A method, system and product for over-the-air upgrade of high voltage maintenance

Abstract

This application provides a high-voltage maintenance method, system, and product for OTA upgrades. The method includes: applying to a takeover controller, wherein the takeover controller is equipped with a high-voltage redundancy control program; the method includes: responding to an upgrade flag signal indicating that a target domain controller is performing an OTA upgrade, and, if it can receive a high-voltage switch signal, sending a high-voltage takeover ready signal to the target domain controller within a first duration; if it is determined that the target domain controller is not performing high-voltage control, performing high-voltage control on the vehicle according to the received high-voltage switch signal; if it is determined that the target domain controller stops sending high-voltage control commands within a second duration, sending a high-voltage control command within a third duration to take over the high-voltage control of the vehicle; and, while taking over the high-voltage control of the vehicle, continuously sending a high-voltage takeover status signal to the target domain controller to control the target domain controller to perform an OTA upgrade. The aim is to maintain high voltage on the vehicle during an OTA upgrade of the domain controller.

Description

Technical Field

[0001] This application relates to the field of OTA upgrade technology for vehicle domain controllers, specifically to a high-voltage maintenance method, system, and product for OTA upgrades. Background Technology

[0002] Currently, when a domain controller containing high-voltage control is not partitioned, during the OTA upgrade of the domain controller, the domain controller will lose high-voltage control over the entire vehicle. In other words, when upgrading a domain controller containing high-voltage control logic, the entire vehicle will be upgraded under low voltage during the OTA upgrade process, which will result in the vehicle's high-voltage function being restricted when static. Summary of the Invention

[0003] In view of this, embodiments of this application provide a high-voltage maintenance method, system, and product for OTA upgrades. The aim is to maintain the vehicle's high voltage during OTA upgrades of a domain controller containing high-voltage control logic for controlling the vehicle's high voltage.

[0004] The first aspect of this application provides a high-pressure maintenance method for OTA upgrades, the method comprising:

[0005] Applied to a pipe connection controller, wherein the pipe connection controller is equipped with a high-voltage redundant control program, the method includes:

[0006] In response to the upgrade flag signal of the target domain controller performing OTA upgrade, and provided that it can receive the high voltage switch signal, it sends a high voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high voltage control commands. The target domain controller is the domain controller that performs high voltage control.

[0007] If monitoring determines that the target domain controller is not performing high-voltage control, high-voltage control is performed on the vehicle based on the received high-voltage switch signal;

[0008] If the monitoring determines that the target domain controller stops issuing high-voltage control commands within a second time period, a high-voltage control command is sent within a third time period to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the suspension of high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller.

[0009] When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

[0010] Optionally, the method further includes:

[0011] If the target domain controller does not receive a high-voltage takeover ready signal or a takeover rejection signal from the takeover controller within the first time period, the target domain controller will perform an OTA upgrade after powering off the vehicle's high voltage.

[0012] Optionally, the method further includes:

[0013] If the target domain controller does not receive a high-voltage takeover status signal from the takeover controller within the third time period, the target domain controller will perform an OTA upgrade after powering off the vehicle's high voltage.

[0014] Optionally, the method further includes:

[0015] If the target domain controller fails to stop issuing high-voltage control commands within the second time period, a high-voltage takeover failure signal is sent to the target domain controller to control the target domain controller to perform an OTA upgrade after the vehicle's high-voltage power is turned off if an OTA upgrade is still required.

[0016] Optionally, the method further includes:

[0017] In response to the upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within the fourth time period, an exit takeover signal is sent to the target domain controller to control the target domain controller to start taking over the high voltage control of the vehicle;

[0018] In response to the takeover signal sent by the target domain controller based on the exit takeover signal, the high-voltage control command is stopped, thereby controlling the target domain controller to send high-voltage control commands within a third time period.

[0019] Optionally, controlling the target domain controller to send high-voltage control commands within a third time period includes:

[0020] The target domain controller is instructed to run the software to a high-voltage state in advance.

[0021] Based on the high-voltage state reached during software operation, the target domain controller is controlled to send high-voltage control commands within a third time period.

[0022] Optionally, the method further includes:

[0023] In response to the rejection signal sent by the target domain controller based on the exit takeover signal, the vehicle is controlled to shut down at high voltage.

[0024] Optionally, the method further includes:

[0025] If the upgrade completion signal is not received within the fourth time period, the vehicle will be powered down.

[0026] In response to the upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period, the vehicle is controlled to shut down the high voltage.

[0027] If a fault is detected during the upgrade of the target domain controller, the entire vehicle will be powered down.

[0028] Optionally, the method further includes:

[0029] In response to the upgrade flag signal of the target domain controller for OTA upgrade, the vehicle status is determined when it is unable to receive the high-voltage switch signal.

[0030] When the vehicle is under high pressure, a high-pressure takeover ready signal is sent to the target domain controller within a first time period to control the target domain controller to stop issuing high-pressure control commands.

[0031] If the target domain controller stops issuing high-voltage control commands within a second time period, it sends high-voltage control commands within a third time period to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the suspension of high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller.

[0032] When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

[0033] Optionally, the method further includes:

[0034] If the vehicle is not under high voltage, a takeover rejection signal is sent to the target domain controller within a first time period to control the target domain controller to perform an OTA upgrade.

[0035] Optionally, the takeover controller includes one of the following: an on-board other domain controller, a controller that has a communication link with the high-voltage component controller and the target domain controller, and a high-voltage component controller that performs high-voltage control on the target domain controller.

[0036] Optionally, when the receiver controller is a high-voltage component controller that performs high-voltage control on the target domain controller, the receiver controller performs high-voltage control on itself through internal signal interaction.

[0037] A second aspect of this application provides a high-voltage maintenance system for OTA upgrades, the system comprising:

[0038] The takeover signal transmission module is used to respond to the upgrade flag signal of the target domain controller performing OTA upgrade. When it can receive the high voltage switch signal, it sends a high voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high voltage control commands. The target domain controller is the domain controller that performs high voltage control.

