Method and system for preventing vehicle-mounted controller software from being mistakenly swiped

Abstract

The invention provides a method for preventing mistaken refreshing of vehicle-mounted controller software, which comprises the following steps: reading to-be-refreshed user program software information to obtain first comparison information, the first comparison information comprising a user program software version number and a termination address of the user program software; and reading the controller information to obtain second comparison information, wherein the second comparison information comprises a hardware version number of the controller and a bootstrap program software version number of the controller. And if the first comparison information is matched with the second comparison information, refreshing the to-be-refreshed software. By verifying whether the refreshing condition is met or not before refreshing, the problem that the software of the vehicle-mounted controller fails to refresh is solved. The invention further provides a vehicle-mounted controller software mistaken-swiping prevention system. Whether the user program software version number, the hardware version number of the controller, the bootstrap program software version number of the controller and the termination address of the user program software are matched or not is judged by comparing whether the user program software version number, the hardware version number and the bootstrap program software version number are matched or not.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software, and particularly relates to a vehicle-mounted controller software error-proof flashing method and system. BACKGROUND

[0002] The vehicle-mounted controller is a core component of the vehicle electronic system, and is responsible for controlling various functional modules of the vehicle, such as the operation of the power system and the chassis system. The software thereof mainly includes APP software (user program) and BOOT software (boot program): the APP software is a core program for realizing the specific functions of the controller, and is executed after the BOOT program jumps; the BOOT software is a program that is first executed when the MCU (micro control unit) is powered on, and is responsible for booting the APP software to start, and providing basic services in the software refreshing process. The APP software to be refreshed refers to a new user program that needs to be updated to the vehicle-mounted controller, the hardware version number of the controller is information for identifying the hardware configuration of the controller, and the BOOT software version number is information for identifying the version of the boot program, and different versions of the BOOT software can correspond to different function supports and address ranges.

[0003] In the software refreshing process of the vehicle-mounted controller, the flashing failure often occurs, and the main reason is that the APP software to be refreshed does not match the hardware version and the BOOT software version of the controller. Specifically, on the one hand, if the APP software version does not match the hardware version of the controller, the software cannot normally run; on the other hand, if the APP software does not match the BOOT software version, it can cause various problems, such as receiving a negative response during the refreshing process and terminating the refreshing, burning failure after erasing the original program to cause the controller to be 'flashed dead', and incomplete APP program after refreshing to cause functional abnormalities. In addition, the same controller can use multiple main chips, and the memory segments occupied by the corresponding APP software are different in size, and if there is a misflashing condition between the chips, the refreshing failure can be caused due to the incompatible address range.

[0004] In order to solve the problem of software refreshing failure of the vehicle-mounted controller, the present application provides a vehicle-mounted controller software error-proof flashing method and system. SUMMARY

[0005] In order to solve the problem of software refreshing failure of the vehicle-mounted controller, the present application provides a vehicle-mounted controller software error-proof flashing method, which comprises the following steps: reading the user program software information to be refreshed to obtain first comparison information, wherein the first comparison information comprises a user program software version number and a termination address of the user program software; reading the controller information to obtain second comparison information, wherein the second comparison information comprises a hardware version number of the controller and a boot program software version number of the controller; Comparing the first comparison information and the second comparison information, if the first comparison information matches the second comparison information, refreshing the software to be refreshed.

[0006] By comparing whether the user program software version number, the hardware version number of the controller, the boot program software version number of the controller and the termination address of the user program software match before software refreshing, the problem of refreshing failure caused by the mismatch is avoided from the source.

[0007] Specifically, the hardware version (such as the main chip model, circuit design, etc.) of the controller determines its physical interface, memory layout and resource allocation mode, and the user program software (APP software) is developed based on a specific hardware version, and its code logic and function implementation need to be strictly adapted to the hardware characteristics. If the verification is skipped and directly refreshed, it may cause the software to be unable to recognize the hardware interface, call the wrong resource address, and further cause the problem that the program cannot run after refreshing, the hardware is damaged and the like. By verifying whether the hardware version number of the controller and the version number of the APP software are consistent, the software that does not match can be intercepted in time before the refreshing operation is performed, the problem of flashing failure caused by the adaptation problem of hardware and software is reduced, and the problem of software refreshing failure of the vehicle-mounted controller is solved.

