Program updating method and device, controller, vehicle and storage medium
By remotely updating the bootloader via the vehicle network and utilizing the initial boot program running in RAM, the problem of the ECU failing to start after the bootloader is damaged is solved, achieving efficient and low-cost system recovery.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ROX MOTOR TECH CO LTD
- Filing Date
- 2025-12-18
- Publication Date
- 2026-04-17
AI Technical Summary
In the existing technology, the ECU cannot start normally after the bootloader is damaged. Existing recovery methods are costly and inefficient, and increase storage space and system complexity.
The method of remote wireless update via vehicle network uses the initial bootloader to load a new bootloader program into RAM and runs it in RAM to update the bootloader program in Flash, ensuring system recovery.
It reduces update costs and time consumption, improves update reliability, and reduces the risk of ECU function failure.
Smart Images
Figure CN121879809A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of software update technology, and in particular to a program update method, apparatus, controller, vehicle, and storage medium. Background Technology
[0002] In modern automobiles, a large number of Electronic Control Units (ECUs) primarily control their functions through software. To fix software vulnerabilities, add new features, or improve performance, the software within the ECU needs to be updated. Currently, the mainstream software update solution employs a dual-zone design with a Bootloader and an Application Programming Interface (APP). In this design, the Bootloader is responsible for performing self-tests and diagnostics during system startup and receives update data via in-vehicle network interfaces such as CAN, LIN, or Ethernet to program the APP area.
[0003] However, the bootloader itself is software stored in Flash memory, which can be damaged due to defects or unexpected events during the update process (such as power outages). Once the bootloader is damaged, the ECU will fail to boot normally and the application cannot be updated through the regular flashing process, resulting in ECU malfunction. In this situation, existing recovery methods typically involve reflashing via physical debugging interfaces such as JTAG and BDM, but this requires on-site operation by technicians, which is costly and inefficient. Existing recovery methods also employ triple backup or boot block recovery methods, but these methods increase storage space requirements and system complexity. Therefore, how to update the bootloader program has become an urgent problem to be solved. Summary of the Invention
[0004] In view of this, embodiments of this application provide a program update method, apparatus, controller, vehicle, and storage medium. The technical solution provided by this application can support remote wireless updates of the bootloader via the vehicle network, avoiding the high cost and time consumption required for technicians to flash the firmware on-site, and improving the reliability of the update. In addition, even if the main bootloader is completely damaged, as long as the initial boot program remains intact, the system can be restored, thereby significantly reducing the risk of ECU bricking (functional failure).
[0005] This application mainly includes the following aspects: In a first aspect, embodiments of this application provide a program update method, the method comprising: Run the initial bootloader used to load and start the new bootloader program, and determine whether to update the current bootloader program in the controller's Flash. When it is determined that the current bootloader program in the Flash memory needs to be updated, the new bootloader program is written into the RAM of the controller. When the new bootloader program in the RAM is started and run, the current bootloader program in the Flash is updated to the new bootloader program.
[0006] Preferably, the method further includes: If it is determined that the current bootloader program in the Flash should not be updated, then it is determined whether to update the current application program in the Flash. If it is determined that the current application in the Flash memory needs to be updated, then the new bootloader program in the Flash memory will be run, and the current application in the Flash memory will be updated to the new application. If it is determined that the current application in the Flash should not be updated, then it is determined whether the current application in the Flash is valid; if the current application in the Flash is valid, then the current application in the Flash is run; if the current application in the Flash is invalid, then the initial boot program is run, and it is re-determined whether to update the current Bootloader program in the Flash.
[0007] Preferably, before updating the current bootloader program in the Flash to the new bootloader program when the new bootloader program in the RAM is started and run, the method further includes: Verify the new bootloader program in the RAM; If the verification of the new bootloader program in the RAM fails, the update of the current bootloader program in the Flash will be stopped. If the new bootloader program in the RAM is successfully verified, then the new bootloader program in the RAM will be run.
[0008] Preferably, after updating the current bootloader program in the Flash to the new bootloader program when the new bootloader program in the RAM is started and run, the method further includes: Reset the controller and rerun the initial bootloader.
[0009] Preferably, after running the current application in the Flash if it is valid, the method further includes: Determine if the current application in the Flash memory has an update request; If the current application in the Flash has an update request, an update request flag indicating that the current application in the Flash should be updated is generated, and the initial bootloader is rerun.
