Dual MCU firmware upgrade method and system for a braking system based on SPI communication

Abstract

The present invention relates to the technical field of vehicle braking systems, in particular to a method and system for dual-MCU firmware upgrade of a braking system based on SPI communication, including a main MCU, a secondary MCU, a host computer, and a vehicle CAN bus. Four partitions A, B, A1, and B1 are established in the Flash area of the main MCU. Partition A and partition B are respectively used as the A partition and the B partition of the main MCU, and partitions A1 and B1 are respectively used as the A1 partition and the B1 partition of the secondary MCU. Relying on the vehicle CAN bus, using a set of host computers and diagnostic IDs, and relying on the SPI communication between the main and secondary MCUs to perform software updates of the secondary MCU, and at the same time using the Flash area of the main MCU to back up the application programs of the secondary MCU, an operation for rolling back the application programs of the secondary MCU is realized, ensuring the safety of the vehicle when the host computer fails to write, being efficient and concise, and being compatible with the diagnostic writing system of a single MCU.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle braking systems, and particularly to a method and system for firmware upgrade of a dual-MCU in a braking system based on SPI communication. Background Art

[0002] A microcontroller (hereinafter referred to as MCU) is the core of an embedded system. With the wide application of embedded systems in fields such as automotive electronics, the multi-microcontroller unit (Multi-MCU) architecture has become the preferred solution for key systems due to its high reliability. In the braking system of the automotive electronics field, the integrated braking system has been increasingly widely used due to its multiple functions, small size, and high performance. The integrated braking system has multiple functions, such as anti-lock braking, electronic brake force distribution, electronic parking, etc. To meet the requirements of functional safety, the current electronic parking function of the integrated braking system relies on a dual-MCU control unit, thus having a redundant backup function. The dual-MCU control unit includes two MCUs (hereinafter referred to as the main MCU and the auxiliary MCU). The main MCU has an electronic parking function and other braking functions, while the auxiliary MCU only has an electronic parking function. If either the main or the auxiliary MCU fails later, the electronic parking function can still be ensured not to fail.

[0003] Because the integrated braking system has a main and an auxiliary MCU, when software is updated, the firmware of the dual-MCU generally needs to be updated. The traditional method is to rely on the vehicle CAN bus, specify two sets of diagnostic IDs, and update the main and auxiliary MCUs respectively. This method generally requires the vehicle OEM to develop two sets of upper computer software for the braking system, which is cumbersome and time-consuming; at the same time, because the Flash area (non-volatile storage area) of the auxiliary MCU is generally small, it does not support A and B partitions. Once the upper computer loses power during the flashing process, the application program rollback is not supported, and the upper computer needs to be re-flashed to work. Summary of the Invention

[0004] The object of the present invention is to provide a method and system for firmware upgrade of a dual-MCU in a braking system based on SPI communication. Relying on the vehicle CAN bus, using a set of upper computer and diagnostic ID, relying on the SPI communication between the main and auxiliary MCUs to update the software of the auxiliary MCU, and at the same time using the Flash area of the main MCU to back up the application program of the auxiliary MCU, realizing the operation of the application program rollback of the auxiliary MCU, ensuring the vehicle safety when the upper computer flashing fails, being efficient and streamlined, and being compatible with the diagnostic flashing system of a single MCU.

[0005] To achieve the above object, the present invention provides a method for firmware upgrade of a dual-MCU in a braking system based on SPI communication, including the following steps:

[0006] S1. Create four partitions A, B, A1, and B1 in the Flash area of the main MCU. Partition A and partition B are respectively used as the A partition and B partition of the main MCU, and partition A1 and partition B1 are respectively used as the A1 partition and B1 partition of the auxiliary MCU;

[0007] S2. Use a programmer to write the initial application program in the corresponding Flash areas of the main MCU and the auxiliary MCU. Write the initial main MCU application program in partition A of the main MCU, and write the initial auxiliary MCU application program in partition A1 of the main MCU and the Flash area of the auxiliary MCU itself;