[0039] The monitoring module is used to perform high-voltage control on the vehicle based on the received high-voltage switch signal when the monitoring determines that the target domain controller is not performing high-voltage control.

[0040] The high-voltage control module is used to send a high-voltage control command within a third time period after monitoring and determining that the target domain controller stops issuing high-voltage control commands within a second time period, so as to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the suspension of high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller.

[0041] The status signal sending module is used to continuously send high-voltage takeover status signals to the target domain controller when the high-voltage control of the vehicle is taken over, so as to control the target domain controller to perform OTA upgrade.

[0042] A third aspect of this application provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the computer program, when executed by the processor, implements the steps of a high-voltage maintenance method for OTA upgrades as described in the first aspect of this application.

[0043] A fourth aspect of this application provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a high-voltage maintenance method for OTA upgrades as described in the first aspect of this application.

[0044] The high-voltage maintenance method for OTA upgrades provided in this application has the following advantages:

[0045] This application provides a high-voltage maintenance method for OTA upgrades, applied to a takeover controller. The takeover controller is equipped with a high-voltage redundancy control program, which is used to take over high-voltage control of the vehicle during the OTA upgrade process of a target domain controller. First, in response to the upgrade flag signal indicating that the target domain controller is performing an OTA upgrade, and provided the takeover controller can receive a high-voltage switch signal, a high-voltage takeover ready signal is sent to the target domain controller within a first duration to control the target domain controller to stop issuing high-voltage control commands. The target domain controller is the domain controller performing high-voltage control. If it is determined that the target domain controller is not performing high-voltage control, high-voltage control is performed on the vehicle based on the received high-voltage switch signal. If it is determined that the target domain controller stops issuing high-voltage control commands within a second duration, a high-voltage control command is sent within a third duration to take over high-voltage control of the vehicle. The sum of the third duration and the duration corresponding to the suspension of high-voltage control commands is less than the agreed duration between the target domain controller and the high-voltage component controller. While taking over high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform an OTA upgrade. Therefore, this application introduces a takeover controller equipped with a high-voltage redundancy control program. During the OTA upgrade of the target domain controller, which was originally used to control the high voltage of the vehicle, the takeover controller actively takes over the high-voltage control of the vehicle. This allows the target domain controller to maintain the high voltage of the vehicle while it is powered on during its own OTA upgrade, even if the target domain controller does not have partitions. This ensures that the use of the vehicle's relevant functions, such as air conditioning cooling and heating, and seat heating, is not restricted in a static state. In other words, the vehicle can maintain the high voltage of functions that require high voltage during the OTA upgrade process without being affected by the OTA upgrade. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating a high-voltage maintenance method for OTA upgrades according to one embodiment of this application;

[0048] Figure 2 This is a schematic diagram of the domain controller ring network structure in a high-voltage maintenance method for OTA upgrades, as shown in one embodiment of this application.

[0049] Figure 3This is another flowchart illustrating a high-voltage maintenance method for OTA upgrades according to one embodiment of this application;

[0050] Figure 4 This is a flowchart illustrating a high-voltage power-off method for OTA upgrades in one embodiment of this application;

[0051] Figure 5 This is a schematic diagram of a high-voltage maintenance system for OTA upgrades, as shown in one embodiment of this application. Detailed Implementation

[0052] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0053] refer to Figure 1 , Figure 1 This is a flowchart illustrating a high-voltage maintenance method for OTA upgrades, as shown in one embodiment of this application. Figure 1 As shown, this application provides a high-voltage maintenance method for OTA upgrades, applied to a takeover controller, which has a high-voltage redundancy control program deployed in the takeover controller. The method includes:

[0054] Step S1: In response to the upgrade flag signal of the target domain controller performing an OTA upgrade, and provided that it can receive the high-voltage switch signal, it sends a high-voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high-voltage control commands. The target domain controller is the domain controller that performs high-voltage control. The takeover controller includes one of the following: other on-board domain controllers, controllers that have communication links with the high-voltage component controller and the target domain controller, and high-voltage component controllers that perform high-voltage control on the target domain controller.

[0055] In this embodiment, the target domain controller refers to the domain controller in the vehicle used for high-voltage control. This target domain controller does not have partitions. In existing control logic, when performing an OTA upgrade on this target domain controller, the entire vehicle is de-energized and the upgrade is performed under low voltage, which limits the use of the vehicle's high-voltage function in a static state. This application addresses this by configuring a takeover controller for the vehicle. This takeover controller deploys a high-voltage redundancy control program to take over the high-voltage control of the vehicle when the target domain controller undergoes an OTA upgrade. To reduce implementation costs, the takeover controller can be a controller already present in the vehicle, or another domain controller on the vehicle besides the target domain controller; it can also be a controller with communication links to both the high-voltage component controller and the target domain controller. The high-voltage component controller refers to the relevant execution controller subject to the high-voltage control of the target domain controller; it can also be a high-voltage component controller subject to the high-voltage control of the target domain controller, requiring communication links with both other high-voltage component controllers and the target domain controller. Figure 2 As shown, when the takeover controller is another domain controller, the control architecture is a ring network architecture, and the high-voltage component controllers include, but are not limited to, battery controllers, motor controllers, and thermal management controllers.

[0056] In this embodiment, the new energy vehicle has a high-voltage state and a low-voltage state. The high-voltage state indicates that all high-voltage components of the vehicle are operational, relevant high-voltage relays are closed, the high-voltage circuit is open, and relevant high-voltage components can use the power from the high-voltage battery. For example, high-voltage electrical appliances such as air conditioners and DC-DC converters can use the power. High-voltage control is generally unified by the vehicle controller, and then each high-voltage controller executes relevant vehicle controller commands. The low-voltage state refers to the relevant low-voltage relays being closed, and some controllers operating normally. However, because the high-voltage relays are not closed, the power from the high-voltage battery cannot be used. The relevant controllers rely on the power from the vehicle's low-voltage battery for operation. The low-voltage battery has a small capacity and a short operating time; generally, the DC-DC converter charges the low-voltage battery after the vehicle is connected to high voltage. The high-voltage state can only be achieved under the premise of the low-voltage state. The high-voltage range of new energy vehicles is roughly between 200V and 750V, but this range varies depending on the specific model. For example, the voltage of ordinary electric vehicles is mostly 336V or 384V, while the voltage of electric buses is usually between 580V and 600V. In addition, the high voltage of some vehicle models may be close to or exceed the upper limit of this range.

