Program upgrading method and program upgrading system of vehicle electronic control unit

Abstract

The invention relates to the technical field of software upgrading, and provides a program upgrading method and a program upgrading system for a vehicle electronic control unit, a storage medium is divided into seven physically isolated storage partitions, a hierarchical guidance and storage management system is constructed, and the problem of flash errors caused by memory mismatching is eliminated; pBL firmware and SBL firmware are developed based on the factory-level upgrading specification and the user-level upgrading specification respectively, the PBL can achieve independent upgrading of the SBL and the application program, and debugging personnel only need to use a factory debugging tool for debugging, so that the consistency of tool chains can be guaranteed; software version management of different vehicle type pedigree can be completed only through one internal version during factory internal production testing, manpower cost and version management cost are greatly saved, if a client needs to update and upgrade a process, the client can choose to use a self tool chain or a factory tool chain for upgrading, uncovering and updating are not needed, and user experience is improved. And quick program replacement can be realized only by updating the SBL plug-in.

Description

Technical Field

[0001] This invention relates to the field of software upgrade technology, specifically to a method for upgrading the program of a vehicle electronic control unit, a system for upgrading the program of a vehicle electronic control unit, and a computer device. Background Technology

[0002] Vehicles, especially off-road construction machinery, have a complex model range, and each model independently defines key parameters such as upgrade communication protocols, CAN (Controller Area Network) message identifiers, baud rates, and timeout mechanisms. When electronic control units need to be adapted to multiple models across platforms, the OTA (Over-the-Air) upgrade strategy, communication parameter matching, and flashing process are usually pre-made with multiple firmware versions for each model, and then customized and manually matched and flashed one by one.

[0003] The above-mentioned program upgrade method will cause the software version matrix to expand exponentially. Engineers need to frequently switch versions and tooling on the production line, EOL (End of Line Testing) test station and after-sales site. This not only significantly increases manpower and equipment costs, but also easily leads to version mismatch, which can easily trigger upgrade crashes, functional abnormalities, or even force disassembly and re-flash. For customer-customized programs, if an update and upgrade process is required, such as an OTA upgrade process, it is necessary to open the cover to update, which brings inconvenience to after-sales. Summary of the Invention

[0004] To address the aforementioned technical problems, the first objective of this invention is to propose a method for upgrading the program of a vehicle electronic control unit.

[0005] The second objective of this invention is to provide a program upgrade system for a vehicle electronic control unit.

[0006] The third objective of this invention is to provide a computer device.

[0007] The technical solution adopted in this invention is as follows:

[0008] An embodiment of the first aspect of the present invention provides a method for upgrading the program of a vehicle electronic control unit, wherein the storage medium of the vehicle electronic control unit is physically isolated into seven memory regions, which are respectively used to store the primary boot loader (PBL) and the secondary boot loader (SBL). The method includes the following steps: After the vehicle electronic control unit is powered on / reset, the main boot loader (PBL) starts; the main boot loader (PBL) determines the type of reprogramming request based on the incoming reprogramming flag; if it is a user-level reprogramming request, it jumps to the secondary boot loader (SBL), which performs an application upgrade; if it is a factory-level reprogramming request, the main boot loader (PBL) determines whether to upgrade the secondary boot loader (SBL) or the application based on the incoming physical address information; if it determines to upgrade the secondary boot loader (SBL), the main boot loader (PBL) performs the secondary boot loader (SBL) upgrade; if it determines to upgrade the application, the main boot loader (PBL) performs the application upgrade.

[0009] The vehicle electronic control unit program upgrade method proposed above in this invention may also have the following additional technical features:

[0010] According to an embodiment of the present invention, the above-described vehicle electronic control unit program upgrade method further includes: when the main bootloader (PBL) determines that reprogramming is not required based on the input reprogramming flag, it checks the application validity flag of the flag information; if the application validity flags of the secondary bootloader (SBL) and the application program in the flag information are both invalid, it further checks the application validity flag of the flag backup information; if the application validity flag of the latest downloaded SBL program in the flag backup information is valid, it remains in the PBL waiting for the user upgrade command; if the application validity flag of the latest downloaded SBL program in the flag backup information is invalid, it further checks the application validity flag of the latest downloaded application program in the flag backup information; if the application validity flag of the latest downloaded SBL program in the flag backup information is invalid ... SBL If the application validity flag of the latest downloaded application in the information is valid, the Master Bootloader (PBL) will switch the latest downloaded application from the application backup area to the application area, overwriting the original application. After the switch is completed, the application validity flag of the latest downloaded application in the backup information will be erased, and the application validity flag of the application in the backup information will be set. If the application validity flag of the application in the backup information is invalid, the Master Bootloader (PBL) will switch the latest downloaded SBL program from the SBL backup area to the SBL area, overwriting the original secondary bootloader (SBL). After the switch is completed, the application validity flag of the latest downloaded SBL program in the backup information will be erased, and the application validity flag of the secondary bootloader (SBL) in the backup information will be set.

[0011] According to an embodiment of the present invention, the above-described method for upgrading the program of the vehicle electronic control unit further includes: if the application validity flag of the secondary bootloader SBL or the application program in the flag information is valid, then the application validity flag of the application program in the flag information is checked again; if the application validity flag of the application program in the flag information is valid, then the process jumps to the application program; if the application validity flag of the application program in the flag information is invalid, then the process jumps to the secondary bootloader SBL.