[0008] S3. Perform pre-programming to prepare the CAN network before writing;

[0009] S4. Integrate the application software of the main MCU and the auxiliary MCU into an update package. Distinguish the firmware areas of the main MCU and the auxiliary MCU by address. The host computer transmits the flash drive FlashDriver to the RAM area of the main MCU, and at the same time synchronously transmits it to the RAM area of the auxiliary MCU using SPI communication;

[0010] S5. Erase the application program in the current B area of the main MCU, the application program in the backup B1 area of the auxiliary MCU, and the application program in the Flash area of the auxiliary MCU itself;

[0011] S6. Transmit the main MCU application software to area B of the main MCU;

[0012] S7. Transmit the application software of the auxiliary MCU to area B1 of the main MCU, and while transmitting to area B1, synchronously transmit the application software of the auxiliary MCU to the Flash area of the auxiliary MCU itself using SPI communication;

[0013] S8. Perform post-programming to restore the vehicle CAN network and the function of recording diagnostic trouble codes;

[0014] S9. The main MCU restarts and jumps to run the application program in its own area B, and the auxiliary MCU restarts to run the application program in its own Flash area. Area B1 of the main MCU is also updated and is used for the rollback writing of the auxiliary MCU in case of a writing failure next time.

[0015] Preferably, in step S2, when the main MCU runs, it jumps to run the application program in partition A through its own bootloader, and the auxiliary MCU runs the application program in its own Flash area.

[0016] Preferably, the SPI communication mechanism is used to transmit the FlashDriver and the auxiliary MCU application program. When SPI data is transmitted, the SPI data is encapsulated into larger encapsulated data, which consists of an identification group, a CRC check code, and SPI data. The identification group is used to ensure the continuity of data transmission, and the CRC check code is used to ensure the integrity of data transmission. Several SPI communications form a data packet, and receiving or sending a complete data packet is regarded as one data exchange.

[0017] Preferably, the identification group includes a normal application program interaction identifier and a program flashing identifier, which are used to distinguish the SPI communication frame category and ensure the continuity identification of data respectively.

[0018] Preferably, the same CRC check algorithm is defined between the main MCU and the auxiliary MCU for the CRC check code. The CRC check algorithm predefines an array, and uses the received SPI data to perform relevant operations with the data corresponding to the identifier position in the predefined array, and ensures that the calculated check code with the same length as the CRC check code is output. The calculated check code is compared with the CRC check code. If the check codes are the same, the data transmitted by this frame is used; otherwise, it is determined to be invalid.

[0019] Preferably, the data packet transmits flashing data. During flashing transmission, the data packet is divided into instruction bytes and reserved bytes. The instruction bytes transmit the flashing instructions from the host computer received by the main MCU to the auxiliary MCU completely. The instruction bytes are responsible for transmitting the diagnostic ID and the data field content of the CAN standard frame. After the auxiliary MCU receives the data packet and completes internal parsing and processing, it feeds back the CAN diagnostic frame that conforms to the vehicle manufacturer's flashing specification to the main MCU in the form of an SPI data packet again. After the main MCU completes parsing, it feeds back to the host computer through the CAN bus to complete the diagnostic request - feedback operation during one flashing process. Repeat the above process until the entire flashing process is completed.

[0020] Preferably, the rollback flashing is used to perform the rollback flashing of the auxiliary MCU by using the main MCU in case of an unexpected sudden interruption of the host computer interaction during the flashing process. A flag bit for auxiliary MCU flashing failure is set in the BootLoader of the main MCU. When an unexpected power failure of the host computer occurs during data transmission, and at this time the braking system is still powered on and has not been restarted, the flag bit for auxiliary MCU flashing failure is set. At this time, the Bootloader of the main MCU independently uses the auxiliary MCU application program stored in the Flash area of the main MCU for rollback refreshing. At this time, the SPI communication mechanism and the flashing process are the same as those during normal use of the host computer for flashing communication. After waiting for the rollback refreshing to complete, the main MCU and the auxiliary MCU are automatically reset and run the program after flashing.

