New energy bus remote OTA upgrading control method and system, storage medium and terminal

Abstract

The application discloses a new energy bus remote OTA upgrading control method and system, a storage medium and a terminal, relates to the vehicle software operation and maintenance technical field, and mainly aims to solve the problem that the existing OTA upgrading is prone to system risks. Mainly includes responding to the OTA upgrading instruction issued by the OTA cloud platform, performing vehicle safety state evaluation; in the case that the vehicle safety state evaluation is passed, verifying and decrypting the encrypted upgrading package carried by the software upgrading instruction, and generating an OTA mode message after the upgrading package verification is passed; the OTA mode message is respectively issued to the vehicle body control system and the vehicle control system to trigger the vehicle body control system and the vehicle control system to respectively perform OTA mode safety condition checking; after receiving the positive safety checking result of the vehicle body control system and the vehicle control system, the vehicle is controlled to enter the OTA mode, and is upgraded according to the upgrading package. It is mainly used for remote OTA upgrading of new energy buses.

Description

Technical Field

[0001] This invention relates to the field of vehicle software operation and maintenance technology, and in particular to a remote OTA upgrade control method and system for new energy buses, as well as a storage medium and terminal. Background Technology

[0002] With the rapid development of automotive intelligence and connectivity technologies, in-vehicle software has become a core element defining vehicle functions and performance. To continuously optimize user experience, fix potential defects, and unlock hardware potential, the industry widely adopts over-the-air (OTA) updates for vehicle software. Through OTA upgrades, manufacturers can efficiently and conveniently update various software applications for user vehicles, including infotainment systems, driver assistance algorithms, and battery management strategies, thereby significantly improving the value and service level throughout the vehicle's lifecycle.

[0003] However, existing remote software upgrade technologies only consider the software upgrade requirements during implementation, ignoring the vehicle's own condition. Initiating the upgrade under unsuitable operating conditions or environments may trigger system risks such as those related to the battery and thermal management. Furthermore, the upgrade process relies entirely on the upgrade system's self-control, lacking systematic safety access adjudication, which may also lead to upgrade interruptions or vehicle malfunctions, thereby causing system risks. Summary of the Invention

[0004] In view of this, the present invention provides a remote OTA upgrade control method and system for new energy buses, a storage medium, and a terminal, the main purpose of which is to solve the problem of system risks that are prone to occur in existing OTA upgrades.

[0005] According to one aspect of the present invention, a method for remote OTA upgrade control of a new energy bus is provided, comprising: In response to OTA upgrade commands issued by the OTA cloud platform, conduct vehicle safety status assessment; If the vehicle safety status assessment is passed, the encrypted upgrade package carried by the software upgrade instruction is verified and decrypted, and an OTA mode message is generated after the upgrade package is verified. The OTA mode message is sent to the body control system and the vehicle control system respectively, so as to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively; After receiving the positive safety verification results from the body control system and the vehicle control system, the vehicle is controlled to enter OTA mode and upgrade according to the upgrade package.

[0006] Furthermore, the process of assessing the vehicle's safety status includes: The vehicle upgrade temperature prediction is performed to obtain the predicted temperature rise and the extreme temperature values ​​during the upgrade process; Under the condition that the extreme temperature values ​​during the upgrade process meet the temperature safety range, multi-dimensional vehicle safety status data is obtained. The multi-dimensional vehicle safety status data includes the insulation resistance of the high voltage positive and negative electrodes to the vehicle body, battery health status parameters, battery state of charge parameters, vehicle parking posture, and vehicle surrounding environment risk parameters. Based on the multidimensional vehicle safety status data and the predicted temperature rise, the vehicle safety status parameters are predicted by a pre-trained vehicle safety status prediction model. If the vehicle safety status parameter is greater than or equal to the preset safety parameter threshold, the vehicle safety status assessment is determined to be passed; if the vehicle safety status parameter is less than the preset safety parameter threshold, the vehicle safety status assessment is determined to be failed.

[0007] Furthermore, the vehicle's temperature is upgraded to predict the predicted temperature rise and the extreme temperatures during the upgrade process, including: Based on real-time battery temperature, ambient temperature, battery power, and upgrade package size, predict the battery temperature change curve during the upgrade process, and extract the predicted temperature rise and temperature extreme values ​​during the upgrade process. The method further includes: when the extreme temperature value during the upgrade process does not meet the temperature safety range, controlling the thermal management system to adjust the battery temperature, and predicting the battery temperature change curve based on the adjusted real-time battery temperature, until the extreme temperature value during the upgrade process meets the temperature safety range.

[0008] Furthermore, the safety condition verification process of the vehicle body control system includes: Perform a safe operation to lock the electric vehicle and check the locking status; If the vehicle is locked, the first OTA mode security process is performed, which includes: human-machine interaction channel takeover and network security protection. After completing the OTA mode security processing, a positive security verification result is generated and fed back. In the event of an abnormal security handling situation in OTA mode, a feedback prompt indicating the abnormal security handling situation will be generated.

[0009] Furthermore, the safety condition verification process of the vehicle control system includes: The high-voltage accessories are flexibly powered down, and the high-voltage power is cut off after all the high-voltage accessories have entered standby mode; After the high-voltage power is cut off, a second OTA mode safety process is performed, which includes monitoring and freezing the status of key sensors and locking the drive system. After completing the OTA mode security processing, a positive security verification result is generated and fed back. In the event of an abnormal security handling situation in OTA mode, a security handling abnormality prompt will be generated and reported.

