Vehicle remote upgrade method, system, and vehicle

Abstract

The embodiment of the application provides a vehicle remote upgrading method, system and vehicle, wherein the method comprises the following steps: in a vehicle remote upgrading process, sending a high-voltage state query instruction of the vehicle to a vehicle gateway controller, instructing the vehicle gateway controller to acquire the high-voltage state of a vehicle power battery at a current time from a battery management system through the high-voltage state query instruction; receiving the high-voltage state of the vehicle power battery at the current time sent by the vehicle gateway controller, and controlling the remote upgrading action of the vehicle according to the high-voltage state of the vehicle power battery at the current time. Therefore, the application periodically triggers the high-voltage state query mechanism in the vehicle remote upgrading process to continuously monitor the whole vehicle high-voltage power supply, and once the high-voltage state is abnormal or the power is off, the remote upgrading task is terminated in time, the risk of power loss caused by long-time power supply of the low-voltage storage battery is avoided, the vehicle has normal starting ability, and the safety, stability and reliability of the remote upgrading process are ensured.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to a method, system, and vehicle for remote vehicle upgrades. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, remote vehicle upgrades have become an important means of achieving software function iteration, defect repair, and performance optimization. Remote vehicle upgrades typically require the vehicle to remain powered on for an extended period to ensure that the upgrade data is completely downloaded and correctly written to the target electronic control unit. During this process, the vehicle's power supply status directly affects the stability and safety of the upgrade.

[0003] In related technologies, the high-voltage battery charge of the vehicle is checked only before remote vehicle upgrade. Once the high-voltage battery charge meets the set upgrade threshold, the high-voltage battery is requested to be powered on before the remote upgrade is performed. This is to avoid the low-voltage battery from running out of power during the remote upgrade, which could prevent the vehicle from starting after the upgrade. However, during the upgrade process, if the high-voltage battery is powered down prematurely due to battery management system protection strategies, user operation, communication interruption, thermal management abnormalities, or vehicle control logic, or if the upgrade package is too large or the upgrade time is too long, exceeding the high-voltage holding time limit, the high-voltage system may be powered down prematurely, causing the vehicle to be powered solely by the low-voltage battery. If the upgrade task is not terminated in time, it will continue to consume the low-voltage battery charge, which can easily lead to a power depletion and affect the normal starting of the vehicle or the operation of critical functions. Summary of the Invention

[0004] This application provides a method, system, and vehicle for remote vehicle upgrades, aiming to improve the problem in related technologies where, if a vehicle experiences a high-voltage power failure during the entire upgrade process, the upgrade process may continue to operate under low-voltage power supply conditions, consuming battery power for a long time, which can easily lead to a risk of battery depletion and affect the normal starting and operation of critical functions of the vehicle.

[0005] The first aspect of this application provides a method for remote vehicle upgrade, which is applied to an in-vehicle communication terminal. The method includes the following steps: during the remote vehicle upgrade process, sending a high-voltage status query command of the vehicle to an in-vehicle gateway controller, instructing the in-vehicle gateway controller to send a corresponding high-voltage diagnostic command to a battery management system to obtain the high-voltage status of the vehicle's power battery at the current moment from the battery management system; receiving the high-voltage status of the vehicle's power battery at the current moment sent by the in-vehicle gateway controller, and controlling the remote upgrade action of the vehicle based on the high-voltage status of the vehicle's power battery at the current moment.

[0006] Based on the aforementioned technical means, this embodiment of the application can proactively send a high-voltage status query command by the vehicle communication terminal during the remote vehicle upgrade process. The high-voltage status query command instructs the vehicle gateway controller to send a corresponding high-voltage diagnostic command to the battery management system to obtain the current high-voltage status of the vehicle's power battery from the battery management system. After receiving the high-voltage status information, the vehicle communication terminal dynamically determines whether to continue, pause, or terminate the remote upgrade action in conjunction with safety policies. If it detects that the high voltage has been de-energized or is in an abnormal state, the upgrade process is immediately terminated to avoid the upgrade process relying on the low-voltage battery for a long time. This effectively prevents the vehicle from failing to start or key functions from malfunctioning due to low-voltage battery depletion, ensuring that the vehicle has normal starting capability and significantly improving the safety and reliability of the remote upgrade process.

[0007] In conjunction with the first aspect of the embodiment, in some possible implementations, during the remote vehicle upgrade process, sending a high-voltage status query command for the vehicle to the vehicle gateway controller includes: identifying the number of times the high-voltage status query command has been sent; and triggering the sending action of the high-voltage status query command based on the number of times it has been sent.

[0008] Based on the above technical means, the embodiments of this application can identify the number of times the high-voltage status query command is sent during the remote vehicle upgrade process, and dynamically trigger the sending of subsequent query commands based on the number of times, thereby realizing periodic or conditional monitoring of the high-voltage status. The triggering mechanism based on the number of times can optimize the scheduling of monitoring resources, avoid unnecessary frequent queries at the beginning or end of the upgrade, thereby further reducing the overall system load and improving bus communication efficiency.

[0009] In conjunction with the first aspect of the embodiment, in some possible implementations, triggering the sending action of the high-pressure status query instruction based on the number of transmissions includes: if the number of transmissions is less than or equal to a first target number, calculating a first interval duration between the current time and the start execution time of the remote upgrade action; if the first interval duration reaches the first target duration, sending the high-pressure status query instruction; if the number of transmissions is greater than the first target number, calculating a second interval duration between the current time and the last time the high-pressure status query instruction was sent; if the second interval duration reaches the second target duration, sending the high-pressure status query instruction.

[0010] Based on the aforementioned technical means, this application embodiment can upgrade the initial stage by judging the number of initial queries and the duration of the upgrade, ensuring stable intervention of the system after the critical startup period; after entering the stable monitoring stage, it is triggered according to the interval of the last query, so that the monitoring frequency can flexibly match the actual progress and real-time needs of the upgrade, effectively avoiding invalid queries when the upgrade state is unstable or when intensive monitoring is not required. Thus, while ensuring that the high-pressure state is under full control, it further reduces the system communication load and energy consumption, and improves the resource utilization efficiency and smooth operation of the entire upgrade process.

[0011] In conjunction with the first aspect of the embodiment, in some possible implementations, controlling the remote upgrade action of the vehicle based on the high voltage state of the vehicle's power battery at the current moment includes: if the high voltage state of the vehicle's power battery at the current moment is a first state, then controlling the vehicle to exit the remote upgrade action; if the high voltage state of the vehicle's power battery at the current moment is a second state, then maintaining the remote upgrade action of the vehicle, wherein the first state includes at least one of the vehicle's power battery being powered down and in a fault state, and the second state is a high voltage being powered on.

