Wireless upgrade interruption method and device of vehicle, vehicle and system

Abstract

The embodiment of the invention provides a wireless upgrade interruption method and device for a vehicle, the vehicle and a system, and the method can comprise the steps: responding to an interruption triggering signal, and determining the upgrade stage of an electronic control unit and the type of the electronic control unit in a current upgrade task; executing different interruption operations on the electronic control unit according to the upgrading stage of the electronic control unit and / or the type of the electronic control unit; the limitation that a user cannot use a vehicle after upgrading is started is broken through, the requirement of the user for emergent travel is met, a safe and reliable upgrading interruption mechanism is also provided, software system damage, data inconsistency and safety risks possibly caused by forced interruption are avoided, and the user experience is improved. And the use flexibility of the vehicle and the safety and reliability of the upgrading process are ensured.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and in particular to a method, apparatus, vehicle, and system for wireless upgrade interruption of a vehicle. Background Technology

[0002] With the development of intelligent connected new energy vehicle technology, OTA technology has become a core means for car companies to iterate vehicle functions and fix software defects. However, once the traditional OTA upgrade process is started, users cannot use the vehicle during the process, and there is a lack of a safe and reliable upgrade interruption mechanism. If users suddenly have an emergency travel need and forcibly interrupt the upgrade, it can easily cause serious problems such as software system damage, data inconsistency and security risks. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a method, apparatus, vehicle, and system for overcoming or at least partially solving the above problems by discontinuing over-the-air upgrades.

[0004] In a first aspect, embodiments of the present invention provide a method for interrupting wireless upgrades for vehicles, the method comprising: In response to the interrupt trigger signal, determine the upgrade stage of the electronic control unit and the type of the electronic control unit in the current upgrade task; Depending on the upgrade stage of the electronic control unit and / or the type of the electronic control unit, different interrupt operations are performed on the electronic control unit.

[0005] Optionally, it also includes: Acquire interrupt trigger signals initiated through the in-vehicle human-machine interface or mobile terminal application; And / or, When an abnormality is detected in the vehicle's critical system status parameters, an interrupt trigger signal is generated; wherein, the critical system status parameters include at least one of battery power, network signal strength, and vehicle speed.

[0006] Optionally, the step of performing different interrupt operations on the electronic control unit based on the upgrade stage of the electronic control unit and / or the type of the electronic control unit includes: If the type of electronic control unit in the current upgrade task is a first type electronic control unit, then the update of the first type electronic control unit is stopped, and the version of the first type electronic control unit is rolled back to the version before the update according to the interrupt trigger signal.

[0007] Optionally, the step of performing different interrupt operations on the electronic control unit based on the upgrade stage of the electronic control unit and / or the type of the electronic control unit includes: If the type of electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the pre-programming stage or the main programming stage, then the update of the second type electronic control unit is stopped, and the post-programming process of the second type electronic control unit is executed. If the type of electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the post-programming stage, then the post-programming process of the second type electronic control unit is executed directly.

[0008] Optionally, it also includes: Before initiating a wireless upgrade task, an upgrade task list and a rollback snapshot are created; the rollback snapshot is used to record the software version and configuration data of the electronic control unit before the upgrade. The electronic control unit is upgraded according to the upgrade task list and the rollback snapshot.

[0009] Optionally, it also includes: An interrupt event report is generated and stored after the interrupt operation is performed; the interrupt event report includes at least one of the following: the interruption triggering reason, the upgrade stage of each electronic control unit at the time of the interruption, and a list of electronic control units that have been successfully upgraded and those that have not been successfully upgraded.

[0010] Optionally, it also includes: Based on the interruption event report, when preset conditions are met, an automatic resume upgrade task is initiated for the electronic control unit that was not successfully upgraded.

[0011] Secondly, the present invention also discloses a wireless upgrade interruption device for a vehicle, the device comprising: The response module is used to respond to the interrupt trigger signal and determine the upgrade stage of the electronic control unit and the type of the electronic control unit in the current upgrade task; An execution module is configured to perform different interrupt operations on the electronic control unit based on the upgrade stage of the electronic control unit and / or the type of the electronic control unit.

[0012] Optionally, it also includes: The acquisition module is used to acquire interrupt trigger signals initiated through the vehicle human-machine interface or mobile terminal application; And / or, The generation module is used to generate an interrupt trigger signal when abnormalities are detected in the vehicle's key system status parameters; wherein, the key system status parameters include at least one of battery power, network signal strength, and vehicle speed.

[0013] Optionally, the execution module includes: The rollback submodule is used to stop updating the first type of electronic control unit if the type of electronic control unit in the current upgrade task is a first type of electronic control unit, and to roll back the version of the first type of electronic control unit to the version before the update according to the interrupt trigger signal.