[0010] Furthermore, the verification and decryption of the encrypted upgrade package carried by the software upgrade instruction includes: Verify the digital signature carried in the encrypted upgrade package based on the root certificate or public key of the corresponding OTA cloud platform configured on the vehicle. After the digital signature verification is successful, the hash value of the received package data is calculated, and the hash value is compared with the original value hash value carried by the encrypted upgrade package to verify the integrity of the upgrade package; After the integrity verification of the upgrade package is passed, the encrypted upgrade package is decrypted according to the key preset on the vehicle to obtain the decrypted upgrade package.

[0011] Furthermore, before verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction, the method further includes: If the vehicle safety status assessment is passed, system upgrade confirmation information will be output through the information interaction system. After receiving positive feedback from the system upgrade confirmation information, the operation of verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction is performed.

[0012] According to another aspect of the present invention, a remote OTA upgrade control system for new energy buses is provided, comprising: The status assessment module is used to assess the vehicle's safety status in response to OTA upgrade commands issued by the OTA cloud platform. The upgrade package verification module is used to verify and decrypt the encrypted upgrade package carried by the software upgrade instruction when the vehicle safety status assessment is passed, and to generate an OTA mode message after the upgrade package is verified. The sending module is used to send the OTA mode message to the body control system and the vehicle control system respectively, so as to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively; The upgrade control module is used to control the vehicle to enter OTA mode and perform upgrades according to the upgrade package after receiving the positive safety verification results from the body control system and the vehicle control system.

[0013] Furthermore, the state assessment module includes: The temperature prediction unit is used to predict the temperature of the vehicle during the upgrade process, and obtain the predicted temperature rise and the extreme temperature values ​​during the upgrade process. The acquisition unit is used to acquire multi-dimensional vehicle safety status data when the extreme temperature values ​​during the upgrade process meet the temperature safety range. The multi-dimensional vehicle safety status data includes the insulation resistance of the high voltage positive and negative electrodes to the vehicle body, battery health status parameters, battery state of charge parameters, vehicle parking posture, and vehicle surrounding environment risk parameters. The prediction unit is used to predict vehicle safety status parameters based on the multidimensional vehicle safety status data and the predicted temperature rise using a pre-trained vehicle safety status prediction model. The determining unit is configured to determine that the vehicle safety status assessment is passed when the vehicle safety status parameter is greater than or equal to a preset safety parameter threshold, and to determine that the vehicle safety status assessment is failed when the vehicle safety status parameter is less than the preset safety parameter threshold.

[0014] Furthermore, in specific application scenarios, the temperature prediction unit is specifically used to predict the battery temperature change curve during the upgrade process based on the real-time battery temperature, ambient temperature, battery power, and upgrade package size, and to extract the predicted temperature rise and the extreme temperature values ​​during the upgrade process. The method further includes: when the extreme temperature value during the upgrade process does not meet the temperature safety range, controlling the thermal management system to adjust the battery temperature, and predicting the battery temperature change curve based on the adjusted real-time battery temperature, until the extreme temperature value during the upgrade process meets the temperature safety range.

[0015] Furthermore, the upgrade package verification module includes: The digital signature verification unit is used to verify the digital signature carried in the encrypted upgrade package based on the root certificate or public key of the corresponding OTA cloud platform configured on the vehicle. The integrity verification unit is used to calculate the hash value of the received software package data after the digital signature verification is passed, and compare the hash value with the original value hash value carried by the encrypted upgrade package to verify the integrity of the upgrade package. The decryption unit is used to decrypt the encrypted upgrade package according to the key preset on the vehicle end after the integrity verification of the upgrade package is passed, so as to obtain the decrypted upgrade package.

[0016] Furthermore, the system also includes: The confirmation message sending module is used to output system upgrade confirmation information through the information interaction system when the vehicle safety status assessment is passed; The confirmation information receiving module is used to perform the operation of verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction after receiving positive feedback of the system upgrade confirmation information.

[0017] According to another aspect of the present invention, a storage medium is provided, wherein at least one executable instruction is stored therein, the executable instruction causing a processor to perform an operation corresponding to the above-described remote OTA upgrade control method for new energy buses.

[0018] According to another aspect of the present invention, a terminal is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the above-described remote OTA upgrade control method for new energy buses.

[0019] By employing the above-described technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages: This invention provides a remote OTA upgrade control method and system for new energy buses, a storage medium, and a terminal. In this embodiment, the vehicle safety status is assessed in response to OTA upgrade commands issued by the OTA cloud platform. If the vehicle safety status assessment passes, the encrypted upgrade package carried by the software upgrade command is verified and decrypted. After the upgrade package verification is successful, an OTA mode message is generated. The OTA mode message is sent to both the body control system and the vehicle control system to trigger OTA mode safety condition verification in each system. Upon receiving the positive safety verification results from both systems, the vehicle is controlled to enter OTA mode and upgrade according to the upgrade package. This significantly reduces the risk of failure and system malfunction caused by blindly initiating upgrades due to vehicle conditions not meeting safety requirements. Furthermore, the dual independent safety verification by the body and vehicle control systems ensures that the vehicle's power system, high-voltage environment, and physical condition meet upgrade safety requirements before entering upgrade mode, thereby greatly improving the reliability, security, and success rate of the remote OTA upgrade process.