[0012] Based on the above technical means, the embodiments of this application can immediately trigger safety protection when abnormal exit of the high-voltage system is detected, thereby effectively preventing the risk of low-voltage battery depletion due to high-voltage power failure during the vehicle upgrade process, ensuring the normal start-up and use of the upgraded vehicle, and significantly enhancing the safety and controllability of the remote upgrade process.

[0013] In conjunction with the first aspect of the embodiment, in some possible implementations, after sending the vehicle's high-voltage status query command to the vehicle gateway controller, the method further includes: obtaining the first response duration of the vehicle gateway controller; if the first response duration is greater than a first timeout threshold, controlling the vehicle to perform the exit remote upgrade action.

[0014] Based on the above technical means, the embodiments of this application can promptly identify the interruption of such monitoring chain when the gateway controller fails to respond to the query request in a timely manner due to internal failure, excessive load or communication abnormality, and actively trigger a safe exit. This effectively prevents the risk of not being able to detect high voltage abnormalities due to the failure of the monitoring system itself, avoids the potential power loss that may occur when the vehicle continues to upgrade in a state without monitoring, and significantly enhances the robustness and reliability of the entire remote upgrade security protection system.

[0015] A second aspect of this application provides a method for remotely upgrading a vehicle. The method is applied to an on-board gateway controller and includes the following steps: sending a corresponding high-voltage diagnostic command to a battery management system to instruct the battery management system to obtain the high-voltage status of the vehicle's power battery at the current moment; obtaining the high-voltage status of the vehicle's power battery at the current moment from the battery management system and sending the high-voltage status of the vehicle's power battery at the current moment to an on-board communication terminal to instruct the on-board communication terminal to control the remote upgrade action of the vehicle.

[0016] Based on the aforementioned technical means, this embodiment of the application sends a high-voltage diagnostic command to the battery management system through the vehicle gateway controller, driving the battery management system to collect and return the high-voltage status of the vehicle's power battery at the current moment in real time. Subsequently, the high-voltage status of the vehicle's power battery at the current moment is accurately transmitted to the vehicle communication terminal. The vehicle communication terminal dynamically decides whether to execute or suspend the remote upgrade action based on the high-voltage status, thereby ensuring that the upgrade is only carried out under safe and reliable high-voltage power supply conditions. This achieves efficient collaboration and reliable transmission of high-voltage status information between the vehicle communication terminal, the vehicle gateway controller, and the battery management system. This eliminates the need for the vehicle communication terminal to directly handle the underlying diagnostic protocol and communication details, greatly simplifying its functional design and complexity. At the same time, the gateway controller, as a dedicated protocol conversion and routing hub, can optimize command scheduling and error handling, improving the stability and efficiency of the entire status query link. This effectively avoids the risk of battery depletion caused by the system switching to low-voltage power supply due to high-voltage power failure or abnormalities, thus improving the safety and stability of remote vehicle upgrades.

[0017] In conjunction with the second aspect of the embodiments, in some possible implementations, sending a corresponding high-voltage diagnostic command to the battery management system includes: parsing the high-voltage status query command to determine the vehicle high-voltage status request from the vehicle communication terminal; querying the communication protocol mapping table based on the vehicle high-voltage status request, and sending the corresponding high-voltage diagnostic command.

[0018] Based on the aforementioned technical means, in this embodiment, the vehicle gateway controller accurately identifies the type of vehicle high-voltage status information requested by the vehicle communication terminal by parsing the received high-voltage status query command. Based on this request, it queries a preset communication protocol mapping table, matches and sends a high-voltage diagnostic command compatible with the battery management system. The mapping table establishes the association between different high-voltage status requests and corresponding diagnostic commands, data formats, and communication parameters, enabling the vehicle gateway controller to flexibly adapt to the communication specifications of various vehicle models or battery management systems. This ensures the correctness and executability of the high-voltage diagnostic commands, improving not only the accuracy and universality of command conversion but also enhancing the system's compatibility in multi-platform and multi-protocol environments, thereby improving the safety, stability, and reliability of remote vehicle upgrades.

[0019] In conjunction with the second aspect of the embodiments, in some possible implementations, after the battery management system obtains the high voltage state of the vehicle's power battery at the current moment through the high voltage state indication, the method further includes: obtaining the second response duration of the battery management system; if the second response duration is greater than the second timeout threshold, sending an exit command; sending the exit command to the vehicle communication terminal, and the vehicle communication terminal responding to the exit command, wherein the exit command is used to instruct the vehicle communication terminal to control the vehicle to exit the remote upgrade action.

[0020] According to the above technical means, in this embodiment of the application, after the vehicle gateway controller sends the high-voltage diagnostic command to the battery management system, it monitors the response time of the battery management system in real time and obtains the second response duration. If the duration exceeds the preset second timeout threshold, it is determined that the battery management system has failed to provide timely feedback on the high-voltage status, which may pose risks such as communication abnormalities, system failures, or high-voltage control failures. At this time, the vehicle gateway controller actively sends an exit command to the vehicle communication terminal. After receiving the exit command, the vehicle communication terminal immediately controls the vehicle to exit the remote upgrade action, avoiding the system from relying on low-voltage power supply for a long time due to the unknown or unreliable high-voltage status. This effectively improves the fault tolerance and safety protection level of the remote upgrade process for battery system abnormalities.

[0021] A third aspect of this application provides a vehicle remote upgrade system, including an on-board communication terminal, a gateway controller, and a battery management system. The on-board communication terminal, during the remote upgrade process, sends a high-voltage status query command to the on-board gateway controller; sends the high-voltage status query command to the on-board gateway controller; receives the current high-voltage status of the vehicle's power battery from the on-board gateway controller; and controls the remote upgrade operation of the vehicle based on the current high-voltage status of the vehicle's power battery. The gateway controller receives the high-voltage status query command from the on-board communication terminal, generates a high-voltage diagnostic command to be sent to the battery management system based on the high-voltage status query command, sends the high-voltage diagnostic command to the battery management system, and receives the current high-voltage status of the vehicle's power battery from the battery management system. The battery management system receives the high-voltage diagnostic command, obtains the current high-voltage status of the vehicle's power battery, and sends the current high-voltage status of the vehicle's power battery to the on-board gateway controller.

