Application program rollback method and device, electronic equipment and vehicle

Abstract

The invention relates to an application program rollback method and device, electronic equipment and a vehicle, and the application program rollback method comprises the steps: obtaining a bootable Bootable mark of a second partition under the condition that an application program of a first partition fails to start; the Bootable mark is used for representing whether the application program is valid or not; the first partition and the second partition are double partitions of the application program in an OTA upgrading scene; one of the first partition and the second partition is a running partition, and the other one is a backup partition; under the condition that the Bootable mark of the second partition is the effective mark, the first partition is switched from the activated state to the inactivated state, and the second partition is switched from the inactivated state to the activated state; the activated state is used for representing that the corresponding partition is running; and starting the application program in the second partition. The method is used for solving the problem that the application program is abnormal during starting.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of automobile controller, in particular to an application rollback method and device, electronic equipment and vehicle. BACKGROUND

[0002] With the development of intelligent and networked vehicles, over-the-air (OTA) technology upgrade has become the core means of vehicle software update. To ensure upgrade reliability, vehicles generally use A / B partition design to upgrade the application program of the backup area of vehicle software, and then complete software update through hardware partition switching. However, in actual vehicle applications, there are often cases of partition upgrade failure and abnormal startup of the current active area. Therefore, after OTA upgrade, how to handle the abnormality of the application program during startup is the key to ensuring the stability and robustness of vehicle OTA upgrade.

[0003] With OTA upgrade playing an increasingly important role in vehicle control, software upgrade strategy and abnormal state detection and recovery have become the focus of industry attention. Based on the current industry status, in related technologies, by obtaining vehicle controller partition information and current software version information, and feeding back the results before and after software upgrade, for the case of upgrade failure, the rollback mechanism is entered to recover to the previous version software, but whether the rollback condition after upgrade failure is met is not judged, which may easily lead to loss of current software version or rollback abnormality.

[0004] In another related technology, by loading the operating system and application program in the main storage partition corresponding to the embedded device when detecting the startup of the embedded device, and loading the corresponding backup operating system and backup application program from the backup storage partition corresponding to the embedded device through the preset boot loader when loading fails and the preset recovery instruction is detected, the embedded device is recovered from failure. Similarly, before loading and booting the backup partition, no verification is performed, which may cause abnormal software operation after loading. SUMMARY

[0005] The present disclosure provides an application rollback method and device, electronic equipment and vehicle, and the purpose of the present disclosure is to solve the technical problem of how to handle the abnormality of the application program during startup.

[0006] To achieve the above purpose, the technical solution adopted by the present disclosure is as follows:

[0007] According to a first aspect of the present disclosure, a method for application rollback is provided, and the method is applied to a vehicle controller, and the method comprises the following steps: in the case that the application in a first partition fails to start, obtaining a Bootable flag of a second partition; the Bootable flag is used to indicate whether the application is valid; the first partition and the second partition are dual-partitions in an over-the-air (OTA) upgrade scenario; of the first partition and the second partition, one is a running partition, and the other is a backup partition; in the case that the Bootable flag of the second partition is a valid flag, switching the first partition from an active state to an inactive state and switching the second partition from the inactive state to the active state; the active state is used to indicate that the corresponding partition is running; and starting the application in the second partition.

[0008] According to the above technical means, in the case that the application in the first partition fails to start, the Bootable flag of the second partition can be used to directly obtain whether the application in the second partition is valid. When the application in the second partition is valid, the rollback operation is completed by switching the current states of the first partition and the second partition, so as to solve the problem that the application in the first partition fails to start, ensure the normal start of the application, and thus ensure the normal operation of the vehicle software. The Bootable flag of the second partition can be used to quickly determine whether the application in the second partition has a problem, and provide a basis for the judgment before the rollback. The validity of the application in the partition to be switched is determined before the rollback, so that the rollback failure caused by the error of the application in the switched partition can be avoided, and the reliability of the rollback operation is improved.

[0009] In a possible implementation, before starting the application in the first partition, the method further comprises the following steps: receiving an OTA upgrade request for the application; in response to the OTA upgrade request, upgrading the application in the first partition; the state of the first partition before the upgrade is the inactive state; in the case that the application in the first partition is upgraded and the upgrade is successful, setting the Bootable flag of the first partition as the valid flag, switching the first partition from the inactive state to the active state, and switching the second partition from the active state to the inactive state; the Bootable flag is used to indicate whether the application is valid.

[0010] According to the technical means, after receiving the OTA upgrade request for the application program, the application program in the first partition (i.e., the backup partition) is upgraded. After the application program is upgraded successfully, the Bootable flag of the first partition is set to a valid flag (if the upgrade fails, the Bootable flag of the first partition is an invalid flag), so that the validity of the application program in the first partition is determined according to the Bootable flag of the first partition. Then, the first partition is switched from the inactive state to the active state, the partition is upgraded, and the OTA upgrade of the application program is completed.

[0011] In a possible implementation, after the first partition is switched from the inactive state to the active state and the second partition is switched from the active state to the inactive state, the method further includes: in a case where the first partition fails to be switched from the inactive state to the active state, upgrading the application program in the second partition; and in a case where the application program in the second partition is upgraded successfully, setting the Bootable flag of the second partition to a valid flag, so as to complete the OTA upgrade of the application program in the second partition.

[0012] According to the technical means, in a case where the partition switching fails, the application program in the second partition (i.e., the running partition) is directly upgraded, and after the upgrade is successful, the Bootable flag of the second partition is set to a valid flag. By being compatible with different upgrade processes, the problem that the application program cannot be upgraded due to the failure of the partition switching is solved, so that in a case where the partition switching fails or in a scenario where the device does not support the dual-partition OTA upgrade, the application program can be normally upgraded.

[0013] In a possible implementation, after the Bootable flag of the second partition is set to a valid flag, the method further includes: upgrading the application program in the first partition according to the upgraded application program in the second partition; and in a case where the application program in the first partition is upgraded successfully, setting the Bootable flag of the first partition to a valid flag.

[0014] According to the technical means, after the application program in the second partition is upgraded successfully by using the single-partition flashing process, the application program in the second partition after the upgrade is synchronized to the first partition, so that the consistency of the dual-partition application program is ensured, compatibility problems caused by version differences during subsequent partition switching are avoided, and the stability of the OTA upgrade is improved.

[0015] In a possible implementation, the application program rollback method further includes: in a case where the application program in the first partition is started successfully, setting a Success flag of the first partition to a valid flag. The Success flag is used to indicate whether the application program is started successfully.

[0016] According to the technical means, in the case that the application program in the first partition is successfully started, the Success flag of the first partition is set as a valid flag, so that the starting condition of the application program in the first partition can be directly obtained before rollback, and the condition judgment before rollback is performed. It is ensured that the switched partition is the partition that is successfully started during the rollback operation process, and the reliability of the rollback operation is further improved.