[0014] Optionally, the execution module includes: The first execution submodule is used to stop updating the second type of electronic control unit and execute the post-programming process of the second type of electronic control unit if the type of electronic control unit in the current upgrade task is a second type of electronic control unit and the second type of electronic control unit is in the pre-programming stage or the main programming stage. The second execution submodule is used to directly execute the post-programming process of the second type of electronic control unit if the type of electronic control unit in the current upgrade task is a second type of electronic control unit and the second type of electronic control unit is in the post-programming stage.

[0015] Optionally, it also includes: A creation module is used to create an upgrade task list and a rollback snapshot before initiating a wireless upgrade task; the rollback snapshot is used to record the software version and configuration data of the electronic control unit before the upgrade. An upgrade module is used to upgrade the electronic control unit according to the upgrade task list and the rollback snapshot.

[0016] Optionally, it also includes: The storage module is used to generate and store an interrupt event report after an interrupt operation is performed; the interrupt event report includes at least one of the following: the interrupt triggering reason, the upgrade stage of each electronic control unit at the time of the interruption, and a list of electronic control units that have been successfully upgraded and those that have not been successfully upgraded.

[0017] Optionally, it also includes: The resume module is used to automatically initiate a resume upgrade task for the electronic control unit that was not successfully upgraded, based on the interruption event report and when preset conditions are met.

[0018] Thirdly, the present invention also discloses a vehicle, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the vehicle wireless upgrade interruption method as described above.

[0019] Fifthly, the present invention also discloses a wireless upgrade system for vehicles, the system comprising: The system includes a vehicle domain controller, a driving domain controller, and a cockpit domain controller; the driving domain controller is connected to both the vehicle domain controller and the cockpit domain controller. The cockpit domain controller is used to respond to an interruption trigger signal, determine the upgrade stage and type of the electronic control unit in the vehicle domain controller and the intelligent driving domain controller, and generate a corresponding interruption operation strategy based on the upgrade stage and / or type of the electronic control unit. The vehicle domain controller and the intelligent driving domain controller are used to execute corresponding interrupt operations according to the interrupt operation strategy.

[0020] The embodiments of the present invention have the following advantages: This invention discloses a method, device, vehicle, and system for wireless upgrade interruption of a vehicle. By responding to an interrupt trigger signal, this invention can identify the upgrade stage and type of the electronic control unit and perform different interrupt operations according to the upgrade stage and type of the electronic control unit. This breaks the limitation that users cannot use the vehicle after the upgrade is started, meets the needs of users for sudden emergency travel, and provides a safe and reliable upgrade interruption mechanism. It avoids software system damage, data inconsistency, and security risks that may be caused by forced interruption, and ensures the flexibility of vehicle use and the safety and reliability of the upgrade process. Thus, while ensuring the basic safety of the vehicle and data consistency, it improves the flexibility of the upgrade process and the user experience. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0022] Figure 1 This is a flowchart of the steps of a vehicle wireless upgrade interruption method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a vehicle wireless upgrade interruption method provided in an embodiment of the present invention; Figure 3 This is a structural block diagram of a vehicle wireless upgrade interruption device provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a vehicle wireless upgrade system provided in an embodiment of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0025] One of the core concepts of this invention is that by responding to an interrupt trigger signal, the upgrade stage and type of the electronic control unit can be identified, and different interrupt operations can be performed according to the upgrade stage and type of the electronic control unit. This breaks the limitation that users cannot use the vehicle after the upgrade is started, meets the user's need for sudden emergency travel, and provides a safe and reliable upgrade interruption mechanism. It avoids software system damage, data inconsistency and security risks that may be caused by forced interruption, and ensures the flexibility of vehicle use and the safety and reliability of the upgrade process. Thus, while ensuring the basic safety of the vehicle and data consistency, it improves the flexibility of the upgrade process and the user experience.

[0026] Reference Figure 1 The diagram illustrates a flowchart of a method for interrupting over-the-air (OTA) upgrades for vehicles according to an embodiment of the present invention. This method may include the following steps: Step 101: In response to the interrupt trigger signal, determine the upgrade stage and type of the electronic control unit in the current upgrade task.

[0027] In this embodiment of the invention, the interrupt trigger signal can originate from the user's active operation (such as the emergency button in the vehicle or a mobile app command), or it can be automatically generated by the system itself when it detects an anomaly (such as insufficient power or severe network fluctuations). The type of electronic control unit refers to the category of dedicated embedded computer control modules classified according to the different functional subsystems of the vehicle it controls.

[0028] Once a terminal trigger signal is received, a high-speed diagnostic scan process can be initiated. Specifically, this process determines the stage of each electronic control unit (ECU) that is being upgraded or awaiting upgrade, such as whether it is downloading an upgrade package, verifying data packets, erasing or writing flash memory, or verifying new firmware after a reboot. Then, the type of ECU is determined. In one example, ECUs can be categorized based on whether they provide basic human-driving related and driver assistance functions. If an ECU provides these functions, it is classified as a Type 1 ECU; otherwise, it is classified as a Type 2 ECU. The specific classification method can be set according to user requirements.

[0029] Step 102: Perform different interrupt operations on the electronic control unit according to the upgrade stage of the electronic control unit and / or the type of the electronic control unit.