[0012] According to one embodiment of the present invention, the secondary boot loader SBL performs an application upgrade, specifically including: after receiving a user upgrade instruction, the secondary boot loader SBL downloads the latest downloaded application to the application backup area; the secondary boot loader SBL switches the latest downloaded application in the application backup area to the application area to overwrite the original application; sets the application validity flag of the application in the flag information, and erases the application validity flag of the latest downloaded application in the flag backup information.

[0013] According to one embodiment of the present invention, the upgrade of the secondary boot loader (SBL) by the primary boot loader (PBL) specifically includes: the primary boot loader (PBL) downloading the latest downloaded SBL program to the SBL backup area; performing integrity verification of the downloaded data; if the verification fails, the secondary boot loader (SBL) remains unchanged; if the verification succeeds, setting the application validity flag of the latest downloaded SBL program in the backup information, and the primary boot loader (PBL) switching the latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader (SBL); erasing the application validity flag of the latest downloaded SBL program in the backup information, and setting the application validity flag of the secondary boot loader (SBL) in the backup information.

[0014] According to one embodiment of the present invention, the Master Bootloader (PBL) performs an application upgrade, specifically including: the PBL downloading the latest downloaded application to the application backup area; performing integrity verification of the downloaded data; if the verification fails, the application remains unchanged; if the verification succeeds, setting the application validity flag of the latest downloaded application in the backup information, the PBL switching the latest downloaded application in the application backup area to the application area to overwrite the original application; erasing the application validity flag of the latest downloaded application in the backup information, and setting the application validity flag of the application in the backup information.

[0015] According to an embodiment of the present invention, the above-described method for upgrading the program of the vehicle electronic control unit further includes: if it is a user-level reprogramming request, checking whether the secondary bootloader SBL image is valid; if the secondary bootloader SBL image is invalid, returning a negative response.

[0016] A second aspect of the present invention provides a program upgrade system for a vehicle electronic control unit (ECU), wherein the storage medium of the ECU is physically isolated into seven memory regions, respectively used to store a master bootloader (PBL), a secondary bootloader (SBL), flag information, flag backup information, application programs, the latest downloaded SBL program, and the latest downloaded application programs. The master bootloader (PBL) is developed based on a factory-level upgrade specification, and the secondary bootloader (SBL) is developed based on a user-level upgrade specification. The system includes a master bootloader (PBL) and a secondary bootloader (SBL); the master bootloader (PBL) is used for powering on / off the ECU. Upon reset and startup, the system determines the reprogramming request type based on the passed reprogramming flag. If it's a user-level reprogramming request, the system jumps to the secondary boot loader (SBL). The secondary boot loader (SBL) performs application upgrades during user-level reprogramming requests. The primary boot loader (PBL) further determines whether to upgrade the secondary boot loader (SBL) or the application based on the passed physical address information if the request is a factory-level reprogramming request. If the secondary boot loader (SBL) needs to be upgraded, the primary boot loader (PBL) performs the upgrade; otherwise, if the application needs to be upgraded, the primary boot loader (PBL) performs the application upgrade.

[0017] The vehicle electronic control unit program upgrade system proposed above in this invention may also have the following additional technical features:

[0018] According to one embodiment of the present invention, the primary boot loader (PBL) is further configured to: check the application validity flag of the flag information when it is determined that reprogramming is not required based on the input reprogramming flag; if the application validity flags of the secondary boot loader (SBL) and the application program in the flag information are both invalid, then further check the application validity flag of the flag backup information; if the application validity flag of the latest downloaded SBL program in the flag backup information is valid, then remain in the PBL waiting for the user's upgrade instruction; if the application validity flag of the latest downloaded SBL program in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information; if the application validity flag of the latest downloaded application in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information; if the application validity flag of the latest downloaded application in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information; if the application validity flag of the latest downloaded application in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information. If the application validity flag of the program is valid, the main boot loader PBL will switch the latest downloaded application from the application backup area to the application area, overwriting the original application. After the switch is completed, the application validity flag of the latest downloaded application in the flag backup information will be erased, and the application validity flag of the application in the flag information will be set. If the application validity flag of the application in the flag backup information is invalid, the main boot loader PBL will switch the latest downloaded SBL program from the SBL backup area to the SBL area, overwriting the original secondary boot loader SBL. After the switch is completed, the application validity flag of the latest downloaded SBL program in the flag backup information will be erased, and the application validity flag of the secondary boot loader SBL in the flag information will be set.

[0019] A third aspect of the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the program upgrade method for a vehicle electronic control unit as described in the first aspect of the present invention.

[0020] The beneficial effects of this invention are:

[0021] By dividing the storage medium into seven physically isolated storage partitions, a hierarchical boot and storage management system is constructed to eliminate the write error problem caused by memory mismatch;

[0022] The upgrade path can be automatically determined based on the identifier (e.g., PBL directly upgrades SBL / application, or jumps to SBL to upgrade only the application), thus realizing intelligent scheduling of the upgrade process;

[0023] PBL and SBL firmware are developed based on factory-level and user-level upgrade specifications, respectively. PBL enables independent upgrades of SBL and application. Debugging personnel only need to use the factory debugging tools to ensure the consistency of the toolchain. During production testing in the factory, only one internal version is needed to complete the software version management of different vehicle models, which greatly saves labor costs and version management costs. If customers need to update the upgrade process, they can choose to use their own toolchain or the factory toolchain to upgrade. No need to open the cover to update. Only the SBL plugin needs to be updated to achieve rapid program replacement. The whole process achieves unified upgrade process, version matrix convergence, reduced maintenance costs, and fundamentally avoids the risk of bricking, improving production line efficiency and end-user experience.