[0017] In a possible implementation, switching the first partition from the inactive state to the active state and switching the second partition from the active state to the inactive state comprises: setting the Active flag of the first partition as a valid flag, and setting the Active flag of the second partition as an invalid flag; the Active flag is used to indicate the state of the corresponding partition.

[0018] According to the technical means, the disclosure can realize the switching of the active states of the first partition and the second partition after upgrading by setting the Active flag of the first partition as a valid flag and setting the Active flag of the second partition as an invalid flag. Precise management of the partition state is realized by the explicit partition state flag, and the unique identification and reliable scheduling of the current active partition are ensured. In the software starting phase, the application program in which partition is currently running can be determined by reading the Active flag, without the need to traverse the current state of all partitions, thereby shortening the starting time. In the partition switching or rollback phase, only the validity of the Active flags of the two partitions needs to be switched, so that the currently running partition can be modified, the implementation logic of the partition switching, starting, rollback and the like is simplified, and the stability and maintainability in the OTA upgrading process are improved.

[0019] In a possible implementation, the application program rollback method further comprises: in the case that the application program in the first partition appears running abnormity, obtaining the Bootable flag and the Success flag of the second partition; in the case that the Bootable flag and the Success flag of the second partition are both valid flags, switching the first partition from the active state to the inactive state and switching the second partition from the inactive state to the active state; and starting the application program in the second partition.

[0020] According to the above technical means, in the case that the application program in the first partition has an exception during running, the Bootable flag and the Success flag of the second partition are acquired first to determine the validity of the application program in the second partition and whether the application program in the second partition has been successfully started. In the case that the application program in the second partition is valid and has been successfully started, the rollback operation is performed. By determining the validity of the application program in the second partition and whether the application program in the second partition has been successfully started before rollback, the validity of rollback can be ensured, and rollback failure caused by problems of the application program in the second partition itself can be avoided. Meanwhile, the Bootable flag and the Success flag of the second partition can also provide a basis for subsequent problem positioning. For example, if it is found that the second partition is valid but has never been successfully started, it indicates that the problem may be in the starting process. If the second partition has been successfully started but is currently invalid, the problem is more likely to be related to the runtime environment, so that the subsequent exception causes can be investigated.

[0021] In a possible implementation, the application program rollback method further includes: in response to an OTA upgrade request for the firmware, upgrading a BootLoader program of the first partition; the firmware includes the BootLoader program and the application program; and in the case that the BootLoader program of the first partition is upgraded successfully and the upgrading is completed, upgrading the application program of the first partition.

[0022] According to the above technical means, the present disclosure can support the cooperative upgrading of the BootLoader program and the application program on the basis of supporting the upgrading of the application program. The BootLoader program is the first line of defense for software starting, and its compatibility directly affects the running stability of the entire software system. For example, when the application program needs to be upgraded, the software starting fails because the current BootLoader program is incompatible with the upgraded application program, and therefore the BootLoader program needs to be upgraded before the application program is upgraded, to ensure that the application program can be normally upgraded and can be normally started after being upgraded.

[0023] In a possible implementation, the application program rollback method further includes: in the case that the OTA upgrading of the application program in the second partition is completed and the application program in the second partition is successfully started, setting the Success flag of the second partition as a valid flag.

[0024] According to the technical means, the Success flag indicating whether the second partition is successfully started is set as a valid flag in a case that the OTA upgrade of the application program of the second partition is completed and the application program of the second partition is successfully started, so that the Success flag of the second partition can be directly acquired to determine whether the second partition is started in a subsequent rollback operation, a basis is provided for a condition judgment before rollback, and the accuracy and reliability of the rollback are ensured.

[0025] According to a second aspect provided by the present disclosure, an application program rollback apparatus is provided, and the application program rollback apparatus comprises: a partition detection module and a rollback execution module; the partition detection module is configured to acquire a Bootable flag of a second partition in a case that an application program of a first partition fails to start; the Bootable flag is used to indicate whether the application program is valid; the first partition and the second partition are dual-partitions in an over-the-air (OTA) upgrade scenario of the application program; of the first partition and the second partition, one is a running partition and the other is a backup partition; the rollback execution module is configured to switch the first partition from an active state to an inactive state and switch the second partition from the inactive state to the active state in a case that the Bootable flag of the second partition is a valid flag; the active state is used to indicate that the corresponding partition is running; and the rollback execution module is further configured to start the application program in the second partition.

[0026] In a possible implementation, the application program rollback apparatus further comprises: a start verification module and a fault recording module; the start verification module is configured to verify the application program of the first partition when the application program of the first partition starts; and the fault recording module is configured to record software version information corresponding to the application program of the first partition in a case that the application program of the first partition fails to start.

[0027] According to a third aspect provided by the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; and wherein the processor is configured to execute the instructions to implement the method of the first aspect and any possible implementation thereof.

[0028] According to a fourth aspect provided by the present disclosure, a computer-readable storage medium is provided, and when computer-executable instructions stored in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is caused to perform the method of the first aspect and any possible implementation thereof.

[0029] According to a fifth aspect provided by the present disclosure, a computer program product is provided, and the computer program product comprises computer instructions, and when the computer instructions are executed on an electronic device, the electronic device is caused to perform the method of the first aspect and any possible implementation thereof.

[0030] According to a sixth aspect provided by the present disclosure, there is provided a vehicle for implementing the method of the first aspect and any possible implementation thereof.

[0031] It should be noted that the technical effects brought by any implementation of the third aspect to the sixth aspect can be referred to the technical effects brought by the corresponding implementation of the first aspect, which will not be repeated here.

[0032] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure, and do not constitute an undue limitation on the present disclosure.

[0034] Figure 1 is a structural schematic diagram of an application rollback system according to an exemplary embodiment;

[0035] Figure 2 is a flowchart of an application rollback method according to an exemplary embodiment;

[0036] Figure 3 is a flowchart of another application rollback method according to an exemplary embodiment;

[0037] Figure 4 is a flowchart of another application rollback method according to an exemplary embodiment;

[0038] Figure 5 is a flowchart of another application rollback method according to an exemplary embodiment;

[0039] Figure 6 is a flowchart of another application rollback method according to an exemplary embodiment;

[0040] Figure 7 is a flowchart of another application rollback method according to an exemplary embodiment;

[0041] Figure 8 is a structural diagram of an application partition state according to an exemplary embodiment;

[0042] Figure 9 is a true value representation intention of an application partition state according to an exemplary embodiment;

[0043] Figure 10 is a latch flowchart of an application partition state according to an exemplary embodiment;

[0044] Figure 11 is a dual-partition synchronous flashing flowchart according to an example embodiment;

[0045] Figure 12 is an arbitration flowchart of partition exception start according to an example embodiment;

[0046] Figure 13 is a block diagram of an application rollback device according to an example embodiment;

[0047] Figure 14 is a block diagram of an electronic device according to an example embodiment. DETAILED DESCRIPTION

[0048] In order for those skilled in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings.