[0008] Preferably, the method further comprises: comparing the first comparison information and the second comparison information, if the user program software version number is consistent with the hardware version number of the controller, the termination address of the user program software is compatible with the address range corresponding to the boot program software version number of the controller, and the user program software version number is consistent with the boot program software version number of the controller, then refreshing the software to be refreshed.

[0009] Preferably, the method further comprises: comparing the first comparison information and the second comparison information, if the user program software version number is inconsistent with the hardware version number of the controller, then reporting an error.

[0010] Preferably, the method further comprises: comparing the first comparison information and the second comparison information, if the termination address of the user program software is incompatible with the termination address corresponding to the boot program software version number of the controller, then reporting an error.

[0011] Preferably, the method further comprises: comparing the first comparison information and the second comparison information, if the user program software version number is inconsistent with the boot program software version number of the controller, then reporting an error.

[0012] The application also provides a vehicle-mounted controller software error-proof flashing system, comprising a reading module, a comparison module and a refreshing module, the reading module, the comparison module and the refreshing module are connected through a network.

[0013] The reading module is configured to read the user program software information of the software to be refreshed to obtain first comparison information, read the controller information to obtain second comparison information, and send the first comparison information and the second comparison information to the comparison module.

[0014] The comparison module is configured to receive the first comparison information and the second comparison information, compare the first comparison information and the second comparison information, send a refresh instruction to the refresh module if the first comparison information matches the second comparison information, and send an error reporting instruction to the refresh module if the first comparison information does not match the second comparison information.

[0015] The refresh module is configured to refresh the software to be refreshed in response to the refresh instruction, and not start the refresh operation of the software to be refreshed in response to the error reporting instruction.

[0016] Preferably, the system further comprises that the reading module is further configured to read the user program software information of the software to be refreshed to obtain first comparison information, read the controller information to obtain second comparison information, and send the first comparison information and the second comparison information to the comparison module, the first comparison information comprises a user program software version number and a user program software termination address, and the second comparison information comprises a controller hardware version number and a controller bootloader software version number.

[0017] Preferably, the comparison module comprises a first comparison module, a second comparison module and a third comparison module, and the first comparison module, the second comparison module and the third comparison module are connected through a network.

[0018] The first comparison module is configured to receive the first comparison information and the second comparison information, compare the first comparison information and the second comparison information, send a first continue comparison instruction to the second comparison module if the user program software version number is consistent with the controller hardware version number, and send a first error reporting instruction to the refresh module if the user program software version number is not consistent with the controller hardware version number.

[0019] The second comparison module is configured to receive the first comparison information and the second comparison information, compare the first comparison information and the second comparison information in response to the first continue comparison instruction, send a second continue comparison instruction to the third comparison module if the user program software termination address is compatible with the address range corresponding to the controller bootloader software version number, and send a second error reporting instruction to the refresh module if the user program software termination address is not compatible with the address range corresponding to the controller bootloader software version number.

[0020] The third comparison module is configured to receive the first comparison information and the second comparison information, compare the first comparison information and the second comparison information in response to a first continue comparison instruction, send a refresh instruction to the refresh module if the user program software version number is consistent with the bootloader software version number of the controller, and send a third error reporting instruction to the refresh module if the user program software version number is inconsistent with the bootloader software version number of the controller.

[0021] Preferably, the system further comprises that the refresh module is further configured to refresh the software to be refreshed in response to the refresh instruction, and end the refresh procedure in response to an error reporting instruction, the error reporting instruction including a first error reporting instruction, a second error reporting instruction and a third error reporting instruction.

[0022] The application provides a vehicle-mounted controller software error-proof refreshing method, comprising reading user program software information to be refreshed to obtain first comparison information, the first comparison information including a user program software version number and a user program software termination address; reading controller information to obtain second comparison information, the second comparison information including a controller hardware version number and a controller bootloader software version number; comparing the first comparison information and the second comparison information, and refreshing the software to be refreshed if the first comparison information matches the second comparison information. The application solves the problem of vehicle-mounted controller software refreshing failure by verifying whether the refreshing condition is met before refreshing. The application also provides a vehicle-mounted controller software error-proof refreshing system, comprising a reading module, a comparison module and a refresh module. Whether the software is refreshed is determined by comparing whether the user program software version number, the controller hardware version number, the controller bootloader software version number and the user program software termination address match. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, for those skilled in the art, other drawings can also be obtained from these drawings without any creative effort.