[0021] A dual-MCU firmware upgrade system for the braking system based on SPI communication, including a flash writer, a host computer, a vehicle CAN bus, a main MCU, and a secondary MCU;

[0022] Flash writer, used to flash the initial application program into the corresponding Flash area of the main MCU and auxiliary MCU;

[0023] The main MCU is used to flash the application program in its own Flash area, back up the application program in the Flash area of the auxiliary MCU, and synchronize data transmission with the auxiliary MCU through SPI communication;

[0024] Auxiliary MCU, used to synchronize data transmission between the main MCU and the slave MCU via SPI communication;

[0025] The host computer is used to execute the flashing process and monitor the flashing process;

[0026] The vehicle CAN bus is used to connect the host computer and the main MCU to ensure data transmission between the main MCU and the host computer.

[0027] Therefore, the present invention adopts the above-mentioned SPI communication-based braking system dual MCU firmware upgrade method and system, which relies on the vehicle CAN bus, adopts a set of host computers and diagnostic IDs, and relies on SPI communication between the main and auxiliary MCUs to update the software of the auxiliary MCU. At the same time, the Flash area of the main MCU is used to back up the application of the auxiliary MCU, and realize the rollback operation of the auxiliary MCU application, ensuring the vehicle safety when the host computer fails to flash, efficient and streamlined, and compatible with the diagnostic flash system of a single MCU.

[0028] The present invention has the following beneficial effects:

[0029] 1. Only one set of host computer and diagnostic ID is required. Compared with the traditional dual-MCU diagnostic flashing system which requires two sets of host computers and diagnostic IDs, it is more efficient and streamlined, and is also compatible with the diagnostic flashing system of a single MCU.

[0030] 2. Implemented the auxiliary MCU application rollback operation to ensure vehicle safety when the host computer flash fails. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a flow chart of the dual MCU firmware upgrade method for the braking system based on SPI communication of the present invention;

[0032] Figure 2 This is a diagram of the SPI single transmission and data packet structure under flash communication provided by the dual MCU firmware upgrade method of the braking system based on SPI communication of the present invention. DETAILED DESCRIPTION

[0033] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. The following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0034] Embodiment

[0035] As Figure 1 shown, a method for dual-MCU firmware upgrade of a braking system based on SPI communication includes the following steps:

[0036] S1. Establish four partitions A, B, A1, and B1 in the Flash area of the main MCU. The A partition and the B partition are respectively used as the A partition and the B partition of the main MCU, and the A1 and B1 partitions are respectively used as the A1 partition and the B1 partition of the auxiliary MCU;

[0037] S2. Use a programmer to write the initial application programs in the corresponding Flash areas of the main MCU and the auxiliary MCU. Write the initial main MCU application program in the A partition of the main MCU, and write the initial auxiliary MCU application program in the A1 partition of the main MCU and the Flash area of the auxiliary MCU itself;

[0038] S3. Pre-program to prepare the CAN network before writing;

[0039] S4. Integrate the application software of the main MCU and the auxiliary MCU into an update package. Distinguish the firmware areas of the main MCU and the auxiliary MCU by address. The host computer transfers the flash driver FlashDriver to the RAM area of the main MCU, and at the same time synchronously transfers it to the RAM area of the auxiliary MCU using SPI communication;

[0040] S5. Erase the application program in the current B area of the main MCU, the application program in the backup B1 area of the auxiliary MCU, and the application program in the Flash area of the auxiliary MCU itself;

[0041] S6. Transfer the main MCU application software to the B area of the main MCU;

[0042] S7. Transfer the application software of the auxiliary MCU to the B1 area of the main MCU. While transferring to the B1 area, synchronously transfer the application software of the auxiliary MCU to the Flash area of the auxiliary MCU itself using SPI communication;

[0043] S8. Function of restoring the vehicle CAN network and recording diagnostic trouble codes after programming;

[0044] S9. When the main MCU restarts, it jumps to the application program in its own B area to run, and the auxiliary MCU restarts to run the application program in its own Flash area. The B1 area of the main MCU is also updated, which is used for the rollback programming of the auxiliary MCU when the programming fails next time.