[0010] Preferably, the initial boot program is stored in the protected Flash sector of the controller.
[0011] Secondly, embodiments of this application also provide a program update apparatus, the apparatus comprising: The first update determination module is used to run the initial bootloader used to load and start the new bootloader program, and determine whether to update the current bootloader program in the controller's Flash. A loading module is used to write a new bootloader program into the RAM of the controller when it is determined that the current bootloader program in the Flash needs to be updated; The Bootloader program update module is used to update the current Bootloader program in the Flash to the new Bootloader program when the new Bootloader program in the RAM is started and run.
[0012] Thirdly, embodiments of this application also provide a controller, which includes the aforementioned program update device.
[0013] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the program update method described in the first aspect or any possible implementation of the first aspect.
[0014] Fifthly, embodiments of this application also provide a vehicle, the vehicle including a controller.
[0015] This application provides a program update method, apparatus, controller, vehicle, and storage medium. The method involves running an initial bootloader for loading and starting a new bootloader program, determining whether to update the current bootloader program in the controller's Flash memory; when it is determined to update the current bootloader program in the Flash memory, writing the new bootloader program into the controller's RAM; and when the new bootloader program in the RAM is started and run, updating the current bootloader program in the Flash memory to the new bootloader program.
[0016] Thus, the technical solution provided in this application can support remote wireless updates of the bootloader via the vehicle network, avoiding the high cost and time required for technicians to flash the firmware on-site, and improving the reliability of the update. In addition, even if the main bootloader is completely damaged, as long as the initial boot program remains intact, the system can be restored, thereby significantly reducing the risk of the ECU becoming bricked (functional failure).
[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description
[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1 This invention provides a flowchart of one of the program update methods according to an embodiment of this application. Figure 2 A second flowchart of a program update method provided in an embodiment of this application is shown; Figure 3 A schematic diagram of the structure of a program update device provided in an embodiment of this application is shown. Detailed Implementation
[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.
[0021] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0022] The methods, apparatus, electronic devices, or computer-readable storage media described in this application can be applied to any scenario requiring Bootloader program updates. This application does not limit specific application scenarios, and any scheme using the program update methods and apparatus provided in this application is within the protection scope of this application.
[0023] It is worth noting that in modern automobiles, a large number of Electronic Control Units (ECUs) primarily control their functions through software. To fix software vulnerabilities, add new features, or improve performance, the software within the ECU needs to be updated. Currently, the mainstream software update solution employs a dual-zone design of Bootloader and Application Programming (APP). In this design, the Bootloader is responsible for self-testing and diagnostics during system startup and receives update data via in-vehicle network interfaces such as CAN, LIN, or Ethernet to program the APP area. However, the Bootloader itself is software stored in Flash memory, which can be damaged due to defects or unexpected events during the update process (such as power outages). Once the Bootloader is damaged, the ECU will fail to boot normally and cannot be updated via the conventional flashing process, resulting in ECU malfunction. In this situation, existing recovery methods typically involve reflashing via physical debugging interfaces such as JTAG and BDM, but this requires on-site operation by technicians, which is costly and inefficient. Existing recovery methods also employ triple backup or boot block recovery methods, but these methods increase storage space requirements and system complexity. Therefore, how to update the Bootloader program has become a pressing issue.
[0024] To address the aforementioned issues, this application provides a program update method, apparatus, controller, vehicle, and storage medium, which reduces costs and increases update reliability.
[0025] To facilitate understanding of this application, the technical solutions provided in this application will be described in detail below with reference to specific embodiments.
[0026] Please see Figure 1 , Figure 1 This is one of the flowcharts for a program update method provided in an embodiment of this application.
[0027] like Figure 1 As shown in the illustration, the program update method provided in this application embodiment is applied to a controller, and the program update method includes the following steps: Step S101: Run the initial bootloader for loading and starting the new bootloader program, and determine whether to update the current bootloader program in the controller's Flash.
