Over-the-air (OTA) upgrade-based boot loading system and loading method

Abstract

The invention discloses a bootstrap loading system and loading method based on OTA upgrade, the bootstrap loading system comprises a first memory module, a second memory module and a third memory module, and the third memory module interactively accesses the first memory module and the second memory module; the first memory module and the second memory module only have the capability of writing data into the third memory module, and after the first memory module / the second memory module writes and supplements the missing part of the third memory module, the first memory module and the second memory module can write data into the third memory module. Only the third memory module can have the capacity of completely updating software of the first memory module and the second memory module, and safe and reliable OTA flashing is achieved. Besides, according to the supported differential upgrading function, by comparing differences of binary files of different versions, all sectors do not need to be updated like a traditional mode, only part of bytes are replaced and changed, and the technical problem that in the prior art, a traditional ECU cannot meet the OTA upgrading requirement of the whole vehicle is solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of vehicle-mounted controllers, and in particular relates to a boot loading system and loading method based on OTA upgrade. Background Art

[0002] ECU (Electronic Control Unit) is an electronic control unit, that is, a car controller; the bootloader (boot loader system) is usually stored in the non-volatile memory of the ECU. Its main purpose is to download program files from the host computer and write them to a specific memory space.

[0003] OTA (Over the Air) is a remote wireless upgrade method first used in the PC and mobile phone industries. In recent years, it has gained widespread adoption in the automotive industry both domestically and internationally. Its essence lies in breaking away from traditional recall methods and enabling remote updates of vehicle software and firmware. This technology allows original equipment manufacturers (OEMs) to avoid the cumbersome process of returning vehicles to service stations and instead connect directly to the target connected vehicle remotely, improving upgrade efficiency, reducing after-sales costs, and enhancing safety.

[0004] Currently, there are information security risks in smart connected vehicles. Software risks include false signatures deceiving security checks, and hardware risks include that during offline production, in order to batch-fill programs, manufacturers often release hardware ports to the outside world, enabling uncontrolled direct access to chip memory.

[0005] There is an urgent need to propose a boot loading solution based on OTA upgrade, which can be quickly deployed on traditional controllers that do not support OTA upgrades, so as to meet the OTA upgrade requirements of the entire vehicle and comply with the GB 44496 "General Technical Requirements for Automotive Software Upgrades" regulations. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a boot loading system and loading method based on OTA upgrade to solve the technical problem in the existing technology that traditional ECU cannot meet the OTA upgrade requirements of the entire vehicle.

[0007] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0008] A boot loading system based on OTA upgrade includes a first memory module, a second memory module and a third memory module, wherein the third memory module interacts with the first memory module and the second memory module respectively;

[0009] The first memory module is used to store instructions and data of the boot program 1 and the application program 1;

[0010] The second memory module is used to store the instructions and data of the bootloader 2 and the application program 2;

[0011] The third memory module is used to perform erase and write operations on the first memory module and the second memory module.

[0012] A bootloading method based on OTA upgrade, based on the bootloading system based on OTA upgrade, specifically includes the following steps:

[0013] Step 1, when the vehicle starts, the in-vehicle controller starts, and the bootloading system based on OTA upgrade described in claim 1 is loaded on the in-vehicle controller;

[0014] Step 2, the in-vehicle controller determines whether a software update request is received. If so, the software upgrade method is executed using the bootloading system based on OTA upgrade, and step 6 is entered. Otherwise, step 3 is entered;

[0015] Step 3, the in-vehicle controller determines whether a rollback request is received. If so, step 4 is entered. Otherwise, step 6 is entered;

[0016] Step 4, the in-vehicle controller determines whether the rollback request received in step 3 is an automatic rollback request. If so, the automatic rollback mechanism is executed using the bootloading system based on OTA upgrade, and step 6 is entered. Otherwise, step 5 is entered;

[0017] Step 5, the in-vehicle controller determines whether the rollback request received in step 3 is a manual rollback request. If so, the manual rollback mechanism is executed using the bootloading system based on OTA upgrade, and step 6 is entered. Otherwise, step 6 is directly entered;

[0018] Step 6, end.