[0049] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein. The implementation described in the following example embodiments does not represent all implementations consistent with the present disclosure. Rather, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0050] As Figure 1 shown, the present embodiment provides an application rollback system, which can be deployed in a vehicle controller 101, and the vehicle can further include a data storage device 102.

[0051] In the present embodiment, the data storage device 102 can include a first partition and a second partition, and the data storage device 102 is configured to store applications of the first partition and the second partition, and application partition state flags of the first partition and the second partition. So that the vehicle controller 101 is configured to upgrade the applications of the first partition or the second partition in the data storage device 102 in response to an over-the-air (OTA) upgrade instruction for the applications, or perform a rollback operation and modify the application partition state flags in response to an application start exception (or an application running exception).

[0052] Optionally, the application partition state flag can include a Bootable flag, a Success flag, an Active flag, and a software version number.

[0053] Optionally, the data storage device 102 can be a storage medium in the vehicle, such as a flash memory and an electrically erasable programmable read-only memory (EEPROM).

[0054] Optionally, the vehicle controller 101 can be an electronic control unit (ECU) or a domain control unit (DCU) in the vehicle.

[0055] Optionally, the execution subject of the application rollback method provided by the embodiments of the present disclosure can be the vehicle controller 101 (for example, the ECU or the DCU), which is configured to perform the following operations: in response to an OTA upgrade instruction for an application, upgrading the application in the first partition or the second partition of the data storage device 102, or in response to an application startup exception (or an application running exception), performing a rollback operation, and modifying an application partition state flag.

[0056] The application rollback method provided by the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0057] The application rollback method provided by the embodiments of the present disclosure is applied to Figure 1 The vehicle controller 101 in the application rollback system shown in FIG. 1, such as Figure 2 The application rollback method provided by the embodiments of the present disclosure includes the following steps.

[0058] S201, in the case where the application in the first partition fails to start, obtaining a Bootable flag of the second partition.

[0059] The Bootable flag is used to indicate whether the application is valid. The first partition and the second partition are dual-partitions of the application in an OTA upgrade scenario. In the first partition and the second partition, one is a running partition and the other is a backup partition.

[0060] Specifically, after one OTA upgrade, a reset operation is needed to restart the application program of the first partition. In the case that the application program of the first partition fails to start, in order to ensure that the application program can normally run, the currently running partition is switched to the second partition to implement a rollback operation. Before switching the partition, in order to ensure that the application program can normally start after being switched to the second partition, and to avoid the case of rollback failure, a Bootable flag of the second partition indicating whether the application program is valid needs to be obtained to determine the validity of the application program of the second partition.

[0061] Optionally, whether the application program is valid indicates whether the application program is a complete and normally loadable and executable application program.

[0062] Optionally, in the OTA upgrade scenario, the OTA upgrade is completed by means of dual-partition, and the data storage device is divided into two partitions, including a first partition and a second partition. In the two partitions, one partition is used as a currently running partition, and the other partition is used as a backup partition. The OTA upgrade by means of dual-partition can ensure that the normal operation of the vehicle controller is not affected during the upgrade, and can ensure that the normal operation of the vehicle system is not affected in the case of upgrade failure, and the safe operation of the system is ensured.

[0063] S202, in the case that the Bootable flag of the second partition is a valid flag, switching the first partition from an active state to an inactive state and switching the second partition from an inactive state to an active state.

[0064] The active state is used to indicate that the corresponding partition is running.

[0065] Specifically, when the Bootable flag of the second partition is a valid flag, it indicates that the application program of the second partition is a complete and normally loadable and executable application program, which meets the precondition of rollback. Further, by switching the first partition from the active state to the inactive state (taking the first partition as the backup partition) and switching the second partition from the inactive state to the active state, it is ensured that the application program can normally start.

[0066] For example, if the application program of the currently active partition (i.e., the currently running partition) starts abnormally, then the strategy of whether to perform rollback is completed through a start verification module, a partition detection module, and a fault recording module, and the specific process is as follows:

[0067] Firstly, the application program in the current active area is checked by starting the checking module. The code segment of the application program in the current active area is sampled and detected, and the Advanced Encryption Standard 128-bit (AES128) and the Secure Hash Algorithm 256-bit (SHA256) are used to calculate whether the code segment of the application program is checked through.

[0068] If the checking of the application program in the current active area exceeds the maximum number of attempts (for example, 3 times), the partition detection module is entered. The application partition state flag of the current inactive area is read to determine whether the current inactive area satisfies the precondition of rollback (that is, to determine the validity of the application program in the current inactive area). If the Bootable of the current inactive area is valid, the rollback condition is satisfied.

[0069] Then, the fault recording module is entered. The software version information corresponding to the application program of the current active area with the startup exception and the software version information corresponding to the application program of the inactive area with the invalid Bootable flag are written into the flash memory to record the abnormal software version information and the abnormal reason for subsequent use.

[0070] Secondly, the rollback execution module is entered. In the case where the rollback condition is satisfied, the active state Active flags of the current active area and the current inactive area are exchanged, and the Bootable flag of the current active area is set as invalid.

[0071] If the application program is successfully entered after switching the partitions, the current rollback is completed. The application program obtains the abnormal software version information stored in the current flash memory and feeds back to the whole vehicle for log recording.

[0072] If the application program is still abnormal after the rollback operation, the fault message is continuously sent through the CAN bus, and a new OTA request is waited for recovery (software upgrade or software rollback).

[0073] S203, start the application program in the second partition.

[0074] Specifically, after the active state of the first partition and the second partition is switched, the application program in the second partition in the active state is started. If the application program in the second partition can be normally started, it indicates that the current rollback operation is successfully executed. Otherwise, if the application program in the second partition fails to start, it indicates that the current rollback operation fails.

[0075] As can be seen from the above, in the case that the application program in the current active partition is started abnormally, the validity of the application program in the backup partition is determined by obtaining the Bootable flag of the backup partition before the rollback operation is performed. The validity of the application program in the partition is determined by the Bootable flag of the partition, which can shorten the verification time. When the application program in the backup partition is complete and can be normally loaded and run, the rollback operation is performed to switch the backup partition to the currently running partition, thereby avoiding rollback to an invalid application program and avoiding secondary failure of the application program caused by the rollback operation.

[0076] In some embodiments, in combination with Figure 2 After the process of S201, the application rollback method further includes:

[0077] In the case that the application program in the first partition is started successfully, the Success flag of the first partition is set as a valid flag.