[0028] In this embodiment, the Bootloader program stored in Flash is a fully functional master bootloader, including functions such as hardware initialization, communication driver, jump logic, system self-test, diagnostics, and application updates. The initial bootloader is a subset of the Bootloader program's functionality, containing only its basic functions, specifically: hardware initialization, communication driver, jump logic, self-test, and diagnostics. Hardware initialization refers to the basic configuration of core hardware such as the CPU, clock, and memory after the controller is powered on, bringing them into a working state. Communication driver refers to the controller's ability to send and receive data with external devices via buses such as CAN, LIN, or Ethernet. Jump logic is the core decision-making mechanism of the bootloader, determining the transfer of CPU execution based on system status (such as update requests and program validity). System self-test is a basic function that performs a power-on self-test to ensure a healthy state. Diagnostics refers to the controller's support for interacting with diagnostic tools through standard protocols to identify faults, read status, or execute debugging instructions. This initial bootloader features concise code, high stability, and is difficult to err on or modify. The initial bootloader is stored in the controller's protected Flash sector, protected against accidental erasure or rewriting. Loading a new bootloader program means writing the new bootloader into the controller's RAM; starting the bootloader program means transferring execution control to the new bootloader program already written to RAM, allowing it to begin running in RAM.
[0029] Specifically, after the controller starts, the initial boot program is run to initialize the hardware and detect whether an update request flag for the current bootloader program is received from the vehicle communication network or external devices. The update request flag for the current bootloader is used to indicate whether the current bootloader program should be updated.
[0030] Step S102: When it is determined that the current Bootloader program in the Flash needs to be updated, the new Bootloader program is written into the RAM of the controller.
[0031] Here, when the initial bootloader determines that the current bootloader program in Flash needs to be updated, it receives the complete new bootloader program as a data block from the communication bus or a preset storage location and writes it into the controller's RAM. The preset storage location can be another sector of the controller's Flash, a non-volatile memory area, or any other memory region; there are no restrictions here.
[0032] like Figure 2As shown in the embodiment of this application, before step S102, the program update method further includes: Step S11: Verify the new Bootloader program in the RAM.
[0033] Here, before updating the current bootloader program in Flash, the initial bootloader first performs an integrity check on the new bootloader program loaded into RAM to prevent erroneous or malicious code from being written to Flash. The check can use either CRC check or hash check; no restriction is imposed here.
[0034] Step S12: If the verification of the new Bootloader program in the RAM fails, then the update of the current Bootloader program in the Flash is stopped.
[0035] Here, if the verification of the new Bootloader program in the RAM fails, it indicates that the new Bootloader program may have been damaged, tampered with, or have a version mismatch during transmission, storage, or loading, and its integrity and reliability cannot be guaranteed, thus terminating the subsequent Bootloader update process.
[0036] Step S13: If the new Bootloader program in the RAM is successfully verified, then the new Bootloader program in the RAM is run.
[0037] Here, if the new bootloader program in the RAM is successfully verified, it indicates that the new bootloader program in the RAM is complete, reliable, and meets the operating requirements.
[0038] See again Figure 1 In step S103, when the new Bootloader program in the RAM is started and run, the current Bootloader program in the Flash is updated to the new Bootloader program.
[0039] Here, the initial bootloader transfers execution control to the new bootloader program in RAM via function pointers or assembly jump instructions. This new bootloader program, running in RAM (as a temporary, fully functional execution entity), utilizes its own Flash driver capabilities to erase the physical area in Flash memory where the current (old) bootloader program is stored, and then reprograms the new program. This process essentially allows a bootloader program running in a temporary RAM environment to replace and upgrade its original copy stored in permanent Flash, thus updating itself (the firmware version).
[0040] like Figure 2 As shown in the embodiment of this application, after updating the current Bootloader program in Flash, the new Bootloader program in Flash can be verified. If the verification of the new Bootloader program in Flash fails, the process returns to step S103. If the verification of the new Bootloader program in Flash succeeds, the controller is reset and the initial bootloader is rerun. Specifically, after the verification of the new Bootloader program in Flash succeeds, the controller performs a soft reset, clears the Bootloader update request flag, and starts running again from the initial bootloader. It should be noted that after the reset, execution will start again from the initial bootloader. The initial bootloader verifies the Flash storage area. When it confirms that a valid new Bootloader program exists therein, control is transferred to the new Bootloader in Flash, which is responsible for continuing to boot the system or performing application update operations.
[0041] like Figure 2 As shown in the embodiments of this application, the program update method further includes: Step S21: If it is determined that the current Bootloader program in the Flash should not be updated, determine whether to update the current application program in the Flash.
[0042] Here, when it is determined that the current Bootloader program in the Flash will not be updated, it means that the current update task is only for the application, or the Bootloader itself is already the latest version.
[0043] Step S22: If it is determined that the current application in the Flash needs to be updated, then the new Bootloader program in the Flash is run, and the current application in the Flash is updated to the new application.
