System and method for carrying out OTA dynamic upgrading during vehicle operation

Abstract

The invention belongs to the technical field of automobile electronic control and software updating, and relates to a system and a method for performing OTA dynamic upgrading during vehicle operation. The method comprises the following steps: upgrade trigger judgment: if a previous vehicle state meets a preset safety condition, entering an upgrade preparation stage; eCU grading and authority control, wherein the ECUs are divided according to the upgrading influence degree, and the CCU determines which ECUs can be upgraded immediately according to the current vehicle state; the OTA communication module downloads the upgrade package, carries out integrity verification, caches the upgrade package to a local temporary area, and waits for deployment; a double-Bank write-in and switching mechanism is adopted; real-time state monitoring and exception handling: if an exception occurs, suspending upgrading and storing the progress, rolling back to an original version, and trying to upgrade again after the original version is recovered to be stable; and performing security verification and feedback reporting. According to the method, the upgrading efficiency can be improved, the user experience is enhanced, the driving safety is guaranteed, flexible scheduling is supported, the fault-tolerant capability is achieved, and the compatibility is high.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of automobile electronic control and software updating, and particularly relates to a system and method for dynamic upgrading during vehicle operation. BACKGROUND

[0002] With the development of intelligent and networked vehicles, vehicle control systems are becoming increasingly complex, the number of ECUs (Electronic Control Units) is increasing, and the software versions are frequently iterated. The traditional OTA upgrade method usually requires the vehicle to be in an off or stationary state to avoid safety hazards caused by power failure, restart or failure to perform critical functions during the upgrade process. However, in actual use scenarios, some non-critical ECU modules (such as infotainment systems, instrument displays, and auxiliary driving modules) can be safely upgraded while the vehicle is running, and users have higher requirements for upgrade efficiency and real-time performance. There is a lack of an OTA mechanism in the prior art that can achieve uninterrupted key tasks, seamless system switching, and support for multi-module parallel upgrades without affecting the normal operation of the vehicle.

[0003] The traditional OTA upgrade method has the following disadvantages: 1. The traditional OTA upgrade requires the vehicle to be in an off or stationary state; 2. There is a lack of hierarchical control mechanism, which cannot flexibly schedule upgrade tasks; 3. The upgrade process is easily affected by abnormal interruptions, and lacks rollback and breakpoint resume mechanisms; 4. There is a lack of dual Bank mechanism, and there is a risk of function interruption during the upgrade process; 5. The upgrade process is single, and cannot be intelligently adjusted according to the vehicle operating conditions.

[0004] Therefore, it is necessary to propose a technical solution for OTA dynamic upgrading during vehicle operation to effectively solve the above problems, improve user experience, reduce maintenance costs, and improve the software management capability of the whole vehicle. SUMMARY

[0005] The purpose of the present application is to provide a system and method for OTA dynamic upgrading during vehicle operation to solve the problems of the traditional OTA upgrade method, which usually requires the vehicle to be in an off or stationary state, cannot flexibly schedule upgrade tasks, has a risk of function interruption during the upgrade process, is easily affected by abnormal interruptions, and cannot be intelligently adjusted according to the vehicle operating conditions.

[0006] The purpose of the present application is achieved by the following technical solutions:

[0007] A method for OTA dynamic upgrading during vehicle operation, comprising the following steps:

[0008] S1, upgrade trigger judgment:

[0009] S11, the central control unit CCU determines whether to upgrade according to cloud pushing or local timing strategy;

[0010] S12, obtain the current vehicle state;

[0011] S13, if the preset safety condition is met, enter the upgrade preparation stage;

[0012] S2, ECU grading and permission control:

[0013] S21, according to the upgrade influence degree, the ECU is divided into: key ECU, hot upgradeable ECU and suspendable upgradeable ECU;

[0014] S22, the central control unit decides which ECU can be upgraded immediately according to the current vehicle state;

[0015] S3, phased download and verification:

[0016] S31, the OTA communication module downloads the upgrade package from the cloud;

[0017] S32, integrity verification is performed on the upgrade package;

[0018] S33, cache the upgrade package to the local temporary area, and wait for deployment;

[0019] S4, double Bank write and switching mechanism:

[0020] S41, the ECU supporting double Bank Flash adopts the mechanism of background writing combined with switching activation:

[0021] S42, the upgrade process does not affect the current function operation;

[0022] S5, real-time state monitoring and exception handling:

[0023] S51, continuously monitor: network state, power voltage, current vehicle speed and vehicle working condition during the upgrade process;

[0024] S52, if an exception occurs, suspend the upgrade and save the progress, roll back to the original version, and try to upgrade again after recovery is stable;

[0025] S6, security verification and feedback reporting:

[0026] S61, continuously monitor during the upgrade process, and verify whether the new version function is normal after the upgrade is completed;

[0027] S62, report the upgrade result to the cloud, if the upgrade fails, automatically roll back and record the log for subsequent analysis.