[0020] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. Furthermore, in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0021] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This invention provides a flowchart of a remote OTA upgrade control method for new energy buses. Figure 2 This diagram illustrates the communication relationships between various platform systems in a vehicle overall architecture provided by an embodiment of the present invention. Figure 3 This invention provides a flowchart of another remote OTA upgrade control method for new energy buses. Figure 4 This diagram illustrates a vehicle software upgrade and mode switching process according to an embodiment of the present invention. Figure 5 This invention provides a block diagram of a remote OTA upgrade control system for new energy buses. Figure 6 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention is shown. Detailed Implementation

[0022] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0023] To address the issue of system risks inherent in existing OTA (Over-The-Air) upgrades, this invention provides a remote OTA upgrade control method for new energy buses, such as... Figure 1 As shown, the method includes: 101. Respond to OTA upgrade commands issued by the OTA cloud platform and conduct vehicle safety status assessment.

[0024] In this embodiment of the invention, the executing entity is the vehicle software upgrade system, specifically the remote OTA upgrade control system for new energy buses. The vehicle upgrade process is initiated by an OTA cloud platform that communicates with the software upgrade system. The OTA cloud platform is a software service platform running on an internet server, serving as the cloud management and distribution center for over-the-air downloads of vehicle upgrade packages. The OTA cloud platform is used to manage vehicle factory serial numbers, vehicle identification numbers, software packages, and software versions. When a software version needs to be updated, it issues an OTA upgrade command to the target vehicle's software upgrade system, distributing different versions of software upgrade packages to different vehicle models. To ensure the safety of vehicle upgrades and reduce upgrade risks, the target vehicle's software upgrade system does not immediately execute the upgrade upon receiving the OTA upgrade command. Instead, it performs a vehicle safety status assessment. The assessment dimensions may include energy status, vehicle attitude, environmental conditions, and surrounding safety.

[0025] 102. If the vehicle safety status assessment is passed, verify and decrypt the encrypted upgrade package carried by the software upgrade instruction, and generate an OTA mode message after the upgrade package is verified.

[0026] In this embodiment, a successful vehicle safety status assessment means that the target vehicle has completed the basic physical environment security check and can proceed with subsequent operations. The software package distributed by the OTA cloud platform is encrypted and transmitted to the vehicle's software upgrade system via a secure transmission channel. Therefore, after the vehicle safety status assessment is passed, the software package needs to be verified and decrypted to ensure the security of the software upgrade from the perspectives of the package's accuracy and integrity. An OTA mode message is generated only if the software package is confirmed to be accurate and complete. The OTA mode message may include instruction type, task code, target system, security token, etc.

[0027] It should be noted that after the software package is verified, sending OTA mode messages to the vehicle control system and body control system can tightly couple software package data security and system control security, further ensuring the security of vehicle upgrades.

[0028] 103. The OTA mode message is sent to the body control system and the vehicle control system respectively to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively.

[0029] In this embodiment of the invention, after verifying the software package, to further ensure the security of the software upgrade, an OTA (Over-The-Air) message is sent to coordinate the body control system and the vehicle control system for security condition verification. The vehicle control system, as the highest-level control unit of the vehicle, is primarily responsible for the vehicle's core power and driving status, such as vehicle speed, gear position, and high-voltage system control. The body control system is primarily responsible for body accessories and comfort functions, such as door locks, windows, and sunroof control. The vehicle control system verifies the vehicle's driving and power safety, for example: whether the vehicle speed is 0, whether the gear is in P (Park) or N (Neutral), whether the drive motor is stopped, whether the high-voltage main circuit has been safely disconnected, and whether the 12V low-voltage battery voltage is sufficient. The body control system verifies the safety of personnel and the environment, for example: whether all doors are locked, whether windows and sunroof are fully closed, whether the trunk is closed, and whether the vehicle is armed.

[0030] In a specific application example, a diagram illustrating the communication relationships between various platform systems within the overall vehicle architecture is shown below. Figure 2 As shown in the diagram, a certificate and password management system provides the foundation for security authentication. Below it, the OTA cloud platform connects to the in-vehicle software upgrade system via a secure link for remote management and distribution of software updates. Below the in-vehicle software upgrade system is a central gateway, serving as the core communication hub. This gateway not only interacts with the in-vehicle software upgrade system but also communicates with multiple electronic control units (ECUs 1 to n) below it, and connects to the information interaction system, body control system, and vehicle control system on the right. The information interaction system handles internal and external information exchange within the vehicle, the body control system manages vehicle functions, and the vehicle control system comprehensively manages all vehicle systems. The arrows in the diagram clearly illustrate the information flow and connections between these systems.

[0031] It should be noted that sending OTA mode messages to both the vehicle control system and the body control system simultaneously creates dual redundancy in both hardware and logic. Even if a sensor in one system fails or its judgment logic is flawed, the other system can still serve as a safety backup, preventing the system from entering upgrade mode under unsafe conditions and greatly reducing the risk of single point of failure.

[0032] 104. After receiving the positive safety verification results from the body control system and the vehicle control system, control the vehicle to enter OTA mode and perform an upgrade according to the upgrade package.