[0057] In this embodiment, as Figure 3As shown, the target domain controller will monitor in real time whether it needs to perform an OTA upgrade. When it determines that it needs to perform an OTA upgrade, it sends an upgrade flag signal to the takeover controller to notify the takeover controller that it will perform an OTA upgrade.

[0058] In this embodiment, when the takeover controller is a controller capable of receiving the high-voltage switch signal, it sends a high-voltage takeover ready signal to the target domain controller within a first time period in response to the upgrade flag signal it receives, informing the target domain controller that it is ready to perform high-voltage takeover. This first time period can be set according to the actual application scenario and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting this first time period is to prevent the target domain controller from waiting indefinitely for feedback from the takeover controller. If the takeover controller does not receive feedback from the takeover controller within the first time period after the target domain controller sends the upgrade flag signal, the target domain controller will execute subsequent control logic. Some optional implementations for the takeover controller to receive the emitted high-voltage switch signal are as follows: the takeover controller belongs to the redundant domain controller on the vehicle, which originally has a communication link for transmitting the high-voltage switch signal to the redundant domain controller; the takeover controller belongs to the high-voltage component controller on the vehicle that was originally controlled by the target domain controller, and the high-voltage switch signal is transmitted to the takeover controller by setting up an additional communication link. This communication link can be the line from the control button on the vehicle that emits the high-voltage switch signal to the takeover controller. When the takeover controller supports Bluetooth communication, this communication link can be the link from the car key to the takeover controller via Bluetooth communication.

[0059] Step S2: If the monitoring determines that the target domain controller is not performing high-voltage control, perform high-voltage control on the vehicle based on the received high-voltage switch signal.

[0060] In this embodiment, when the takeover controller detects that the vehicle is currently in a low-pressure state, it indicates that the target domain controller is not currently performing high-pressure control. At this time, the takeover controller directly takes over the high-pressure control of the vehicle. The takeover controller receives the high-pressure switch signal of the vehicle and starts high-pressure control directly after receiving it.

[0061] Step S3: If the monitoring determines that the target domain controller stops issuing high-voltage control commands within the second duration, a high-voltage control command is sent within the third duration to take over the high-voltage control of the vehicle. The sum of the third duration and the duration corresponding to the suspension of high-voltage control commands is less than the agreed duration between the target domain controller and the high-voltage component controller.

[0062] In this embodiment, when the takeover controller detects that the vehicle is currently in a high-voltage state, it indicates that the target domain controller is currently performing high-voltage control. The takeover controller will then take over the high-voltage control of the vehicle from the target domain controller through takeover logic. Specifically, when the target domain controller receives a high-voltage takeover ready signal from the takeover controller within a first time period, it determines that the takeover controller will perform high-voltage takeover. At this time, the target domain controller will stop issuing high-voltage control commands within a second time period. This second time period can be set according to the actual application scenario and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting this second time period is to prevent the takeover controller from waiting indefinitely for the target domain controller to stop issuing high-voltage control commands. If the target domain controller does not stop issuing high-voltage control commands within the second time period after the takeover controller issues the high-voltage takeover ready signal, the takeover controller will execute subsequent control logic.

[0063] In this embodiment, when the takeover controller detects and determines that the target domain controller has stopped issuing high-voltage control commands within a second time period, the takeover controller immediately sends high-voltage control commands within a third time period to take over the high-voltage control of the vehicle. The rule for the takeover controller to determine whether the target domain controller has stopped issuing high-voltage control commands is as follows: It monitors and determines whether the target domain controller has not issued any high-voltage control commands within a set time period. If the target domain controller has not issued any high-voltage control commands within the set time period, it is determined that the target domain controller has stopped issuing high-voltage control commands. This set time period is less than the agreed-upon time period between the target domain controller and the high-voltage component controller. This agreed-upon time period means that if the high-voltage component controller does not receive a high-voltage control command from the target domain controller within this agreed-upon time period, the high-voltage component controller will maintain the state corresponding to the last received high-voltage control command. If it does not receive a high-voltage control command from the target domain controller after this agreed-upon time period, the high-voltage component controller will consider that the vehicle has experienced a certain fault. At this time, the high-voltage component controller will execute its own fault response strategy. In this case, the target domain controller does not meet the OTA upgrade conditions and cannot perform an OTA upgrade. The purpose of limiting the set duration to be less than the agreed duration between the target domain controller and the high-voltage component controller is to prevent the target domain controller from refraining from issuing high-voltage control commands for an extended period before the takeover controller has even issued them. This would cause the high-voltage component controller to mistakenly believe that the vehicle has malfunctioned and execute its own fault response strategy, thus preventing OTA upgrades from being performed due to unmet requirements. For the same reason, this application limits the sum of the third duration and the set duration to be less than the agreed duration. Since the target domain controller has already refrained from issuing high-voltage control commands for a certain period, if the takeover controller cannot complete the transmission of the high-voltage control commands within the third duration, the final duration of refraining from issuing high-voltage control commands will exceed the agreed duration. This would cause the high-voltage component controller to mistakenly believe that the vehicle has malfunctioned and execute its own fault response strategy, further preventing OTA upgrades from being performed due to unmet requirements.

[0064] Step S4: When taking over the high-voltage control of the vehicle, continuously send a high-voltage takeover status signal to the target domain controller to control the target domain controller to perform OTA upgrade.