[0044] In this embodiment of the application, after updating the current application in Flash, the new application in Flash can be verified. If the verification of the new application in Flash fails, the process returns to step S22. If the verification of the new application in Flash succeeds, the controller is reset and the initial boot program is run again. Specifically, after the verification of the new application in Flash succeeds, the controller performs a soft reset, clears the application update request flag, and starts running from the initial boot program again.
[0045] Step S23: If it is determined that the current application in the Flash should not be updated, then determine whether the current application in the Flash is valid.
[0046] Here, "effective" refers to whether the application is complete and functional.
[0047] Step S24: If the current application in the Flash is valid, then run the current application in the Flash.
[0048] If the current application in Flash is active, the system will jump directly to the current application in Flash and start it normally.
[0049] In this embodiment of the application, after running the current application in Flash, it is determined whether the current application in Flash has an update request; if the current application in Flash has an update request request, an update request flag indicating that the current application in Flash should be generated, and the initial boot program is rerun; if the current application in Flash does not have an update request, the current application in Flash continues to run.
[0050] Step S25: If the current application in the Flash is invalid, run the initial bootloader to re-determine whether to update the current Bootloader program in the Flash.
[0051] If the current application in Flash is invalid, it means that the current application in Flash is unreliable. The system will terminate the normal startup process of the current application and trigger the recovery mechanism to jump back to the initial boot program.
[0052] In this application embodiment, traditional solutions typically store the bootloader firmware in Flash memory, and the program also runs directly in Flash. This makes it difficult to add or remove features when the bootloader itself has operational defects, and problems cannot be corrected in a timely manner. This solution overcomes the limitations of storing the firmware in Flash by placing the new bootloader program in RAM. When an update is needed, the new bootloader program can be written directly into RAM and run, and then the new bootloader program running in RAM can perform erase and update operations on the original bootloader program and application in Flash. For example, if the current upgrade package has a problem, the upgrade package can be directly replaced and reloaded into RAM, greatly improving the flexibility and reliability of system updates. This application has the following advantages: 1. Strong security: Integrity verification is performed on the new bootloader code in RAM, effectively preventing erroneous or malicious code from being written to Flash, ensuring system firmware security; 2. Low cost: No additional hardware is required, only software architecture is needed.
[0053] This application provides a program update method, which includes: running an initial bootloader for loading and starting a new bootloader program; determining whether to update the current bootloader program in the Flash memory of the controller; when it is determined to update the current bootloader program in the Flash memory, writing the new bootloader program into the RAM of the controller; and when the new bootloader program in the RAM is started and run, updating the current bootloader program in the Flash memory to the new bootloader program.
[0054] Thus, the technical solution provided in this application can support remote wireless updates of the bootloader via the vehicle network, avoiding the high cost and time required for technicians to flash the firmware on-site, and improving the reliability of the update. In addition, even if the main bootloader is completely damaged, as long as the initial boot program remains intact, the system can be restored, thereby significantly reducing the risk of the ECU becoming bricked (functional failure).
[0055] Based on the same application concept, this application also provides a program update device corresponding to the program update method provided in the above embodiments. Since the principle of the device in this application to solve the problem is similar to the program update method in the above embodiments of this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.
[0056] Please see Figure 3 , Figure 3 This is a schematic diagram of a program update device provided in an embodiment of this application.
[0057] like Figure 3 As shown in the illustration, the program update apparatus 310 provided in this application embodiment includes: The first update judgment module 311 is used to run the initial boot program for loading and starting a new bootloader program to determine whether to update the current bootloader program in the controller's Flash. The loading module 312 is used to write a new bootloader program into the RAM of the controller when it is determined that the current bootloader program in the Flash needs to be updated; Bootloader program update module 313 is used to update the current bootloader program in Flash to the new bootloader program when the new bootloader program in RAM is started and run.
[0058] Furthermore, the device 310 also includes: The second update determination module is used to determine whether to update the current application in Flash when it is determined that the current Bootloader program should not be updated. An application update module is used to run the updated current bootloader program to update the current application if it is determined that the current application needs to be updated. The validity determination module is used to determine whether the current application is valid if it is determined that the current application should not be updated. An application execution module is used to run the current application if it is valid. If the application is invalid, the first update judgment module 311 is executed.