[0033] In this embodiment of the invention, after completing all preliminary safety checks, the system performs a mode switch, putting the vehicle into a protected software maintenance state, i.e., OTA mode. OTA (Over-the-Air) mode is a vehicle-wide, protected special operating condition. In this mode, conventional driving functions and some comfort functions are disabled (the vehicle cannot be driven, and the air conditioning may only maintain basic ventilation). The in-vehicle network enters a non-diagnostic or programming session mode, prioritizing the bandwidth and stability of upgrade communication. The vehicle power mode is locked to prevent unexpected power outages. The in-vehicle software upgrade system coordinates the above state switch and broadcasts a global signal indicating that OTA mode is activated to relevant systems. In this state, the system or software requiring upgrade is upgraded according to the software upgrade package.

[0034] If the safety verification result of the body control system or the vehicle control system is not positive, that is, when the body control system or the vehicle control system is abnormal, the abnormal system will report the abnormal fault and specific fault code to the software upgrade system. The software upgrade system will then display this information to the maintenance personnel or vehicle driver through the information interaction system for manual intervention to handle the abnormality.

[0035] In one embodiment of the present invention, for further illustration and limitation, such as Figure 3 As shown, the process of assessing the vehicle's safety status in the steps described includes: 201. Perform temperature prediction for vehicle upgrades to obtain predicted temperature rise and extreme temperature values ​​during the upgrade process.

[0036] 202. Under the condition that the extreme temperature values ​​during the upgrade process meet the temperature safety range, obtain multi-dimensional vehicle safety status data.

[0037] 203. Based on the multidimensional vehicle safety status data and the predicted temperature rise, the vehicle safety status parameters are predicted by a pre-trained vehicle safety status prediction model.

[0038] 204. If the vehicle safety status parameter is greater than or equal to the preset safety parameter threshold, the vehicle safety status assessment is determined to be passed; if the vehicle safety status parameter is less than the preset safety parameter threshold, the vehicle safety status assessment is determined to be failed.

[0039] In this embodiment of the invention, during the vehicle safety status assessment, the system first performs a thermodynamic prediction of the upgrade process. It simulates and calculates the battery temperature change trend throughout the upgrade process, obtaining a predicted temperature rise characterizing the overall temperature increment from the start to the end of the upgrade, and extreme temperature values ​​characterizing the highest and lowest temperature points that may be reached during the upgrade. If these extreme temperature values ​​meet a preset temperature safety range (e.g., the highest temperature point is less than a preset temperature safety threshold), subsequent vehicle safety status prediction is performed. The lowest temperature point generally occurs at the start of the upgrade and is essentially equal to the real-time battery temperature. Alternatively, the real-time battery temperature can be compared with the lower limit of the temperature safety range first. If the real-time battery temperature is greater than the lower limit, then the upgrade temperature prediction is performed; if it is less than the lower limit, preheating is initiated directly. The upper limit of the temperature safety range is typically set below the safety margin of the battery's thermal runaway threshold, while the lower limit is set as a suitable temperature to ensure the battery's chemical activity and discharge capacity. This lower limit can be determined based on the material temperature resistance rating of various vehicle components, the semiconductor junction temperature, and the battery's thermal safety management threshold.

[0040] If the minimum temperature during the upgrade process is lower than the lower limit of the safe temperature range, or the maximum temperature during the upgrade process is higher than the upper limit of the safe temperature range, multi-dimensional vehicle safety status data will be further acquired for subsequent safety status assessment. This multi-dimensional vehicle safety status data includes the insulation resistance of the high-voltage positive and negative electrodes to the vehicle body, battery health status parameters, battery state of charge parameters, vehicle parking posture, and environmental risk parameters. The insulation resistance of the high-voltage positive and negative electrodes to the vehicle body is used to monitor for potential leakage in the high-voltage system; battery health status parameters reflect the long-term aging of the battery; battery state of charge parameters reflect the current remaining charge; vehicle parking posture is acquired through onboard inertial sensors, such as longitudinal and lateral tilt angles, to determine whether the vehicle is in a stable state. Environmental risk parameters are obtained through the fusion analysis of perception data from surround-view cameras, ultrasonic radar, etc., and are used to identify whether the vehicle is in a safe area such as a garage or private parking space, or in a high-risk location such as a highway or slope.

[0041] After obtaining multi-dimensional vehicle safety status data, this data, along with the predicted temperature rise, is input into a pre-trained vehicle safety status prediction model. The model learns the non-linear mapping relationship between complex state combinations and the upgraded safety outcome, outputting a quantified vehicle safety status parameter. This parameter is a comprehensive score; a higher value indicates a higher confidence level that the overall vehicle status supports a safety upgrade under the current predicted temperature rise conditions. If the vehicle safety status parameter is greater than or equal to the preset safety parameter threshold, the system determines that the vehicle safety status assessment has passed, allowing subsequent software package verification, user confirmation, and upgrade execution. If the vehicle safety status parameter is less than the preset safety parameter threshold, the system determines that the vehicle safety status assessment has failed and immediately terminates the current upgrade process. Simultaneously, based on specific parameter deficiencies, such as excessively low insulation resistance or excessively high environmental risk, the system can provide feedback to the user or the backend server regarding the specific reasons for the obstacle. The vehicle safety status prediction model can be built based on a gradient boosting decision tree or neural network, trained using a large amount of historical upgrade data and corresponding results. The preset safety parameter threshold can be customized based on the verification results in actual scenarios.