[0078] The Success flag is used to indicate whether the application program is started successfully.

[0079] Optionally, after receiving the OTA upgrade request for the application program, the vehicle controller upgrades the application program in the active partition, as in the process of S302. Then, in the case that the application program in the first partition is upgraded and started successfully, the application program needs to be restarted to ensure that the partition switching is successful. If the application program in the first partition is started successfully, it indicates that the application program in the first partition is upgraded successfully and can be normally started, and on this basis, the Success flag of the first partition is set as a valid flag, indicating that the application program in the first partition is started successfully, which provides a basis for the subsequent judgment before rollback.

[0080] In some embodiments, as Figure 3 Before starting the application program in the first partition, the process further includes:

[0081] S301, receiving an OTA upgrade request for the application program.

[0082] Specifically, in the OTA upgrade scenario, the vehicle controller receives the OTA upgrade request for the application program issued by the cloud, so that the vehicle controller can subsequently upgrade the application program in response to the OTA upgrade request.

[0083] S302, in response to the OTA upgrade request, upgrading the application program in the first partition.

[0084] The state of the first partition before upgrading is the non-active state.

[0085] Specifically, in the case that the first partition is in the inactive state, after the vehicle controller receives the OTA upgrade request for the application, first, the application of the first partition is erased, and the application partition state flag of the first partition is initialized. Then, the new version of the application is written to the first partition, and the upgrade of the application of the first partition is completed.

[0086] Optionally, the initialization of the application partition state flag of the first partition includes setting the Bootable flag and the Success flag to invalid flags (such as setting the value of the Bootable flag and the value of the Success flag to “0”), and setting the software version number to invalid (such as setting the software version number to “0xFF”).

[0087] S303, in the case that the upgrade of the application of the first partition is completed and the upgrade is successful, setting the Bootable flag of the first partition to a valid flag, and switching the first partition from the inactive state to the active state and switching the second partition from the active state to the inactive state.

[0088] The Bootable flag is used to indicate whether the application is valid.

[0089] Specifically, after the upgrade of the application of the first partition is completed and it is ensured that the upgraded application is a valid application, the Bootable flag of the first partition is set to a valid flag (such as setting the value of the Bootable flag to “1”), so that the validity of the application of the first partition can be accurately judged in subsequent OTA upgrade or rollback operations, and a reliable basis is provided for partition switching.

[0090] Optionally, after the upgrade of the application of the first partition is completed, the integrity and the runnability of the upgraded application of the first partition are checked to ensure that the upgraded application of the first partition is a complete and normally loadable and executable application, so as to ensure that the upgrade of the application of the first partition is successful. When the upgrade of the application of the first partition is completed and the check is passed (i.e., the upgrade is successful), the Bootable flag of the first partition is set to a valid flag, indicating that the first partition has met the conditions for being a boot partition. If the upgrade fails or the check fails, the Bootable flag of the first partition is kept as an invalid flag, and the specific failure reason (such as file missing, signature verification failure, and function call timeout) is recorded, and the upgrade is ended.

[0091] As can be seen from the above, the present disclosure, through the partition upgrade mechanism, upgrades the application program of the backup partition (i.e., the first partition described above) when receiving the OTA upgrade request, avoids modifying the application program of the partition that is running, physically isolates the influence of the upgrade operation on the current function of the vehicle, and even if an error (such as application program writing failure or file damage) occurs during the upgrade process, the partition that is currently running on the vehicle will not be affected, ensuring that the function (such as power control and braking system) of the vehicle can be safely and stably operated during the application program upgrade. The present disclosure verifies the validity of the application program of the partition that has been upgraded successfully, and stores the verification result (i.e., whether the application program is valid) through the Bootable flag, so that when subsequent partition switching (such as upgrade partition switching and rollback partition switching) is performed, the validity of the application program of the partition can be directly judged according to the Bootable flag of the partition. When the upgrade fails or the verification fails, the Bootable flag of the current partition is recorded as an invalid flag, and the related error reason is recorded at the same time, so as to determine the specific reason for the current upgrade failure during the application program upgrade process or the subsequent rollback process. Not only can the specific situation of the application program upgrade be obtained in time during the application program upgrade process, but also a basis for subsequent rollback operation can be provided.

[0092] In some embodiments, in combination with Figure 3 As Figure 4 As shown in S303, after the first partition is switched from the inactive state to the active state and the second partition is switched from the active state to the inactive state, the following steps are further included:

[0093] S401, in the case that the first partition fails to switch from the inactive state to the active state, upgrading the application program of the second partition.

[0094] Specifically, in the case that the first partition fails to switch from the inactive state to the active state after the upgrade, the application program of the second partition (the partition that is currently running) can be upgraded to ensure that the application program can be normally upgraded.

[0095] Optionally, in the case that the first partition fails to switch from the inactive state to the active state after the upgrade (i.e., the first partition fails to switch from the inactive state to the active state after the upgrade), the application program of the second partition (i.e., the active partition) can be upgraded through the single-partition flashing process to ensure that the application program can be normally upgraded.

[0096] S402, in the case that the application program of the second partition is upgraded and the upgrade is successful, setting the Bootable flag of the second partition as a valid flag.

[0097] Specifically, after the application upgrade on the second partition is completed, the integrity and operability of the upgraded application on the second partition are verified to ensure that the upgraded application on the second partition is complete and can be loaded and run normally, thus ensuring a successful upgrade. When the application upgrade on the second partition is complete and the verification passes (i.e., the upgrade is successful), the Bootable flag of the second partition is set to a valid flag to complete the OTA upgrade of the application on the second partition.

[0098] Optionally, if the upgrade fails or the verification fails, the OTA upgrade response will be terminated and the current OTA upgrade process will be exited.

[0099] As can be seen from the above, this disclosure also provides a single-partition flashing process, which upgrades the application in the currently active partition (and the aforementioned second partition). By being compatible with different upgrade processes, it ensures that the application can complete the upgrade operation normally in the event of partition switching failure or device not supporting the dual-partition mechanism, thereby improving the overall robustness of OTA upgrades.

[0100] In some embodiments, the application rollback method further includes:

[0101] Once the OTA upgrade of the application in the second partition is complete and the application in the second partition starts successfully, the Success flag of the second partition will be set to valid.

[0102] Optionally, the Success flag of the second partition can be set to a valid flag, indicating that the application in the second partition has been successfully started, providing a basis for subsequent judgment before rollback and reducing the risk of rollback failure.

[0103] In some embodiments, combined with Figure 4 ,like Figure 5 As shown, in S402 above, after setting the Bootable flag of the second partition to a valid flag, the following steps are also included:

[0104] S501. Upgrade the application in the first partition based on the upgraded application in the second partition.

