module is used to send a high-voltage takeover failure signal to the target domain controller when it is monitored and determined that the target domain controller has not stopped sending high-voltage control instructions within the second time period, so as to control the target domain controller to perform OTA upgrade after the high voltage of the whole vehicle is powered off if OTA upgrade is still required.

[0107] Optionally, the system 500 further includes:

[0108] An exit takeover signal sending module, configured to send an exit takeover signal to the target domain controller in response to an upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within a fourth time period, so as to control the target domain controller to start taking over the high-voltage control of the vehicle;

[0109] The high-voltage control instruction stopping module is used to stop sending high-voltage control instructions in response to the takeover signal sent by the target domain controller based on the exit takeover signal, so as to control the target domain controller to send high-voltage control instructions within a third time period.

[0110] Optionally, the target domain controller is further used to run the software to a high-voltage state in advance; and to send a high-voltage control instruction within a third time period based on the high-voltage state to which the software runs.

[0111] Optionally, the system 500 further includes:

[0112] The high voltage control module 5012 is also used to control the whole vehicle to power off the high voltage in response to a takeover refusal signal sent by the target domain controller based on the exit takeover signal.

[0113] Optionally, the system 500 further includes:

[0114] The high-voltage control module 5012 is also used to control the whole vehicle to power off the high voltage in response to not receiving the upgrade completion flag signal within the fourth time period; and to control the whole vehicle to power off the high voltage in response to the upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period; and to control the whole vehicle to power off the high voltage when a fault is detected during the upgrade of the target domain controller.

[0115] Optionally, the system 500 further includes:

[0116] A state determination module, for determining a vehicle state in response to an upgrade flag signal of an OTA upgrade performed by a target domain controller, when the vehicle itself cannot receive a high-voltage switch signal;

[0117] A takeover signal sending module, used for sending a high-voltage takeover ready signal to the target domain controller within a first time period when the vehicle is in a high-voltage state, so as to control the target domain controller to stop sending high-voltage control instructions;

[0118] A high-voltage control module, configured to send a high-voltage control instruction within a third time period to take over high-voltage control of the vehicle when it is detected that the target domain controller stops sending the high-voltage control instruction within a second time period, and the sum of the third time period and the time period corresponding to the stop of sending the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller;

[0119] The status signal sending module is used to continuously send a high-voltage takeover status signal to the target domain controller when taking over the high-voltage control of the vehicle, so as to control the target domain controller to perform OTA upgrade.

[0120] Optionally, the system 500 further includes:

[0121] The takeover refusal signal sending module is used to send a takeover refusal signal to the target domain controller within a first time period when the vehicle is not in a high-voltage state, so as to control the target domain controller to perform OTA upgrade.

[0122] Optionally, when the takeover controller in the system 500 is a high-voltage component controller on which the target domain controller performs high-voltage control, the takeover controller performs high-voltage control through internal signal interaction when performing high-voltage control on itself.

[0123] Based on the same inventive concept, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored on the memory and running on the processor. When the computer program is executed by the processor, it implements the steps in the high-voltage maintenance method for OTA upgrade as described in the first aspect of the present application.

[0124] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in a high-voltage maintenance method for OTA upgrade as described in the first aspect of the present application are implemented.

[0125] As for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0126] It should be noted that, for the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0127] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0128] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the embodiments of the present application may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0129] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0132] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0133] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0134] The above is a detailed introduction to the high-voltage maintenance method, system and product for OTA upgrade provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A high voltage maintenance method for OTA upgrade, characterized in that: Applied to a takeover controller, in which a high voltage redundant control program is deployed, the method comprises: In response to an upgrade flag signal of the target domain controller for OTA upgrade, when the target domain controller can receive a high-voltage switch signal, a high-voltage takeover ready signal is sent to the target domain controller within a first time period to control the target domain controller to stop sending high-voltage control instructions, where the target domain controller is a domain controller for high-voltage control; When it is determined through monitoring that the target domain controller does not perform high voltage control, performing high voltage control on the vehicle according to the received high voltage switch signal; In the case where it is determined through monitoring that the target domain controller stops issuing the high-voltage control instruction within the second time period, the high-voltage control instruction is sent within a third time period to take over the high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the suspension of issuing the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller; When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

2. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: When the target domain controller does not receive the high-voltage takeover ready signal and the takeover refusal signal sent by the takeover controller within the first time period, the target domain controller performs an OTA upgrade after powering off the high voltage of the entire vehicle.

3. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: When the target domain controller does not receive the high-voltage takeover status signal sent by the takeover controller within the third time period, the target domain controller performs an OTA upgrade after powering off the high voltage of the entire vehicle.

4. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: When monitoring determines that the target domain controller has not stopped issuing high-voltage control instructions within the second time period, a high-voltage takeover failure signal is sent to the target domain controller to control the target domain controller to perform an OTA upgrade after the high voltage of the entire vehicle is powered off if an OTA upgrade is still required.

5. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: In response to an upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within a fourth time period, sending an exit takeover signal to the target domain controller to control the target domain controller to start taking over high-voltage control of the vehicle; In response to a takeover signal sent by the target domain controller based on the exit takeover signal, the high-voltage control instruction is stopped to control the target domain controller to send the high-voltage control instruction within a third time period.

6. The high voltage maintenance method for OTA upgrade according to claim 5, characterized in that: Controlling the target domain controller to send a high-voltage control instruction within a third time period includes: Controlling the target domain controller to run the software to a high-pressure state in advance; Based on the high-voltage state in which the software runs, the target domain controller is controlled to send a high-voltage control instruction within a third time period.

7. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: In response to a takeover refusal signal sent by the target domain controller based on the takeover exit signal, the entire vehicle is controlled to power off at high voltage.

8. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: In response to not receiving the upgrade completion flag signal within the fourth time period, controlling the entire vehicle to power off the high voltage; In response to an upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period, controlling the entire vehicle to power off at high voltage; When monitoring determines that a fault occurs during the upgrade process of the target domain controller, the entire vehicle is controlled to power off at high voltage.

9. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The method further comprises: In response to an upgrade flag signal of an OTA upgrade performed by a target domain controller, determining a vehicle state when the vehicle itself cannot receive a high-voltage switch signal; When the vehicle is in a high-voltage state, sending a high-voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high-voltage control instructions; In the case where it is detected that the target domain controller stops sending the high-voltage control instruction within the second time period, the high-voltage control instruction is sent within a third time period to take over the high-voltage control of the vehicle, and the sum of the third time period and the time period corresponding to the stop of sending the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller; When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

10. The high voltage maintenance method for OTA upgrade according to claim 9, characterized in that: The method further comprises: When the vehicle is not in a high-voltage state, a refusal to take over signal is sent to the target domain controller within a first time period to control the target domain controller to perform OTA upgrade.

11. The high voltage maintenance method for OTA upgrade according to claim 1, characterized in that: The takeover controller includes one of other vehicle-mounted domain controllers, a controller having a communication link with the high-voltage component controller and the target domain controller, and a high-voltage component controller over which the target domain controller performs high-voltage control.

12. The high voltage maintenance method for OTA upgrade according to claim 11, characterized in that: In the case where the takeover controller is a high-voltage component controller on which the target domain controller performs high-voltage control, the takeover controller performs high-voltage control through internal signal interaction when performing high-voltage control on itself.

13. An OTA upgraded high voltage maintenance system, characterized in that: The system comprises: A takeover signal sending module, configured to respond to an upgrade flag signal of an OTA upgrade of a target domain controller, and to send a high-voltage takeover ready signal to the target domain controller within a first time period when the target domain controller can receive a high-voltage switch signal, so as to control the target domain controller to stop sending high-voltage control instructions, wherein the target domain controller is a domain controller that performs high-voltage control; A monitoring module, configured to perform high voltage control on the vehicle according to a received high voltage switch signal when it is determined through monitoring that the target domain controller does not perform high voltage control; The high-voltage control module is configured to send a high-voltage control instruction within a third time period to take over the high-voltage control of the vehicle when it is determined through monitoring that the target domain controller stops sending the high-voltage control instruction within a second time period, and the sum of the third time period and the time period corresponding to the stop of sending the high-voltage control instruction is less than the agreed time period between the target domain controller and the high-voltage component controller; The status signal sending module is used to continuously send a high-voltage takeover status signal to the target domain controller when taking over the high-voltage control of the vehicle, so as to control the target domain controller to perform OTA upgrade.

14. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and running on the processor, wherein when the computer program is executed by the processor, the steps in the high-voltage maintenance method for OTA upgrade according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the high-voltage maintenance method for OTA upgrading according to any one of claims 1 to 12 are implemented.

Images