[0042] It should be noted that by introducing predictive temperature rise analysis, post-event temperature monitoring is transformed into pre-event risk prevention, effectively avoiding thermal runaway problems induced by the upgrade process itself. Simultaneously, by constructing an evaluation model that integrates multi-dimensional real-time data and predictive parameters, a leap from single-threshold judgment to comprehensive global scoring is achieved, improving the accuracy of safety status assessment.

[0043] In one embodiment of the present invention, for further explanation and limitation, the vehicle is upgraded with temperature prediction to obtain the predicted temperature rise and the extreme temperature values ​​during the upgrade process, including: Based on real-time battery temperature, ambient temperature, battery power, and upgrade package size, predict the battery temperature change curve during the upgrade process, and extract the predicted temperature rise and temperature extreme values ​​during the upgrade process. The method further includes: when the extreme temperature value during the upgrade process does not meet the temperature safety range, controlling the thermal management system to adjust the battery temperature, and predicting the battery temperature change curve based on the adjusted real-time battery temperature, until the extreme temperature value during the upgrade process meets the temperature safety range.

[0044] In this embodiment of the invention, based on real-time battery temperature, ambient temperature, battery power, and upgrade package size, a battery temperature change curve from the start to the end of the upgrade is simulated and calculated using thermodynamic equations or a data-driven model. This allows for the extraction of predicted temperature rise and extreme temperatures during the upgrade process. Ambient temperature refers to the external temperature of the vehicle, which, along with the real-time battery temperature, can be measured by temperature sensors at corresponding locations. Battery power is the estimated average power supplied by the battery system to the vehicle's low-voltage network and various controllers during the upgrade process, based on historical data. The upgrade package size characterizes the total data volume of the upgrade package and is directly related to the estimated total write time, i.e., the duration for which the battery needs to continuously supply power. The above data comprehensively considers the battery's own charging and discharging thermal characteristics, environmental heat exchange, and the continuous load during the upgrade process.

[0045] If the extreme temperature during the upgrade process does not meet the safe temperature range, the system determines that the current thermal conditions are unsafe. In this case, the system will not directly reject the upgrade, but will instead initiate a closed-loop thermal management intervention process. The system sends instructions to the vehicle's thermal management system, requesting it to preheat or cool the battery. If the predicted temperature is too high, the battery cooling cycle is activated to lower the battery temperature. If the temperature is too low, for example, if the vehicle is in a cold environment, the battery heating system is activated to raise the battery temperature. By predicting temperature changes through a refined model, potential thermal risks are identified in advance, and these risks are proactively eliminated before the upgrade begins, enhancing system safety.

[0046] In one embodiment of the present invention, for further explanation and limitation, the safety condition verification process of the vehicle body control system includes: Perform a safe operation to lock the electric vehicle and check the locking status; If the vehicle is locked, perform the first OTA mode security procedure. After completing the OTA mode security processing, a positive security verification result is generated and fed back. In the event of an abnormal security handling situation in OTA mode, a feedback prompt indicating the abnormal security handling situation will be generated.

[0047] In this embodiment of the invention, the vehicle body control system first performs a safe power-lock operation, that is, sends a forced locking command to all door locks, trunk locks, and charging port cover locks, and simultaneously controls all windows, sunroof, and sunshades to the fully closed position. The locking status is continuously monitored in real time using position sensors on each lock and window. When all feedback signals confirm successful locking, the first OTA mode security process is initiated. The first OTA mode security process includes human-machine interface channel takeover and network security protection. Human-machine interface channel takeover temporarily deprives the regular user control channel to prevent any possible human error interference during the upgrade process. Network security protection involves activating a dedicated network protection strategy for the upgrade period, activating the upgrade protection mode of the vehicle firewall, strictly filtering non-upgrade-related network packets and service requests, and preventing network attacks and interference.

[0048] In one embodiment of the present invention, for further explanation and limitation, the safety condition verification process of the vehicle control system includes: The high-voltage accessories are flexibly powered down, and the high-voltage power is cut off after all the high-voltage accessories have entered standby mode; After the high-voltage power is cut off, a second OTA mode safety procedure is performed; After completing the OTA mode security processing, a positive security verification result is generated and fed back. In the event of an abnormal security handling situation in OTA mode, a security handling abnormality prompt will be generated and reported.

[0049] In this embodiment of the invention, the vehicle control system does not directly cut off the high-voltage power supply. Instead, it first controls the high-voltage accessories such as the air conditioning compressor, PTC heater, and DC-DC converter to enter a low-power standby or off state. After monitoring and confirming that all high-voltage accessories have entered a safe standby state or have been turned off, it controls the battery management system or the high-voltage distribution box to perform a safe disconnection operation of the high-voltage main circuit contactor, thereby achieving physical isolation of the high-voltage system and avoiding electrical shocks or logic faults that may be caused by direct power outage.

[0050] The second OTA mode safety handling includes critical sensor status monitoring and freezing, and drive system locking. Critical sensor status monitoring and freezing involves taking snapshots and continuously monitoring the status of critical sensors affecting vehicle safety judgments, such as gear position sensors, speed sensors, and gradient sensors. The system records instantaneous values ​​before entering upgrade mode and continuously compares them during the upgrade process. If abnormal signal jumps are detected, it is considered a serious fault. Simultaneously, the input values ​​of certain sensors can be configured as safe values ​​at the software level to prevent interference from false signals. Drive system locking ensures that the drive system, such as the motor controller, is in an inoperable locked state through software commands or hardware interlock mechanisms. At the same time, lock or hold commands are sent to the electronic parking system to achieve mechanical braking protection.