[0022] A fourth aspect of this application provides a vehicle that includes a vehicle remote upgrade system as described in the above embodiments. Attached Figure Description

[0023] Figure 1 This is a flowchart of a vehicle remote upgrade method provided in one embodiment of this application; Figure 2This is a flowchart of a vehicle remote upgrade method provided in another embodiment of this application; Figure 3 This is a schematic diagram of the high-voltage status monitoring process provided in this application; Figure 4 This is a schematic diagram of the remote upgrade process provided in an embodiment of this application; Figure 5 This is a block diagram of the vehicle remote upgrade system provided in the embodiments of this application. Detailed Implementation

[0024] To make the technical problems, technical solutions, and beneficial effects solved by this application clearer, the following detailed description is provided in conjunction with embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0025] Remote software upgrades for new energy vehicles are an effective measure for upgrading vehicle functions during the vehicle R&D and mass production stages. They are crucial for enhancing the competitiveness of automotive products and improving user experience. The vehicle's user experience is also critical during and after remote upgrades. Currently, the mainstream high-pressure status monitoring methods during remote upgrades fall into three categories: (1) Judgment of no high-voltage status during remote upgrade: The system checks the vehicle's high-voltage battery level only before remote upgrades. Once the high-voltage battery level meets the set upgrade threshold, it requests power to the vehicle's high-voltage battery before proceeding with the remote upgrade. This is to prevent the vehicle from failing to start after the upgrade due to a low-voltage battery depletion. However, this technical solution only requests high-voltage power before the remote upgrade and cannot check the high-voltage status in real time during the upgrade process. This inevitably leads to situations where abnormal high-voltage power loss or an excessively large upgrade package causes high-voltage power loss due to timeout, resulting in a depleted vehicle battery.

[0026] (2) During remote upgrades, whitelist broadcasts of high-voltage status signals are performed: This solution requires special coordination among the battery management controller, vehicle gateway controller, and vehicle communication terminal. When remotely upgrading and disabling vehicle functions, a whitelist is enabled separately to send, forward, and receive high-voltage status signals, thereby judging the vehicle's high-voltage status in real time and preventing low-voltage battery depletion.

[0027] However, the above technical solutions require significant modifications to the associated nodes and special adaptations, which is not conducive to product platform adaptation. In addition, when upgrading vehicles, the presence of application message transmission and reception on the bus from non-upgrade nodes will affect the bus load and pose a risk of upgrade failure.

[0028] (3) During remote upgrades, the vehicle-mounted communication terminal obtains the high-voltage status through diagnostics: The solution involves the vehicle communication terminal controller sending a diagnostic command to the battery management system to obtain the high-voltage status DID (Data Identifier). The vehicle gateway controller then routes the diagnostic command sent by the vehicle communication terminal directly to the battery management system node. After receiving the diagnostic service request, the battery management system provides feedback on the high-voltage status through the diagnostic service.

[0029] However, the advantages of the above technical solutions are that high-voltage state requests can be obtained on demand and the interval of diagnostic service requests can be controlled, which will not cause a waste of bus load resources. However, the disadvantage of the method is that the vehicle communication terminal controller needs to have a diagnostic request service module, which is not currently available in mainstream vehicle communication terminal controllers on the market, and therefore cannot support the implementation of the solution.

[0030] In summary, the existing technical solutions mainly involve determining whether the vehicle conditions are met before remote upgrade, requesting high-voltage power supply from the vehicle, and having the battery management system controller continuously maintain the high-voltage state while waiting to receive a high-voltage command or exiting after a timeout. The technical problem is that if the high-voltage power fails abnormally or exits after a timeout during the upgrade process, the remote task is not yet completed, and the low-voltage battery power continues to be consumed, causing the vehicle to run out of power and become unable to start, thus preventing the user from using the vehicle.

[0031] Therefore, this application addresses the risk of power loss during remote upgrades of new energy vehicles under traditional distributed architecture by adding a high-voltage real-time monitoring method to the existing signal transmission link during the remote upgrade process. When an abnormal high-voltage exit or timeout is detected during the upgrade process, the remote upgrade task is stopped to avoid the risk of vehicle power loss.

[0032] Figure 1 This is a flowchart of a vehicle remote upgrade method according to an embodiment of the present invention.

[0033] like Figure 1 As shown, the vehicle remote upgrade method according to an embodiment of the present invention is applied to an in-vehicle communication terminal, wherein the method includes the following steps: Step S101: During the vehicle remote upgrade process, a high-voltage status query command for the vehicle is sent to the vehicle gateway controller. The high-voltage status query command instructs the vehicle gateway controller to send a corresponding high-voltage diagnostic command to the battery management system in order to obtain the high-voltage status of the vehicle's power battery at the current moment from the battery management system.

[0034] It is understood that, in the embodiments of the present invention, during the remote vehicle upgrade process, the vehicle communication terminal can actively send a high-voltage status query command to the vehicle gateway controller to instruct the vehicle gateway controller to send a corresponding high-voltage diagnostic command to the battery management system, thereby obtaining the high-voltage status of the power battery at the current moment in real time. This establishes a cross-domain collaborative channel between the vehicle communication terminal and the battery management system, enabling the remote upgrade system to dynamically monitor whether the high-voltage power supply of the whole vehicle is normal during the upgrade execution, and providing an accurate basis for subsequent safety decisions.

[0035] It should be noted that the high-voltage status query command refers to a data packet or service request that is proactively generated by the vehicle-mounted communication terminal during remote vehicle upgrades to monitor the safety of the high-voltage system in real time. This command conforms to a specific application-layer protocol. The high-voltage status query command is not a raw signal directly transmitted from the underlying network, but rather an application-layer command that encapsulates a clear business intent (i.e., querying the high-voltage status). It is a proprietary protocol message based on the vehicle-mounted Ethernet, a dedicated communication language internally defined between the vehicle-mounted communication terminal and the gateway controller for remote upgrade services.

[0036] The vehicle communication terminal and the vehicle gateway controller interact using a proprietary Ethernet protocol. This proprietary protocol is a unique remote upgrade in-vehicle network communication interaction protocol between the vehicle communication terminal and the vehicle gateway controller, defined in internal technical development documents, and is based on the Ethernet TCP / IP (Transmission Control Protocol / Internet Protocol) protocol.

[0037] Specifically, after receiving the high-voltage status query command, the vehicle gateway controller first parses the semantics of the high-voltage status query command to identify the request to obtain the current high-voltage status of the power battery. According to the pre-stored diagnostic protocol mapping table, the gateway controller converts the request to obtain the current high-voltage status of the power battery into a diagnostic command that conforms to the unified diagnostic service. For example, it constructs a service request to read the data identifier, such as 0x22+0xF201 (where 0xF201 is the data identifier of the high-voltage system status defined by the vehicle manufacturer). This high-voltage diagnostic command is sent to the battery management system through the power domain CAN (Controller Area Network) bus. After receiving the diagnostic command, the battery management system collects the high-voltage relay status, bus voltage and its own operating mode in real time, determines whether it is currently in a high-voltage power-on state, and encapsulates the result (such as 0x01 indicating that the high voltage is powered on, 0x00 indicating that the power is off or there is a fault) and returns it to the vehicle gateway controller. After receiving the response, the gateway controller extracts the high-voltage status data and forwards it to the vehicle communication terminal for it to decide whether to continue to perform the remote upgrade.