[0065] In this embodiment, when the takeover controller issues a high-voltage control command, it also takes over the high-voltage control of the vehicle. To inform the target domain controller that the takeover controller has taken over the high-voltage control, allowing it to confidently perform OTA upgrades, the takeover controller simultaneously sends a first high-voltage takeover status signal to the target domain controller when issuing the first high-voltage control command to the high-voltage component controller. This signal informs the target domain controller that the takeover controller has taken over the high-voltage control of the vehicle. The target domain controller then performs an OTA upgrade based on this first high-voltage takeover status signal. Furthermore, to prevent the target domain controller from immediately resuming high-voltage control of the vehicle after completing its OTA upgrade, as is the case with existing control logic, this application continuously sends high-voltage takeover status signals to the target domain controller. This informs the target domain controller that the takeover controller is currently performing high-voltage control of the vehicle. Thus, after the OTA upgrade is complete, the target domain controller will know that the takeover controller is currently in charge of high-voltage control of the vehicle. The target domain controller will not immediately begin high-voltage control of the vehicle but will first obtain high-voltage control authority from the takeover controller before performing high-voltage control.

[0066] This application provides a high-voltage maintenance method for OTA upgrades, applied to a takeover controller. The takeover controller is equipped with a high-voltage redundancy control program, which is used to take over high-voltage control of the vehicle during the OTA upgrade process of a target domain controller. First, in response to the upgrade flag signal indicating that the target domain controller is performing an OTA upgrade, and provided the takeover controller can receive a high-voltage switch signal, a high-voltage takeover ready signal is sent to the target domain controller within a first duration to control the target domain controller to stop issuing high-voltage control commands. The target domain controller is the domain controller performing high-voltage control. If it is determined that the target domain controller is not performing high-voltage control, high-voltage control is performed on the vehicle based on the received high-voltage switch signal. If it is determined that the target domain controller stops issuing high-voltage control commands within a second duration, a high-voltage control command is sent within a third duration to take over high-voltage control of the vehicle. The sum of the third duration and the duration corresponding to the suspension of high-voltage control commands is less than the agreed duration between the target domain controller and the high-voltage component controller. While taking over high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform an OTA upgrade. Therefore, this application introduces a takeover controller equipped with a high-voltage redundancy control program. During the OTA upgrade of the target domain controller, which was originally used to control the high voltage of the vehicle, the takeover controller actively takes over the high-voltage control of the vehicle. This allows the target domain controller to maintain the high voltage of the vehicle while it is powered on during its own OTA upgrade, even if the target domain controller does not have partitions. This ensures that the use of the vehicle's relevant functions, such as air conditioning cooling and heating, and seat heating, is not restricted in a static state. In other words, the vehicle can maintain the high voltage of functions that require high voltage during the OTA upgrade process without being affected by the OTA upgrade.

[0067] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. This high-voltage maintenance method for OTA upgrades further includes: responding to an upgrade flag signal from a target domain controller for an OTA upgrade, determining the vehicle state when the controller itself cannot receive a high-voltage switch signal; when the vehicle is in a high-voltage state, sending a high-voltage takeover ready signal to the target domain controller within a first duration to control the target domain controller to stop issuing high-voltage control commands; if it is detected that the target domain controller stops issuing high-voltage control commands within a second duration, sending a high-voltage control command within a third duration to take over high-voltage control of the vehicle, wherein the sum of the third duration and the duration corresponding to the stop issuing high-voltage control commands is less than the agreed duration between the target domain controller and the high-voltage component controller; and continuously sending a high-voltage takeover status signal to the target domain controller when taking over high-voltage control of the vehicle to control the target domain controller to perform an OTA upgrade.

[0068] In another embodiment of this application, the target domain controller monitors in real time whether it needs an OTA upgrade. When it determines that an OTA upgrade is needed, it sends an upgrade flag signal to the takeover controller to notify the takeover controller that it will perform an OTA upgrade. If the takeover controller cannot receive the high-voltage switch signal, it will only take over high-voltage control of the vehicle when the vehicle is in a high-voltage state. Specifically, in response to the received upgrade flag signal, if it cannot receive the high-voltage switch signal, it determines whether the vehicle is currently in a high-voltage state. If it determines that the vehicle is in a high-voltage state, it sends a high-voltage takeover ready signal to the target domain controller within a first duration to inform the target domain controller that it is ready to perform high-voltage takeover. This first duration can be set according to the actual application scenario and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting this first duration is to prevent the target domain controller from waiting indefinitely for feedback from the takeover controller. If the takeover controller does not receive feedback from the takeover controller within the first duration after the target domain controller sends the upgrade flag signal, the target domain controller will execute subsequent control logic.