[0028] Further, in step S11, the OTA cloud server stores the upgrade package, distribution instructions and manages the upgrade process; the vehicle-side communication module establishes a connection with the cloud, receives the upgrade package and control instructions, and sends them to the central control unit.

[0029] Further, in step S12, the current vehicle state includes vehicle speed, gear, battery power and network signal strength.

[0030] Further, in step S13, the safety conditions include vehicle speed less than a set value, non-high-speed driving state and stable network connection.

[0031] Further, in step S21, the key ECU is not allowed to be upgraded during operation; the hot-upgradable ECU can be upgraded during operation; and the suspend-upgradable ECU can be suspended under certain conditions.

[0032] Further, in step S32, the integrity check includes CRC and SHA256.

[0033] Further, in step S41, the specific operation is as follows: running the current version in one Bank, writing the new version in the other Bank, and after writing is completed, switching the Bootloader by software to guide the new version to start.

[0034] Further, in step S52, the exceptions include network disconnection, power failure and emergency braking.

[0035] A system for a vehicle running during OTA dynamic upgrade method, comprising an OTA cloud server, a vehicle-side communication module, a central control unit, a plurality of ECU modules, a dual-Bank storage structure, a redundant power management module and an upgrade strategy database.

[0036] The OTA cloud server is configured to store upgrade packages, distribution instructions and manage upgrade processes.

[0037] The vehicle-side communication module is responsible for establishing a connection with the cloud, receiving upgrade packages and control instructions.

[0038] The central control unit serves as an OTA master node, coordinating ECU upgrade sequences and monitoring upgrade states.

[0039] The plurality of ECU modules includes key ECUs and non-key ECUs.

[0040] The dual-Bank storage structure is equipped with dual-partition Flash for each ECU, supports coexistence of new and old versions, and can achieve running of the current version in one Bank while writing of the new version in the other Bank, and seamless activation of the new version through software switching.

[0041] The redundant power management module is used to ensure stable power supply during the upgrading process.

[0042] The upgrading strategy database is used to record the upgrading priority, dependency relationship and allowed working condition of each ECU.

[0043] Further, the key ECU includes engine control and brake system, and the non-key ECU includes navigation, audio and ADAS auxiliary system.

[0044] Compared with the prior art, the present application has the following beneficial effects:

[0045] 1. Improve the upgrading efficiency: the upgrading of part of the ECUs can be completed during the driving of the vehicle, without additional parking time;

[0046] 2. Enhance user experience: reduce the user's upgrade frequency to the store and improve the intelligent service experience;

[0047] 3. Ensure driving safety: through the hierarchical control mechanism, only the non-key ECU is allowed to upgrade under suitable working conditions;

[0048] 4. Support flexible scheduling: combined with the double Bank mechanism and background writing, seamless switching is realized to avoid interruption;

[0049] 5. Fault tolerance: with functions such as abnormality detection, rollback and breakpoint resume, the upgrading stability is improved;

[0050] 6. Strong compatibility: suitable for multiple vehicle platforms and supporting unified OTA management of different ECU manufacturers. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0052] Figure 1 The step flow chart of the dynamic upgrading method during the running of the vehicle of the present application. DETAILED DESCRIPTION

[0053] The present application will be further described below in conjunction with the embodiments:

[0054] The present application will be further described below in conjunction with the embodiments: It should be understood that the specific embodiments described herein are only used to explain the present application, and not to limit the present application. In addition, it should be noted that, in order to facilitate the description, only the parts related to the present application are shown in the drawings, not all the structures.