[0019] The present invention further includes the following technical features:

[0020] The software upgrade method specifically includes the following steps:

[0021] Q1, the application program 1 of the first memory module receives a software update request from an external source;

[0022] Q2, the application program mode 1 jumps to the bootloader mode 1, and the bootloader mode 1 performs the first security check on the external source. After being legal, it waits for the external source to transmit the incomplete part file of the third memory module;

[0023] Q3, the bootloader mode 1 writes the received incomplete part file of the third memory module into the third memory module and requests the third memory module to work properly;

[0024] In Q4, a second security verification is performed between the first memory module and the third memory module. After passing the verification, it waits for the external source to transmit the new version of Application Program 2;

[0025] In Q5, the third memory module erases the old version of Application Program 2 in the second memory module and writes the new version of Application Program 2;

[0026] In Q6, the third memory module decides to run the next time from the bootloader 2 of the second memory module. The third memory module triggers the restart of the OTA upgrade-based bootloader system, and the incomplete part of the file in the third memory module is automatically lost.

[0027] The automatic rollback mechanism specifically includes the following steps:

[0028] P1, Force a jump to the third memory module mode;

[0029] P2, The third memory module determines whether the jump source is the first memory module or the second memory module. If it is the first memory module, it decides to run the next time from the bootloader 2 of the second memory module and enters P3; if it is the second memory module, it decides to run the next time from the bootloader 1 of the first memory module and enters P4;

[0030] P3, Determine whether there is a fault in Application Program 2 of the second memory module. If a fault is found, write the jump flag bit of the bootloader 2 of the second memory module as invalid; if no fault is found, write the jump flag bit of the bootloader 2 of the second memory module as valid;

[0031] P4, Determine whether there is a fault in Application Program 1 of the first memory module. If a fault is found, write the jump flag bit of the bootloader 1 of the first memory module as invalid; if no fault is found, write the jump flag bit of the bootloader 1 of the first memory module as valid.

[0032] The manual rollback mechanism specifically includes the following steps:

[0033] S1, Force a jump to the third memory module;

[0034] S2, The third memory module determines whether the jump source is the first or the second memory module. If it is the first memory module, it decides to run the next time from the bootloader 2 of the second memory module and enters S3; if it is the second memory module, it decides to run the next time from the bootloader 1 of the first memory module and enters S4;

[0035] S3, The third memory module writes the jump flag bit of the bootloader 2 of the second memory module as valid;

[0036] S4. The third memory module writes the jump flag bit of the boot program 1 of the first memory module as valid.

[0037] Compared with the prior art, the beneficial technical effects of the present invention are:

[0038] (Ⅰ) In the present invention, the first memory module and the second memory module only have the ability to write data to the third memory module. After the first memory module / second memory module writes and fills in the missing parts of the third memory module, only the third memory module can have the complete ability to update the software of the first memory module and the second memory module, realizing safe and reliable OTA flashing. In addition, the differential upgrade function supported by the present invention lies in comparing the differences between different versions of binary files, so that it is not necessary to update all sectors in the traditional way, but only make partial byte replacements. After statistics, the vast majority of factors affecting the flashing time account for the data volume transmitted through the channel. By reducing its size, faster OTA updates are achieved, solving the technical problem in the prior art that traditional ECUs cannot meet the vehicle OTA upgrade requirements.

[0039] (Ⅱ) Considering the three-level memory module design in the present invention, it will mislead illegal intruders to read the software according to wrong address information, so it is also impossible to use and spy on the internal architecture.

[0040] (Ⅲ) The present invention can implement functions such as adaptive channel parameters, specific source wake-up start, update of complete / differential data packets, security and integrity verification, automatic and manual rollback, etc. Not only can it batch repair major functional defects in a short time, but it can also reduce related cost. Description of the Drawings

[0041] Figure 1 It is a schematic structural diagram of the system in the present invention;

[0042] Figure 2 It is a schematic flow diagram of the method in the present invention;

[0043] Figure 3 It is a schematic flow diagram of the software upgrade method in the present invention; Figure 4 It is a schematic flow diagram of the automatic rollback mechanism in the present invention. The following further explains the specific content of the present invention in detail with reference to the embodiments. Detailed Embodiments

[0044] It should be noted that all components in the present invention, without special instructions, are components known in the art.

[0045] Specific embodiments of the present invention are given below. It should be noted that the present invention is not limited to the following specific embodiments, and all equivalent modifications made on the basis of the technical solution of this application fall within the protection scope of the present invention.

[0046] The present invention provides a boot loading system based on OTA upgrade, comprising a first memory module, a second memory module and a third memory module, wherein the third memory module interacts with the first memory module and the second memory module respectively;

[0047] The first memory module is used to store instructions and data of the boot program 1 and the application program 1;

[0048] The second memory module is used to store instructions and data of the boot program 2 and the application program 2;

[0049] The third memory module is used to perform erasing and writing operations on the first memory module and the second memory module.