[0069] In this embodiment, when the target domain controller receives a high-voltage takeover ready signal from the takeover controller within a first time period, it determines that the takeover controller will initiate high-voltage takeover. At this time, the target domain controller will stop issuing high-voltage control commands within a second time period. This second time period can be set according to the actual application scenario and is not specifically limited here, such as 800ms, 1000ms, etc. The purpose of setting this second time period is to prevent the takeover controller from waiting indefinitely for the target domain controller to stop issuing high-voltage control commands. If the target domain controller does not stop issuing high-voltage control commands within the second time period after the takeover controller issues the high-voltage takeover ready signal, the takeover controller will execute subsequent control logic. When the takeover controller detects and determines that the target domain controller has stopped issuing high-voltage control commands within the second time period, the takeover controller immediately sends high-voltage control commands within a third time period to take over the high-voltage control of the vehicle. The rule for the takeover controller to determine whether the target domain controller has stopped issuing high-voltage control commands is: monitoring and determining whether the target domain controller has not issued any high-voltage control commands within the set time period. If the target domain controller has not issued any high-voltage control commands within the set time period, it is determined that the target domain controller has stopped issuing high-voltage control commands. The set duration is shorter than the agreed-upon duration between the target domain controller and the high-voltage component controller. This agreed-upon duration means that if the high-voltage component controller does not receive a high-voltage control command from the target domain controller within this agreed-upon duration, it will maintain the state corresponding to the last received high-voltage control command. If it does not receive a high-voltage control command from the target domain controller after this agreed-upon duration, the high-voltage component controller will assume that the vehicle has a certain fault. At this time, the high-voltage component controller will execute its own fault response strategy. In this case, the target domain controller will not meet the OTA upgrade conditions and cannot perform an OTA upgrade. The purpose of limiting this set duration to less than the agreed-upon duration between the target domain controller and the high-voltage component controller is to prevent the target domain controller from refusing to send high-voltage control commands for an extended period before the takeover controller has issued them, causing the high-voltage component controller to assume that the vehicle has a fault and execute its own fault response strategy, thereby further preventing the OTA upgrade from being performed due to the failure to meet the OTA upgrade conditions. For the same reason, this application limits the sum of the third duration and the set duration to be less than the agreed duration. This is because the target domain controller has already stopped issuing high-voltage control commands for a certain period. If the takeover controller cannot complete the transmission of high-voltage control commands within the third duration, the final duration of stopping high-voltage control commands will exceed the agreed duration. This will cause the high-voltage component controller to mistakenly believe that the vehicle has malfunctioned and execute its own fault response strategy, further resulting in the inability to perform an OTA upgrade due to unmet conditions. When the takeover controller issues a high-voltage control command, it also takes over the high-voltage control of the vehicle. To ensure the target domain controller is aware that the takeover controller has taken over high-voltage control, allowing it to confidently perform an OTA upgrade, further measures are needed.When the takeover controller issues the first high-voltage control command to the high-voltage component controller, it simultaneously issues the first high-voltage takeover status signal to the target domain controller, informing the target domain controller that the takeover controller has taken over the high-voltage control of the vehicle. At this time, the target domain controller performs an OTA upgrade based on the received first high-voltage takeover status signal. To prevent the target domain controller from immediately starting high-voltage control of the vehicle after completing its OTA upgrade, as in existing control logic, this application continuously sends high-voltage takeover status signals to the target domain controller to inform it that the takeover controller is currently performing high-voltage control of the vehicle. Thus, after the OTA upgrade is completed, the target domain controller will know that the takeover controller is currently taking over the high-voltage control of the vehicle. The target domain controller will not immediately start high-voltage control of the vehicle, but will first obtain high-voltage control authority from the takeover controller before performing high-voltage control.

[0070] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, the method further includes: when the vehicle is not in a high-voltage state, sending a takeover rejection signal to the target domain controller within a first duration to control the target domain controller to perform an OTA upgrade.

[0071] In this embodiment, in response to the upgrade flag signal it receives, if the takeover controller cannot receive the high-voltage switch signal and the vehicle is not in a high-voltage state, it sends a takeover rejection signal to the target domain controller within a first duration. The purpose of this first duration is to prevent the target domain controller from waiting indefinitely for feedback (high-voltage takeover ready signal and takeover rejection signal) from the takeover controller. If the takeover controller does not receive feedback from the takeover controller within the first duration after the target domain controller sends the upgrade flag signal, the target domain controller will execute subsequent control logic. When the target domain controller receives the takeover rejection signal from the takeover controller within the first duration after sending its own upgrade flag signal, it can determine that the vehicle is not currently in a high-voltage state, and the target domain controller will directly perform an OTA upgrade.

[0072] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, the method further includes: if the target domain controller does not receive a high-voltage takeover ready signal and a takeover rejection signal from the takeover controller within a first time period, the target domain controller performs an OTA upgrade after powering off the vehicle's high voltage.

[0073] In this embodiment, if the target domain controller does not receive the high-voltage takeover ready signal and the takeover rejection signal from the takeover controller within the first time period after it sends the upgrade flag signal, the target domain controller will no longer wait for the takeover controller to take over, and it will directly execute the vehicle high-voltage power-off logic and then perform OTA upgrade.

[0074] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, the method further includes: if the target domain controller does not receive a high-voltage takeover status signal sent by the takeover controller within a third time period, the target domain controller performs an OTA upgrade after powering off the vehicle's high voltage.

[0075] In this embodiment, if the target domain controller waits for a third time after stopping the high-voltage control command for a set period without receiving the high-voltage takeover status signal from the takeover controller, it determines that the takeover controller has failed to take over the high-voltage control of the vehicle for an extended period. To prevent the high-voltage component actuator from failing to send the high-voltage control command for an extended period, which would cause the high-voltage component actuator to execute its own fault response strategy and prevent OTA upgrades from being performed, the target domain controller will directly execute the vehicle high-voltage power-off logic and then perform an OTA upgrade.

[0076] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, the method further includes: if monitoring determines that the target domain controller has not stopped issuing high-voltage control commands within a second time period, sending a high-voltage takeover failure signal to the target domain controller, so as to control the target domain controller to perform an OTA upgrade after the vehicle's high-voltage power is turned off if an OTA upgrade is still required.

[0077] In this embodiment, when the takeover controller detects that the target domain controller has not stopped issuing high-voltage control commands within the second time period, the takeover controller will exit the takeover and send a high-voltage takeover failure signal to the target domain controller to inform the target domain controller that the takeover controller will no longer take over high-voltage control. If the target domain controller still needs to perform an OTA upgrade, it will directly execute the vehicle high-voltage power-off logic based on the high-voltage takeover failure signal and then perform the OTA upgrade.

[0078] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this OTA upgrade high-voltage maintenance method, the method further includes: in response to an upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within a fourth time period, sending an exit takeover signal to the target domain controller to control the target domain controller to begin taking over the high-voltage control of the vehicle; and in response to a takeover signal sent by the target domain controller based on the exit takeover signal, stopping the issuance of high-voltage control commands to control the target domain controller to send high-voltage control commands within a third time period.