[0051] In a specific application example, the vehicle software upgrade and mode switching process is as follows: Figure 4 As shown. The OTA cloud platform sends upgrade tasks to the vehicle software upgrade system, which receives the task and sends upgrade status information to the body control system, etc. The information interaction system prompts the user to confirm the upgrade operation. After the user confirms, it sends vehicle confirmation information back to the vehicle software upgrade system. Next, the vehicle software upgrade system performs vehicle safety condition verification. If it fails, the process terminates; if it passes, it sends an OTA mode message to the vehicle control system and the body control system. After receiving the OTA mode message, the body control system checks the vehicle locking conditions. If the conditions are met, it performs OTA mode safety processing and, if there are no abnormalities, manages the software upgrade activity. After the upgrade is completed, it reports the results and reports the OTA mode safety processing to exit OTA mode; if an abnormality occurs, it performs fault handling or unlocking. At the same time, after receiving the OTA mode message, the vehicle control system checks the high-voltage power-off condition. If the conditions are met, it performs OTA mode safety processing and, if there are no abnormalities, manages the software upgrade activity. After the upgrade is completed, it reports the results and reports the OTA mode safety processing to exit OTA mode; if an abnormality occurs, it also performs fault handling.

[0052] In one embodiment of the present invention, for further explanation and limitation, verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction includes: Verify the digital signature carried in the encrypted upgrade package based on the root certificate or public key of the corresponding OTA cloud platform configured on the vehicle. After the digital signature verification is successful, the hash value of the received package data is calculated, and the hash value is compared with the original value hash value carried by the encrypted upgrade package to verify the integrity of the upgrade package; After the integrity verification of the upgrade package is passed, the encrypted upgrade package is decrypted according to the key preset on the vehicle to obtain the decrypted upgrade package.

[0053] In this embodiment of the invention, the vehicle-side system uses its factory-pre-installed root certificate or public key, corresponding to the official OTA cloud platform, to verify the digital signature attached to the upgrade package, ensuring the legitimacy and authority of the upgrade package's source. After confirming the source's trustworthiness, the vehicle-side system uses the same hash algorithm as the cloud to calculate a local hash value for the entire received software package's original data. This hash value is then rigorously compared with the original hash value carried in the upgrade package, calculated by the cloud and sent with the package. If they match, it indicates that the upgrade package data is complete and has not been tampered with or damaged. After the first two verification steps pass, confirming the data source's authenticity and completeness, the vehicle-side system uses a symmetric key in its secure storage area to decrypt the core data of the upgrade package. This completes a closed-loop verification of the upgrade data's trustworthiness before officially triggering the vehicle state switch, providing a preliminary security guarantee for subsequent upgrade operations.

[0054] In one embodiment of the present invention, for further explanation and limitation, before verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction, the method further includes: If the vehicle safety status assessment is passed, system upgrade confirmation information will be output through the information interaction system. After receiving positive feedback from the system upgrade confirmation information, the operation of verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction is performed.

[0055] In this embodiment of the invention, after the system has passed the vehicle safety status assessment, it enters the user interaction phase. That is, the system outputs system upgrade confirmation information to the user through an information interaction system, such as the in-vehicle central control screen, digital instrument panel, or mobile app. After outputting the information, the system enters a waiting state, listening for user input feedback. Positive feedback refers to the user actively selecting the option to confirm the upgrade or functional equivalence via touch, voice, or physical buttons. Only after receiving this positive feedback will the system trigger and execute subsequent verification and decryption of the software upgrade package and subsequent operations. If the user chooses to cancel, or fails to respond within a certain timeout period, the system determines that user authorization has not been obtained. By adding a necessary human-computer interaction and user decision-making step before the data security verification, the final execution right is granted to the user, serving as a manual confirmation node in the security process, further improving the controllability and security of the upgrade process.

[0056] This invention provides a remote OTA upgrade control method for new energy buses. In this embodiment, the vehicle safety status is assessed in response to an OTA upgrade command issued by an OTA cloud platform. If the vehicle safety status assessment passes, the encrypted upgrade package carried by the software upgrade command is verified and decrypted. After the upgrade package verification is successful, an OTA mode message is generated. The OTA mode message is sent to both the body control system and the vehicle control system to trigger OTA mode safety condition verification in each system. After receiving the positive safety verification results from both systems, the vehicle is controlled to enter OTA mode and upgrade according to the upgrade package. This significantly reduces the risk of failure and system malfunction caused by blindly initiating upgrades due to vehicle conditions not meeting safety requirements. Furthermore, the dual independent safety verification by the body and vehicle control systems ensures that the vehicle's power system, high-voltage environment, and physical condition meet upgrade safety requirements before entering upgrade mode, thereby greatly improving the reliability, security, and success rate of the remote OTA upgrade process.