[0030] In this embodiment of the invention, the most suitable interrupt instructions can be formulated for different types of electronic control units at different stages according to a preset strategy matrix, and then the electronic control unit can be controlled to perform the corresponding interrupt operation according to the interrupt instructions.

[0031] For example, for a Type I electronic control unit that is in the critical firmware erasure stage, the interruption strategy could be to interrupt the current update operation and revert the electronic control unit version to the version before the update.

[0032] This invention discloses a wireless upgrade interruption method for vehicles. By responding to an interruption trigger signal, the upgrade stage and type of the electronic control unit are identified, and different interruption operations are performed according to the upgrade stage and type of the electronic control unit. This breaks the limitation that users cannot use the vehicle after the upgrade is started, meets the needs of users for sudden emergency travel, and provides a safe and reliable upgrade interruption mechanism. It avoids software system damage, data inconsistency and security risks that may be caused by forced interruption, and ensures the flexibility of vehicle use and the safety and reliability of the upgrade process. Thus, while ensuring the basic safety of the vehicle and data consistency, it improves the flexibility of the upgrade process and the user experience.

[0033] In one embodiment of the present invention, the method further includes: acquiring an interrupt trigger signal initiated through an in-vehicle human-machine interface or a mobile terminal application; and / or generating an interrupt trigger signal when an abnormality is detected in a key system status parameter of the vehicle; wherein the key system status parameter includes at least one of battery power, network signal strength, and vehicle speed.

[0034] In this embodiment of the invention, the methods for obtaining terminal trigger signals can include both user-level and system-level methods.

[0035] At the user level, when encountering sudden emergency travel or temporary changes in car usage plans, users can operate directly through the vehicle's built-in human-machine interface or remotely initiate an interruption trigger signal through a mobile terminal application bound to the vehicle. The operation path is convenient and intuitive, giving users full autonomy over the OTA upgrade process and avoiding the inability to meet user needs due to upgrades occupying the vehicle.

[0036] At the system level, the vehicle can dynamically monitor key status parameters of the core system in real time. The monitored parameters cover the core dimensions that ensure the safety and smooth progress of the upgrade. The battery power must be maintained above the threshold required for upgrade operation and basic vehicle function use to avoid the vehicle being unable to start or drive normally after the upgrade is interrupted due to insufficient power. The network signal strength must be stable to support upgrade package transmission, data interaction and other operations to prevent signal fluctuations from causing upgrade data transmission interruption or errors. The vehicle speed must meet the preset safe upgrade conditions to avoid the upgrade operation affecting the stability of the vehicle control system during high-speed driving. When the system detects any one or more of the above parameters as abnormal, it can automatically generate an interruption trigger signal to initiate the interruption process without user intervention.

[0037] This invention's dual-trigger mechanism not only takes into account the personalized needs of users to actively interrupt, but also achieves passive safety protection during the upgrade process through intelligent system monitoring, ensuring the timeliness and rationality of interrupt triggering, and providing a comprehensive and reliable starting basis for the electronic control unit to perform differentiated interrupt operations during the upgrade stage and for different types of operations.

[0038] In one embodiment of the present invention, different interrupt operations are performed on the electronic control unit according to the upgrade stage of the electronic control unit and / or the type of the electronic control unit, including: if the type of the electronic control unit in the current upgrade task is a first type of electronic control unit, then the update of the first type of electronic control unit is stopped, and the version of the first type of electronic control unit is rolled back to the version before the update according to the interrupt trigger signal.

[0039] In this embodiment of the invention, the first type of electronic control unit refers to the electronic control unit that ensures basic human-driving related functions and the electronic control unit that enables human-driving assistance functions. When it is confirmed that the electronic control unit in the current upgrade task is of the first type, the safety interruption process can be initiated first: the first step is to immediately stop all update actions of the electronic control unit, including interrupting the current firmware flashing, data transmission and other upgrade-related operations, so as to avoid the continuous upgrade process from interfering with the core functions; the second step is to start the version rollback mechanism according to the interruption trigger signal, and restore the software version of the electronic control unit to the stable version before this upgrade according to the preset safety rollback process.

[0040] Throughout the process, data verification and status monitoring can be performed simultaneously to ensure that there are no residual processes after the update operation stops, that the data is complete and not lost during the version rollback process, and that the electronic control unit can be quickly restored to the normal working state before the upgrade after the rollback, ensuring that basic human driving and human driving assistance functions are not affected by the interruption operation and always maintain reliable operation.

[0041] In one example, suppose that while the vehicle is undergoing an OTA upgrade, a user suddenly has an urgent travel need and initiates an interruption signal. After identification, the system confirms that the electronic control unit currently being upgraded includes a Type I electronic control unit responsible for vehicle steering control and braking assistance. This type of electronic control unit is directly related to basic human-driven and assisted driving safety functions and is the core guarantee for vehicle operation. The system can immediately terminate all upgrade operations such as firmware flashing and data transmission for this unit, and at the same time start a preset safety rollback program to accurately restore its software version to a stable version that has been verified over a long period of time before the upgrade. During this process, it can also verify core data such as steering assist parameters and braking response logic in real time to ensure that key functions such as steering and braking assistance are fully restored to normal after the rollback. The user can directly and safely start the vehicle to meet the emergency travel needs without worrying about the upgrade interruption affecting driving safety.