[0105] Specifically, after upgrading the application in the second partition (active partition), the application in the first partition is upgraded simultaneously based on the upgraded application in the second partition. This ensures the consistency of the applications in the first and second partitions, avoids hardware compatibility risks caused by version differences, and ensures the reliability of subsequent partition switching.

[0106] For example, after the OTA upgrade of the application program in the active partition (i.e., the second partition) is completed, the application program in the active partition (i.e., the second partition) is copied and written into the non-active partition (i.e., the first partition), and the program segment in the non-active partition is checked for compliance (e.g., the integrity of the program is checked and whether the program can run normally).

[0107] S502, in the case where the application program upgrade of the first partition is completed and the upgrade is successful, setting the Bootable flag of the first partition as a valid flag.

[0108] Specifically, in the case where the application program of the first partition is upgraded according to the application program of the second partition, after the application program upgrade of the first partition is completed and it is ensured that the upgraded application program is a valid application program, the Bootable flag of the first partition is set as a valid flag, so that the validity of the application program of the first partition can be accurately determined in subsequent execution of the OTA upgrade or rollback operation, and a reliable basis is provided for partition switching.

[0109] As can be seen from the above, after the application program upgrade of the current active partition (i.e., the second partition) is completed and the upgrade is successful through the single-partition flashing process, the application program in the active partition is synchronized and flashed into the non-active partition (i.e., the first partition), the consistency of the application programs in the two partitions is ensured, and the hardware compatibility failure problem caused by the difference in the application programs in different partitions during subsequent partition switching is avoided.

[0110] In some embodiments, in combination with Figure 3 In S303, the first partition is switched from the non-active state to the active state, and the second partition is switched from the active state to the non-active state, including:

[0111] The Active flag of the first partition is set as a valid flag, and the Active flag of the second partition is set as an invalid flag.

[0112] The Active flag is used to indicate the state of the corresponding partition.

[0113] Specifically, before the partition switching, the vehicle controller modifies and saves the Active flags of the first partition and the second partition stored in the data storage device, so that when the application program is restarted during subsequent partition switching, it can be ensured that the partition switching is truly effective (i.e., the first partition is switched to the active partition, and the second partition is switched to the non-active partition).

[0114] Optionally, when the Active flag of the first partition is set as a valid flag (e.g., the value of the Active flag is "1"), after the restart, the first partition is switched from the backup partition to the currently running partition. Correspondingly, when the Active flag of the second partition is set as an invalid flag (e.g., the value of the Active flag is "0"), after the restart, the second partition is switched from the currently running partition to the backup partition. By setting the flag bit for indicating the current partition state, the state of each partition can be determined to distinguish the running partition and the backup partition. Compared with other complex logic judgment methods for activating the partition (i.e., the currently running partition) (such as checking the software version information, hardware adaptation, etc.), the Active flag can more directly determine the state of each partition, and the process is simpler and more efficient. If the subsequent application program runs abnormally, the Active flag can be read to quickly determine which partition is currently activated, and the application program upgrade record and the verification result (such as the Bootable flag and the Success flag) of the partition are combined to locate the problem (whether the program of the partition itself fails or the switching process is abnormal).

[0115] In some embodiments, as shown in Figure 6 the application rollback method further includes:

[0116] S601, in the case that the application program of the first partition runs abnormally, obtaining the Bootable flag and the Success flag of the second partition.

[0117] Specifically, in the case that the application program of the first partition runs abnormally in the running process, in order to ensure that the rolled-back application program is valid and has been successfully started, the Bootable flag and the Success flag of the second partition are obtained as the judgment basis before the subsequent rollback.

[0118] S602, in the case that the Bootable flag and the Success flag of the second partition are both valid flags, switching the first partition from the active state to the inactive state and switching the second partition from the inactive state to the active state.

[0119] Specifically, when the Bootable flag and the Success flag of the second partition are both valid flags, it indicates that the application program of the second partition is valid and has been successfully run, so the application program of the second partition can be switched to the currently running application program, and the rollback operation is realized.

[0120] S603, starting the application program in the second partition.

[0121] Specifically, after the current state of the first partition is switched to the inactive state and the current state of the second partition is switched to the active state in S602, the actual switching process (for example, the address remapping process of the active area and the inactive area) needs to be completed by restarting the application program, and therefore the application program in the second partition needs to be restarted to ensure that the rollback operation of the application program is successfully performed.

[0122] As can be seen from the above, the present disclosure provides a dual-partition flashing process and a single-partition flashing process (including synchronous flashing of the active area and the inactive area) to flexibly cope with application program upgrade requirements in different scenarios. In the case of application program startup exception, the Bootable flag of the inactive area is obtained for judgment, and when the Bootable flag of the inactive area is a valid flag, the rollback condition is met, and then the rollback operation is performed. The present disclosure further sets a Success flag for indicating whether the application program has been successfully started, and in the case of application program exception during running, the application program is rolled back to the previous version. At this time, it is necessary to judge whether the Bootable flag and the Success flag of the inactive area are both valid flags, and when the Bootable flag and the Success flag of the inactive area are both valid flags, the rollback condition is met, and then the application program is rolled back to the valid and successfully started version.

[0123] In some embodiments, as shown in Figure 7 the application program rollback method further includes:

[0124] S701, in response to an OTA upgrade request for firmware, upgrading a BootLoader of a first partition.

[0125] The firmware includes a BootLoader and an application program.

[0126] Optionally, because the BootLoader program needs to be started first to load the application program before the application program is started, if the BootLoader program fails to start the application program due to problems in the BootLoader program (for example, the old version of the BootLoader program has a startup timeout problem and thus fails to load the application program), the BootLoader program needs to be upgraded and repaired.

[0127] S702, in the case that the BootLoader program of the first partition is successfully upgraded and the upgrading is completed, upgrading an application program of the first partition.

[0128] Specifically, before the application is started, the BootLoader program needs to be started first to load the application. Therefore, the upgrade of the application needs to be performed after the upgrade of the BootLoader program is successful and completed.

[0129] As can be seen, the present disclosure can also support an OTA upgrade request for firmware, and upgrade the BootLoader program and the application, thereby avoiding the problem that the application cannot be normally started after being upgraded due to the version or security vulnerability of the BootLoader program, and further improving the stability of OTA upgrade.

[0130] For example, the present disclosure provides an application partition state structure, as shown in Figure 8 The application partition state includes:

[0131] Active flag: indicating the activation state of the A partition or the B partition.

[0132] Bootable flag: indicating whether the A partition or the B partition has a complete and valid application.

[0133] Success flag: indicating whether the application of the A partition or the B partition is successfully started and run.

[0134] Cyclic redundancy check (CRC) check value: used to determine the integrity of the application of the A partition or the B partition.

[0135] Software version number: indicating the software version number of the A partition or the B partition.