[0024] Figure 1 The flow chart for reading the controller hardware version number method; Figure 2 The flow chart for reading the controller BOOT version number method; Figure 3 The flow chart for the vehicle-mounted controller software error-proof refreshing method. DETAILED DESCRIPTION

[0025] Embodiments will be described in detail below with reference to examples illustrated in the accompanying drawings. When the following description refers to the drawings, same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following embodiments are not meant to represent all implementations consistent with the present application. Rather, they are merely examples of systems and methods consistent with some aspects of the present application as detailed in the appended claims.

[0026] To solve the problem of vehicle controller software refreshing failure, the present application provides a vehicle controller software error-proof refreshing method, comprising: reading user program (APP) software information to be refreshed to obtain first comparison information, the first comparison information including user program software version number and user program software termination address; reading controller information to obtain second comparison information, the second comparison information including controller hardware version number and controller bootloader (BOOT) software version number; comparing the first comparison information and the second comparison information, if the first comparison information matches the second comparison information, refreshing the software to be refreshed.

[0027] By verifying the consistency of user program software version number and controller hardware version number before software refreshing, the refreshing failure problem caused by their inconsistency is avoided from the source. Specifically, the hardware version of the controller (such as the main chip model, circuit design, etc.) determines its physical interface, memory layout and resource allocation method, while the user program software (APP software) is developed based on a specific hardware version, and its code logic and function implementation need to be strictly adapted to the hardware characteristics. If the verification is skipped and directly refreshed, it may cause the software to fail to recognize the hardware interface, call the wrong resource address, and further cause the program after refreshing to fail to run, the hardware to be damaged, etc. Verifying whether the controller hardware version number and the APP software version number are consistent can timely intercept the mismatched software before the refreshing operation is executed, reduce the refreshing failure caused by the hardware and software adaptation problem, and solve the problem of vehicle controller software refreshing failure.

[0028] In some embodiments, the method further comprises: comparing the first comparison information and the second comparison information, if the user program software version number is consistent with the hardware version number of the controller, the termination address of the user program software is compatible with the address range corresponding to the bootloader software version number of the controller, and the user program software version number is consistent with the bootloader software version number of the controller, refreshing the software to be refreshed.

[0029] Figure 1 The flow chart for reading the controller hardware version number method is shown in Figure 1 .

[0030] First, enter the extended session: the host sends a diagnostic service instruction to the vehicle controller, which switches the controller from the default working mode to the extended session mode.

[0031] Second, send the read instruction: in the extended session mode, the host sends a read data service instruction.

[0032] Third, read the controller hardware version number: after receiving the instruction, the controller returns its hardware version number information through a message, and the host parses the message to obtain the version number.

[0033] Figure 2 The flowchart for the method of reading the controller BOOT version number is shown in Figure 2 .

[0034] First, enter the extended session: the host sends a diagnostic service instruction to the vehicle controller.

[0035] Second, switch to the refresh session: send a diagnostic session control instruction to switch the controller from the extended session to the refresh session mode. The essence of this operation is to jump the controller's running program from the APP software to the BOOT software, ensuring that subsequent BOOT-related operations are performed in the BOOT program environment.

[0036] Third, in the refresh session mode, the host sends a read data service instruction.

[0037] Fourth, obtain the controller BOOT version number: the controller returns a response message containing the BOOT version number, and the host parses the message to obtain the version number.

[0038] In some embodiments, the method further comprises: if the user program software version number is inconsistent with the hardware version number of the controller, then report an error.

[0039] In some embodiments, the method further comprises: if the termination address of the user program software is incompatible with the termination address corresponding to the bootloader software version number of the controller, then report an error.

[0040] Different chip APP software occupies different memory segment sizes, for example, if the controller has a core problem, there may be multiple main chips for the same controller, so the same controller may have multiple S19 files. During software update, if there are A chips and B chips, it is easy to mistakenly flash the S19 file of the A chip controller into the B chip controller. For this situation, if the memory size occupied by the S19 file of the A chip is different from that of the B chip, the starting address of the S19 file is generally the same, so termination address matching can be used.