[0055] It should be noted that similar reference numerals and letters refer to like items in the accompanying drawings, and once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0056] The traditional OTA upgrade method requires the vehicle to be in an off or stationary state, resulting in a long upgrade process, user inconvenience, and increased after-sales maintenance costs. A technical solution is needed that can upgrade non-critical ECU modules online during vehicle operation. The existing OTA system lacks a hierarchical management mechanism for ECU modules, and cannot differentiate based on the importance of ECU functions and the degree of upgrade impact. Classification control of ECU modules is needed to dynamically determine which modules can be safely upgraded under the current working conditions. During the upgrade process, if abnormal situations such as network interruption, power failure, or sudden braking occur, the existing system lacks effective abnormality detection, suspension saving, and version rollback mechanisms, which can easily cause system instability or even functional failure. A set of upgrade processes with real-time monitoring and fault tolerance capabilities need to be built to ensure system stability and safety. Most ECU modules do not have a dual-Bank Flash structure, and the current program needs to be interrupted during the upgrade process, resulting in unavailable functions and potential safety hazards. A background writing and seamless switching mechanism based on dual-Bank storage needs to be introduced to achieve uninterrupted functions during the upgrade process. The existing OTA upgrade strategy is fixed and cannot be intelligently adjusted based on vehicle real-time conditions such as speed, gear, power, and network signal to determine the upgrade timing and sequence. An upgrade strategy database needs to be established, and dynamic scheduling needs to be combined with vehicle state information to improve the safety and intelligence level of the upgrade. After the upgrade is completed, there is a lack of a perfect verification and feedback mechanism, making it difficult for the cloud platform to timely grasp the upgrade results and device status, which is not conducive to remote management and troubleshooting. A function verification process needs to be designed after the upgrade is completed, and the upgrade results need to be fed back to the cloud through the communication module to improve the overall management efficiency of OTA.

[0057] Therefore, the present application provides a method for OTA dynamic upgrade during vehicle operation, which upgrades specific types of ECU in a running state, judges whether it is suitable for upgrade, and then selects the appropriate ECU for upgrade. This method can perform dual-Bank storage structure and switching, monitor vehicle status in real time, and take measures such as suspension and rollback when abnormal situations are detected, as well as safety verification and feedback reporting. This method can verify the function of the new version after the upgrade is completed and feed back the results to the cloud, and ensure the success rate and reliability of each upgrade.

[0058] Specifically includes the following steps:

[0059] S1, upgrade trigger judgment:

[0060] S11, the central control unit CCU judges whether it needs to be upgraded according to the cloud push or local timing strategy. The OTA cloud server stores the upgrade package, distribution instructions and manages the upgrade process. The vehicle-side communication module establishes a connection with the cloud, receives the upgrade package and control instructions.

[0061] S12, obtain the current vehicle state, such as vehicle speed, gear, battery capacity, network signal strength, etc.

[0062] S13, if the preset safety conditions are met, such as vehicle speed less than a set value, in a non-high-speed driving state, network connection stable, then enter the upgrade preparation stage.

[0063] S2, ECU grading and permission control:

[0064] S21, according to the upgrade influence degree, the ECU is divided into: critical ECU, hot-upgradable ECU and pauseable ECU;

[0065] Among them, the critical ECU: not allowed to upgrade in running;

[0066] Hot-upgradable ECU: can be upgraded in running;

[0067] Pauseable ECU: can be paused under certain conditions;

[0068] S22, the CCU decides which ECU can be upgraded immediately according to the current vehicle state.

[0069] S3, phased download and verification:

[0070] S31, the OTA communication module downloads the upgrade package from the cloud;

[0071] S32, integrity verification (such as CRC, SHA256) is performed on the upgrade package;

[0072] S33, cache the upgrade package to the local temporary area and wait for deployment.

[0073] S4, double Bank write and switching mechanism:

[0074] S41, the ECU supporting double Bank Flash adopts the "background writing + switching activation" mechanism:

[0075] Run the current version in one Bank;

[0076] Write a new version in the other Bank;

[0077] After writing is completed, a new version is started by booting the bootloader through software switching;

[0078] S42, the upgrading process does not affect the current function running.

[0079] S5, real-time state monitoring and abnormality processing:

[0080] S51, continuously monitoring during the upgrading process: network state, power voltage, current vehicle speed and vehicle working condition;

[0081] S52, if an abnormality occurs, such as network disconnection, power failure or emergency braking, then:

[0082] suspend the upgrading and save the progress;

[0083] roll back to the original version;

[0084] re-try the upgrading after recovery to stability.

[0085] S6, security verification and feedback reporting:

[0086] S61, continuously monitoring during the upgrading process, and verifying whether the new version function is normal after the upgrading is completed;

[0087] S62, reporting the upgrading result to the cloud;

[0088] if the upgrading fails, then automatically roll back and record logs for subsequent analysis.