[0136] Optionally, the Active flag value of "1" represents that the partition is activated and serves as the currently started partition, and the Active flag value of "0" represents that the partition is not activated and serves as the flashing area (also referred to as the backup partition). The Bootable flag value of "1" represents that the partition has a valid application, indicating that the partition has successfully performed the upgrade process and passed the validity check, and the Bootable flag value of "0" represents that the application of the partition is invalid. The Success flag value of "1" represents that the partition is successfully started, and the Success flag value of "0" represents that the partition is not successfully started.

[0137] For example, the present disclosure provides an application partition state truth table, as shown in Figure 9 Before the rollback operation is performed, it is necessary to determine whether the preconditions for rollback are met according to the application state flag.

[0138] If the Active flag value of the A area is "1", it indicates that the A area is an active area. If the Bootable flag value of the A area is "1", it indicates that the application program of the A area is valid. If the Bootable flag value of the A area is "0", it indicates that the application program of the A area is invalid (i.e. the application program of the A area fails to pass the verification). If the Success flag value of the A area is "1", it indicates that the A area has been successfully started. If the Success flag value of the A area is "0", it indicates that the A area has not been successfully started. Correspondingly, the Active flag value of the B area is "0", indicating that the B area is an inactive area. If the Bootable flag value of the B area is "1", it indicates that the application program of the B area is valid. If the Success flag value of the B area is "1", it indicates that the B area has been successfully started.

[0139] When the application program of the A area abnormally occurs during the running process, as shown in FIG. 6, if the Bootable flag value and the Success flag value of the current inactive area (i.e. the B area) are both "1" (i.e. the Bootable flag and the Success flag are both valid flags), the preconditions for rollback are met, and thus the rollback operation is supported. If the Bootable flag value of the inactive area is "0" or the Bootable flag value is "1" but the Success flag value is "0" (i.e. the application program of the inactive area has not been successfully started), the preconditions for rollback are not met. Thus, the rollback operation is not supported. Figure 9

[0140] Exemplarily, the present disclosure provides an application partition state latching flow, as shown in FIG. 7, which is as follows: Figure 10

[0141] S1001, receiving an OTA upgrade request, and performing a state self-check on the application partition state of the A / B partition.

[0142] Exemplarily, in order to avoid abnormal partition state before upgrading, after receiving a valid OTA upgrade request, the application partition state is first self-checked. Then, the active state in the hardware register is self-checked and compared with the A / B active state in the application partition state. If they are inconsistent, the actual active state of the hardware register is updated to the flash memory, and the CRC check value is re-written. If they are consistent, the partition upgrade flow is directly entered.

[0143] S1002, upgrading the application program of the inactive area.

[0144] Exemplarily, in the partition upgrade, if the inactive area is successfully erased, the Bootble flag and the Success flag of the inactive area are set to be invalid, and the software version number is set to "0xFF", representing that the partition no longer has a complete application program. ​​

[0145] S1003, check whether the upgrade is passed.

[0146] For example, after the partition upgrade is completed, it is checked whether the non-active area upgrade is passed, and if not, the upgrade is ended. If yes, S1004 is executed.

[0147] S1004, set the Bootable of the non-active area to valid.

[0148] For example, if the upgrade is passed, the Bootable of the non-active area is set to valid, indicating that the area already has a valid application program, but is waiting to be started.

[0149] S1005, complete the A / B partition switching and perform a reset jump.

[0150] For example, after the upgrade is completed, the active state Active of the two partitions is exchanged before the partition switching is performed, indicating that the next start needs to run the new active area, and then after the reset is performed, the Flash address remapping is completed, and the new active area application program is started.

[0151] S1006, set the Success flag of the active area to a valid flag, and write the software version number.

[0152] For example, after the reset jumps to the application program of the active area, the Success flag and the version number of the current software are written into the application partition state, and the upgrade is ended.

[0153] For example, in order to avoid the situation that after the partition switching in the partition upgrade, the new application program cannot be run due to hardware. The present disclosure provides a dual-partition synchronous flashing process, as shown in Figure 11 The dual-partition synchronous flashing process comprises:

[0154] S1101, use the single-partition upgrade process of upgrading the current active area to upgrade and check the active area.

[0155] For example, the single-partition flashing process is used, and the upgrade and check of the current active area program are completed, and then the application program of the active area is upgraded and checked.

[0156] S1102, check whether the upgrade of the active area is passed after the upgrade is completed.

[0157] For example, it is judged whether the upgrade of the active area is passed after the upgrade is completed, and if not, the upgrade process is exited. If yes, S1103 is executed, and the Bootable of the non-active area is also set to valid.

[0158] S1103, copy the application program of the active area to the non-active area.

[0159] For example, the Bootable of the activation area is set to be valid, and the application corresponding data of the activation area is copied and written into the non-activation area, and the program segment of the non-activation area is verified.

[0160] S1104, whether the non-activation area verification passes.

[0161] For example, whether the non-activation area verification passes is judged, if not, the upgrade process is exited, if yes, S1105 is executed.

[0162] S1105, the upgrade is completed and reset jump to the application program of the activation area.

[0163] For example, the reset jump is directly entered into the application program of the current activation area, and the Success and software version number update writing are completed.

[0164] For example, the present disclosure provides a partition abnormal startup arbitration process, as shown in the following table, the partition abnormal startup arbitration process comprises: Figure 12

[0165] S1201, the application program of the current activation area is sampled and verified.

[0166] For example, the application program segment is verified by starting the verification module.

[0167] S1202, whether the sampling verification passes.

[0168] For example, whether the sampling verification passes is judged (for example, if the sampling verification failure times exceed the maximum verification attempt times (3 times), the verification does not pass), if not, S1204 is executed, if yes, S1203 is executed.

[0169] S1203, the application program of the activation area is started and jumped.

[0170] For example, the software can normally start and jump to the application program of the activation area, which indicates that the application program of the current activation area can be normally started, and the abnormal startup processing is ended.

[0171] S1204, the non-activation area is detected.

[0172] For example, the partition detection module is entered, and whether the current non-activation area meets the precondition of active rollback is detected by reading the application partition state.

[0173] S1205, whether the Bootable flag of the non-activation area is valid.

[0174] ​If yes, the active rollback condition is met, the fault recording module is entered, the current abnormal software version information is written into the fixed Flash for recording, S1207 is executed, and if no, S1206 is executed.

[0175] S1206, waiting for the OTA upgrade to recover.

[0176] The OTA upgrade request is waited for to recover the normal operation of the application, and the current abnormal startup processing is ended.

[0177] S1207, rollback switching is executed, and the application is started from the non-active area. The rollback execution module is entered, the active state Active flag of the A / B area is exchanged, the Bootable of the current active area is set to be invalid, and the application is started from the non-active area and entered into the application.

[0178] S1208, and the application version of the non-active area is transmitted to the application layer for recording.