[0050] In the above technical solution, the first and second memory modules only have the ability to write data to the third memory module. After the first and second memory modules have completed the missing parts of the third memory module, only the third memory module can fully update the software of the first and second memory modules, thus achieving safe and reliable OTA flashing. In addition, the differential upgrade function supported by the present invention is to compare the differences between different versions of binary files, eliminating the need to update all sectors as in the traditional method, and only replacing and changing some bytes. According to statistics, the vast majority of factors affecting flashing time are the channel transmission data volume. By reducing its size, faster OTA updates can be achieved, solving the technical problem in the existing technology that traditional ECUs cannot meet the OTA upgrade requirements of the entire vehicle.

[0051] The present invention also provides a boot loading method based on OTA upgrade, based on the boot loading system based on OTA upgrade, specifically comprising the following steps:

[0052] Step 1: The vehicle is started and the on-board controller is started, and the on-board controller is loaded with the boot loading system based on OTA upgrade according to claim 1;

[0053] Step 2: The vehicle controller determines whether a software update request is received. If so, the vehicle controller uses the OTA upgrade-based boot loading system to execute the software upgrade method and proceeds to step 6. Otherwise, the vehicle controller proceeds to step 3.

[0054] Step 3: The vehicle controller determines whether a rollback request is received. If so, it proceeds to step 4; otherwise, it proceeds to step 6.

[0055] Step 4, the vehicle-mounted controller determines whether the rollback request received in Step 3 is an automatic rollback request. If so, the automatic rollback mechanism is executed using the OTA upgrade-based bootloader system, and Step 6 is entered; otherwise, Step 5 is entered.

[0056] Step 5, the vehicle-mounted controller determines whether the rollback request received in Step 3 is a manual rollback request. If so, the manual rollback mechanism is executed using the OTA upgrade-based bootloader system, and Step 6 is entered; otherwise, Step 6 is directly entered.

[0057] Step 6, end.

[0058] In the above solution, the design of the three-level memory module misleads illegal intruders to read the software according to the wrong address information, so it is also impossible to use and spy on the internal architecture, realizing functions such as adaptive channel parameters, specific source wake-up start, updating complete / differential data packets, security and integrity verification, automatic and manual rollback, etc. Not only can major functional defects be repaired in batches in a short time, but also the related cost can be reduced.

[0059] The software upgrade method specifically includes the following steps:

[0060] Q1, the application program 1 of the first memory module receives a software update request from an external source;

[0061] Q2, the application program mode 1 jumps to the bootloader mode 1, and the bootloader mode 1 performs the first security check on the external source. After passing the check, it waits for the external source to transmit the incomplete part file of the third memory module;

[0062] Q3, the bootloader mode 1 writes the received incomplete part file of the third memory module into the third memory module and requests the third memory module to work properly;

[0063] Q4, a second security check is performed between the first memory module and the third memory module. After passing the check, it waits for the external source to transmit the new version of the application program 2;

[0064] Q5, the third memory module erases the old version of the application program 2 in the second memory module and writes the new version of the application program 2;

[0065] Q6, the third memory module decides to boot from the bootloader 2 of the second memory module next time. The third memory module triggers the restart of the OTA upgrade-based bootloader system, and the incomplete part file of the third memory module is automatically lost.

[0066] The automatic rollback mechanism specifically includes the following steps:

[0067] P1, force a jump to the third memory module mode;

[0068] P2. The third memory module determines whether the jump source is the first memory module or the second memory module. If it is the first memory module, it decides to run the boot program 2 of the second memory module next and enters P3; if it is the second memory module, it decides to run the boot program 1 of the first memory module next and enters P4.

[0069] P3. Determine whether there is a fault in the application program 2 of the second memory module. If a fault is found, write the jump flag bit of the boot program 2 of the second memory module as invalid; if no fault is found, write the jump flag bit of the boot program 2 of the second memory module as valid.

[0070] P4. Determine whether there is a fault in the application program 1 of the first memory module. If a fault is found, write the jump flag bit of the boot program 1 of the first memory module as invalid; if no fault is found, write the jump flag bit of the boot program 1 of the first memory module as valid.

[0071] The manual rollback mechanism specifically includes the following steps:

[0072] S1. Force a jump to the third memory module.