[0041] The termination address information of the S19 file, i.e., the APP software termination address information, is read, in particular, the last line of the S1, S2 or S3 section in the S19 file is read, the 3-4 bytes (S1 section address occupies two bytes), 3-5 (S2 section address occupies three bytes) or 3-6 (S3 section address occupies four bytes), and the number of bytes occupied by the data section of this line is added and then 1 is subtracted (because the address itself can store one byte of data), to obtain the termination address.

[0042] The BOOT software version of the controller is bound with the hardware main chip, and the memory address range allowed to be occupied by the APP software is preset in the BOOT software version. The termination address of the APP software is the end position of the occupied space in the memory, and needs to fall within the address range corresponding to the BOOT software version to be correctly stored and executed. If the termination address exceeds the range, the BOOT software will detect address out-of-bounds when executing the burn service in the flashing process, which may cause burn failure after erasing, controller "burning to death", inability to enter the flashing session again, or incomplete APP program after flashing due to part of the code not being correctly stored.

[0043] By verifying the compatibility of the APP software termination address and the address range corresponding to the BOOT version number, the address mismatch problem caused by the misburning of the main chip can be accurately intercepted, such as avoiding the address mismatch problem caused by burning the S19 file of A chip into the controller of B chip, avoiding the above burn failure scenarios, and being especially suitable for the scenario of controller hardware diversification caused by chip shortage, thereby improving the adaptability and accuracy of software flashing and solving the problem of software flashing failure of the vehicle controller.

[0044] The S19 file is a commonly used hexadecimal program file format (full name: S-Record file) in the industry, which is widely used in embedded systems to store program code, data and related information (such as version number, address information, etc.). It is a "program package" that contains user program software information to be given to the vehicle controller. In the vehicle controller software error-proof flashing system involved in the present application, the user program software information to be flashed, such as version number, termination address and other key information, is contained in the S19 file, and by reading the file, the system can extract the comparison information for error-proof flashing verification to ensure the accuracy and safety of the entire software updating process.

[0045] In some embodiments, the method further comprises: comparing the first comparison information and the second comparison information, and if the user program software version number is inconsistent with the BOOT software version number of the controller, an error is reported.

[0046] The BOOT software is the core executor of the refreshing process, and the version thereof directly determines the supported refreshing protocol, data transmission format, security verification mechanism and interaction logic with the APP software. The version of the APP software needs to be matched with the BOOT version, so as to ensure that the BOOT software correctly parses the refreshing instruction, completes data transmission and storage, and successfully hands over the program control to the APP software after refreshing. If the versions of the two are not matched, problems such as that the BOOT software cannot parse the refreshing instruction of the APP software and returns a negative response, that the security access fails to cause the burn-in process to be unable to be entered, and that the BOOT cannot correctly jump to the APP software after refreshing to cause the program to be unable to start may occur.

[0047] By verifying the consistency of the APP software version and the BOOT version, the protocol compatibility and smooth interaction in the refreshing process can be ensured, the problems such as negative response, burn-in failure and controller "burning to death" caused by version mismatch can be avoided, and it is ensured that the APP software can be correctly started by the BOOT after refreshing, so that the success rate of software refreshing and the system stability are significantly improved, and the problem of software refreshing failure of the vehicle-mounted controller is solved.

[0048] In some embodiments, the method further comprises: reading an S19 file of the user program software to be refreshed to obtain first comparison information.

[0049] The version information of the S19 file, i.e., the APP software version information, is generally obtained by reading the S0 field of the S19 file. The first line of the S19 file is the S0 field, which contains information such as file / module name, version / revision number, date / time, product name, supplier name, copyright statement, etc. The S0 field of the S19 can be read to obtain the version information of the S19 file.

[0050] The application further provides a vehicle-mounted controller software error-proof refreshing system, comprising a reading module, a comparison module and a refreshing module, wherein the reading module, the comparison module and the refreshing module are connected through a network.

[0051] The reading module is configured to read user program software information to be refreshed to obtain first comparison information, read controller information to obtain second comparison information, and send the first comparison information and the second comparison information to the comparison module.

[0052] The comparison module is configured to receive the first comparison information and the second comparison information, and compare the first comparison information and the second comparison information. If the first comparison information matches the second comparison information, a refreshing instruction is sent to the refreshing module. If the first comparison information does not match the second comparison information, an error reporting instruction is sent to the refreshing module.

[0053] The refreshing module is configured to refresh the software to be refreshed in response to the refreshing instruction, and not to start the refreshing operation of the software to be refreshed in response to the error reporting instruction.