[0179] S1209, the CAN bus records an abnormal message.

[0180] If the active rollback still fails or the startup is abnormal after the active rollback, the fault message is continuously sent through the CAN bus, and the main node is waited for to recover the program through a new OTA.

[0181] S1210, the abnormal version is recorded into a log.

[0182] The application program obtains the abnormal version in the current Flash segment and feeds back to the whole vehicle for log recording, and the current abnormal startup processing is ended.

[0183] The above mainly introduces the scheme provided by the embodiments of the disclosure from the method aspect. In order to implement the above functions, the application program rollback device or the electronic device comprises a hardware structure and / or a software module for executing each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in the present text, the disclosure can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the disclosure.

[0184] The embodiments of the present disclosure can perform function module division on the application rollback device or the electronic device according to the above method. For example, the application rollback device or the electronic device can include various function modules corresponding to various function divisions, or two or more functions can be integrated in one processing module. The integrated module can be realized in the form of hardware or in the form of a software function module. It should be noted that the division of the modules in the embodiments of the present disclosure is illustrative, and is only a logical function division. In actual implementation, another division mode can be used.

[0185] The embodiments of the present disclosure provide an application rollback device, as shown in the figure. Figure 13 The application rollback device 1300 includes a partition detection module 1302 and a rollback execution module 1304.

[0186] The partition detection module 1302 is configured to acquire a Bootable flag of a second partition in a case where an application in a first partition fails to start.

[0187] The Bootable flag is used to indicate whether the application is valid. The first partition and the second partition are dual partitions of the application in an OTA upgrade scenario. In the first partition and the second partition, one is an active partition, and the other is a backup partition.

[0188] Specifically, the partition detection module 1302 determines whether the preconditions for active rollback are met by acquiring the application partition state. If the complete application exists in the non-active partition (that is, the Bootable flag is a valid flag), the active rollback can be performed once to attempt to start again, thereby avoiding the need for manual recovery and improving the user experience.

[0189] The rollback execution module 1304 is configured to switch the first partition from an active state to a non-active state and switch the second partition from a non-active state to an active state in a case where the Bootable flag of the second partition is a valid flag.

[0190] The active state is used to indicate that the corresponding partition is running.

[0191] Specifically, the rollback execution module 1304 is configured to perform a rollback operation. After all the preconditions for rollback are met, the current active partition state, the software valid flag, and the like are marked, and the rollback switching operation is performed.

[0192] The rollback execution module 1304 is further configured to start the application in the second partition.

[0193] Specifically, the application in the non-active partition is restarted to ensure that the rollback operation is successfully performed and the application can be normally started.

[0194] In a possible implementation, the rollback execution module 1304 is further configured to receive an OTA upgrade request for the application. In response to the OTA upgrade request, the application in the first partition is upgraded.

[0195] The pre-upgrade state of the first partition is the inactive state.

[0196] In a case where the application in the first partition is upgraded successfully, the Bootable flag of the first partition is set to the valid flag, and the first partition is switched from the inactive state to the active state and the second partition is switched from the active state to the inactive state.

[0197] The Bootable flag is used to indicate whether the application is valid.

[0198] In a possible implementation, the application rollback method further includes:

[0199] In a case where the first partition is switched from the inactive state to the active state fails, the application in the second partition is upgraded.

[0200] In a case where the application in the second partition is upgraded successfully, the Bootable flag of the second partition is set to the valid flag.

[0201] In a possible implementation, the application rollback method further includes: upgrading the application in the first partition according to the upgraded application in the second partition.

[0202] In a case where the application in the first partition is upgraded successfully, the Bootable flag of the first partition is set to the valid flag.

[0203] In a possible implementation, the application rollback method further includes: in a case where the application in the first partition is started successfully, setting the Success flag of the first partition to the valid flag.

[0204] The Success flag is used to indicate whether the application is started successfully.

[0205] In a possible implementation, the application rollback method further includes: setting the Active flag of the first partition to the valid flag and setting the Active flag of the second partition to the invalid flag.

[0206] The Active flag is used to indicate the state of the corresponding partition.

[0207] In a possible implementation, the rollback execution module 1304 is further configured to: in the case that the application program in the first partition has a running exception, acquire the Bootable flag and the Success flag of the second partition.

[0208] In the case that the Bootable flag and the Success flag of the second partition are both valid flags, switch the first partition from the active state to the inactive state and switch the second partition from the inactive state to the active state.

[0209] Start the application program in the second partition.

[0210] In a possible implementation, the application program rollback method further includes: in response to an OTA upgrade request for the firmware, upgrading the BootLoader program of the first partition.

[0211] The firmware includes the BootLoader program and the application program.

[0212] In the case that the BootLoader program of the first partition is upgraded successfully and the upgrading is completed, upgrading the application program of the first partition.

[0213] In a possible implementation, the application program rollback method further includes: in the case that the OTA upgrading of the application program in the second partition is completed and the starting of the application program in the second partition is successful, setting the Success flag of the second partition as a valid flag.

[0214] In a possible implementation, the application program rollback apparatus further includes: a start verification module 1301 and a fault recording module 1303.

[0215] The start verification module 1301 is configured to verify the application program in the first partition when the application program in the first partition is started.

[0216] Specifically, in the power-on starting application program stage, the start verification module 1301 is used for sampling detection on the application program code segment, and the AES128 symmetric encryption algorithm and the SHA256 hash algorithm are used to calculate whether the current program segment passes the verification, and only when the verification passes, the application program is allowed to jump to the application program, otherwise, the partition detection module 1301 is entered.

[0217] The fault recording module 1303 is configured to, in the case that the starting of the application program in the first partition fails, record the software version information corresponding to the application program in the first partition.

[0218] Specifically, after the partition detection module 1302 executes, the fault recording module 1303 records the current abnormal software version information and reports the data regardless of whether the preconditions for rollback are met or not. When entering the application program, the fault recording module 1303 records the current abnormal software version information in the log of the vehicle abnormal version information.

[0219] As to the apparatus in the above-described embodiments, the specific manner in which each module performs operations has been described in detail in the embodiments of the method, and thus will not be described in detail here.

[0220] An electronic device is provided in the embodiments of the present disclosure. As shown in Figure 14 The electronic device 1400 includes, but is not limited to, a processor 1401 and a memory 1402.

[0221] The memory 1402 described above is configured to store executable instructions of the processor 1401. It can be understood that the processor 1401 is configured to execute the instructions to implement the application rollback method in the above-described embodiments.

[0222] It should be noted that those skilled in the art can understand, Figure 14 The electronic device structure shown in the above-described embodiments does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than those shown in the above-described embodiments, or combine certain components, or arrange different components. Figure 14 The electronic device structure shown in the above-described embodiments does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than those shown in the above-described embodiments, or combine certain components, or arrange different components.

