An ECU-guided dynamic self-healing system, method, and device based on vehicle diagnostic communication protocol and physical perception.

Abstract

This invention relates to the field of ECU management technology, and discloses an ECU boot dynamic self-healing system, method, and device based on vehicle diagnostic communication protocols and physical sensing. The key technical features include a microcontroller, non-volatile memory, a memory protection unit, and a power supply voltage detection unit. The microcontroller runs a boot protection module, a logic evolution module, a dynamic driving unit, and a snapshot management and power-down hardening unit. The boot protection module is used for power-on priority startup, reading snapshot status, performing fault self-healing, and resuming interrupted data transfer. The logic evolution module is used to execute the main business of the bootloader program. The dynamic driving unit is loaded into the running memory and used to perform erase / write operations on the updatable boot area, updating the snapshot information in the running memory in real time during the flashing process. The power supply voltage detection unit is used to trigger power-down processing. The snapshot management and power-down hardening unit is used to respond to power-down signals and write snapshot information to the snapshot storage area.

Description

Technical Field

[0001] This invention relates to the field of ECU management technology, and more specifically, to an ECU-guided dynamic self-healing system, method, and apparatus based on vehicle diagnostic communication protocols and physical sensing. Background Technology

[0002] Current automotive ECU software architecture typically consists of a bootloader and an application program (APP). Throughout the ECU's lifecycle after delivery, the bootloader is generally considered fixed logic, with APP updates only performed via standard bus interfaces (such as CAN, LIN, and ETH). When faced with the need to update the bootloader itself, the mainstream industry solution is to use a RAM-based dynamic driver solution (Flash Driver). Using the existing bootloader, a Flash Driver image containing the Flash driver, communication protocol stack, and minimal business logic is downloaded to the ECU's random access memory (RAM) via a diagnostic protocol (such as UDS). The system jumps to the RAM address for execution, where the Flash Driver takes over ECU bus control and gains write / erase access to the internal Flash. The Flash Driver first erases the existing bootloader sectors in the Flash, then receives the new image and performs the write operation. However, this approach has the following problems: Volatility Risk: RAM is volatile. If an unexpected power outage occurs during the window between erasing the old bootloader by the Flash Driver and completing the flashing of the new image, the running context in RAM will be immediately lost. At this point, the bootloader sector in the Flash is already damaged or blank. The system will fail to boot on the next restart due to the loss of the reset vector, resulting in permanent ECU failure, or "bricking," which can only be resolved through expensive offline flashing or factory repair.

[0003] Resource waste: To mitigate risks, some solutions adopt a dual-bank (such as A / BSwap) redundancy architecture, but this doubles the Flash space cost, making it difficult to deploy on a large scale in cost-sensitive low- to mid-range controllers. Summary of the Invention

[0004] The purpose of this invention is to provide an ECU boot dynamic self-healing system, method, and apparatus based on vehicle diagnostic communication protocols and physical sensing. The system divides the bootloader into a hardware read-only boot protection module and an updatable logic evolution module. By combining voltage physical sensing and snapshot atomization solidification mechanisms, it achieves dynamic self-healing capabilities for the ECU bootloader under a single-bank non-volatile memory architecture, ensuring it does not become unusable due to power loss, can resume from breakpoints, and has low resource consumption. This solves the technical problems of easy failure and high cost of dual-bank redundancy in traditional RAM-based update schemes, significantly improving the reliability, security, and maintenance efficiency of vehicle ECUs throughout the firmware update process.

[0005] The above-mentioned technical objective of the present invention is achieved through the following technical solution: an ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception, including a microcontroller, a non-volatile memory, a memory protection unit, a power supply voltage detection unit, a power failure emergency power supply component, and a bus transceiver; The non-volatile memory is divided into: a start address boot region, an updatable boot region, and a snapshot storage region; The microcontroller includes: a boot protection module, a logic evolution module, a dynamic driving unit, and a snapshot management and power-down hardening unit. The boot protection module is fixed in the boot area of ​​the starting address and is configured as read-only and unmodifiable by the memory protection unit. It is used for power-on priority startup, reading snapshot status, performing fault self-healing and breakpoint resume. The logical evolution module is stored in the updatable boot area and is used to execute the main business of the bootloader. The dynamic driving unit is loaded into the running memory to perform erase and write operations on the updatable boot area, and to update the snapshot information in the running memory in real time during the writing process; The power supply voltage detection unit is used to monitor power supply voltage drops and trigger power-off processing. The power failure emergency power supply component is used to provide short-term power during power failure; The snapshot management and power-off persistence unit is used to respond to a power-off signal and atomically write the updated snapshot information in the running memory into the snapshot storage area. The bus transceiver is used to enable bus communication between the ECU and external devices.

[0006] As a preferred embodiment of the present invention, the snapshot information includes transaction status, physical write offset, bus transmission sequence number, and global integrity check value.

[0007] As a preferred technical solution of the present invention, the dynamic driving unit pre-erases the snapshot storage area before starting the write sequence, so that the power failure interruption only performs a fast programming operation to complete the snapshot information solidification.

[0008] As a preferred technical solution of the present invention, the transaction states include: idle state, pre-erase state, and write execution state; The pre-erasure status is marked before the execution logic evolution module erases the operation; The execution status is written when data is started being written to the logic evolution module; The idle state is marked by the dynamic driving unit after all data has been written and the integrity check has passed.