[0089] The system for OTA dynamic upgrading during vehicle running comprises an OTA cloud server, a vehicle-side communication module, a central control unit, multiple ECU modules, a double-Bank storage structure, a redundant power management module and an upgrading strategy database.

[0090] The OTA cloud server is used for storing upgrading packages, distributing instructions and managing upgrading processes;

[0091] The vehicle-side communication module is responsible for establishing a connection with the cloud, receiving upgrading packages and control instructions;

[0092] The central control unit is used as an OTA master node, coordinates the upgrading sequence of each ECU and monitors the upgrading state;

[0093] The multiple ECU modules comprise key ECUs (such as engine control and braking system) and non-key ECUs (such as navigation, audio, ADAS auxiliary system);

[0094] Dual-Bank storage structure: Each ECU is equipped with dual-partition Flash, supporting the coexistence of new and old versions, allowing the current version to run on one Bank while writing a new version on the other Bank, and enabling seamless activation of the new version through software switching.

[0095] Redundant power management module: Ensures stable power supply during the upgrade process.

[0096] Upgrade strategy database: Records the upgrade priority, dependency relationship, and allowable operating conditions of each ECU.

[0097] To address the problem of traditional OTA upgrade requiring the vehicle to be in an off or stationary state. Currently, most OTA systems only allow upgrades when the vehicle is completely stopped and the power supply is stable. The upgrade process is time-consuming, and users need to specifically arrange time to park and wait, affecting user experience. The invention supports online upgrade of non-critical ECU modules during vehicle operation, without the need for parking, improving upgrade efficiency and user convenience.

[0098] To address the problem of lacking a hierarchical control mechanism, which cannot flexibly schedule upgrade tasks. Existing OTA systems usually adopt a "one-size-fits-all" approach, either upgrading all or not upgrading at all, lacking differentiation in the importance of different ECU modules. The upgrade logic is rigid, treating all ECUs uniformly, which can easily cause resource waste and is difficult to adapt to the diversity needs of complex vehicle systems. The invention introduces an ECU hierarchical mechanism (critical ECU / hot-upgradable ECU / suspendable ECU), dynamically decides whether to upgrade based on the current vehicle state, and achieves more refined control.

[0099] To address the problem of being easily interrupted by exceptions during the upgrade process, lacking rollback and breakpoint resume mechanisms. In existing OTA upgrades, if network interruption, power failure, or other abnormal situations occur during the upgrade process, it may lead to upgrade failure or even system crash. The system has poor stability, safety risks, poor user experience, and increased after-sales maintenance burden. The invention has real-time state monitoring and exception handling mechanisms, which can automatically pause, save progress, or roll back to the original version when an exception is detected, ensuring that the system is always in a usable state.

[0100] To address the problem of lacking a dual-Bank mechanism, which poses a risk of function interruption during the upgrade process. Most existing ECUs do not have a dual-Bank Flash storage structure, and the current running program needs to be interrupted during the upgrade, causing temporary unavailability of functions. Function interruption may pose safety risks; it is not suitable for some continuously running function modules (such as ADAS auxiliary driving); user perception is obvious, affecting user experience. The invention uses a dual-Bank writing and switching mechanism, with new and old versions coexisting, so that the upgrade process does not affect the current function running, achieving seamless switching.

[0101] The existing OTA system mostly adopts a fixed strategy to perform upgrading and cannot make a judgment according to the actual working conditions such as vehicle speed, gear, power, network signal, etc., which is prone to trigger upgrading at an inappropriate time, has a driving safety risk, and has a low system intelligence level.

[0102] In terms of the capability of OTA upgrading during vehicle operation, the present application can perform online upgrading on non-critical ECUs (such as infotainment systems, instrument displays, etc.) without affecting driving safety. In terms of hierarchical control mechanism, the present application classifies ECUs into critical ECUs, hot-upgradable ECUs and suspendable-upgradable ECUs according to their importance and influence range, and decides whether to allow upgrading according to the current state of the vehicle. In terms of dual-Bank storage structure and seamless switching mechanism, each ECU in the present application is equipped with dual-partition Flash storage, supporting coexistence of new and old versions. The background writing + switching activation mechanism is adopted to ensure uninterrupted functions during upgrading. In terms of real-time state monitoring and abnormal processing mechanism, the present application continuously monitors key parameters such as network state, power voltage, vehicle speed, etc. during upgrading. Once an abnormal condition is found, it can automatically suspend upgrading or roll back to the original version, ensuring the stability and safety of the system. In terms of flexible scheduling strategy, the present application intelligently schedules the upgrading order of each ECU module in combination with the priority, dependency relationship and allowable working condition in the upgrading strategy database, optimizing the upgrading process. In terms of redundant power management module, the present application ensures the stability of power supply during the entire upgrading process, avoiding upgrading failure or system failure due to power failure.