[0042] This invention develops a dedicated safety strategy for the first type of electronic control unit (ECU) that ensures basic human-driven and human-driven assistance functions. By combining the operation of immediately stopping updates and reverting the version to the stable state before the upgrade, it not only meets the user's need for sudden interruption of upgrades, but also maximizes the continuity and stability of the vehicle's core safety functions. It fundamentally avoids the driving safety risks that may be caused by the interruption of core ECU upgrades, allowing users to interrupt the upgrade and use the vehicle in emergency travel scenarios while still obtaining the same safe driving experience as before the upgrade, significantly improving the safety of the OTA upgrade interruption process.

[0043] In one embodiment of the present invention, different interrupt operations are performed on the electronic control unit according to the upgrade stage of the electronic control unit and / or the type of the electronic control unit, including: if the type of the electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the pre-programming stage or the main programming stage, then the update of the second type electronic control unit is stopped, and the post-programming process of the second type electronic control unit is executed; if the type of the electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the post-programming stage, then the post-programming process of the second type electronic control unit is executed directly.

[0044] In this embodiment of the invention, when the system performs a differentiated interruption operation, it first determines whether the target electronic control unit is of the second type based on the information already obtained. This type covers all electronic control units except those that guarantee basic human-driving related and human-driving assistance functions, and their functions do not directly affect the core driving safety of the vehicle.

[0045] Based on this, if it is determined that the electronic control unit in the current upgrade task is a type II electronic control unit, then the specific upgrade stage of the type II electronic control unit is further determined. If it is determined that it is in the pre-programming stage or the main programming stage, the current update operation can be stopped immediately, including interrupting firmware download, data writing and other related processes. Then, the post-programming process is started and fully executed to ensure that the programming operations have formed an effective data loop and to avoid data residue or program abnormalities. If it is determined that it is in the post-programming stage, there is no need to stop the update operation. The post-programming process can be continued and completed to ensure that all key steps involved in this stage, such as parameter configuration, function activation and data verification, are implemented in place.

[0046] Assuming that during an OTA upgrade, a user initiates an interruption signal via a mobile terminal, the system identifies that the upgrade is currently affecting the Type II electronic control unit responsible for the in-vehicle entertainment system, and that this unit is in the main programming phase. This phase primarily involves writing programs for new entertainment system functions and does not involve vehicle driving safety. The system will immediately stop the main programming data writing operation for this unit and then automatically start the post-programming process, sequentially completing steps such as entertainment system parameter configuration, function module activation, and data verification to ensure that the written program forms valid operating logic. After the interruption, functions such as in-vehicle music, navigation, and vehicle-to-everything (V2X) connectivity can still be used normally, and the user can start the vehicle smoothly. The remaining upgrade process can then be completed based on this interruption point without having to start from scratch.

[0047] This invention, through the interruption operation process, targets the second type of electronic control unit (ECU) that is not a core safety function. It formulates a precise and adaptable operation strategy in conjunction with its upgrade stage. This avoids data anomalies or functional failures caused by unnecessary process interruptions, and ensures the standardization and security of upgrade-related operations through the complete execution of the post-programming process. While meeting the user's sudden interruption needs and ensuring the normal use of the vehicle, it also takes into account the integrity of the upgrade process and the convenience of subsequent upgrade recovery, achieving a balance between flexibility and reliability in the upgrade interruption of non-core function ECUs.

[0048] In one embodiment of the present invention, the method further includes: before initiating a wireless upgrade task, creating an upgrade task list and a rollback snapshot; the rollback snapshot is used to record the software version and configuration data of the electronic control unit before the upgrade; and the electronic control unit is upgraded according to the upgrade task list and the rollback snapshot.

[0049] In this embodiment of the invention, before initiating the wireless upgrade task, a preliminary preparation process is first started, which includes two key operations: First, an upgrade task list is created, which details all electronic control units involved in this upgrade, including the type of each unit, the software version to be upgraded, the upgrade order, the required resources, and key operation nodes, providing a clear execution framework and basis for the entire upgrade process; Second, a rollback snapshot is generated. For each electronic control unit in the list, the snapshot accurately records its software version number, complete configuration data, operating parameters, and system status before the upgrade, which is equivalent to leaving an initial backup of each unit before the upgrade.

[0050] After completing these two preparations, the upgrade can be carried out based on the steps planned in the upgrade task list. At the same time, the rollback snapshot is used as a reference to ensure that the upgrade operation of each electronic control unit is strictly carried out according to the preset path. For example, according to the order determined by the list, different types of electronic control units are sequentially subjected to operations such as downloading update packages and flashing firmware. During the upgrade process, the current state is compared with the initial state recorded in the snapshot in real time to ensure the accuracy of the upgrade action.