[0024] The redundant backup mechanism is combined with the bootloader and implemented synchronously in both PBL and SBL. If the upgrade fails, the recovery mechanism is triggered by the flag position of the backup area. The bootable program is rebuilt using the redundant image, ensuring the program's self-recovery and stable existence under any extreme case of burning failure, eliminating the risk of burning crash. At the same time, two flag areas are configured to fully record the status data of the upgrade process, supporting the implementation of differentiated recovery strategies at different stages of burning failure. The original program can be restored, or it can be replaced with a new version of the program. The associated additional data on the user side or the factory side is stored synchronously. Attached Figure Description

[0025] Figure 1 This is a flowchart of a method for upgrading the program of a vehicle electronic control unit according to an embodiment of the present invention;

[0026] Figure 2 This is a schematic diagram showing the partitioning of the storage medium of a vehicle electronic control unit according to an embodiment of the present invention;

[0027] Figure 3 This is a flowchart of a method for upgrading the program of a vehicle electronic control unit according to another embodiment of the present invention;

[0028] Figure 4 This is a flowchart illustrating the process of an application upgrade performed by a secondary bootloader (SBL) according to an embodiment of the present invention.

[0029] Figure 5 This is a flowchart illustrating the process of a primary boot loader (PBL) performing an upgrade using a secondary boot loader (SBL) according to an embodiment of the present invention.

[0030] Figure 6 This is a flowchart of the Master Bootloader (PBL) performing an application upgrade according to an embodiment of the present invention;

[0031] Figure 7This is a flowchart of a method for upgrading the program of a vehicle electronic control unit according to another embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Figure 1 This is a flowchart of a method for upgrading the program of a vehicle electronic control unit according to an embodiment of the present invention. Figure 2 This is a schematic diagram showing the partitioning of the storage medium of a vehicle electronic control unit according to an embodiment of the present invention.

[0034] Among them, such as Figure 2 As shown, the storage medium of the vehicle electronic control unit is physically isolated into seven memory regions. All seven physically isolated storage regions are non-volatile storage media. Each region does not overlap with the others in the physical address space and has a unique access address range, eliminating the problem of writing errors caused by memory mismatch. The seven memory regions are: PBL program region, SBL program region, flag bit region, flag bit backup region, application region, SBL backup region, and application backup region. They are used to store the main boot loader PBL, the secondary boot loader SBL, flag bit information, flag bit backup information, application, the latest downloaded SBL program, and the latest downloaded application, respectively.

[0035] The PBL program area stores the factory-level BootLoader firmware, which is the root-level bootloader and has the attributes of being non-erasable and non-updateable, forming the basic layer of system booting. The SBL program area stores the user-level BootLoader firmware, which supports selective downloading and can be updated by the PBL program to achieve iterative maintenance of user-level boot functions. It is a mirror image of the SBL backup area.

[0036] The flag area stores flag information, which is critical system operation status information. Specifically, it includes application validity flags, programming count statistics, device fingerprint information, software version number, and the corresponding CRC32 (Cyclic Redundancy Check 32) checksums for each of the above information, ensuring the integrity and verifiability of the status data. The specific flag information mainly includes: application validity flag, application programming count, application fingerprint information, SBL application validity flag, SBL programming count, SBL fingerprint information, the latest downloaded SBL program application validity flag, the latest downloaded SBL program programming count, the latest downloaded SBL program fingerprint information, the latest downloaded SBL program application validity flag, the latest downloaded SBL program programming count, the latest downloaded SBL program fingerprint information, the PBL version number, the SBL version number, and CRC32.

[0037] The flag backup area serves as a redundant backup storage area for flag information. Its storage content is consistent with that of the flag area. Through a data mirroring mechanism, it ensures the effectiveness of the application and provides data recovery capabilities in the event of a write failure.

[0038] The application area stores the firmware of the currently active application and is a mirror image of the application backup area. The application backup area needs to be the same size as the application area and is used to store application installation packages downloaded by the PBL or SBL program, serving as temporary storage space for programs in the application area. The SBL backup area is a dedicated storage area for the SBL program and needs to be the same size as the SBL program area. It is used to store SBL firmware programs downloaded by the PBL program and supports independent flashing and version management of the SBL itself.

[0039] The primary bootloader (PBL) is developed based on the factory-level upgrade specification, while the secondary bootloader (SBL) is developed based on the user-level upgrade specification. This means the SBL is a user-customized program containing only the user's upgrade process. The PBL program only contains CAN identifier information defined by the factory upgrade, corresponding to the functional addressing, physical addressing, and response address in UDS (Unified Diagnostic Services) diagnostics. The upgrade process only includes factory protocol process information. The PBL is a program that must be burned into the factory; it cannot be updated or erased. It possesses the factory CAN identifier and can upgrade both the SBL and the application.

[0040] like Figure 1 As shown, the method for upgrading the program of a vehicle's electronic control unit includes the following steps:

[0041] S1, after the vehicle's electronic control unit is powered on / reset, the Master Boot Record (PBL) is started.

[0042] S2, the main bootloader PBL determines the reprogramming request type based on the passed reprogramming flag.

[0043] Specifically, when the PBL is reset or powered on, it determines whether reprogramming is required based on the incoming reprogramming flag. The reprogramming flag is set to different values ​​depending on the CAN identifier. The reprogramming flag is set by the application program and stored in the RAM (Random-Access Memory) area where data is not lost after reset. Different CAN identifiers are used for user upgrades and factory upgrades.

[0044] If it is a user-level reprogramming request, S3 will jump to the secondary bootloader SBL, which will perform the application upgrade.