[0038] Step S102: Receive the current high voltage status of the vehicle's power battery from the vehicle gateway controller.

[0039] It is understood that the embodiments of the present invention can receive the high voltage status of the vehicle's power battery at the current moment sent by the vehicle gateway controller, so that the vehicle communication terminal can monitor in real time whether the high voltage power supply of the whole vehicle is in a normal power-on state. This allows the system to control the remote upgrade action of the vehicle based on the high voltage status of the vehicle's power battery at the current moment, avoiding the system from continuously consuming the low voltage battery power when there is no high voltage support. This effectively prevents the vehicle from failing to start or key functions from failing due to power depletion, and significantly improves the safety and reliability of the remote upgrade process.

[0040] Step S103: Control the vehicle's remote upgrade action based on the current high voltage state of the vehicle's power battery.

[0041] It is understood that the embodiments of the present invention can dynamically control the remote upgrade action according to the high voltage state of the vehicle's power battery at the current moment. It can maintain the upgrade process smoothly when the high voltage is normally powered on, ensuring that the software update task is completed efficiently. When an abnormal state such as high voltage power failure or fault is detected, the upgrade operation is immediately suspended or terminated to prevent the system from relying on the low voltage battery for power supply for a long time. This effectively avoids the risk of low voltage battery depletion caused by high voltage abnormalities, and ensures that the vehicle still has the ability to start normally and operate key functions after the upgrade. This significantly improves the reliability, safety and user experience of the remote upgrade process.

[0042] In step S101, during the vehicle remote upgrade process, a high-voltage status query command for the vehicle is sent to the vehicle gateway controller, including: identifying the number of times the high-voltage status query command has been sent; and triggering the sending action of the high-voltage status query command based on the number of times it has been sent.

[0043] It is understood that, during the remote vehicle upgrade process, the system can identify the number of times the high-voltage status query command is sent and dynamically trigger subsequent query actions based on the number of times. This enables the system to achieve orderly and phased monitoring of the high-voltage status of the power battery. While ensuring the real-time perception capability of the high-voltage status, it effectively balances communication efficiency and system performance, and improves the stability and adaptability of the remote upgrade process.

[0044] In step S101, the sending action of the high-pressure status query instruction is triggered according to the number of times it is sent, including: if the number of times it is sent is less than or equal to the first target number, then the first interval duration between the current time and the start execution time of the remote upgrade action is calculated; if the first interval duration reaches the first target duration, then the high-pressure status query instruction is sent; if the number of times it is sent is greater than the first target number, then the second interval duration between the current time and the last time the high-pressure status query instruction was sent is calculated; if the second interval duration reaches the second target duration, then the high-pressure status query instruction is sent.

[0045] The first target number of times can be 1 or 2 times. The first interval duration and the second interval duration can be obtained according to the actual timer. The duration of the first target can be 30s or 20s, and the duration of the second target can be 50s or 60s. All of the above can be set according to actual needs and are not specifically limited.

[0046] It is understood that the embodiments of the present invention can upgrade the initial stage by judging the number of initial queries and the duration of the upgrade, ensuring stable intervention of the system after the critical startup period; after entering the stable monitoring stage, it is triggered according to the interval of the last query, so that the monitoring frequency can flexibly match the actual progress and real-time needs of the upgrade, effectively avoiding invalid queries when the upgrade state is not stable or when intensive monitoring is not required. Thus, while ensuring that the high-pressure state is under control throughout, the system communication load and energy consumption are further reduced, and the resource utilization efficiency and smooth operation of the entire upgrade process are improved.

[0047] Specifically, in one embodiment of this application, the vehicle communication terminal maintains a high-voltage status query counter during the remote vehicle upgrade process to record the number of high-voltage status query commands sent. When the upgrade process starts, the terminal first initializes the counter to zero and enters the query control logic: it decides whether to send the next high-voltage status query command based on the current count value. For example, if the high-voltage status query command is sent for the first time after the upgrade starts, and the count value is less than or equal to a preset first target number, the interval between the current time and the upgrade start time is calculated. If the interval reaches the first target duration, a high-voltage status query command is sent and the counter is incremented by 1.

[0048] Once the counter value indicates that a high-voltage status query command has been sent, the interval between the current time and the last query sending time is calculated before each query command is sent. The query command is sent again only when the interval reaches the second target duration (e.g., 60 seconds, which is greater than the first target duration), and the counter is updated. This allows the system to monitor the high-voltage status at high frequency in the early stages of the upgrade to ensure safe access, and then switch to low-frequency monitoring in the middle and later stages to reduce the load on the CAN or Ethernet bus.

[0049] In addition, if an abnormal high-voltage condition is detected after a query (such as when power is off), the system can immediately clear the counter and terminate subsequent queries, while exiting the upgrade process; if the upgrade is successfully completed, the counter is also reset to prepare for the next upgrade.

[0050] After step S101, after sending the vehicle's high-voltage status query command to the vehicle gateway controller, the method further includes: obtaining the first response duration of the vehicle gateway controller; if the first response duration is greater than the first timeout threshold, controlling the vehicle to perform the exit remote upgrade action.

[0051] The first response duration can be obtained based on the actual timer, and the first timeout threshold can be 30s or 20s, which can be set according to actual needs without specific limitations.

[0052] It is understood that, in this embodiment of the invention, after the high-voltage status query command is sent to the vehicle gateway controller, the vehicle communication terminal can monitor and obtain the first response time of the vehicle gateway controller in real time. If the response time exceeds the preset first timeout threshold, it is determined that the vehicle gateway controller has failed to complete the command processing or return high-voltage status information within a reasonable time, which may indicate abnormal situations such as communication interruption, excessive gateway load, or internal failure. At this time, the vehicle communication terminal actively controls the vehicle to perform the exit from remote upgrade action, avoiding the continuation of the upgrade process under the condition that the high-voltage status is unknown or cannot be confirmed. This effectively prevents upgrade misjudgment or low-voltage power supply risk caused by intermediate link failure, and further enhances the reliability and safety protection capability of the remote upgrade process.