[0051] For example, a car manufacturer pushes an OTA upgrade task for vehicles that includes a powertrain control electronic control unit (Type 1) and an air conditioning control electronic control unit (Type 2). Before initiating the upgrade, the system first creates an upgrade task list, specifying that the air conditioning control electronic control unit should be upgraded first, followed by the powertrain control electronic control unit, and marking the target versions and flashing steps for both. At the same time, a rollback snapshot is generated, recording the current stable firmware version and torque output parameters of the powertrain control electronic control unit, as well as the operating mode configuration and sensor calibration data of the air conditioning control electronic control unit. Then, the system starts the upgrade according to the list, first performing a firmware update on the air conditioning control electronic control unit, and then proceeding with the upgrade of the powertrain control electronic control unit. If the user triggers an interruption midway, the system can directly use the rollback snapshot to quickly revert the powertrain control electronic control unit to the previous version, ensuring driving safety. The air conditioning control electronic control unit can also be successfully restored for upgrade in the future based on the list and snapshot information.

[0052] This invention establishes a standardized execution framework and a safety fallback mechanism for wireless upgrade tasks by pre-creating an upgrade task list and rollback snapshots: the upgrade task list ensures that the upgrade process is orderly and controllable, avoiding upgrade errors caused by chaotic operations; the rollback snapshots completely preserve the initial state of each electronic control unit, providing a precise reference for version rollback and data recovery after upgrade interruption, reducing the risk of system anomalies that may be caused by upgrade failure or interruption from the source, while greatly improving the efficiency and accuracy of subsequent interruption recovery, making the upgrade process both operable and safe and redundant, and providing a pre-emptive guarantee for the reliability and security of the entire OTA upgrade.

[0053] In one embodiment of the present invention, the method further includes: generating and storing an interrupt event report after performing an interrupt operation; the interrupt event report includes at least one of the following: the interruption triggering reason, the upgrade stage of each electronic control unit at the time of the interruption, and a list of electronic control units that have been successfully upgraded and those that have not been successfully upgraded.

[0054] In this embodiment of the invention, after the interrupt operation is completed on the electronic control unit, the generation and storage process of the interrupt event report can be automatically started. First, key information related to this interrupt can be comprehensively collected, specifically including the reason for the interruption—whether it is initiated by the user through the in-vehicle human-machine interface or mobile terminal, or automatically triggered by the system detecting abnormal status parameters such as insufficient battery power, abnormal network signal, or excessive vehicle speed. Second, the specific upgrade stage of each electronic control unit at the time of the interruption is recorded, such as which are in the pre-programming stage, which are undergoing main programming, and which have entered the post-programming stage. At the same time, a list of electronic control units that have successfully completed the upgrade and a list of electronic control units that have not yet been successfully upgraded are also compiled to ensure a complete presentation of the upgrade progress.

[0055] After collecting and organizing the above information, this content can be integrated into a structured interruption event report and securely stored according to a preset storage path, such as the vehicle's local storage module or a cloud server, for subsequent querying, analysis, and to support recovery and optimization for subsequent upgrade tasks.

[0056] For example, if a user initiates an emergency travel request during a vehicle upgrade process via the in-vehicle screen, the system can immediately generate an interruption event report after completing the interruption operations for the first type (such as the steering control electronic control unit) and the second type (such as the in-vehicle entertainment electronic control unit). The report will indicate that the interruption was triggered by "the user actively initiating an emergency travel request," record that the steering control electronic control unit was in the main programming stage when the upgrade was interrupted, and that the in-vehicle entertainment electronic control unit was in the pre-programming stage when the upgrade was interrupted. It will also list the electronic control units that have been successfully upgraded (empty) and the electronic control units that have not been successfully upgraded, including the steering control electronic control unit and the in-vehicle entertainment electronic control unit. Subsequently, the report will be stored in the vehicle's local database. When the user initiates the upgrade again later, the system can directly retrieve the report and quickly determine whether to continue from the main programming stage of the steering control electronic control unit and the pre-programming stage of the in-vehicle entertainment electronic control unit, without repeating the steps already completed.

[0057] This process generates and stores interruption event reports containing information such as the interruption triggering reason, the upgrade stage of each electronic control unit at the time of interruption, and a list of upgrade statuses. This provides a complete process record for OTA upgrade interruptions. This not only makes it easier for automakers or technicians to trace the cause of the interruption and analyze potential problems in the upgrade process, providing a basis for optimizing upgrade strategies and interruption mechanisms, but also allows the system to quickly identify which electronic control units need to continue upgrading and which have been upgraded when the upgrade is resumed. This greatly improves the efficiency and accuracy of upgrade recovery, while enhancing the traceability and transparency of the upgrade process, further ensuring the reliability and manageability of OTA upgrades.

[0058] In one embodiment of the present invention, the method further includes: based on the interruption event report, when preset conditions are met, automatically initiating a resume upgrade task for the unsuccessfully upgraded electronic control unit.