[0223] The processor 1401 is the control center of the electronic device 1400, and connects various parts of the electronic device 1400 through various interfaces and lines. The processor 1401 executes software programs and / or modules stored in the memory 1402 and calls data stored in the memory 1402 to perform various functions and process data of the electronic device 1400, thereby monitoring the entire electronic device 1400. The processor 1401 can include one or more processing units. Optionally, the processor 1401 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application programs, and the modem processor mainly processes wireless communication. It can be understood that the modem processor can also not be integrated into the processor 1401.

[0224] The memory 1402 can be used to store software programs and various data. The memory 1402 can mainly include a program storage area and a data storage area, wherein the program storage area can store the operating system, the application programs required by at least one functional module (such as the processing module 802, etc.), and the like. In addition, the memory 1402 can include a high-speed random access memory, and can also include a non-volatile memory, for example, at least one magnetic disk storage device, a flash memory device or other volatile solid-state memory device.

[0225] In an example embodiment, a computer readable storage medium including instructions, for example, the memory 1402 including instructions, is also provided, which can be executed by the processor 1401 of the electronic device 1400 to implement the application rollback method in the above embodiments.

[0226] In actual implementation, Figure 13 The functions of the start verification module 1301, the partition detection module 1302, the fault record module 1303 and the rollback execution module 1304 in the device 1300 can be implemented by the processor 1401 calling the computer program stored in the memory 1402. Figure 14 The specific execution process can refer to the description of the application rollback method in the above embodiments, which will not be described here.

[0227] Alternatively, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, the non-transitory computer readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk and an optical data storage device, etc.

[0228] In an example embodiment, the embodiments of the present disclosure also provide a computer program product including one or more instructions, which can be executed by the processor 1401 of the electronic device 1400 to complete the application rollback method in the above embodiments.

[0229] It should be noted that the instructions in the above computer readable storage medium or the one or more instructions in the computer program product are executed by the processor of the electronic device to implement each process of the above application rollback method embodiment, and can achieve the same technical effect as the above application rollback method. To avoid repetition, it will not be described here.

[0230] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above division of functional modules is taken as an example for illustration. In actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0231] In several embodiments provided by the present disclosure, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the division of the apparatus embodiments is merely an example, and for example, the division of the modules or units can be different, and for example, multiple modules or units can be combined or integrated into another apparatus, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, apparatuses or units, and can be in electrical, mechanical or other forms.

[0232] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, i.e., may be located in one place, or may be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0233] In addition, each functional unit in the various embodiments of the present disclosure can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0234] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present disclosure essentially or the parts that make contributions to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, and includes several instructions for making a device (which can be a single-chip microcomputer, a chip, etc.) or a processor execute all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, and various media that can store program codes.

[0235] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto, and any changes or replacements within the technical scope disclosed by the present disclosure should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. An application rollback method, characterized in that, Applied to vehicle controllers, including: If the application fails to start in the first partition, obtain the bootable flag of the second partition; the bootable flag is used to indicate whether the application is valid; the first partition and the second partition are dual partitions for the application in the OTA upgrade scenario; one of the first partition and the second partition is the running partition, and the other is the backup partition. If the Bootable flag of the second partition is valid, the first partition is switched from an active state to an inactive state and the second partition is switched from an inactive state to an active state; the active state indicates that the corresponding partition is running. Launch the application in the second partition.

2. The method according to claim 1, characterized in that, Before launching the application on the first partition, the following is also included: Receive OTA upgrade requests for the application; In response to the OTA upgrade request, the application in the first partition is upgraded; the first partition was inactive before the upgrade. If the application upgrade in the first partition is completed and successful, the Bootable flag of the first partition is set to valid, and the first partition is switched from inactive to active, while the second partition is switched from active to inactive, to complete the OTA upgrade of the application; the Bootable flag is used to indicate whether the application is valid.

3. The method according to claim 2, characterized in that, After switching the first partition from an inactive state to an active state and the second partition from an active state to an inactive state, the method further includes: If the first partition fails to switch from an inactive state to an active state, the application in the second partition is upgraded. If the application upgrade in the second partition is completed and successful, the Bootable flag of the second partition is set to valid.

4. The method according to claim 3, characterized in that, After setting the Bootable flag of the second partition to a valid flag, the method further includes: The application in the first partition is upgraded based on the upgraded application in the second partition; If the application upgrade in the first partition is completed and successful, the Bootable flag of the first partition is set to valid.

5. The method according to claim 1, characterized in that, Also includes: If the application in the first partition starts successfully, the success flag of the first partition is set to valid. The Success flag is used to indicate whether the application has started successfully.

6. The method according to claim 2, characterized in that, The step of switching the first partition from an inactive state to an active state and switching the second partition from an active state to an inactive state includes: Set the Active flag of the first partition to valid and set the Active flag of the second partition to invalid; the Active flag is used to indicate the status of the corresponding partition.

7. The method according to claim 1, characterized in that, Also includes: If the application in the first partition experiences a runtime exception, obtain the Bootable flag and Success flag of the second partition; If both the Bootable and Success flags of the second partition are valid, the first partition is switched from an active state to an inactive state and the second partition is switched from an inactive state to an active state. Launch the application in the second partition.

8. The method according to claim 1, characterized in that, Also includes: In response to an OTA upgrade request for firmware, the bootloader program of the first partition is upgraded; the firmware includes the bootloader program and the application program. If the BootLoader program in the first partition is successfully upgraded and the upgrade is complete, the application in the first partition is upgraded.

9. The method according to claim 3, characterized in that, Also includes: Once the OTA upgrade of the application in the second partition is completed and the application in the second partition starts successfully, the Success flag of the second partition is set to a valid flag.

10. An application rollback device, characterized in that, The application rollback device includes: a partition detection module and a rollback execution module; The partition detection module is used to obtain the bootable flag of the second partition when the application in the first partition fails to start; the bootable flag is used to indicate whether the application is valid; the first partition and the second partition are dual partitions for the application in the OTA upgrade scenario; one of the first partition and the second partition is the running partition and the other is the backup partition. The rollback execution module is used to switch the first partition from an active state to an inactive state and the second partition from an inactive state to an active state when the Bootable flag of the second partition is a valid flag; the active state is used to indicate that the corresponding partition is running. The rollback execution module is also used to start the application in the second partition.

11. The apparatus according to claim 10, characterized in that, Also includes: Start the verification module and fault recording module; The startup verification module is used to verify the application in the first partition when the application in the first partition starts. The fault recording module is used to record the software version information of the application in the first partition when the application in the first partition fails to start.

12. A vehicle, characterized in that, The vehicle is used to implement the application rollback method as described in any one of claims 1-9; or, the vehicle includes the application rollback device as described in any one of claims 10-11.

Images