[0045] In step S2, when the main MCU runs, it jumps to the application program in partition A through its own bootloader, and the auxiliary MCU runs the application program in its own Flash area.

[0046] The SPI communication between the main MCU and the auxiliary MCU transmits application data when the application program is working properly. Therefore, a new SPI communication form needs to be established during programming transmission to transmit the FlashDriver and the application program of the auxiliary MCU. When each SPI data communication transmits 8 bits, for the integrity and continuity of the data, it is encapsulated into 16-bit encapsulated data for transmission. The structure diagram is as shown in Figure 2 the single transmission frame structure in. The first 8 bits are composed of an identification group (5 bits) and a CRC check code (3 bits), and the last 8 bits are the SPI data to be transmitted. The identification group is used to ensure the continuity of data transmission, and the CRC check code is used to ensure the integrity of data transmission. Several SPI communications form a data packet, and receiving or sending a complete data packet is one data exchange. When a data packet is composed of n 16-bit encapsulated data and managed by a 5-bit identification group, the maximum value of n is 31. When a data contains 20 16-bit encapsulated data, a data contains 20 bytes of programming data. The first 20 (range 0 - 19) of the identification group are listed as normal application program interaction identifiers, and the last 10 (range 20 - 29) are listed as program programming identifiers. In this way, it can not only distinguish the SPI communication frame category but also achieve the continuity recognition of data.

[0047] The CRC checksum stipulates the same CRC check algorithm between the main and auxiliary MCUs. Since the SPI communication transmission channel and CRC check algorithm are shared for transmitting normal application program data and flashing data, an 8-bit array with a size of 20 is defined to correspond to the 20 bytes of flashing data in a data packet for CRC check. The received 8-bit data is subjected to relevant operations with the data corresponding to the identifier position in the pre-defined 8-bit array (for example, if the identifier is 29, it is the 10th data in the array. Since the range of the program flashing identifier is 20 - 29, the identifier 29 corresponds to the 10th data in the array; since the range of the normal application program interaction identifier is 0 - 19, the identifier 9 also corresponds to the 10th data in the array), and it is ensured that the calculated checksum with an output length of 3 bits is obtained. Finally, this checksum is compared with the received CRC checksum. Only when the calculated checksum obtained by the receiving party using the 8-bit data area is the same as the transmitted CRC checksum can the data transmitted in this frame be used; otherwise, it is determined to be invalid.

[0048] On the other hand, during the flashing transmission, a data packet transmits 20 bytes of flashing data. During the flashing transmission, the first 10 bytes of the flashing data packet are used as instruction bytes, and the last 10 bytes are reserved. The first 10 bytes of the flashing data packet should completely transfer the flashing instruction from the host computer received by the main MCU to the auxiliary MCU. The first 2 bytes transmit the diagnostic ID, and the last 8 bytes transmit the data field content of the CAN standard frame. The SPI single transmission and data packet structure diagram under the flashing communication are as Figure 2 shown. After the auxiliary MCU receives the SPI data packet for the flashing transmission and completes the internal parsing and processing, it feeds back the CAN diagnostic frame that complies with the host factory flashing specification to the main MCU in the form of an SPI data packet again. After the main MCU completes the parsing, it feeds back to the flashing host computer through the CAN bus to complete the diagnostic request - feedback operation during a single flashing process. Repeat the above process until the entire flashing process is completed.