[0045] S4, if it is a factory-level reprogramming request, the primary boot loader PBL will determine whether to upgrade the secondary boot loader SBL or upgrade the application based on the passed physical address information.

[0046] S5. If it is determined that the secondary bootloader SBL needs to be upgraded, then the primary bootloader PBL will execute the secondary bootloader SBL to upgrade.

[0047] S6. If it is determined that an application needs to be upgraded, the Master Bootloader (PBL) will perform the application upgrade.

[0048] Specifically, if the PBL detects a user-level reprogramming request, it jumps to the SBL and only performs the application upgrade; when the PBL detects a factory-level reprogramming request, it stays in the PBL waiting for the upgrade instruction. After completing the pre-key service, communication control, diagnostic control, reading device information, writing fingerprint information, it will enter the erase FLASH (flash memory) service. The erase FLASH service will pass in the physical address information of the file to be upgraded, and it will determine whether to upgrade the SBL or the application based on the different physical address information. Therefore, the upgrade path can be automatically determined based on the identifier (such as PBL directly upgrading SBL / application, or jumping to SBL to upgrade only the application), realizing intelligent scheduling of the upgrade process; PBL can realize independent upgrades of SBL and application, and debugging personnel only need to use the factory debugging tools to ensure the consistency of the toolchain. The factory software version has universality, and only one internal version is needed to complete the software version management of different vehicle series during internal production testing, which greatly saves labor costs and version management costs. If the customer needs to update the upgrade process, the customer can choose to use their own toolchain or the factory toolchain to upgrade. There is no need to open the cover to update. Only the SBL plugin needs to be updated to achieve rapid program replacement. The entire process realizes unified upgrade process, version matrix convergence, reduced maintenance costs, and fundamentally avoids the risk of bricking, improving production line efficiency and end-user experience.

[0049] In one embodiment of the present invention, such as Figure 3 As shown, the above-mentioned method for upgrading the vehicle electronic control unit program may further include:

[0050] S7, the Master Bootloader (PBL) checks the application validity flag of the flag information when it determines that reprogramming is not required based on the passed-in reprogramming flag.

[0051] S8. If the application valid flags of the secondary bootloader SBL and the application are both invalid in the flag information, then further check the application valid flags of the flag backup information.

[0052] S9, if the application validity flag of the latest downloaded SBL program in the flag backup information is valid, then stay in PBL and wait for the user's upgrade instruction.

[0053] S10, if the application validity flag of the latest downloaded SBL program in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information.

[0054] S11, if the application validity flag of the latest downloaded application in the flag backup information is valid, the master boot loader PBL will switch the latest downloaded application in the application backup area to the application area to overwrite the original application. After the switch is completed, the application validity flag of the latest downloaded application in the flag backup information will be erased, and the application validity flag of the application in the flag information will be set.

[0055] S12, if the application validity flag bit in the flag backup information is invalid, the master boot loader PBL will switch the latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader SBL. After the switch is completed, the application validity flag bit of the latest downloaded SBL program in the flag backup information will be erased, and the application validity flag bit of the secondary boot loader SBL in the flag backup information will be set.

[0056] Specifically, after the vehicle's electronic control unit (ECU) is powered on / reset, during reset or power-on, the Master Boot Record (PBL) determines whether reprogramming is unnecessary based on the incoming reprogramming flags (i.e., no factory-level reprogramming request or user-level reprogramming request is detected). It then checks the application validity flags in the flag area. If both the SBL's application validity flags and the application's application validity flags are invalid, it further checks the corresponding application validity flags in the flag backup information. If the corresponding valid flag is selected, the program is switched. After the switch is complete, an active reset is performed to ensure the program in the runtime area remains valid. When switching from the backup area to the runtime area, the application validity flags of the main program can be erased first. Then, after the program is installed in the runtime area, the application validity flags of the backup program are erased simultaneously, and the application validity flags of the main program are set.

[0057] In one embodiment of the present invention, such as Figure 3 As shown, the above-mentioned method for upgrading the vehicle electronic control unit program also includes:

[0058] S13. If the application valid flag of the secondary bootloader SBL or the application is valid in the flag information, then check the application valid flag of the application in the flag information again.

[0059] S14. If the application validity flag in the flag information is valid, then jump to the application.

[0060] S15, if the application validity flag in the flag information is invalid, then jump to the secondary bootloader SBL.

[0061] Specifically, if the application validity flag of the secondary bootloader SBL or the application is valid, it will check the application validity flag again. If valid, it will directly jump to the application, which is why SBL can be selected for burning. If invalid, it will enter SBL and wait for subsequent actions.

[0062] In one specific embodiment of the present invention, such as Figure 4 As shown, the secondary bootloader (SBL) performs application upgrades, specifically including:

[0063] S31, after receiving the user's upgrade command, the secondary bootloader SBL downloads the latest application to the application backup area.

[0064] S32, the secondary bootloader SBL, switches the latest downloaded application from the application backup area to the application area to overwrite the original application.

[0065] S33, Set the application validity flag in the application information, and erase the application validity flag of the latest downloaded application in the backup information.

[0066] Specifically, the SBL program possesses CAN identifiers for both the factory and the user, used respectively for upgrading the application via PBL and via the user's upgrade process. The SBL program, which only has the function of upgrading the application, exists in memory as a plug-in. If the user directly uses the factory upgrade process without an upgrade process, the SBL program does not need to be downloaded to the storage medium. The SBL program also downloads the application to the application backup area, awaiting a switch command to switch the application backup area program to the application area, enabling differentiated recovery strategies at different stages of programming failures.