[0079] In this embodiment, the time spent by the target domain controller on OTA upgrade is basically the same, with no significant deviation. Therefore, after the target domain controller completes the OTA upgrade, it sends an upgrade completion flag signal to the takeover controller. If the time between the takeover controller receiving the upgrade completion flag signal and issuing its first high-voltage control command is less than or equal to the fourth time interval, the takeover controller will send a takeover exit signal to the target domain controller. Upon receiving the takeover exit signal, the target domain controller will begin to execute corresponding actions to take over the high-voltage control of the vehicle. At this time, the target domain controller sends a takeover signal to the takeover controller based on the takeover exit signal, and the takeover controller, upon receiving the takeover signal, stops issuing high-voltage control commands. The target domain controller will monitor in real time whether the takeover controller has stopped issuing high-voltage control commands. If it is determined that the takeover controller has stopped issuing high-voltage control commands, the target domain controller will send high-voltage control commands within the third time interval. The rule for determining whether the takeover controller has stopped issuing high-voltage control commands is: monitoring whether the takeover controller has not issued any high-voltage control commands within the set time interval. If the takeover controller has not issued any high-voltage control commands within the set time interval, it is determined that the high-voltage redundant domain controller has stopped issuing high-voltage control commands. The fourth duration can be determined based on the OTA upgrade duration, and is not specifically limited here; the sum of the third duration and the set duration is less than the agreed duration.

[0080] In this embodiment, if the takeover controller itself fails to stop issuing high-voltage control commands within the second preset time period, it will directly execute the high-voltage power-off logic to control the high-voltage power-off of the entire vehicle.

[0081] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, controlling the target domain controller to send high-voltage control commands within a third time period includes: controlling the target domain controller to run the software to a high-voltage state in advance; and based on the high-voltage state reached by the software, controlling the target domain controller to send high-voltage control commands within the third time period.

[0082] In this embodiment, after the target domain controller determines that the takeover controller has stopped issuing high-voltage control commands, since the vehicle is still in a high-voltage state, the target domain controller will immediately run its internal software to the high-voltage state in advance, and then issue high-voltage control commands within a third time period. The total time spent running the internal software to the high-voltage state in advance and issuing high-voltage control commands must be less than the third time period.

[0083] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this OTA upgrade high-voltage maintenance method, the method further includes: controlling the vehicle to power down at high voltage in response to a rejection takeover signal sent by the target domain controller based on the exit takeover signal.

[0084] In this embodiment, due to vehicle configuration limitations, some vehicle models' target domain controllers do not have the logic to control the internal software of the target domain controller to run to a high-voltage state in advance. Therefore, after the target domain controller receives the exit takeover signal from the takeover controller, it will send a refuse takeover signal to the takeover controller based on the fact that it does not have the logic to control the internal software of the target domain controller to run to a high-voltage state in advance. The takeover controller then controls the entire vehicle to power down at high voltage based on the received refuse takeover signal.

[0085] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, the method further includes: controlling the vehicle to power down at high voltage in response to not receiving an upgrade completion flag signal within a fourth time period; controlling the vehicle to power down at high voltage in response to an upgrade failure flag signal sent by the target domain controller after an OTA upgrade failure within the fourth time period; and controlling the vehicle to power down at high voltage if a fault is detected during the upgrade process of the target domain controller.

[0086] In this embodiment, if the target domain controller does not receive an upgrade completion flag signal from the target domain controller within the fourth time period, it is determined that the OTA upgrade of the target domain controller has malfunctioned. In this case, the takeover controller will directly control the vehicle to power down. If the target domain controller receives an upgrade failure flag signal from the target domain controller within the fourth time period, the takeover controller will also directly control the vehicle to power down. If the takeover controller detects that the target domain controller has malfunctioned during the OTA upgrade process, the takeover controller will also directly control the vehicle to power down.

[0087] In this embodiment, the logic for controlling the high-voltage power-on and power-off of the vehicle by the high-voltage redundancy control program configured in the takeover controller includes the following state transitions. For example... Figure 4As shown, when the high-voltage connection of the connection controller is turned on and the high-voltage connection state is met, the connection controller jumps from the initial state to the high-voltage activation state. At this time, the connection controller can directly send the high-voltage control command according to the high-voltage activation state command agreed with the high-voltage component controller, without having to execute the high-voltage power-on control process again (because the vehicle is already in a high-voltage state at this time, and will not execute the high-voltage power-on execution process as when it is first turned on).

[0088] If the takeover controller receives an upgrade completion signal but also receives a takeover rejection signal within the fourth time period, or if the takeover controller does not receive an upgrade completion signal within the fourth time period, or if the takeover controller receives an upgrade failure signal within the fourth time period, or if the monitoring determines that a fault has occurred during the upgrade process of the target domain controller, the takeover controller sends a pre-agreed high-pressure unloading command to the high-pressure component controller to switch from the high-pressure activation state to the high-pressure load unloading state.

[0089] If the vehicle does not experience a high-voltage fault and the high-voltage load is unloaded, or if the vehicle does not experience a high-voltage fault but remains in the high-voltage load unloading state for more than the agreed maximum time, the takeover controller sends an agreed active short-circuit command to the high-voltage component controller and switches to the active short-circuit state. If the vehicle experiences a high-voltage fault, the takeover controller sends an agreed high-voltage cut-off command to the high-voltage component controller and switches to the high-voltage cut-off state.

[0090] In the event of a high-voltage fault in the vehicle, completion of an active short circuit, or an active short circuit exceeding the agreed maximum time, the takeover controller sends an agreed high-voltage cut-off command to the high-voltage component controller and switches to the high-voltage cut-off state.

[0091] When the battery relay has been disconnected for a certain period of time, or when the high voltage cut-off state has been in place for more than the agreed maximum time, the takeover controller sends an agreed high voltage discharge command to the high voltage component controller and switches to the active discharge state.

[0092] When high-voltage discharge is completed or when the high-voltage discharge state exceeds the agreed maximum time, the takeover controller sends an agreed standby command to the high-voltage component controller, jumps to the standby state, and sends a corresponding signal to inform the target domain controller that it has exited the high-voltage takeover state.