[0049] When the main MCU program flashing process is suddenly interrupted, since the main MCU has partitions A and B, it will automatically restart; when the auxiliary MCU program flashing process is suddenly interrupted, the rollback flashing mechanism of the auxiliary MCU needs to be applied. The main MCU's BootLoader sets the auxiliary MCU flashing failure flag bit. At this time, the braking system is still powered on and has not been restarted. Set the auxiliary MCU flashing failure flag bit. At this time, the main MCU's Bootloader will autonomously use the auxiliary MCU application program stored in the Flash area of the main MCU to perform rollback refresh. At this time, the SPI communication mechanism and the flashing process are the same as when using the host computer for flashing communication normally. After waiting for the rollback refresh to complete, the main and auxiliary MCUs will automatically reset and restart, and run the flashed program. When the rollback refresh of the auxiliary MCU fails twice repeatedly, the main MCU needs to push the relevant function failures of the auxiliary MCU to the vehicle, such as the failures related to the vehicle's electronic parking function.

[0050] The dual-MCU firmware upgrade system for the braking system based on SPI communication includes a flasher, a host computer, a vehicle CAN bus, a main MCU, and an auxiliary MCU;

[0051] The flasher is used to flash the initial application program in the corresponding Flash areas of the main MCU and the auxiliary MCU;

[0052] The main MCU is used to flash the application program in its own Flash area, back up the application program in the Flash area of the auxiliary MCU, and synchronously transmit data with the auxiliary MCU through SPI communication;

[0053] The auxiliary MCU is used to synchronously transmit data with the main MCU through SPI communication;

[0054] The host computer is used to execute the flashing process and monitor the flashing process;

[0055] The vehicle CAN bus is used to connect the host computer and the main MCU to ensure data transmission between the main MCU and the host computer.

[0056] Therefore, the present invention adopts the above-mentioned dual-MCU firmware upgrade method and system for the braking system based on SPI communication, realizes software update of the auxiliary MCU relying on the vehicle CAN bus, using a set of host computer and diagnostic ID, relying on the SPI communication between the main and auxiliary MCUs, and at the same time uses the Flash area of the main MCU to back up the application program of the auxiliary MCU, realizes the operation of rolling back the application program of the auxiliary MCU, ensures the vehicle safety when the host computer flashing fails, is efficient and streamlined, and is compatible with the diagnostic flashing system of single MCU.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions of the present invention or make equivalent replacements, and these modifications or equivalent replacements cannot make the modified technical solutions deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A dual-MCU firmware upgrade method for a braking system based on SPI communication, characterized by: The following steps are involved: S1. Create four partitions A, B, A1, and B1 in the Flash area of the master MCU. Partition A and partition B serve as the A partition and B partition of the master MCU respectively. Partition A1 and partition B1 serve as the A1 partition and B1 partition of the slave MCU respectively. S2. Use a flash writer to flash the initial application program in the corresponding Flash areas of the master MCU and slave MCU. Flash the initial master MCU application program in the A partition of the master MCU, and flash the initial slave MCU application program in the A1 partition of the master MCU and the Flash area of the slave MCU itself. S3, pre-programming to prepare the CAN network before flashing; S4. The application software of the main MCU and the auxiliary MCU are merged into one update package. The firmware areas of the main MCU and the auxiliary MCU are distinguished by address. The host computer transfers the Flash Driver to the RAM area of the main MCU and simultaneously transfers it to the RAM area of the auxiliary MCU using SPI communication. The SPI communication mechanism is used to transmit FlashDriver and auxiliary MCU applications. When SPI data is transmitted, the SPI data is encapsulated into larger encapsulated data. The encapsulated data consists of an identification group, a CRC check code, and SPI data. The identification group is used to ensure the continuity of data transmission, and the CRC check code is used to ensure the integrity of data transmission. Several SPI communications constitute a data packet, and receiving or sending a complete data packet is considered a data exchange. S5, erase the application program in the current B area of the main MCU, the application program in the backup B1 area of the auxiliary MCU, and the application program in the Flash area of the auxiliary MCU itself; S6. Transfer the main MCU application software to area B of the main MCU; S7, transfer the application software of the auxiliary MCU to the B1 area of the main MCU. While transferring the application software to the B1 area, use SPI communication to transfer the application software of the auxiliary MCU to the Flash area of the auxiliary MCU itself; S8, post-programming restores the vehicle's CAN network and records diagnostic trouble code functions; S9. The main MCU restarts and jumps to its own B area to run the application. The auxiliary MCU restarts and runs the application in its own Flash area. The B1 area of the main MCU is also updated and is used for the rollback flash of the auxiliary MCU when the flash fails next time.