[0067] In one embodiment of the present invention, such as Figure 5 As shown, the primary boot loader (PBL) performs an upgrade using the secondary boot loader (SBL), which specifically includes:

[0068] S51, the master boot loader PBL downloads the latest SBL program to the SBL backup area.

[0069] S52 performs integrity verification on the downloaded data.

[0070] S53, if the verification fails, the secondary bootloader SBL remains unchanged.

[0071] S54, if the verification is successful, set the flag bit of the latest downloaded SBL program in the backup information to be valid. The main boot loader PBL will switch the latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader SBL.

[0072] S55, erase the application valid flag bit of the latest downloaded SBL program in the backup flag information, and set the application valid flag bit of the secondary bootloader SBL in the flag information.

[0073] Specifically, in the case of a factory-level reprogramming request, the PBL determines when to upgrade the SBL based on the incoming physical address information. It then enters the data download process, downloading the latest SBL program to the SBL backup area. During the data download phase, the CRC32 value of the transmitted data is calculated in real time. After the data download is complete, data integrity is verified. If the verification is successful, the application validity flag of the latest downloaded SBL program in the backup information is set. The application validity flag of the SBL program is retained at this point. Then, the PBL switches the entire latest downloaded SBL program to the SBL area to overwrite the original SBL, completing the SBL upgrade. If the verification fails, the SBL remains unchanged.

[0074] In one specific embodiment of the present invention, such as Figure 6 As shown, the Master Boot Loader (PBL) performs application upgrades, specifically including:

[0075] S61, the Master Bootloader (PBL) downloads the latest application to the application backup area.

[0076] S62 performs integrity verification on the downloaded data.

[0077] S63: If the verification fails, the application remains unchanged.

[0078] S64, if the verification is successful, set the flag bit of the latest downloaded application in the backup information to be valid. The master boot loader PBL will switch the latest downloaded application in the application backup area to the application area to overwrite the original application.

[0079] S65, erase the application valid flag bit of the latest downloaded application in the backup information, and set the application valid flag bit of the application in the information.

[0080] Specifically, in the case of a factory-level reprogramming request, the PBL determines when to upgrade the application based on the incoming physical address information. First, it downloads the latest application to the application backup area, calculating the CRC32 value of the transmitted data in real time during the data download phase. After the data download is complete, it performs a data integrity check. If the check succeeds, it sets the application validity flag of the latest downloaded application in the backup information, retaining the application validity flag. Then, the PBL switches the entire latest downloaded application to the application area to overwrite the original application, completing the application upgrade. If the check fails, the application remains unchanged.

[0081] The program switching phase offers high flexibility, allowing users to define custom switching commands or perform data switching and installation within a range of diagnostic services, such as dependency checks and download result requests. When switching the program from the backup area to the runtime area, the application valid flag in the flag area is first erased. Then, after the program is installed in the runtime area, the application valid flag in the backup area is erased simultaneously, and the application valid flag in the flag area is set.

[0082] In this invention, if an upgrade anomaly occurs at any stage before program switching, such as a power outage or communication loss, the application validity flag of the backup flag information will not be set, while the application validity flag of the backup flag information will be set. Therefore, after power is restored, the program will continue to run the previous program, ensuring normal vehicle operation. If an upgrade anomaly occurs during the program switching installation stage, such as a power outage, the application validity flag of the backup flag information will be erased, but the application validity flag of the backup flag information will remain valid. Program switching can then be achieved simply by restoring power.

[0083] In one specific embodiment of the present invention, such as Figure 7 As shown, the above-mentioned method for upgrading the vehicle electronic control unit program may further include:

[0084] S16, if it is a user-level reprogramming request, check whether the application validity flag of the secondary bootloader SBL is valid.

[0085] S17. If the application validity flag of the secondary bootloader SBL is invalid, a negative response is returned.

[0086] S18. If the application validity flag of the secondary bootloader SBL is valid, further determine whether the version number of the secondary bootloader SBL matches the program to be burned.

[0087] S19. If there is no match, a negative response is returned.

[0088] Specifically, for user-level reprogramming requests, PBL first checks the validity of the SBL program. The SBL is essentially a user upgrade program, such as an OTA upgrade. If the SBL program is invalid, a negative response is given to prevent jumping to an invalid SBL program area and causing program crashes. If the SBL program is valid, it further checks whether the SBL program's version number matches the program to be burned. If they don't match, another negative response is given. If it's valid and the version matches, the user upgrade / reprogramming flag is set and the program is reset. After resetting and restarting, the process first goes through the PBL program, at which point it enters the SBL upgrade application process. Therefore, this multi-checking of the SBL during the reprogramming process avoids problems such as program crashes and maintenance difficulties caused by a missing SBL or version mismatch.

[0089] In summary, the vehicle electronic control unit program upgrade method according to embodiments of the present invention divides the storage medium into seven physically isolated storage partitions, constructs a hierarchical boot and storage management system, and eliminates the problem of flashing errors caused by memory mismatch; it can automatically decide the upgrade path based on the identifier (such as PBL directly upgrading SBL / application, or jumping to SBL to upgrade only the application), realizing intelligent scheduling of the upgrade process; PBL and SBL firmware are developed based on factory-level upgrade specifications and user-level upgrade specifications respectively. PBL can realize independent upgrades of SBL and application. Debugging personnel only need to use factory debugging tools to ensure the consistency of the toolchain. During factory production testing, only one internal version is needed to complete the software version management of different vehicle models, greatly saving labor costs and version management costs. If the customer needs to update the upgrade process, the customer can... Upgrades can be performed using either the user's own toolchain or the factory's toolchain. No need to open the package for updates; simply updating the SBL plugin enables rapid program replacement. The entire process unifies the upgrade workflow, converges the version matrix, reduces maintenance costs, and fundamentally avoids the risk of bricking, improving production line efficiency and end-user experience. A redundant backup mechanism is combined with the bootloader and implemented synchronously in both the PBL and SBL. In case of upgrade anomalies, a recovery mechanism is triggered by the status of the flags in the backup area. A bootable program is rebuilt using the redundant image, ensuring the program's self-recovery and stable existence even in extreme cases of burning anomalies, eliminating the risk of burning crashes. Simultaneously, two flag areas are configured to fully record the upgrade process status data, supporting differentiated recovery strategies at different stages of burning anomalies. This allows for either restoring the original program or replacing it with a new version, while simultaneously storing related additional data from the user or factory side.