[0093] When the takeover controller completes the high-voltage power-down and enters standby mode, it notifies the target domain controller to exit the high-voltage takeover state in two ways: If the target domain controller is successfully flashed, it will enter standby mode upon receiving this signal, and will resume high-voltage operation for the entire vehicle upon receiving a user request; if the target domain controller is not successfully flashed, it will not receive this signal, which effectively ensures the high-voltage safety of the entire vehicle. After the maintenance personnel repair the target domain controller, the high-voltage operation for the entire vehicle will be restored to the target domain controller.

[0094] In conjunction with the above embodiments, in one implementation, this application also provides a high-voltage maintenance method for OTA upgrades. In this high-voltage maintenance method for OTA upgrades, when the takeover controller is a high-voltage component controller that performs high-voltage control on itself by the target domain controller, the high-voltage control is performed through internal signal interaction.

[0095] In this embodiment, when the takeover controller is a high-voltage component controller, it not only acts as the main controller for taking over high-voltage control but also as a high-voltage component controller being controlled by high voltage. When the high-voltage component controller, acting as a takeover controller, performs high-voltage control on other high-voltage component controllers, it directly interacts with them through communication links to achieve high-voltage control. However, when the high-voltage component controller, acting as a takeover controller, performs high-voltage control on itself, it deploys a high-voltage redundancy control program within an internal region. Therefore, when controlling itself, the high-voltage component controller, based on this high-voltage redundancy control program, interacts with other regions within its own internal system via internal signal interaction to perform high-voltage control on other regions.

[0096] Based on the same inventive concept, one embodiment of this application provides a high-voltage maintenance system for OTA upgrades, such as... Figure 5 As shown, the system 500 includes a takeover controller 501 and a target domain controller 502, the takeover controller including:

[0097] The takeover signal sending module 5011 is used to respond to the upgrade flag signal of the target domain controller performing OTA upgrade. When it can receive the high voltage switch signal, it sends a high voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high voltage control commands. The target domain controller is the domain controller that performs high voltage control.

[0098] The monitoring module 5012 is used to perform high-voltage control on the vehicle based on the received high-voltage switch signal when the monitoring determines that the target domain controller is not performing high-voltage control.

[0099] The high-voltage control module 5013 is used to send a high-voltage control command within a third time period after monitoring and determining that the target domain controller stops issuing high-voltage control commands within a second time period, so as to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the stop issuing high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller.

[0100] The status signal sending module 5014 is used to continuously send a high-voltage takeover status signal to the target domain controller when the high-voltage control of the vehicle is taken over, so as to control the target domain controller to perform OTA upgrade. The takeover controller includes one of the following: other domain controllers in the vehicle, controllers that have communication links with the high-voltage component controller and the target domain controller, and high-voltage component controllers that perform high-voltage control on the target domain controller.

[0101] Optionally, the system 500 further includes:

[0102] The target domain controller is used to perform OTA upgrades after the vehicle's high voltage is powered down if the target domain controller does not receive a high voltage takeover ready signal or a takeover rejection signal from the takeover controller within a first time period.

[0103] Optionally, the system 500 further includes:

[0104] The target domain controller is also used to perform OTA upgrades after the vehicle's high voltage is powered down if the target domain controller does not receive a high voltage takeover status signal from the takeover controller within a third time period.

[0105] Optionally, the system 500 further includes:

[0106] The high-voltage takeover failure signal sending module is used to send a high-voltage takeover failure signal to the target domain controller when the target domain controller fails to stop issuing high-voltage control commands within a second time period, so as to control the target domain controller to perform OTA upgrade after the vehicle high-voltage power is turned off if OTA upgrade is still required.

[0107] Optionally, the system 500 further includes:

[0108] The exit takeover signal sending module is used to send an exit takeover signal to the target domain controller in response to the upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within the fourth time period, so as to control the target domain controller to start taking over the high voltage control of the vehicle.

[0109] The high-voltage control command stop module is used to stop sending high-voltage control commands in response to a takeover signal sent by the target domain controller based on the exit takeover signal, so as to control the target domain controller to send high-voltage control commands within a third time period.

[0110] Optionally, the target domain controller is further configured to pre-run the software to a high-voltage state; and to send high-voltage control commands within a third time period based on the high-voltage state reached by the software.

[0111] Optionally, the system 500 further includes:

[0112] The high-voltage control module 5012 is also used to control the vehicle to power down in response to a rejection signal sent by the target domain controller based on the exit takeover signal.

[0113] Optionally, the system 500 further includes:

[0114] The high-voltage control module 5012 is also used to control the vehicle to power down in response to the failure to receive an upgrade completion flag signal within the fourth time period; and to control the vehicle to power down in response to an upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period; and to control the vehicle to power down in the event that a fault has occurred during the upgrade process of the target domain controller.

[0115] Optionally, the system 500 further includes:

[0116] The status determination module is used to determine the vehicle status in response to the upgrade flag signal of the target domain controller performing an OTA upgrade, when it is unable to receive the high-voltage switch signal.

[0117] The takeover signal transmission module is used to send a high-voltage takeover ready signal to the target domain controller within a first time period when the vehicle is in a high-voltage state, so as to control the target domain controller to stop issuing high-voltage control commands.

[0118] The high-voltage control module is used to send a high-voltage control command within a third time period after detecting and determining that the target domain controller stops issuing high-voltage control commands within a second time period, so as to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the stop issuing high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller.

[0119] The status signal sending module is used to continuously send high-voltage takeover status signals to the target domain controller when the high-voltage control of the vehicle is taken over, so as to control the target domain controller to perform OTA upgrade.

[0120] Optionally, the system 500 further includes:

[0121] The takeover rejection signal sending module is used to send a takeover rejection signal to the target domain controller within a first time period when the vehicle is not under high voltage, so as to control the target domain controller to perform OTA upgrade.

[0122] Optionally, when the receiver controller in the system 500 is a high-voltage component controller that performs high-voltage control on the target domain controller, the receiver controller performs high-voltage control on itself through internal signal interaction.