[0053] In step S103, the remote upgrade action of the vehicle is controlled according to the high voltage state of the vehicle power battery at the current moment, including: if the high voltage state of the vehicle power battery at the current moment is a first state, the vehicle is controlled to exit the remote upgrade action; if the high voltage state of the vehicle power battery at the current moment is a second state, the remote upgrade action of the vehicle is maintained, wherein the first state includes at least one of the power battery being powered down and a fault state, and the second state is the high voltage being powered on.

[0054] It is understood that, in the embodiments of the present invention, when the high voltage state is in the first state, which includes at least one of power-off or fault, the vehicle can be immediately controlled to exit the remote upgrade action, preventing the system from continuing to operate without high voltage power supply or battery abnormality and excessively consuming the low voltage battery. This effectively avoids the risk of the vehicle being unable to start or key functions failing due to power depletion. When the high voltage state is in the second state, which is normal high voltage power-on, the remote upgrade action is maintained and continues to be executed, ensuring that the upgrade process is completed in a stable and reliable power supply environment. By clearly distinguishing between safe and unsafe power supply states and adopting differentiated response strategies, precise safety control of the remote upgrade process is achieved, significantly improving the reliability, safety, and user experience of the whole vehicle remote upgrade.

[0055] It should be noted that the current high-voltage status of the vehicle's power battery is collected in real time by the battery management system and transmitted after conversion via the gateway protocol. It is typically represented by a numerical value or status code, for example: 0x01 indicates that the high voltage is powered on and the system is normal; 0x00 indicates that the high voltage is powered off; and 0x02 indicates a fault in the high-voltage system. The vehicle communication terminal has a pre-installed upgrade control logic module. This module performs corresponding actions based on the received high-voltage status. For example, when a high-voltage status of 0x01 is received, the current power supply environment is deemed safe, allowing the upgrade process to continue, including downloading subsequent upgrade packages, verifying data integrity, or flashing firmware to the target electronic control unit. However, when 0x00 or 0x02 is received, the control module immediately triggers a safety protection mechanism, sending a stop signal to the remote upgrade management unit to stop all upgrade-related communication and write operations, and recording the current upgrade interruption point and the reason for the anomaly. Simultaneously, it can report a "upgrade exited due to high-voltage anomaly" status log to the user or the cloud.

[0056] In one embodiment of this application, if the high voltage state changes from normal to power-off during the upgrade, the vehicle communication terminal not only terminates the upgrade, but also links the power management module to maintain a minimum low voltage power supply to save the context, so as to avoid the ECU (Electronic Control Unit) being in a semi-flash state and causing functional failure. After the high voltage is detected to be re-energized, the upgrade can be resumed in combination with the breakpoint resume mechanism to further improve the fault tolerance capability.

[0057] According to the vehicle remote upgrade method of this application embodiment, during the vehicle remote upgrade process, the vehicle communication terminal actively sends a high-voltage status query command. The high-voltage status query command instructs the vehicle gateway controller to send a corresponding high-voltage diagnostic command to the battery management system to obtain the high-voltage status of the vehicle's power battery at the current moment. After receiving the high-voltage status information, the vehicle communication terminal dynamically determines whether to continue, pause, or terminate the remote upgrade action in conjunction with the safety strategy. If it detects that the high voltage has been de-energized or is in an abnormal state, the upgrade process is immediately stopped to avoid the upgrade process relying on the low-voltage battery for a long time. This effectively prevents the vehicle from failing to start or key functions from failing due to low-voltage battery depletion, ensuring that the vehicle has normal starting capability and significantly improving the safety and reliability of the remote upgrade process.

[0058] Figure 2 This is a flowchart of a vehicle remote upgrade method according to an embodiment of the present invention.

[0059] like Figure 2 As shown, the vehicle remote upgrade method according to an embodiment of the present invention is applied to an on-board gateway controller, wherein the method includes the following steps: Step S201: Send the corresponding high-voltage diagnostic command to the battery management system, and instruct the battery management system to obtain the high-voltage status of the vehicle's power battery at the current moment through the high-voltage diagnostic command.

[0060] It is understood that, in this embodiment of the invention, the vehicle gateway controller can send corresponding high-voltage diagnostic commands to the battery management system to trigger it to obtain the high-voltage status of the vehicle's power battery at the current moment. This achieves active detection of the underlying battery system status, enabling the upper-layer control logic, which is originally in a different communication domain or protocol system, to indirectly but accurately perceive the high-voltage power supply situation. Through standardized or pre-configured diagnostic commands, reliable interaction with the battery management system is ensured, laying the foundation for subsequent high-voltage status information feedback and safe decision-making for remote upgrades.

[0061] Step S202: Obtain the current high voltage status of the vehicle's power battery from the battery management system, send the current high voltage status of the vehicle's power battery to the vehicle communication terminal, and use the high voltage status to instruct the vehicle communication terminal to control the vehicle's remote upgrade action.

[0062] It is understood that in this embodiment of the invention, after the vehicle gateway controller obtains the current high-voltage status of the vehicle's power battery from the battery management system, it promptly sends the status information to the vehicle communication terminal. This enables the vehicle communication terminal to dynamically decide whether to execute or suspend the remote upgrade action based on the real-time high-voltage power supply situation. When the high-voltage status is normal, the upgrade process can continue, ensuring the task is completed smoothly. However, when the high voltage is in a power-off or fault state, an exit mechanism is triggered to prevent the system from continuously consuming low-voltage battery power in the absence of high-voltage support. At the same time, it realizes effective linkage between the battery management system and the remote upgrade control logic, significantly improving the safety, responsiveness, and system coordination capabilities of the vehicle's remote upgrade process.

[0063] In step S202, a corresponding high-voltage diagnostic command is sent to the battery management system, including: parsing the high-voltage status query command to determine the vehicle high-voltage status request of the vehicle communication terminal; querying the communication protocol mapping table according to the vehicle high-voltage status request, and sending the corresponding high-voltage diagnostic command.

[0064] It is understood that, in this embodiment of the invention, after receiving a high-voltage status query command, the vehicle gateway controller parses the command to accurately identify the vehicle high-voltage status request requested by the vehicle communication terminal. Based on the request, it queries a preset communication protocol mapping table, matches and sends a high-voltage diagnostic command compatible with the battery management system. Since the mapping table establishes the association between different high-voltage status requirements and corresponding diagnostic services, data identifiers, and communication parameters, the gateway can flexibly adapt to the protocol differences of various battery management systems or vehicle platforms. This not only ensures the correctness and executability of diagnostic commands but also improves the system's versatility and scalability in multi-protocol environments, providing solid technical support for the reliable acquisition of high-voltage status information and safe remote upgrade control.