[0057] Furthermore, as a response to the above Figure 1 The implementation of the method shown in this invention provides a remote OTA upgrade control system for new energy buses, such as... Figure 5 As shown, the system includes: The status assessment module 31 is used to perform vehicle safety status assessment in response to OTA upgrade commands issued by the OTA cloud platform; The upgrade package verification module 32 is used to verify and decrypt the encrypted upgrade package carried by the software upgrade instruction when the vehicle safety status assessment is passed, and to generate an OTA mode message after the upgrade package is verified. The sending module 33 is used to send the OTA mode message to the body control system and the vehicle control system respectively, so as to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively; The upgrade control module 34 is used to control the vehicle to enter OTA mode and perform upgrades according to the upgrade package after receiving the positive safety verification results of the body control system and the vehicle control system.

[0058] Furthermore, the state assessment module 31 includes: The temperature prediction unit is used to predict the temperature of the vehicle during the upgrade process, and obtain the predicted temperature rise and the extreme temperature values ​​during the upgrade process. The acquisition unit is used to acquire multi-dimensional vehicle safety status data when the extreme temperature values ​​during the upgrade process meet the temperature safety range. The multi-dimensional vehicle safety status data includes the insulation resistance of the high voltage positive and negative electrodes to the vehicle body, battery health status parameters, battery state of charge parameters, vehicle parking posture, and vehicle surrounding environment risk parameters. The prediction unit is used to predict vehicle safety status parameters based on the multidimensional vehicle safety status data and the predicted temperature rise using a pre-trained vehicle safety status prediction model. The determining unit is configured to determine that the vehicle safety status assessment is passed when the vehicle safety status parameter is greater than or equal to a preset safety parameter threshold, and to determine that the vehicle safety status assessment is failed when the vehicle safety status parameter is less than the preset safety parameter threshold.

[0059] Furthermore, in specific application scenarios, the temperature prediction unit is specifically used to predict the battery temperature change curve during the upgrade process based on the real-time battery temperature, ambient temperature, battery power, and upgrade package size, and to extract the predicted temperature rise and the extreme temperature values ​​during the upgrade process. The method further includes: when the extreme temperature value during the upgrade process does not meet the temperature safety range, controlling the thermal management system to adjust the battery temperature, and predicting the battery temperature change curve based on the adjusted real-time battery temperature, until the extreme temperature value during the upgrade process meets the temperature safety range.

[0060] Furthermore, the upgrade package verification module 32 includes: The digital signature verification unit is used to verify the digital signature carried in the encrypted upgrade package based on the root certificate or public key of the corresponding OTA cloud platform configured on the vehicle. The integrity verification unit is used to calculate the hash value of the received software package data after the digital signature verification is passed, and compare the hash value with the original value hash value carried by the encrypted upgrade package to verify the integrity of the upgrade package. The decryption unit is used to decrypt the encrypted upgrade package according to the key preset on the vehicle end after the integrity verification of the upgrade package is passed, so as to obtain the decrypted upgrade package.

[0061] Furthermore, the system also includes: The confirmation message sending module is used to output system upgrade confirmation information through the information interaction system when the vehicle safety status assessment is passed; The confirmation information receiving module is used to perform the operation of verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction after receiving positive feedback of the system upgrade confirmation information.

[0062] This invention provides a remote OTA upgrade control system for new energy buses. In this embodiment, the system responds to OTA upgrade commands issued by an OTA cloud platform and performs a vehicle safety status assessment. If the vehicle safety status assessment passes, the system verifies and decrypts the encrypted upgrade package carried by the software upgrade command. After the upgrade package verification is successful, an OTA mode message is generated. This OTA mode message is then sent to both the body control system and the vehicle control system to trigger OTA mode safety condition verification in each system. Upon receiving the positive safety verification results from both systems, the system controls the vehicle to enter OTA mode and performs the upgrade according to the upgrade package. This significantly reduces the risk of failure and system malfunction caused by blindly initiating upgrades when the vehicle's status does not meet safety conditions. Furthermore, the dual independent safety verification by the body and vehicle control systems ensures that the vehicle's power system, high-voltage environment, and physical condition meet the upgrade safety requirements before entering upgrade mode, thereby greatly improving the reliability, security, and success rate of the remote OTA upgrade process.

[0063] According to one embodiment of the present invention, a storage medium is provided, the storage medium storing at least one executable instruction, which can execute the remote OTA upgrade control method for new energy buses in any of the above method embodiments.

[0064] Figure 6 The diagram shows a structural schematic of a terminal according to an embodiment of the present invention. The specific implementation of the present invention is not limited to the specific implementation of the terminal.

[0065] like Figure 6 As shown, the terminal may include: a processor 402, a communication interface 404, a memory 406, and a communication bus 408.

[0066] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408.

[0067] Communication interface 404 is used for network communication with other devices such as clients or other servers.

[0068] The processor 402 is used to execute program 410, which can specifically execute the relevant steps in the above embodiment of the remote OTA upgrade control method for new energy buses.

[0069] Specifically, program 410 may include program code that includes computer operation instructions.

[0070] Processor 402 may be a central processing unit (CPU), a specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The terminal includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0071] Memory 406 is used to store program 410. Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0072] Specifically, program 410 can be used to cause processor 402 to perform the following operations: In response to OTA upgrade commands issued by the OTA cloud platform, conduct vehicle safety status assessment; If the vehicle safety status assessment is passed, the encrypted upgrade package carried by the software upgrade instruction is verified and decrypted, and an OTA mode message is generated after the upgrade package is verified. The OTA mode message is sent to the body control system and the vehicle control system respectively, so as to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively; After receiving the positive safety verification results from the body control system and the vehicle control system, the vehicle is controlled to enter OTA mode and upgrade according to the upgrade package.