[0090] Corresponding to the above-described method for upgrading the program of a vehicle electronic control unit, this invention also proposes a system for upgrading the program of a vehicle electronic control unit. Since the system embodiments of this invention correspond to the method embodiments described above, details not disclosed in the system embodiments can be found in the method embodiments described above, and will not be repeated here.

[0091] In embodiments of the present invention, such as Figure 2 As shown, the storage medium of the vehicle electronic control unit is physically isolated into seven memory areas, which are used to store the main boot loader (PBL), the secondary boot loader (SBL), flag information, flag backup information, application programs, the latest downloaded SBL program, and the latest downloaded application programs, respectively. The main boot loader (PBL) is developed based on the factory-level upgrade specification, and the secondary boot loader (SBL) is developed based on the user-level upgrade specification.

[0092] The vehicle electronic control unit's program upgrade system includes a primary bootloader (PBL) and a secondary bootloader (SBL). The PBL starts after the vehicle electronic control unit is powered on / reset. It determines the type of reprogramming request based on the input reprogramming flag. If it is a user-level reprogramming request, the system jumps to the secondary bootloader (SBL). The SBL performs application upgrades in the event of a user-level reprogramming request. The PBL also determines whether to upgrade the secondary bootloader (SBL) or the application based on the input physical address information if it is a factory-level reprogramming request. If it determines to upgrade the secondary bootloader (SBL), the PBL performs the SBL upgrade; if it determines to upgrade the application, the PBL performs the application upgrade.

[0093] According to one embodiment of the present invention, the primary boot loader (PBL) is further configured to: determine, based on the input reprogramming flag, that reprogramming is not required, check the application validity flag of the flag information; if the application validity flags of both the secondary boot loader (SBL) and the application program in the flag information are invalid, further check the application validity flag of the flag backup information; if the application validity flag of the latest downloaded SBL program in the flag backup information is valid, then remain in the PBL waiting for the user's upgrade instruction; if the application validity flag of the latest downloaded SBL program in the flag backup information is invalid, further check the application validity flag of the latest downloaded application program in the flag backup information; if the application validity flag of the latest downloaded application program in the flag backup information is invalid, then remain in the PBL waiting for the user's upgrade instruction; if the application validity flag of the latest downloaded application program in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application program in the flag backup information .... If the application validity flag is valid, the Master Bootloader (PBL) will switch the latest downloaded application from the application backup area to the application area, overwriting the original application. After the switch, it will erase the application validity flag of the latest downloaded application in the backup information and set the application validity flag of the application in the backup information. If the application validity flag of the application in the backup information is invalid, the PBL will switch the latest downloaded SBL program from the SBL backup area to the SBL area, overwriting the original secondary bootloader (SBL). After the switch, it will erase the application validity flag of the latest downloaded SBL program in the backup information and set the application validity flag of the secondary bootloader (SBL) in the backup information.

[0094] According to an embodiment of the present invention, the primary boot loader PBL is further configured to: if the application validity flag of the secondary boot loader SBL or the application in the flag information is valid, then check the application validity flag of the application in the flag information again; if the application validity flag of the application in the flag information is valid, then jump to the application; if the application validity flag of the application in the flag information is invalid, then jump to the secondary boot loader SBL.

[0095] According to one embodiment of the present invention, the secondary boot loader SBL is specifically used for: after receiving a user upgrade command, the secondary boot loader SBL downloads the latest downloaded application to the application backup area; the secondary boot loader SBL switches the latest downloaded application from the application backup area to the application area to overwrite the original application; setting the application validity flag in the flag information, and erasing the application validity flag of the latest downloaded application in the flag backup information.

[0096] According to one embodiment of the present invention, the primary boot loader (PBL) is specifically used for: downloading the latest downloaded SBL program to the SBL backup area; performing integrity verification of the downloaded data; if the verification fails, the secondary boot loader (SBL) remains unchanged; if the verification succeeds, setting the application validity flag of the latest downloaded SBL program in the backup information; switching the entire latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader (SBL); erasing the application validity flag of the latest downloaded SBL program in the backup information, and setting the application validity flag of the secondary boot loader (SBL) in the backup information.

[0097] According to one embodiment of the present invention, the Master Boot Loader (PBL) is specifically used for: downloading the latest downloaded application to the application backup area; performing integrity verification of the downloaded data; if the verification fails, the application remains unchanged; if the verification succeeds, setting the application validity flag of the latest downloaded application in the backup information, and the PBL switching the latest downloaded application in the application backup area to the application area to overwrite the original application; erasing the application validity flag of the latest downloaded application in the backup information, and setting the application validity flag of the application in the backup information.