[0065] It should be noted that the communication protocol mapping table is a pre-configured data structure or configuration file in the vehicle gateway controller (or similar middleware module) used to implement the conversion between different communication protocols, data formats, or functional requests. Its function is to bridge heterogeneous electronic control units, enabling higher-level application requests to be correctly translated into diagnostic or communication commands recognizable by the lower-level target devices. The communication protocol mapping table is a key-value pair or multi-field association table, which may include: the upper-level request type (such as querying high-voltage status), the corresponding lower-level communication protocol specification (such as UDS (Unified Diagnostic Services), DID, CAN ID (CAN identifier), baud rate, etc.), data encoding / decoding rules, target ECU address or network routing information, etc., without specific limitations.

[0066] Specifically, in one embodiment of this application, the vehicle communication terminal sends a high voltage status query command to the vehicle gateway controller during a remote upgrade. The command is transmitted in the form of a structured message, for example, containing the fields "request_type:high_voltage_status" and "target_ecu:battery management system".

[0067] Upon receiving the instruction, the vehicle gateway controller first parses it, identifying that the vehicle communication terminal's intent is to request the current high-voltage power supply status of the power battery. Subsequently, the gateway controller searches its internally stored communication protocol mapping table based on the request type. This mapping table pre-configures the correspondence between different requests and underlying diagnostic commands. For example: Request type: high_voltage_status, corresponding UDS service: 0x22 (Read Data by Identifier), corresponding DID (Data Identifier): 0xF201, target CAN ID: 0x7E4 (Battery Management System Diagnostic Address), response format: 1-byte status code (0x01 = High voltage power-on, 0x00 = Power-off, 0x02 = Fault). Based on the above mapping information, the gateway controller constructs a complete high-voltage diagnostic command message, for example, sending on the CAN bus: [0x7E4, 0x03, 0x22, 0xF2, 0x01] (a single-frame UDS request conforming to ISO 15765-2 standard). After receiving the diagnostic command, the battery management system reads the internal high-voltage relay status, pre-charge completion flag, and fault flag bit, comprehensively judges the current high-voltage status, and returns the result with a positive response, such as [0x7E4, 0x04, 0x62, 0xF2, 0x01, [0x01] indicates that the high voltage has been successfully powered on. After receiving the response, the vehicle gateway controller extracts the status value and encapsulates it into a high-level message, which is then sent back to the vehicle communication terminal for the terminal to decide whether to continue the remote upgrade.

[0068] After step S201, after obtaining the high voltage state of the vehicle's power battery at the current moment through the high voltage state indication battery management system, the method further includes: obtaining the second response duration of the battery management system; if the second response duration is greater than the second timeout threshold, sending an exit command; and sending the exit command to the vehicle communication terminal, wherein the exit command is used to instruct the vehicle communication terminal to control the vehicle to exit the remote upgrade action.

[0069] The second response duration can be obtained based on the actual timer, and the second timeout threshold can be 30s or 20s, which can be set according to actual needs without specific limitations.

[0070] It is understood that in this embodiment of the invention, the vehicle gateway controller monitors and obtains the second response time of the battery management system in real time. If the response time exceeds the preset second timeout threshold, it is determined that the battery management system has failed to return high-voltage status information within the specified time, which may pose risks such as communication failure, system crash, or high-voltage control abnormality. At this time, the vehicle gateway controller immediately sends an exit command to the vehicle communication terminal. After receiving the exit command, the vehicle communication terminal actively terminates the remote upgrade action to avoid continuing to execute the upgrade process when the high-voltage status is unknown or unreliable. This effectively prevents misjudgment or continuous discharge of the low-voltage battery due to failure to obtain the underlying status, and further enhances the safety, robustness, and fault tolerance of the remote upgrade process.

[0071] For example, after the vehicle gateway controller sends a high-voltage diagnostic command (such as a read DID 0xF201 request based on the UDS protocol) to the battery management system, it immediately starts a high-precision timer to record the time interval between the completion of the command sending and the receipt of a valid response from the battery management system, i.e., the second response duration.

[0072] If the timer exceeds the second timeout threshold (30s or 20s) and no valid response is received, it may be due to reasons such as the battery management system software freezing, abnormal high-voltage relay control, CAN bus communication interruption, or the battery management system being in a low-power sleep state. The vehicle gateway controller determines that this diagnostic interaction has failed and then sends an exit command, which is sent to the vehicle communication terminal via the vehicle Ethernet or high-speed CAN FD (Flexible Data Rate Controller Area Network) bus.

[0073] Upon receiving the exit command, the vehicle-mounted communication terminal immediately triggers the remote upgrade safe exit procedure: stopping the current firmware download or flashing operation, releasing occupied resources, saving the upgrade interruption context, and reporting a log to the cloud indicating that the upgrade was terminated due to BMS unresponsiveness. Simultaneously, the system can coordinate with the power management module to prevent entering deep sleep mode, ensuring the availability of basic vehicle functions. In another embodiment, if BMS response timeouts occur multiple times consecutively (e.g., twice), the system can also proactively wake up the BMS or attempt to switch to a backup communication channel. If these methods fail, a forced exit is initiated to prevent the upgrade process from entering an uncertain state.

[0074] According to the vehicle remote upgrade method of this application embodiment, a high-voltage diagnostic command is sent to the battery management system through the vehicle gateway controller, driving the battery management system to collect and return the high-voltage status of the vehicle's power battery at the current moment in real time. Then, the high-voltage status of the vehicle's power battery at the current moment is accurately transmitted to the vehicle communication terminal. The vehicle communication terminal dynamically decides whether to execute or suspend the remote upgrade action based on the high-voltage status, thereby ensuring that the upgrade is only carried out under safe and reliable high-voltage power supply conditions. This realizes efficient coordination and reliable transmission of high-voltage status information between the vehicle communication terminal, the vehicle gateway controller, and the battery management system. This eliminates the need for the vehicle communication terminal to directly handle the underlying diagnostic protocol and communication details, greatly simplifying its functional design and complexity. At the same time, the gateway controller, as a dedicated protocol conversion and routing hub, can optimize command scheduling and error handling, improving the stability and efficiency of the entire status query link. This effectively avoids the risk of battery depletion caused by the system switching to low-voltage power supply due to high-voltage power failure or abnormality, thus improving the safety and stability of the vehicle remote upgrade.

[0075] The following will combine Figure 3 and Figure 4 This application provides a detailed description of the vehicle remote upgrade method. The upgrade process includes the following: OTA Manager (Over-the-Air Manager), TBOX (Telematics BOX Controller), IBCM (Intelligent Body Control Module), GWM (Gateway Module or Gateway Manager), BMS (Battery Management System Controller), and various ECU nodes in the vehicle, as detailed below: like Figure 3 As shown, the overall OTA upgrade process is as follows: The remote upgrade manager first initiates a status query request for the target vehicle on the background server. When the vehicle's status meets the preset prerequisites for upgrade (such as normal network connection, sufficient battery power, and being in parked state), the remote upgrade manager sends an instruction to the vehicle to enter OTA mode.