[0054] In some embodiments, the system further comprises that the reading module is further configured to read user program software information of the software to be refreshed to obtain first comparison information, read controller information to obtain second comparison information, and send the first comparison information and the second comparison information to the comparison module, wherein the first comparison information comprises a user program software version number and a termination address of the user program software, and the second comparison information comprises a hardware version number of the controller and a bootloader software version number of the controller.

[0055] In some embodiments, the comparison module comprises a first comparison module, a second comparison module and a third comparison module, and the first comparison module, the second comparison module and the third comparison module are connected through a network.

[0056] The first comparison module is configured to receive the first comparison information and the second comparison information, and compare the first comparison information and the second comparison information, send a first continue comparison instruction to the second comparison module if the user program software version number is consistent with the hardware version number of the controller, and send a first error reporting instruction to the refreshing module if the user program software version number is inconsistent with the hardware version number of the controller.

[0057] The second comparison module is configured to receive the first comparison information and the second comparison information, compare the first comparison information and the second comparison information in response to the first continue comparison instruction, send a second continue comparison instruction to the third comparison module if the termination address of the user program software is compatible with an address range corresponding to the bootloader software version number of the controller, and send a second error reporting instruction to the refreshing module if the termination address of the user program software is incompatible with the address range corresponding to the bootloader software version number of the controller.

[0058] The third comparison module is configured to receive the first comparison information and the second comparison information, compare the first comparison information and the second comparison information in response to the first continue comparison instruction, send a refreshing instruction to the refreshing module if the user program software version number is consistent with the bootloader software version number of the controller, and send a third error reporting instruction to the refreshing module if the user program software version number is inconsistent with the bootloader software version number of the controller.

[0059] In some embodiments, the system further comprises: the refreshing module is further configured to, in response to the refreshing instruction, refresh the software to be refreshed, and in response to an error reporting instruction, end the refreshing procedure, the error reporting instruction comprising a first error reporting instruction, a second error reporting instruction and a third error reporting instruction.

[0060] The procedure of refreshing the software to be refreshed is performed, i.e., the services 27, 31, 34, 36 and 37 are sequentially executed for refreshing. The service 27 is Security Access, the service 31 is Routine Control, the service 34 is Request Download, the service 36 is Transfer Data, and the service 37 is Request Transfer Exit.

[0061] Embodiment: Figure 3 The flowchart of the error-proof refreshing method for the software of the vehicle-mounted controller is shown in FIG. 1. First, the version number of the APP software to be refreshed, the termination address, the version number of the controller hardware and the version number of the controller BOOT are read. Figure 3

[0062] Then, it is compared whether the version number of the APP software is consistent with the version number of the controller hardware. If yes, the next round of comparison is performed; if no, the refreshing procedure is directly ended.

[0063] When the version number of the APP software is consistent with the version number of the controller hardware, it is compared whether the termination address of the APP software is compatible with the address range corresponding to the version number of the controller BOOT. If yes, the next round of comparison is performed; if no, the refreshing procedure is directly ended.

[0064] When the version number of the APP software is consistent with the version number of the controller hardware, and the termination address of the APP software is compatible with the address range corresponding to the version number of the controller BOOT, it is compared whether the version number of the APP software is consistent with the version number of the controller BOOT. If yes, the APP to be refreshed is refreshed; if no, the refreshing procedure is ended.

[0065] After the APP to be refreshed is refreshed, the updating procedure is ended.

[0066] ​The application provides a vehicle-mounted controller software error-proof refreshing method, which comprises the following steps: reading user program software information to be refreshed to obtain first comparison information, wherein the first comparison information comprises a user program software version number and a user program software end address; reading controller information to obtain second comparison information, wherein the second comparison information comprises a controller hardware version number and a controller boot program software version number; comparing the first comparison information with the second comparison information, and refreshing the software to be refreshed if the first comparison information matches the second comparison information. The problem of vehicle-mounted controller software refreshing failure is solved by verifying whether the refreshing condition is met before refreshing. The application further provides a vehicle-mounted controller software error-proof refreshing system, which comprises a reading module, a comparison module and a refreshing module. Whether the software is refreshed is determined by comparing whether the user program software version number, the controller hardware version number, the controller boot program software version number and the user program software end address match.