[0059] In this embodiment of the invention, after storing the interruption event report, the vehicle status and environmental conditions can be continuously monitored. Based on the key information recorded in the report, such as the list of electronic control units that failed to be upgraded and the upgrade stage when each unit was interrupted, it can be determined whether the preset conditions for resuming the upgrade are met.

[0060] Preset conditions typically include the vehicle being in a non-driving state (e.g., stationary and parked), sufficient battery power, stable network signal, and no user request for vehicle use. These conditions aim to ensure the safety of the upgrade process and not affect normal user operation. When all preset conditions are met, the system can automatically retrieve relevant data from the interruption event report to identify the electronic control units that failed to upgrade and their interruption points. For example, if an electronic control unit is interrupted in the pre-programming stage, it will continue from that stage; if it is interrupted in the main programming stage, it will resume data transmission and flashing based on the existing progress, without having to start the entire upgrade process from scratch. At the same time, the system can orderly advance the upgrade of each incomplete unit according to the logic of the original upgrade task list, and verify data integrity in real time during the process to ensure smooth connection between the upgrade part and the completed part, ultimately completing the upgrade tasks of all unsuccessful upgrade units.

[0061] Suppose that the vehicle upgrade was interrupted due to the user's emergency travel, and the interruption event report shows that the in-vehicle navigation electronic control unit (Type II) failed to upgrade and was interrupted in the main programming stage. Afterwards, when the system detects that the vehicle is parked, the battery power is above 80%, the network signal is full, and the user has gotten out of the car and locked the car (with no immediate need for use), and the preset conditions for resuming the upgrade are met, it can automatically start the resuming upgrade based on the report information. It can directly start the data writing from the remaining part of the main programming stage of the in-vehicle navigation electronic control unit, without having to download the upgrade package again or repeat the pre-programming steps. Finally, the upgrade of the electronic control unit is successfully completed and the status is updated to the system. The user can use the upgraded navigation function the next time they use the car.

[0062] This invention achieves OTA upgrade breakpoint resume functionality by automatically triggering resume upgrades based on interruption event reports. This avoids repeated execution or abandonment of upgrade tasks due to interruptions. The preset conditions ensure that resume upgrades are performed safely and without interfering with users. This saves upgrade time and network resources, improves the completion rate of upgrade tasks, and allows users to achieve seamless upgrade processes without manual operation. It significantly optimizes the continuity of OTA upgrades and user experience, and further improves the closed-loop processing mechanism after upgrade interruption.

[0063] like Figure 2 This diagram illustrates a method for interrupting a vehicle's wireless upgrade according to an embodiment of the present invention. First, the OTA (Over-The-Air) Server sends an upgrade task supporting OTA interruption to the main screen. When the user clicks "Interrupt Upgrade" on the main screen, the main screen sends an interrupt command to the cockpit domain controller. Upon receiving the command, the cockpit domain controller sets up the scheduled upgrade and sends an interrupt command to the target area controller. The target area controller can be either the driver domain controller or the vehicle domain controller. After receiving the interrupt command, the target area controller can perform an interrupt exit operation and then synchronize the exit result back to the cockpit domain controller. Finally, the cockpit domain controller synchronizes the exit result back to the wireless download server, completing the entire wireless download upgrade interruption process.

[0064] This invention discloses a wireless upgrade interruption method for vehicles. By responding to an interruption trigger signal, the upgrade stage and type of the electronic control unit are identified, and different interruption operations are performed according to the upgrade stage and type of the electronic control unit. This breaks the limitation that users cannot use the vehicle after the upgrade is started, meets the needs of users for sudden emergency travel, and provides a safe and reliable upgrade interruption mechanism. It avoids software system damage, data inconsistency and security risks that may be caused by forced interruption, and ensures the flexibility of vehicle use and the safety and reliability of the upgrade process. Thus, while ensuring the basic safety of the vehicle and data consistency, it improves the flexibility of the upgrade process and the user experience.

[0065] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0066] like Figure 3The diagram illustrates a structural block diagram of a vehicle wireless upgrade interruption device according to an embodiment of the present invention. The device includes: The response module 201 is used to respond to the interrupt trigger signal and determine the upgrade stage and type of the electronic control unit in the current upgrade task; The execution module 202 is used to perform different interrupt operations on the electronic control unit according to the upgrade stage of the electronic control unit and / or the type of the electronic control unit.

[0067] This invention discloses a wireless upgrade interruption device for vehicles. By responding to an interruption trigger signal, it identifies the upgrade stage and type of the electronic control unit and performs different interruption operations according to the upgrade stage and type of the electronic control unit. This breaks the limitation that users cannot use the vehicle after the upgrade is started, meets the needs of users for sudden emergency travel, and provides a safe and reliable upgrade interruption mechanism. It avoids software system damage, data inconsistency and security risks that may be caused by forced interruption, and ensures the flexibility of vehicle use and the safety and reliability of the upgrade process. Thus, while ensuring the basic safety of the vehicle and data consistency, it improves the flexibility of the upgrade process and the user experience.