[0073] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using program code executable by a computing system, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0074] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for remote OTA upgrade control of new energy buses, characterized in that, include: In response to OTA upgrade commands issued by the OTA cloud platform, conduct vehicle safety status assessment; If the vehicle safety status assessment is passed, the encrypted upgrade package carried by the software upgrade instruction is verified and decrypted, and an OTA mode message is generated after the upgrade package is verified. The OTA mode message is sent to the body control system and the vehicle control system respectively, so as to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively; After receiving the positive safety verification results from the body control system and the vehicle control system, the vehicle is controlled to enter OTA mode and upgrade according to the upgrade package.

2. The method according to claim 1, characterized in that, The process of assessing the vehicle's safety status includes: The vehicle upgrade temperature prediction is performed to obtain the predicted temperature rise and the extreme temperature values ​​during the upgrade process; Under the condition that the extreme temperature values ​​during the upgrade process meet the temperature safety range, multi-dimensional vehicle safety status data is obtained. The multi-dimensional vehicle safety status data includes the insulation resistance of the high voltage positive and negative electrodes to the vehicle body, battery health status parameters, battery state of charge parameters, vehicle parking posture, and vehicle surrounding environment risk parameters. Based on the multidimensional vehicle safety status data and the predicted temperature rise, the vehicle safety status parameters are predicted by a pre-trained vehicle safety status prediction model. If the vehicle safety status parameter is greater than or equal to the preset safety parameter threshold, the vehicle safety status assessment is determined to be passed; if the vehicle safety status parameter is less than the preset safety parameter threshold, the vehicle safety status assessment is determined to be failed.

3. The method according to claim 2, characterized in that, The vehicle undergoes an upgrade temperature prediction process, yielding the predicted temperature rise and extreme temperatures during the upgrade process, including: Based on real-time battery temperature, ambient temperature, battery power, and upgrade package size, predict the battery temperature change curve during the upgrade process, and extract the predicted temperature rise and temperature extreme values ​​during the upgrade process. The method further includes: when the extreme temperature value during the upgrade process does not meet the temperature safety range, controlling the thermal management system to adjust the battery temperature, and predicting the battery temperature change curve based on the adjusted real-time battery temperature, until the extreme temperature value during the upgrade process meets the temperature safety range.

4. The method according to claim 1, characterized in that, The safety condition verification process of the vehicle body control system includes: Perform a safe operation to lock the electric vehicle and check the locking status; If the vehicle is locked, the first OTA mode security process is performed, which includes: human-machine interaction channel takeover and network security protection. After completing the OTA mode security processing, a positive security verification result is generated and fed back. In the event of an abnormal security handling situation in OTA mode, a feedback prompt indicating the abnormal security handling situation will be generated.

5. The method according to claim 1, characterized in that, The safety condition verification process of the vehicle control system includes: The high-voltage accessories are flexibly powered down, and the high-voltage power is cut off after all the high-voltage accessories have entered standby mode; After the high-voltage power is cut off, a second OTA mode safety process is performed, which includes monitoring and freezing the status of key sensors and locking the drive system. After completing the OTA mode security processing, a positive security verification result is generated and fed back. In the event of an abnormal security handling situation in OTA mode, a security handling abnormality prompt will be generated and reported.

6. The method according to claim 1, characterized in that, The process of verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction includes: Verify the digital signature carried in the encrypted upgrade package based on the root certificate or public key of the corresponding OTA cloud platform configured on the vehicle. After the digital signature verification is successful, the hash value of the received package data is calculated, and the hash value is compared with the original value hash value carried by the encrypted upgrade package to verify the integrity of the upgrade package; After the integrity verification of the upgrade package is passed, the encrypted upgrade package is decrypted according to the key preset on the vehicle to obtain the decrypted upgrade package.

7. The method according to claim 1, characterized in that, Before verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction, the method further includes: If the vehicle safety status assessment is passed, system upgrade confirmation information will be output through the information interaction system. After receiving positive feedback from the system upgrade confirmation information, the operation of verifying and decrypting the encrypted upgrade package carried by the software upgrade instruction is performed.

8. A remote OTA upgrade control system for new energy buses, characterized in that, include: The status assessment module is used to assess the vehicle's safety status in response to OTA upgrade commands issued by the OTA cloud platform. The upgrade package verification module is used to verify and decrypt the encrypted upgrade package carried by the software upgrade instruction when the vehicle safety status assessment is passed, and to generate an OTA mode message after the upgrade package is verified. The sending module is used to send the OTA mode message to the body control system and the vehicle control system respectively, so as to trigger the body control system and the vehicle control system to perform OTA mode security condition verification respectively; The upgrade control module is used to control the vehicle to enter OTA mode and perform upgrades according to the upgrade package after receiving the positive safety verification results from the body control system and the vehicle control system.

9. A storage medium, characterized in that, The storage medium stores at least one executable instruction, which causes the processor to perform the operation corresponding to the remote OTA upgrade control method for new energy buses as described in any one of claims 1-7.

10. A terminal, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the remote OTA upgrade control method for new energy buses as described in any one of claims 1-7.

Images