[0059] Furthermore, the device 310 also includes: The verification module is used to verify the new bootloader program in the RAM; The stop module is used to stop updating the current bootloader program in the Flash if the verification of the new bootloader program in the RAM fails. The new bootloader program execution module 320 is used to run the new bootloader program in the RAM if the verification of the new bootloader program in the RAM is successful.
[0060] Furthermore, the device 310 also includes: A reset module is used to reset the controller and rerun the initial boot program.
[0061] Furthermore, the device 310 also includes: The request determination module is used to determine whether the current application in the Flash has an update request; The generation module is configured to generate an update request flag indicating that the current application in the Flash needs to be updated, and to rerun the initial bootstrap program if the current application in the Flash has an update request.
[0062] This application provides a program update apparatus, comprising: a first update determination module 311, configured to run an initial boot program for loading and starting a new bootloader program, and determine whether to update the current bootloader program in the Flash memory of the controller; a loading module 312, configured to write a new bootloader program into the RAM of the controller when it is determined that the current bootloader program in the Flash memory should be updated; and a bootloader program update module 313, configured to update the current bootloader program in the Flash memory to the new bootloader program when the new bootloader program in the RAM is started and run.
[0063] Thus, the technical solution provided in this application can support remote wireless updates of the bootloader via the vehicle network, avoiding the high cost and time required for technicians to flash the firmware on-site, and improving the reliability of the update. In addition, even if the main bootloader is completely damaged, as long as the initial boot program remains intact, the system can be restored, thereby significantly reducing the risk of the ECU becoming bricked (functional failure).
[0064] This application also provides a controller, which includes the aforementioned program update device.
[0065] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figure 1 and Figure 2 The steps of the program update method in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.
[0066] This application also provides a vehicle, which includes a controller.
[0067] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.
[0068] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0069] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0070] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0071] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A program update method, characterized in that, The method is applied to a controller; the method includes: Run the initial bootloader used to load and start the new bootloader program, and determine whether to update the current bootloader program in the controller's Flash. When it is determined that the current bootloader program in the Flash memory needs to be updated, the new bootloader program is written into the RAM of the controller. When the new bootloader program in the RAM is started and run, the current bootloader program in the Flash is updated to the new bootloader program.
2. The program update method according to claim 1, characterized in that, The method further includes: If it is determined that the current bootloader program in the Flash should not be updated, then it is determined whether to update the current application program in the Flash. If it is determined that the current application in the Flash memory needs to be updated, then the new bootloader program in the Flash memory will be run, and the current application in the Flash memory will be updated to the new application. If it is determined that the current application in the Flash should not be updated, then it is determined whether the current application in the Flash is valid; if the current application in the Flash is valid, then the current application in the Flash is run; if the current application in the Flash is invalid, then the initial boot program is run, and it is re-determined whether to update the current Bootloader program in the Flash.
3. The program update method according to claim 1, characterized in that, Before updating the current bootloader program in the Flash to the new bootloader program when the new bootloader program in the RAM is started and run, the method further includes: Verify the new bootloader program in the RAM; If the verification of the new bootloader program in the RAM fails, the update of the current bootloader program in the Flash will be stopped. If the new bootloader program in the RAM is successfully verified, then the new bootloader program in the RAM will be run.
4. The program update method according to claim 1, characterized in that, After updating the current bootloader program in the Flash to the new bootloader program when the new bootloader program in the RAM is started and run, the method further includes: Reset the controller and rerun the initial bootloader.
5. The program update method according to claim 2, characterized in that, If the current application in the Flash is valid, after running the current application in the Flash, the method further includes: Determine if the current application in the Flash memory has an update request; If the current application in the Flash has an update request, an update request flag indicating that the current application in the Flash should be updated is generated, and the initial bootloader is rerun.
6. The program update method according to claim 1, characterized in that, The initial bootloader is stored in the protected Flash sector of the controller.
7. A program update device, characterized in that, The device includes: The first update determination module is used to run the initial bootloader used to load and start the new bootloader program, and determine whether to update the current bootloader program in the controller's Flash. A loading module is used to write a new bootloader program into the RAM of the controller when it is determined that the current bootloader program in the Flash needs to be updated; The Bootloader program update module is used to update the current Bootloader program in the Flash to the new Bootloader program when the new Bootloader program in the RAM is started and run.
8. A controller, characterized in that, The controller includes the program update device as described in claim 7.
9. A vehicle, characterized in that, The vehicle includes the controller as described in claim 8.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the program update method as described in any one of claims 1 to 6.