[0098] According to an embodiment of the present invention, the primary boot loader (PBL) is further configured to: if it is a user-level reprogramming request, check whether the application validity flag of the secondary boot loader (SBL) is valid; if the application validity flag of the secondary boot loader (SBL) is invalid, return a negative response; if the application validity flag of the secondary boot loader (SBL) is valid, further determine whether the version number of the secondary boot loader (SBL) matches the program to be burned; if they do not match, return a negative response.

[0099] In summary, the vehicle electronic control unit program upgrade system according to embodiments of the present invention divides the storage medium into seven physically isolated storage partitions, constructs a hierarchical boot and storage management system, and eliminates the flashing error problem caused by memory mismatch. It can automatically decide the upgrade path based on identifiers, realizing intelligent scheduling of the upgrade process. PBL and SBL firmware are developed based on factory-level upgrade specifications and user-level upgrade specifications respectively. PBL enables independent upgrades of SBL and application programs. Debugging personnel only need to use factory debugging tools to ensure toolchain consistency. During factory production testing, only one internal version is needed to manage software versions for different vehicle models, greatly saving labor and version management costs. If customers need to update the upgrade process, they can choose to use their own toolchain or the factory toolchain for upgrade. No need to open the cover for updates; simply updating the SBL plugin enables rapid program replacement. The entire process unifies the upgrade workflow, converges the version matrix, reduces maintenance costs, and fundamentally avoids the risk of bricking, improving production line efficiency and end-user experience. A redundant backup mechanism is combined with the bootloader and implemented synchronously in both PBL and SBL. In case of upgrade anomalies, the recovery mechanism is triggered by the flag position in the backup area, using the redundant image to rebuild a bootable program. This ensures the program's self-recovery and stable existence under any extreme case of burning anomalies, eliminating the risk of burning crashes. Simultaneously, two flag areas are configured to fully record the upgrade process status data, supporting differentiated recovery strategies at different stages of burning anomalies. This allows for either restoring the original program or replacing it with a new version, while simultaneously storing related additional data from the user or factory side.

[0100] Furthermore, the present invention also proposes a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the above-mentioned method for upgrading the program of a vehicle electronic control unit.

[0101] According to embodiments of the present invention, the computer device divides the storage medium into seven physically isolated storage partitions, constructs a hierarchical boot and storage management system, and eliminates the problem of flashing errors caused by memory mismatch. It can automatically decide the upgrade path based on identifiers, realizing intelligent scheduling of the upgrade process. PBL and SBL firmware are developed based on factory-level upgrade specifications and user-level upgrade specifications respectively. PBL enables independent upgrades of SBL and applications. Debugging personnel only need to use factory debugging tools to ensure toolchain consistency. During factory production testing, only one internal version is needed to manage software versions for different vehicle models, greatly saving labor and version management costs. If customers need to update the upgrade process, they can choose to use their own toolchain or the factory toolchain for upgrades without opening the cover for updates. The system allows for rapid program replacement simply by updating the SBL plugin. The entire process unifies the upgrade workflow, converges the version matrix, reduces maintenance costs, and fundamentally avoids the risk of bricking, improving production line efficiency and end-user experience. It combines a redundant backup mechanism with the bootloader and implements this synchronously in both the PBL and SBL. In case of an upgrade anomaly, the recovery mechanism is triggered by the flag position in the backup area, using the redundant image to rebuild a bootable program. This ensures the program's self-recovery and stable existence even in extreme cases of burning anomalies, eliminating the risk of burning crashes. Simultaneously, two flag areas are configured to fully record the upgrade process status data, supporting differentiated recovery strategies at different stages of burning anomalies. This allows for either restoring the original program or replacing it with a new version, while simultaneously storing related additional data from the user or factory side.

[0102] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0103] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0104] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0105] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0106] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0107] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0108] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0109] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for upgrading the program of a vehicle electronic control unit, characterized in that, in, The storage medium of the vehicle electronic control unit is physically isolated into seven memory areas, which are respectively used to store the main boot loader (PBL), the secondary boot loader (SBL), flag information, flag backup information, application programs, the latest downloaded SBL program, and the latest downloaded application programs. The main boot loader (PBL) is developed based on the factory-level upgrade specification, and the secondary boot loader (SBL) is developed based on the user-level upgrade specification. The method includes the following steps: After the vehicle electronic control unit is powered on / reset, the master bootloader (PBL) is started. The main bootloader (PBL) determines the reprogramming request type based on the passed-in reprogramming flag. If it is a user-level reprogramming request, it jumps to the secondary bootloader SBL, which performs the application upgrade. If it is a factory-level reprogramming request, the primary boot loader (PBL) will determine whether to upgrade the secondary boot loader (SBL) or the application based on the passed physical address information. If it is determined that the secondary bootloader SBL needs to be upgraded, then the primary bootloader PBL will perform the secondary bootloader SBL upgrade. If it is determined that an application needs to be upgraded, the Master Bootloader (PBL) will perform the application upgrade.

2. The method for upgrading the program of a vehicle electronic control unit according to claim 1, characterized in that, Also includes: The main bootloader PBL checks the application validity flag of the flag information when it determines that reprogramming is not required based on the input reprogramming flag. If both the secondary bootloader SBL and the application's application validity flags in the flag information are invalid, then the application validity flags of the flag backup information are further checked. If the application validity flag of the latest downloaded SBL program in the flag backup information is valid, then the program will remain in PBL and wait for the user's upgrade instruction. If the application validity flag of the latest downloaded SBL program in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information; If the application validity flag of the latest downloaded application in the flag backup information is valid, the main boot loader PBL will switch the latest downloaded application in the application backup area to the application area to overwrite the original application. After the switch is completed, the application validity flag of the latest downloaded application in the flag backup information will be erased, and the application validity flag of the application in the flag information will be set. If the application validity flag bit in the flag backup information is invalid, the main boot loader PBL will switch the latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader SBL. After the switch is completed, the application validity flag bit of the latest downloaded SBL program in the flag backup information will be erased, and the application validity flag bit of the secondary boot loader SBL in the flag backup information will be set.