[0076] After receiving the OTA mode instruction, the vehicle communication terminal controller performs two key operations simultaneously: (1) initiating a security verification request to the intelligent body control module controller; (2) sending a high-voltage power-on request to the battery management system controller to ensure that the subsequent upgrade process has a stable high-voltage power supply capability.

[0077] After receiving the safety verification from the TBOX controller, the IBCM controller performs an OTA vehicle condition check, which includes checking the vehicle's power status, gear position, speed, and other vehicle conditions. Once the IBCM controller completes its check, it sends a vehicle OTA mode broadcast request to the GWM controller. The GWM controller then checks the vehicle's safety conditions again. After completing the vehicle safety condition check, the GWM controller immediately broadcasts the OTA mode to the entire vehicle, notifying all relevant ECUs. It has entered a rewritable state.

[0078] It is worth noting that before receiving the OTA mode broadcast by the GWM controller, the BMS controller has already completed the feedback to the TBOX controller requesting high voltage. After receiving the feedback from the BMS controller, the TBOX controller returns the vehicle's high voltage status to the remote upgrade manager. The remote upgrade manager, upon successfully receiving the vehicle's high voltage status request, continues the OTA task; if the received vehicle high voltage status request fails, it issues a request to exit OTA mode. The entire vehicle OTA mode broadcast process is completed within a few seconds.

[0079] Once OTA mode is successfully entered, the remote upgrade manager notifies the TBOX controller to install and upgrade the target ECU. Upon receiving the request, the TBOX controller sends the upgrade command and the target ECU's installation file package to the GWM controller. The GWM controller, acting as a refresher, sends UDS commands to install the ECU and interacts with it. After the refresh is complete, the TBOX controller sends the installation and upgrade result back to the TBOX controller and simultaneously resets the target ECU. The TBOX controller receives the successful ECU installation status feedback from the GWM controller and sends the result back to the remote upgrade manager, completing the OTA upgrade process. The ECU installation process depends on the size of the installation file package and the number of ECUs being installed, taking anywhere from a few minutes to several hours. During installation, the low-voltage battery is continuously drained; if the high-voltage battery is not replenished in time, the vehicle will run out of power and be unable to start.

[0080] To address the aforementioned risks, this application incorporates a dynamic high-voltage status monitoring mechanism into the standard OTA process, such as... Figure 4 As shown, the specific implementation is as follows: Throughout the OTA upgrade process, the TBOX controller periodically sends a high-voltage status callback command to the GWM controller via the vehicle Ethernet service interface. Upon receiving the command, the GWM controller identifies it as a high-voltage status query request and converts it into a diagnostic command conforming to the BMS communication protocol, such as a read data identifier command based on the UDS protocol (e.g., DID=0xF201).

[0081] The diagnostic command is sent to the BMS controller via the power domain CAN bus. The BMS controller collects the status of the high-voltage relay, bus voltage, insulation resistance, and internal fault flags in real time, comprehensively judges whether the current high-voltage system is in a normal power-on state, and returns the status code (such as 0x01 = high voltage power-on, 0x00 = power-off, 0x02 = fault) to the GWM controller through a positive diagnostic response.

[0082] After receiving the response, the GWM controller transmits the high-voltage status information back to the TBOX controller via the Ethernet service interface. The TBOX controller parses the return value and continuously assesses power supply safety accordingly. Throughout the OTA process, the high-voltage callback command is read cyclically. The cycle is flexible; it can be read periodically or as needed based on bus load and OTA task availability. When the high-voltage status changes abnormally, the TBOX can send an exit command for the OTA task to prevent high-voltage anomalies during OTA from causing vehicle battery drain and rendering the vehicle unusable.

[0083] The high-voltage status query can employ a flexible cyclical strategy: it can poll at a fixed period (e.g., every 30 seconds) or dynamically adjust the query frequency based on the current bus load, OTA task busyness, or system power consumption. Once the high-voltage status is detected to change from a normal power-on state to a power-off state or a fault state, the TBOX controller immediately reports the anomaly to the remote upgrade manager and proactively sends an OTA task exit command, forcibly terminating the upgrade process. This avoids battery depletion due to prolonged reliance on low-voltage power supply after high-voltage loss, ensuring that the user's vehicle can still start and be used normally after the upgrade is interrupted.

[0084] In summary, this application introduces a dynamic, closed-loop high-voltage status monitoring mechanism during remote vehicle upgrades. The onboard communication terminal periodically initiates high-voltage status queries, which, after protocol conversion by the gateway controller, obtain the real-time high-voltage power supply status of the power battery from the battery management system. Based on this status, the system intelligently controls the continuation or termination of the OTA process. This effectively solves the problem of traditional solutions relying solely on static pre-upgrade judgments, leading to a failure to respond promptly to abnormal high-voltage power outages during upgrades. This mechanism can proactively terminate the upgrade when risks such as high-voltage power outages, faults, or response timeouts occur, preventing the system from relying on low-voltage battery power for extended periods. This prevents vehicle failure to start or critical function malfunctions due to battery depletion, significantly improving the safety, reliability, and environmental adaptability of the remote upgrade process.

[0085] Figure 5 This is a block diagram of a vehicle remote upgrade system according to an embodiment of the present invention.

[0086] like Figure 5 As shown, the vehicle remote upgrade system 10 according to an embodiment of the present invention includes: an in-vehicle communication terminal 100, a gateway controller 200, and a battery management system 300.

[0087] The vehicle communication terminal 100 is used to send a high-voltage status query command of the vehicle to the vehicle gateway controller during the remote vehicle upgrade process, receive the high-voltage status of the vehicle's power battery at the current moment from the vehicle gateway controller, and control the remote upgrade action of the vehicle based on the high-voltage status of the vehicle's power battery at the current moment; the gateway controller 200 is used to receive the high-voltage status query command of the vehicle sent by the vehicle communication terminal, generate a high-voltage diagnostic command to be sent to the battery management system based on the high-voltage status query command, send the high-voltage diagnostic command to the battery management system, and receive the high-voltage status of the vehicle's power battery at the current moment from the battery management system; the battery management system 300 is used to receive the high-voltage diagnostic command, obtain the high-voltage status of the vehicle's power battery at the current moment, and send the high-voltage status of the vehicle's power battery at the current moment to the vehicle gateway controller.