2. The method for upgrading dual MCU firmware of a braking system based on SPI communication according to claim 1, characterized in that: In step S2, when the main MCU is running, it jumps to the application program in partition A through its own boot loader Bootloader, and the auxiliary MCU runs the application program in its own Flash area.

3. The method for upgrading dual MCU firmware of a braking system based on SPI communication according to claim 1, characterized in that: The identification group includes a normal application interaction identifier and a program flashing identifier, which are respectively used to distinguish the SPI communication frame category and ensure the continuity of data identification.

4. The method for upgrading dual MCU firmware of a brake system based on SPI communication according to claim 3, characterized in that: The CRC check code specifies the same CRC check algorithm between the main MCU and the auxiliary MCU. The CRC check algorithm predefines an array, uses the received SPI data and the data corresponding to the position of the normal application interaction identifier or the program flash identifier in the predefined array to perform correlation operations, and ensures that the calculated check code with the same length as the CRC check code is output. The calculated check code is compared with the CRC check code. If the check codes are the same, the data transmitted in this frame is used, otherwise it is determined to be invalid.

5. The method for upgrading dual MCU firmware of a brake system based on SPI communication according to claim 1, characterized in that: The data packet transmits the flash data. During the flash transmission, the data packet is divided into instruction bytes and reserved bytes. The instruction bytes completely transmit the flash instruction of the host computer received by the main MCU to the auxiliary MCU. The instruction bytes are responsible for transmitting the diagnostic ID and the data field content of the CAN standard frame. After the auxiliary MCU receives the data packet and completes the internal analysis and processing, it again feeds back the CAN diagnostic frame that meets the host factory's flash specification to the main MCU in the form of an SPI data packet. After the main MCU completes the analysis, it feeds back to the host computer through the CAN bus, completing a diagnostic request-feedback operation in the flash process. The above process is repeated until the entire flash process is completed.

6. The method for upgrading dual MCU firmware of a brake system based on SPI communication according to claim 1, characterized in that: The rollback flashing is used to roll back the auxiliary MCU using the main MCU when the interaction with the upper computer is suddenly interrupted due to an accident during the flashing process. The auxiliary MCU flashing failure flag is set in the BootLoader of the main MCU. When the upper computer accidentally loses power during data transmission, the braking system is still powered on and has not yet been restarted. The auxiliary MCU flashing failure flag is set. At this time, the Bootloader of the main MCU autonomously uses the auxiliary MCU application sealed in the Flash area of the main MCU to roll back and refresh. At this time, the SPI communication mechanism and the flashing process are the same as when using the upper computer for flashing communication normally. After waiting for the rollback refresh to be completed, the main MCU and the auxiliary MCU are automatically reset and run the flashed program.

7. A dual-MCU firmware upgrade system for a braking system based on SPI communication, adopting the dual-MCU firmware upgrade method for a braking system based on SPI communication according to any one of claims 1 to 6, characterized in that: Including flash writer, host computer, vehicle CAN bus, main MCU and auxiliary MCU; Flash writer, used to flash the initial application program into the corresponding Flash area of the main MCU and auxiliary MCU; The main MCU is used to flash the application program in its own Flash area, back up the application program in the Flash area of the auxiliary MCU, and synchronize data transmission with the auxiliary MCU through SPI communication; Auxiliary MCU, used to synchronize data transmission between the main MCU and the slave MCU via SPI communication; The host computer is used to execute the flashing process and monitor the flashing process; The vehicle CAN bus is used to connect the host computer and the main MCU to ensure data transmission between the main MCU and the host computer.

Images