3. The method for upgrading the program of a vehicle electronic control unit according to claim 2, characterized in that, Also includes: If the application validity flag of the secondary bootloader SBL or the application is valid in the flag information, then check the application validity flag of the application in the flag information again. If the application validity flag in the flag information is valid, then jump to the application; If the application validity flag in the flag information is invalid, then jump to the secondary bootloader SBL.

4. The method for upgrading the program of a vehicle electronic control unit according to claim 1, characterized in that, The secondary bootloader (SBL) performs application upgrades, specifically including: After receiving the user's upgrade command, the secondary bootloader SBL downloads the latest application to the application backup area; The secondary bootloader SBL switches the latest downloaded application from the application backup area to the application area to overwrite the original application; Set the application validity flag of the application in the flag information, and erase the application validity flag of the latest downloaded application in the flag backup information.

5. The method for upgrading the program of a vehicle electronic control unit according to claim 1, characterized in that, The primary boot loader (PBL) performs an upgrade using the secondary boot loader (SBL), specifically including: The main bootloader PBL downloads the latest downloaded SBL program to the SBL backup area; Perform integrity verification on the downloaded data; If the verification fails, the secondary bootloader SBL remains unchanged; If the verification is successful, the application validity flag of the latest downloaded SBL program in the backup information is set. The main boot loader PBL will switch the latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader SBL. Erase the application valid flag bit of the latest downloaded SBL program in the flag bit backup information, and set the application valid flag bit of the secondary bootloader SBL in the flag bit information.

6. The method for upgrading the program of a vehicle electronic control unit according to claim 1, characterized in that, The Master Bootloader (PBL) performs application upgrades, specifically including: The main bootloader (PBL) downloads the latest downloaded application to the application backup area; Perform integrity verification on the downloaded data; If the verification fails, the application remains unchanged; If the verification is successful, the application validity flag of the latest downloaded application in the backup information is set, and the main boot loader PBL switches the latest downloaded application in the application backup area to the application area to overwrite the original application. Erase the application validity flag of the latest downloaded application in the flag backup information, and set the application validity flag of the application in the flag information.

7. The method for upgrading the program of a vehicle electronic control unit according to claim 1, characterized in that, Also includes: If it is a user-level reprogramming request, check whether the application validity flag of the secondary bootloader SBL is valid; If the application validity flag of the secondary bootloader SBL is invalid, a negative response is returned; If the application validity flag of the secondary bootloader SBL is valid, further determine whether the version number of the secondary bootloader SBL matches the program to be burned; If there is no match, a negative response is returned.

8. A program upgrade system for a vehicle electronic control unit, characterized in that, in, The storage medium of the vehicle electronic control unit is physically isolated into seven memory areas, which are used to store the main boot loader (PBL), the secondary boot loader (SBL), flag information, flag backup information, application programs, the latest downloaded SBL program, and the latest downloaded application programs, respectively. The main boot loader (PBL) is developed based on the factory-level upgrade specification, and the secondary boot loader (SBL) is developed based on the user-level upgrade specification. The system includes: the main boot loader (PBL) and the secondary boot loader (SBL). The main bootloader (PBL) is used to start after the vehicle electronic control unit is powered on / reset. It determines the type of reprogramming request based on the incoming reprogramming flag. If it is a user-level reprogramming request, it causes the system to jump to the secondary bootloader (SBL). The secondary bootloader SBL is used to perform application upgrades upon user-level reprogramming requests; The primary boot loader (PBL) is also used to: if it is a factory-level reprogramming request, determine whether to upgrade the secondary boot loader (SBL) or the application based on the incoming physical address information; if it is determined to upgrade the secondary boot loader (SBL), the primary boot loader (PBL) executes the secondary boot loader (SBL) upgrade; if it is determined to upgrade the application, the primary boot loader (PBL) executes the application upgrade.

9. The vehicle electronic control unit program upgrade system according to claim 8, characterized in that, The Master Bootloader (PBL) is also used for: If it is determined that no reprogramming is needed based on the input reprogramming flag, check the application validity flag of the flag information; If both the secondary bootloader SBL and the application's application validity flags in the flag information are invalid, then the application validity flags of the flag backup information are further checked. If the application validity flag of the latest downloaded SBL program in the flag backup information is valid, then the program will remain in PBL and wait for the user's upgrade instruction. If the application validity flag of the latest downloaded SBL program in the flag backup information is invalid, then further check the application validity flag of the latest downloaded application in the flag backup information; If the application validity flag of the latest downloaded application in the flag backup information is valid, the main boot loader PBL will switch the latest downloaded application in the application backup area to the application area to overwrite the original application. After the switch is completed, the application validity flag of the latest downloaded application in the flag backup information will be erased, and the application validity flag of the application in the flag information will be set. If the application validity flag bit in the flag backup information is invalid, the main boot loader PBL will switch the latest downloaded SBL program in the SBL backup area to the SBL area to overwrite the original secondary boot loader SBL. After the switch is completed, the application validity flag bit of the latest downloaded SBL program in the flag backup information will be erased, and the application validity flag bit of the secondary boot loader SBL in the flag backup information will be set.

10. A computer device, characterized in that, The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a program upgrade method for a vehicle electronic control unit according to any one of claims 1-7.

Images