[0068] In one embodiment of the present invention, it further includes: The acquisition module is used to acquire interrupt trigger signals initiated through the vehicle human-machine interface or mobile terminal application; And / or, The generation module is used to generate an interrupt trigger signal when abnormalities are detected in the vehicle's critical system status parameters; the critical system status parameters include at least one of battery power, network signal strength, and vehicle speed.

[0069] In one embodiment of the present invention, the execution module includes: The rollback submodule is used to stop updating the first type of electronic control unit if the type of electronic control unit in the current upgrade task is the first type of electronic control unit, and to roll back the version of the first type of electronic control unit to the version before the update according to the interrupt trigger signal.

[0070] In one embodiment of the present invention, the execution module includes: The first execution submodule is used to stop updating the second type of electronic control unit and execute the post-programming process of the second type of electronic control unit if the type of electronic control unit in the current upgrade task is the second type of electronic control unit and the second type of electronic control unit is in the pre-programming stage or the main programming stage. The second execution submodule is used to directly execute the post-programming process of the second type electronic control unit if the type of electronic control unit in the current upgrade task is a second type electronic control unit and the second type electronic control unit is in the post-programming stage.

[0071] In one embodiment of the present invention, it further includes: The module is used to create an upgrade task list and rollback snapshot before initiating a wireless upgrade task; the rollback snapshot is used to record the software version and configuration data of the electronic control unit before the upgrade. The upgrade module is used to upgrade the electronic control unit based on the upgrade task list and rollback snapshot.

[0072] In one embodiment of the present invention, it further includes: The storage module is used to generate and store an interrupt event report after an interrupt operation is performed; the interrupt event report includes at least one of the following: the interrupt triggering reason, the upgrade stage of each electronic control unit at the time of the interruption, and a list of electronic control units that have been successfully upgraded and those that have not been successfully upgraded.

[0073] In one embodiment of the present invention, it further includes: The resume module is used to automatically initiate a resume upgrade task for electronic control units that have not been successfully upgraded, based on interruption event reports and when preset conditions are met.

[0074] This invention discloses a wireless upgrade interruption device for vehicles. By responding to an interruption trigger signal, it identifies the upgrade stage and type of the electronic control unit and performs different interruption operations according to the upgrade stage and type of the electronic control unit. This breaks the limitation that users cannot use the vehicle after the upgrade is started, meets the needs of users for sudden emergency travel, and provides a safe and reliable upgrade interruption mechanism. It avoids software system damage, data inconsistency and security risks that may be caused by forced interruption, and ensures the flexibility of vehicle use and the safety and reliability of the upgrade process. Thus, while ensuring the basic safety of the vehicle and data consistency, it improves the flexibility of the upgrade process and the user experience.

[0075] This invention also provides a vehicle, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the various processes of the above-described vehicle wireless upgrade interruption method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0076] It should be noted that the vehicles in the embodiments of the present invention include the mobile vehicles and non-mobile vehicles described above.

[0077] like Figure 4The diagram illustrates a structural block diagram of a vehicle wireless upgrade system 30 according to an embodiment of the present invention. The system may include: The system includes a vehicle domain controller 303, a smart driving domain controller 301, and a cockpit domain controller 302; the smart driving domain controller 301 is connected to the vehicle domain controller 303 and the cockpit domain controller 302, respectively. The cockpit domain controller 302 is used to respond to the interrupt trigger signal, determine the upgrade stage and type of the electronic control unit in the vehicle domain controller 303 and the intelligent driving domain controller 301, and generate a corresponding interrupt operation strategy based on the upgrade stage and / or type of the electronic control unit. The vehicle domain controller 303 and the intelligent driving domain controller 302 are used to execute corresponding interrupt operations according to the interrupt operation strategy.

[0078] In this embodiment of the invention, when the vehicle domain controller 303 determines that the type of electronic control unit in the current upgrade task is a first type electronic control unit, the interrupt strategy can be determined as follows: stop updating the first type electronic control unit and revert the version of the first type electronic control unit to the version before the update according to the interrupt trigger signal; when it determines that the type of electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the pre-programming stage or the main programming stage, the interrupt strategy can be determined as follows: stop updating the second type electronic control unit and execute the post-programming process of the second type electronic control unit; if the type of electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the post-programming stage, the interrupt strategy can be determined as follows: directly execute the post-programming process of the second type electronic control unit.

[0079] When the intelligent driving domain controller 302 determines that the type of electronic control unit in the current upgrade task is a first-type electronic control unit, the interrupt strategy can be determined as follows: stop updating the first-type electronic control unit and revert the version of the first-type electronic control unit to the version before the update according to the interrupt trigger signal; when it determines that the type of electronic control unit in the current upgrade task is a second-type electronic control unit, and the second-type electronic control unit is in the pre-programming stage or the main programming stage, the interrupt strategy can be determined as follows: stop updating the second-type electronic control unit and execute the post-programming process of the second-type electronic control unit; if the type of electronic control unit in the current upgrade task is a second-type electronic control unit, and the second-type electronic control unit is in the post-programming stage, the interrupt strategy can be determined as follows: directly execute the post-programming process of the second-type electronic control unit.