[0088] According to the vehicle remote upgrade system of this application embodiment, the vehicle communication terminal, vehicle gateway controller, and battery management system work together. During the vehicle remote upgrade process, the vehicle communication terminal actively sends a high-voltage status query command to the vehicle gateway controller. Based on this, the gateway controller constructs a high-voltage diagnostic command that conforms to the communication protocol of the battery management system and issues it. The battery management system collects the high-voltage relay status, bus voltage, and system operating mode of the power battery in real time, sends the current high-voltage status, and returns it to the gateway controller. The gateway controller then transmits the status information to the vehicle communication terminal. Based on this real-time and accurate high-voltage status, the vehicle communication terminal dynamically decides whether to continue or exit the upgrade action. When the high voltage is normal, the upgrade is guaranteed to proceed smoothly. When the high voltage is de-energized or malfunctions, the process is terminated in time, effectively avoiding the risk of power loss caused by relying on low-voltage batteries for long-term power supply. The collaborative architecture realizes cross-domain and cross-protocol safety status closed-loop management, significantly improving the reliability, safety, and collaborative efficiency of the vehicle electronic system during the remote upgrade process.

[0089] This application also provides a vehicle, including a vehicle remote upgrade system.

[0090] In this application, "multiple" refers to two or more.

[0091] In this application, unless otherwise expressly defined, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0092] The terms “first,” “second,” “third,” “fourth,” etc., in this application (if present) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0093] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, in this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0094] Unless otherwise specified, all steps in this application may be performed sequentially or randomly. For example, if a method includes steps A and B, it means that the method may include steps A and B performed sequentially, or it may include steps B and A performed sequentially. For example, if the method may also include step C, it means that step C may be added to the method in any order. For example, the method may include steps A, B, and C, or it may include steps A, C, and B, or it may include steps C, A, and B, etc.

[0095] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for remotely upgrading a vehicle, characterized in that, The method is applied to an in-vehicle communication terminal, and the method includes the following steps: During the remote vehicle upgrade process, a high-voltage status query command for the vehicle is sent to the vehicle gateway controller. The high-voltage status query command instructs the vehicle gateway controller to send a corresponding high-voltage diagnostic command to the battery management system in order to obtain the high-voltage status of the vehicle's power battery at the current moment from the battery management system. Receive the high voltage status of the vehicle's power battery at the current moment from the vehicle gateway controller; The remote upgrade operation of the vehicle is controlled based on the current high voltage state of the vehicle's power battery.

2. The vehicle remote upgrade method according to claim 1, characterized in that, During the remote vehicle upgrade process, sending a high-voltage status query command for the vehicle to the on-board gateway controller includes: Identify the number of times the high-voltage status query command has been sent; The sending action of the high-voltage status query command is triggered based on the number of times the command is sent.

3. The vehicle remote upgrade method according to claim 2, characterized in that, The action of triggering the sending of the high-voltage status query command according to the number of times it is sent includes: If the number of transmissions is less than or equal to the first target number of transmissions, then the first interval between the current time and the start time of the remote upgrade action is calculated. If the first interval reaches the first target duration, then the transmission action of the high-pressure status query instruction is triggered. If the number of transmissions is greater than the first target number, then the second interval between the current time and the last transmission time of the high-voltage status query instruction is calculated. If the second interval reaches the second target duration, then the transmission action of the high-voltage status query instruction is triggered.

4. The vehicle remote upgrade method according to claim 1, characterized in that, The step of controlling the remote upgrade action of the vehicle based on the current high voltage state of the vehicle's power battery includes: If the vehicle's power battery is in the first high-voltage state at the current moment, then control the vehicle to perform the action of exiting the remote upgrade. If the vehicle's power battery is in the second high-voltage state at the current moment, then the remote upgrade operation of the vehicle is maintained. The first state includes at least one of the vehicle's power battery being powered down or in a fault state, and the second state is the high-voltage power-on state.

5. The vehicle remote upgrade method according to claim 4, characterized in that, After sending the high-voltage status query command of the vehicle to the vehicle gateway controller, the method further includes: Obtain the first response duration of the vehicle gateway controller; If the duration of the first response exceeds the first timeout threshold, then the vehicle is controlled to exit the remote upgrade action.

6. A method for remotely upgrading a vehicle, characterized in that, The method is applied to an in-vehicle gateway controller, and the method includes the following steps: Send a corresponding high-voltage diagnostic command to the battery management system, and instruct the battery management system to obtain the high-voltage status of the vehicle's power battery at the current moment through the high-voltage diagnostic command; The system obtains the current high-voltage status of the vehicle's power battery from the battery management system, sends the current high-voltage status of the vehicle's power battery to the vehicle communication terminal, and uses the high-voltage status to instruct the vehicle communication terminal to control the remote upgrade action of the vehicle.

7. The vehicle remote upgrade method according to claim 6, characterized in that, Sending the corresponding high-voltage diagnostic command to the battery management system includes: Parse the high-voltage status query command to determine the vehicle high-voltage status request from the vehicle communication terminal; Based on the vehicle's high-voltage status request, the communication protocol mapping table is queried, and the corresponding high-voltage diagnostic command is sent.

8. The vehicle remote upgrade method according to claim 6, characterized in that, After instructing the battery management system to obtain the current high-voltage state of the vehicle's power battery via the high-voltage state indication, the method further includes: Obtain the second response time of the battery management system; If the duration of the second response exceeds the second timeout threshold, an exit command is sent; The exit command is sent to the vehicle communication terminal, wherein the exit command is used to instruct the vehicle communication terminal to control the vehicle to exit the remote upgrade action.

9. A vehicle remote upgrade system, characterized in that, This includes an in-vehicle communication terminal, a gateway controller, and a battery management system, among which... The vehicle-mounted communication terminal is used to send a high-voltage status query command of the vehicle to the vehicle-mounted gateway controller during the remote vehicle upgrade process, receive the high-voltage status of the vehicle's power battery at the current moment from the vehicle-mounted gateway controller, and control the remote upgrade action of the vehicle based on the high-voltage status of the vehicle's power battery at the current moment. The vehicle gateway controller is used to receive the vehicle's high voltage status query command sent by the vehicle communication terminal, generate a high voltage diagnostic command to be sent to the battery management system according to the high voltage status query command, send the high voltage diagnostic command to the battery management system, and receive the high voltage status of the vehicle's power battery at the current moment from the battery management system. The battery management system is used to receive the high-voltage diagnostic command, obtain the high-voltage status of the vehicle's power battery at the current moment, and send the high-voltage status of the vehicle's power battery at the current moment to the vehicle gateway controller.

10. A vehicle, characterized in that, It includes the vehicle remote upgrade system as described in claim 9 above.

Images