[0067] The similar parts among the embodiments provided by the application can be referred to each other, the specific embodiments provided above are only several examples under the general concept of the application, and do not constitute the limitation of the protection scope of the application. Any other embodiments extended according to the application scheme without creative labor belong to the protection scope of the application for the person skilled in the art.

Claims

1. A method for preventing incorrect software flashing in vehicle controllers, characterized in that, include: Read the user program software information to be refreshed to obtain the first comparison information, which includes the user program software version number and the termination address of the user program software. The controller information is read to obtain the second comparison information, which includes the controller's hardware version number and the controller's bootloader software version number. Compare the first comparison information and the second comparison information. If the first comparison information matches the second comparison information, then refresh the software to be refreshed.

2. The method according to claim 1, characterized in that, Also includes: Compare the first comparison information and the second comparison information. If the user program software version number is consistent with the hardware version number of the controller, the termination address of the user program software is compatible with the address range corresponding to the bootloader software version number of the controller, and the user program software version number is consistent with the bootloader software version number of the controller, then refresh the software to be refreshed.

3. The method according to claim 2, characterized in that, Also includes: If the user program software version number is inconsistent with the hardware version number of the controller, an error is reported by comparing the first comparison information and the second comparison information.

4. The method according to claim 3, characterized in that, Also includes: If the termination address of the user program software is incompatible with the termination address corresponding to the version number of the controller's bootloader software, an error is reported.

5. The method according to claim 4, characterized in that, Also includes: If the user program software version number is inconsistent with the controller's bootloader software version number, an error is reported by comparing the first comparison information and the second comparison information.

6. A vehicle-mounted controller software anti-misoperation system, characterized in that, It includes a read module, a comparison module, and a refresh module, wherein the read module, the comparison module, and the refresh module are connected via a network. The reading module is configured to read the user program software information to be refreshed to obtain first comparison information, read the controller information to obtain second comparison information, and send the first comparison information and the second comparison information to the comparison module. The comparison module is configured to receive the first comparison information and the second comparison information, and compare the first comparison information and the second comparison information. If the first comparison information matches the second comparison information, a refresh instruction is sent to the refresh module. If the first comparison information does not match the second comparison information, an error reporting instruction is sent to the refresh module. The refresh module is configured to refresh the software to be refreshed in response to the refresh command, and not to initiate the refresh operation of the software to be refreshed in response to an error command.

7. The system according to claim 6, characterized in that, Also includes: The reading module is further configured to read the user program software information of the software to be refreshed to obtain first comparison information, read the controller information to obtain second comparison information, and send the first comparison information and the second comparison information to the comparison module. The first comparison information includes the user program software version number and the termination address of the user program software. The second comparison information includes the hardware version number of the controller and the boot program software version number of the controller.

8. The system according to claim 7, characterized in that, The comparison module includes a first comparison module, a second comparison module, and a third comparison module, which are connected via a network. The first comparison module is configured to receive the first comparison information and the second comparison information, and compare the first comparison information and the second comparison information. If the user program software version number is consistent with the hardware version number of the controller, a first continue comparison instruction is sent to the second comparison module. If the user program software version number is inconsistent with the hardware version number of the controller, a first error reporting instruction is sent to the refresh module. The second comparison module is configured to receive the first comparison information and the second comparison information, and in response to the first continue comparison instruction, compare the first comparison information and the second comparison information. If the termination address of the user program software is compatible with the address range corresponding to the version number of the bootloader software of the controller, then send a second continue comparison instruction to the third comparison module. If the termination address of the user program software is not compatible with the address range corresponding to the version number of the bootloader software of the controller, then send a second error reporting instruction to the refresh module. The third comparison module is configured to receive the first comparison information and the second comparison information, and in response to the first continue comparison instruction, compare the first comparison information and the second comparison information. If the user program software version number is consistent with the bootloader software version number of the controller, a refresh instruction is sent to the refresh module. If the user program software version number is inconsistent with the bootloader software version number of the controller, a third error reporting instruction is sent to the refresh module.

9. The system according to claim 8, characterized in that, Also includes: The refresh module is further configured to refresh the software to be refreshed in response to the refresh instruction, and to terminate the refresh program in response to an error reporting instruction, wherein the error reporting instruction includes a first error reporting instruction, a second error reporting instruction, and a third error reporting instruction.

Images