[0080] In one embodiment of the present invention, a zone controller 304 may also be included. The zone controller 304 is responsible for low-voltage power management and controls the power supply of the vehicle.

[0081] This invention discloses a wireless upgrade system for vehicles. By responding to interrupt trigger signals, it identifies the upgrade stage and type of the electronic control unit (ECU) and executes different interrupt operations based on the upgrade stage and type. This breaks the limitation that users cannot use the vehicle after the upgrade is initiated, meeting the needs of users for sudden emergency travel. It also provides a safe and reliable upgrade interruption mechanism, avoiding software system damage, data inconsistency, and security risks that may be caused by forced interruptions. This ensures the flexibility of vehicle use and the safety and reliability of the upgrade process, thereby improving the flexibility of the upgrade process and the user experience while guaranteeing basic vehicle safety and data consistency. The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0082] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0083] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0084] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0086] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0087] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0088] The present invention has provided a detailed description of a method, apparatus, vehicle, and system for wireless upgrade interruption of a vehicle. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for interrupting wireless upgrades for vehicles, characterized in that, The method includes: In response to the interrupt trigger signal, determine the upgrade stage of the electronic control unit and the type of the electronic control unit in the current upgrade task; Depending on the upgrade stage of the electronic control unit and / or the type of the electronic control unit, different interrupt operations are performed on the electronic control unit.

2. The wireless upgrade interruption method according to claim 1, characterized in that, Also includes: Acquire interrupt trigger signals initiated through the in-vehicle human-machine interface or mobile terminal application; And / or, When an abnormality is detected in the vehicle's critical system status parameters, an interrupt trigger signal is generated; wherein, the critical system status parameters include at least one of battery power, network signal strength, and vehicle speed.

3. The wireless upgrade interruption method according to claim 1, characterized in that, The step of performing different interrupt operations on the electronic control unit based on the upgrade stage of the electronic control unit and / or the type of the electronic control unit includes: If the type of electronic control unit in the current upgrade task is a first type electronic control unit, then the update of the first type electronic control unit is stopped, and the version of the first type electronic control unit is rolled back to the version before the update according to the interrupt trigger signal.

4. The wireless upgrade interruption method according to claim 1, characterized in that, The step of performing different interrupt operations on the electronic control unit based on the upgrade stage of the electronic control unit and / or the type of the electronic control unit includes: If the type of electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the pre-programming stage or the main programming stage, then the update of the second type electronic control unit is stopped, and the post-programming process of the second type electronic control unit is executed. If the type of electronic control unit in the current upgrade task is a second type electronic control unit, and the second type electronic control unit is in the post-programming stage, then the post-programming process of the second type electronic control unit is executed directly.

5. The wireless upgrade interruption method according to claim 1, characterized in that, Also includes: Before initiating a wireless upgrade task, an upgrade task list and a rollback snapshot are created; the rollback snapshot is used to record the software version and configuration data of the electronic control unit before the upgrade. The electronic control unit is upgraded according to the upgrade task list and the rollback snapshot.

6. The wireless upgrade interruption method according to claim 1, characterized in that, Also includes: An interrupt event report is generated and stored after the interrupt operation is performed; the interrupt event report includes at least one of the following: the interruption triggering reason, the upgrade stage of each electronic control unit at the time of the interruption, and a list of electronic control units that have been successfully upgraded and those that have not been successfully upgraded.

7. The wireless upgrade interruption method according to claim 6, characterized in that, Also includes: Based on the interruption event report, when preset conditions are met, an automatic resume upgrade task is initiated for the electronic control unit that was not successfully upgraded.

8. A wireless upgrade interruption device for a vehicle, characterized in that, The device includes: The response module is used to respond to the interrupt trigger signal and determine the upgrade stage of the electronic control unit and the type of the electronic control unit in the current upgrade task; An execution module is configured to perform different interrupt operations on the electronic control unit based on the upgrade stage of the electronic control unit and / or the type of the electronic control unit.

9. A vehicle, characterized in that, include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of the wireless upgrade interruption method for a vehicle as described in any one of claims 1-7.

10. A wireless upgrade system for a vehicle, characterized in that, The system includes: The system includes a vehicle domain controller, a driving domain controller, and a cockpit domain controller; the driving domain controller is connected to both the vehicle domain controller and the cockpit domain controller. The cockpit domain controller is used to respond to an interruption trigger signal, determine the upgrade stage and type of the electronic control unit in the vehicle domain controller and the intelligent driving domain controller, and generate a corresponding interruption operation strategy based on the upgrade stage and / or type of the electronic control unit. The vehicle domain controller and the intelligent driving domain controller are used to execute corresponding interrupt operations according to the interrupt operation strategy.

Images