[0123] Based on the same inventive concept, one embodiment of this application provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and running on the processor. When the computer program is executed by the processor, it implements the steps in the high-voltage maintenance method for OTA upgrades as described in the first aspect of this application.

[0124] Based on the same inventive concept, one embodiment of this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the high-voltage maintenance method for OTA upgrades as described in the first aspect of this application.

[0125] As the system implementation is basically similar to the method implementation, it is described in a relatively simple way. For relevant details, please refer to the description of the method implementation.

[0126] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of this application.

[0127] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0128] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0132] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0133] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0134] The above provides a detailed description of the high-voltage maintenance method, system, and product for OTA upgrades provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A high-pressure maintenance method for OTA upgrades, characterized in that, Applied to a pipe connection controller, wherein the pipe connection controller is equipped with a high-voltage redundant control program, the method includes: In response to the upgrade flag signal of the target domain controller performing OTA upgrade, and provided that it can receive the high voltage switch signal, it sends a high voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high voltage control commands. The target domain controller is the domain controller that performs high voltage control. If monitoring determines that the target domain controller is not performing high-voltage control, high-voltage control is performed on the vehicle based on the received high-voltage switch signal; If the monitoring determines that the target domain controller stops issuing high-voltage control commands within a second time period, a high-voltage control command is sent within a third time period to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the suspension of high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller. When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

2. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The method further includes: If the target domain controller does not receive a high-voltage takeover ready signal or a takeover rejection signal from the takeover controller within the first time period, the target domain controller will perform an OTA upgrade after powering off the vehicle's high voltage.

3. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The method further includes: If the target domain controller does not receive a high-voltage takeover status signal from the takeover controller within the third time period, the target domain controller will perform an OTA upgrade after powering off the vehicle's high voltage.

4. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The method further includes: If the target domain controller fails to stop issuing high-voltage control commands within the second time period, a high-voltage takeover failure signal is sent to the target domain controller to control the target domain controller to perform an OTA upgrade after the vehicle's high-voltage power is turned off if an OTA upgrade is still required.

5. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The method further includes: In response to the upgrade completion flag signal sent by the target domain controller after the OTA upgrade is completed within the fourth time period, an exit takeover signal is sent to the target domain controller to control the target domain controller to start taking over the high voltage control of the vehicle; In response to the takeover signal sent by the target domain controller based on the exit takeover signal, the high-voltage control command is stopped, thereby controlling the target domain controller to send high-voltage control commands within a third time period.

6. The high-voltage maintenance method for OTA upgrades according to claim 5, characterized in that, Controlling the target domain controller to send high-voltage control commands within a third time period includes: The target domain controller is instructed to run the software to a high-voltage state in advance. Based on the high-voltage state reached during software operation, the target domain controller is controlled to send high-voltage control commands within a third time period.

7. The high-voltage maintenance method for OTA upgrades according to claim 5, characterized in that, The method further includes: In response to the rejection signal sent by the target domain controller based on the exit takeover signal, the vehicle is controlled to shut down at high voltage.

8. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The method further includes: If the upgrade completion signal is not received within the fourth time period, the vehicle will be powered down. In response to the upgrade failure flag signal sent by the target domain controller after the OTA upgrade fails within the fourth time period, the vehicle is controlled to shut down the high voltage. If a fault is detected during the upgrade of the target domain controller, the entire vehicle will be powered down.

9. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The method further includes: In response to the upgrade flag signal of the target domain controller for OTA upgrade, the vehicle status is determined when it is unable to receive the high-voltage switch signal. When the vehicle is under high pressure, a high-pressure takeover ready signal is sent to the target domain controller within a first time period to control the target domain controller to stop issuing high-pressure control commands. If the target domain controller stops issuing high-voltage control commands within a second time period, it sends high-voltage control commands within a third time period to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the suspension of high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller. When taking over the high-voltage control of the vehicle, a high-voltage takeover status signal is continuously sent to the target domain controller to control the target domain controller to perform OTA upgrade.

10. The high-voltage maintenance method for OTA upgrades according to claim 9, characterized in that, The method further includes: If the vehicle is not under high voltage, a takeover rejection signal is sent to the target domain controller within a first time period to control the target domain controller to perform an OTA upgrade.

11. The high-voltage maintenance method for OTA upgrades according to claim 1, characterized in that, The takeover controller includes one of the following: an on-board other domain controller, a controller that has a communication link with the high-voltage component controller and the target domain controller, and a high-voltage component controller that performs high-voltage control on the target domain controller.

12. The high-voltage maintenance method for OTA upgrades according to claim 11, characterized in that, When the receiver controller is a high-voltage component controller that performs high-voltage control on the target domain controller, the receiver controller performs high-voltage control on itself through internal signal interaction.

13. A high-voltage maintenance system for OTA upgrades, characterized in that, The system includes: The takeover signal transmission module is used to respond to the upgrade flag signal of the target domain controller performing OTA upgrade. When it can receive the high voltage switch signal, it sends a high voltage takeover ready signal to the target domain controller within a first time period to control the target domain controller to stop sending high voltage control commands. The target domain controller is the domain controller that performs high voltage control. The monitoring module is used to perform high-voltage control on the vehicle based on the received high-voltage switch signal when the monitoring determines that the target domain controller is not performing high-voltage control. The high-voltage control module is used to send a high-voltage control command within a third time period after monitoring and determining that the target domain controller stops issuing high-voltage control commands within a second time period, so as to take over the high-voltage control of the vehicle. The sum of the third time period and the time period corresponding to the suspension of high-voltage control commands is less than the agreed time period between the target domain controller and the high-voltage component controller. The status signal sending module is used to continuously send high-voltage takeover status signals to the target domain controller when the high-voltage control of the vehicle is taken over, so as to control the target domain controller to perform OTA upgrade.

14. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and running on the processor, wherein the computer program, when executed by the processor, implements the steps of a high-voltage maintenance method for an OTA upgrade as claimed in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of a high-pressure maintenance method for OTA upgrades as described in any one of claims 1 to 12.

Images