[0103] Note that the above is only the preferred embodiment of the present application and the technical principle applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and those skilled in the art can make various obvious changes, readjustments and substitutions without departing from the scope of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A method for performing OTA dynamic upgrade during vehicle operation, characterized in that: The following steps are involved: S1. Upgrade trigger judgment: S11. The central control unit determines whether an upgrade is required based on cloud push or local timing strategy; S12, obtaining the current vehicle status; S13. If the preset safety conditions are met, the upgrade preparation phase begins; S2. ECU classification and authority control: S21. Classify ECUs according to the impact of the upgrade into: critical ECUs, hot-upgradeable ECUs, and ECUs with paused upgrades; S22, the central control unit determines which ECUs can be upgraded immediately based on the current vehicle status; S3, staged download and verification: S31, OTA communication module downloads the upgrade package from the cloud; S32. Perform integrity check on the upgrade package; S33. Cache the upgrade package to a local temporary area and wait for deployment; S4, dual bank write and switch mechanism: S41. ECUs supporting dual-bank flash use a mechanism that combines background writing with switch activation: S42. The upgrade process does not affect the current function operation; S5. Real-time status monitoring and exception handling: S51. Continuously monitor the following during the upgrade process: network status, power supply voltage, current vehicle speed, and vehicle operating conditions; S52. If an exception occurs, pause the upgrade and save the progress, roll back to the original version, and try upgrading again after stability is restored; S6. Security verification and feedback reporting: S61. Continuously monitor the upgrade process and verify that the new version functions normally after the upgrade is complete. S62. Report the upgrade result to the cloud. If the upgrade fails, it will automatically roll back and record the log for subsequent analysis.

2. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: In step S11, the OTA cloud server stores the upgrade package, distributes instructions and manages the upgrade process; the vehicle-side communication module establishes a connection with the cloud, receives the upgrade package and control instructions, and sends them to the central control unit.

3. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: Step S12: The current vehicle status includes vehicle speed, gear position, battery charge, and network signal strength.

4. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: Step 13: Satisfying safety conditions includes the vehicle speed being less than a set value, being in a non-high-speed driving state, and having a stable network connection.

5. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: In step S21 , the key ECU is not allowed to be upgraded during operation; the hot-upgradeable ECU is upgradeable during operation; and the upgrade-pausable ECU is upgrade-pausable under specific conditions.

6. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: Step S32: integrity check includes CRC and SHA256.

7. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: Step S41 is as follows: the current version is run in one Bank, and the new version is written to another Bank. After the writing is completed, the new version is started by switching the Bootloader through software.

8. The method for performing OTA dynamic upgrade during vehicle operation according to claim 1, characterized in that: Step S52: abnormalities include network disconnection, power outage and sudden braking.

9. The system used in the method for dynamically updating a vehicle during operation according to claim 1, characterized in that: Includes OTA cloud server, vehicle-side communication module, central control unit, multiple ECU modules, dual-bank storage structure, redundant power management module and upgrade strategy database; The OTA cloud server is used to store upgrade packages, distribute instructions, and manage upgrade processes. The vehicle-side communication module is responsible for establishing a connection with the cloud and receiving upgrade packages and control instructions; The central control unit, as the OTA master control node, is used to coordinate the upgrade sequence of each ECU and monitor the upgrade status; The multiple ECU modules include key ECUs and non-key ECUs; The dual-bank storage structure, in which each ECU is equipped with dual-partition Flash, supports the coexistence of old and new versions. It is possible to run the current version on one bank while writing the new version on another bank, and seamlessly activate the new version through software switching. The redundant power management module is used to ensure stable power supply during the upgrade process; The upgrade strategy database is used to record the upgrade priority, dependency relationship and operating conditions of each ECU that allow the upgrade.

10. The system used in the method for performing OTA dynamic upgrade during vehicle operation according to claim 9, characterized in that: Key ECUs include engine control and braking systems, while non-key ECUs include navigation, audio and ADAS assistance systems.

Images