[0073] S2. The third memory module determines whether the jump source is the first or the second memory module. If it is the first memory module, it decides to run the boot program 2 of the second memory module next and enters S3; if it is the second memory module, it decides to run the boot program 1 of the first memory module next and enters S4.

[0074] S3. The third memory module writes the jump flag bit of the boot program 2 of the second memory module as valid.

[0075] S4. The third memory module writes the jump flag bit of the boot program 1 of the first memory module as valid.

Claims

1. A boot loading system based on OTA upgrade, characterized in that, It includes a first memory module, a second memory module, and a third memory module, and the third memory module interacts with and accesses the first memory module and the second memory module respectively; The first memory module is used to store the instructions and data of the boot program 1 and the application program 1; The second memory module is used to store the instructions and data of the boot program 2 and the application program 2; The third memory module is used to perform erase and write operations on the first memory module and the second memory module.

2. A boot loading method based on OTA upgrade, based on the boot loading system based on OTA upgrade described in claim 1, characterized in that, Specifically, it includes the following steps: Step 1: When the vehicle starts and the vehicle-mounted controller starts, the vehicle-mounted controller loads the boot loading system based on OTA upgrade as claimed in claim 1; Step 2: The vehicle-mounted controller determines whether it receives a software update request. If so, it executes the software upgrade method using the boot loading system based on OTA upgrade and enters step 6. Otherwise, it enters step 3; Step 3: The vehicle-mounted controller determines whether it receives a rollback request. If so, it enters step 4. Otherwise, it enters step 6; Step 4: The vehicle-mounted controller determines whether the rollback request received in step 3 is an automatic rollback request. If so, it executes the automatic rollback mechanism using the boot loading system based on OTA upgrade and enters step 6. Otherwise, it enters step 5; Step 5: The vehicle-mounted controller determines whether the rollback request received in step 3 is a manual rollback request. If so, it executes the manual rollback mechanism using the boot loading system based on OTA upgrade and enters step 6. Otherwise, it directly enters step 6; Step 6: End.

3. The OTA upgrade-based boot loading method according to claim 2, wherein The software upgrade method specifically includes the following steps: Q1: The application program 1 of the first memory module receives a software update request from an external source; Q2: The application program mode 1 jumps to the boot program mode 1, and the boot program mode 1 performs the first security check on the external source. After it is legal, it waits for the external source to transmit the incomplete part file of the third memory module; Q3: The boot program mode 1 writes the received incomplete part file of the third memory module into the third memory module and requests the third memory module to work properly; Q4: A second security check is performed between the first memory module and the third memory module. After it is legal, it waits for the external source to transmit the new version of the application program 2; [[ID=ed]]Q5: The third memory module erases the old version of the application program 2 in the second memory module and writes the new version of the application program 2; Q6: The third memory module decides to run from the boot program 2 of the second memory module next time. The third memory module triggers the restart of the boot loading system based on OTA upgrade, and the incomplete part file of the third memory module is automatically lost.

4. The OTA upgrade-based boot loading method according to claim 2, wherein The automatic rollback mechanism specifically includes the following steps: P1: Forcefully jump to the third memory module mode; P2: The third memory module determines whether the jump source is the first memory module or the second memory module. If it is the first memory module, it decides to run from the boot program 2 of the second memory module next time and enters P3; if it is the second memory module, it decides to run from the boot program 1 of the first memory module next time and enters P4; P3, determine whether there is a fault in the application program 2 of the second memory module. If a fault is found, write the jump flag bit of the boot program 2 of the second memory module as invalid; if no fault is found, write the jump flag bit of the boot program 2 of the second memory module as valid. P4, determine whether there is a fault in the application program 1 of the first memory module. If a fault is found, write the jump flag bit of the boot program 1 of the first memory module as invalid; if no fault is found, write the jump flag bit of the boot program 1 of the first memory module as valid.

5. The OTA upgrade-based boot loading method according to claim 2, wherein The manual rollback mechanism specifically includes the following steps: S1, force a jump to the third memory module; S2, the third memory module determines whether the jump source is the first or the second memory module. If it is the first memory module, it decides to run from the boot program 2 of the second memory module next time and enters S3; if it is the second memory module, it decides to run from the boot program 1 of the first memory module next time and enters S4; S3, the third memory module writes the jump flag bit of the boot program 2 of the second memory module as valid; S4, the third memory module writes the jump flag bit of the boot program 1 of the first memory module as valid.

Images