[0009] As a preferred technical solution of the present invention, during power-down processing, only snapshot information writing operations are performed, and unclosed data is not processed. Snapshot information is written atomically, ensuring either a successful write or no write at all. In the event of a power outage, only snapshot data that has been completed, verified, and closed-loop is dumped.

[0010] As a preferred technical solution of the present invention, in the pre-erase state, the logical evolution module is first subjected to integrity verification. If the verification passes, the transaction state is rolled back; if the verification fails, the rescue and continuation mode is entered.

[0011] As a preferred technical solution of the present invention, in the write execution state, the download request initialization is skipped during the resume transmission and the data transmission process is directly entered; the guidance and protection module verifies the bus message according to the serial number in the snapshot. If it matches, the write continues; if it does not match, a retransmission is requested.

[0012] As a preferred technical solution of the present invention, the global integrity check value is calculated using an incremental iterative method. The check value is updated only after the complete data block is written to the non-volatile memory. The check value is a global data fingerprint from the start address of the write operation to the current physical offset.

[0013] An ECU-guided dynamic self-healing method based on vehicle diagnostic communication protocols and physical sensing includes the following steps: Hardware configuration: The ECU bootloader is decoupled into a physically isolated boot assurance module and a logic evolution module. The boot assurance module is fixed in the starting address region of non-volatile memory and configured as read-only and unmodifiable, and includes at least a bus driver, a memory driver, and a download engine. The logic evolution module is used to execute the main business of the bootloader. A snapshot storage area is allocated in the non-volatile memory to store snapshot information of transactions. During the flashing process, the ECU power supply voltage is monitored in real time. When the voltage drop reaches a preset threshold, a power-down process is triggered, and the snapshot information in the running memory is atomically written to the snapshot storage area. When the ECU is powered on or reset, the boot protection module first reads the transaction status of the snapshot storage area and performs the following actions according to the transaction status: in the idle state, normal booting; in the pre-erase state, integrity verification is performed on the logic evolution module, and rollback or rescue mode is performed according to the verification result; in the write execution state, the bus transmission context is restored based on the snapshot information and breakpoint resume is performed.

[0014] An ECU-guided dynamic self-healing device based on vehicle diagnostic communication protocol and physical perception includes: a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor implements the above-mentioned method when executing the computer program.

[0015] In summary, the present invention has the following beneficial effects: By embedding the boot protection module and providing hardware read-only protection, the ECU can be guaranteed to start normally under any abnormal power failure or write interruption scenario, and will not fail to reset due to boot sector damage, thus fundamentally preventing permanent controller failure. This completely eliminates the risk of ECU updates "bricking" the system, achieving absolutely safe booting. It eliminates the need for dual-bank redundant storage, enabling near-atomic updates with a single-bank architecture. It achieves power-off self-healing with only a tiny snapshot storage area, significantly reducing non-volatile memory resource overhead and making it suitable for cost-sensitive mid-to-low-end automotive ECU platforms.

[0016] By monitoring voltage in real time and providing emergency power supply during power outages, snapshot information such as transaction status, write address, transmission sequence number, and global check value is atomically solidified. After restarting, updates can be resumed directly from the breakpoint without the need for the host computer to re-initiate a complete session. The power outage scene is completely preserved, supporting breakpoint resume and seamless recovery.

[0017] By employing a three-state management system of idle, pre-erase, and write execution, combined with an integrity verification and rollback mechanism, misjudgment of state and pollution by half-written data are avoided, ensuring that the system is always in a detectable and repairable stable state.

[0018] The guidance and protection module retains only the core driver and the minimum download engine. During self-healing, it does not send unnecessary error frames, does not occupy bus resources, has a fast recovery speed, and has minimal impact on the vehicle network.

[0019] Global incremental iterative verification is adopted to generate physical fingerprints of written data in real time, avoiding data errors and omissions, and ensuring that the updated image is complete and usable. Attached Figure Description

[0020] Figure 1 This is a system architecture diagram of the present invention; Figure 2 This is a logic block diagram of the tombstone mechanism of the present invention. Detailed Implementation

[0021] It is readily understood that, based on the technical solution of this invention, various embodiments of the invention can be conceived by those skilled in the art without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention. Rather, these embodiments are provided to enable those skilled in the art to gain a more thorough understanding of the invention. Preferred embodiments of the invention are described below in conjunction with the accompanying drawings, which form part of this application and, together with the embodiments of the invention, serve to illustrate the innovative concept of the invention.

[0022] like Figure 1 As shown, the present invention provides an ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception, including a microcontroller, a non-volatile memory, a memory protection unit, a power supply voltage detection unit, a power failure emergency power supply component, and a bus transceiver; The non-volatile memory is divided into: a start address boot region, an updatable boot region, and a snapshot storage region; The microcontroller contains: a boot protection module, a logic evolution module, a dynamic driving unit, and a snapshot management and power-down hardening unit; The boot protection module is fixed in the boot area at the starting address and is configured as read-only and unmodifiable by the memory protection unit. It is used for power-on priority startup, reading snapshot status, performing fault self-healing and breakpoint resume. The logical evolution module is stored in the updatable boot area and is used to execute the main business logic of the bootloader. The dynamic driver unit is loaded into the runtime memory to perform erase and write operations on the updatable boot area and update the snapshot information in the runtime memory in real time during the flushing process. Before starting the flushing sequence, the dynamic driver unit pre-erases the snapshot storage area, so that power failure interruptions only perform fast programming operations to solidify the snapshot information. Snapshot information includes transaction status, physical write offset, bus transmission sequence number, and global integrity check value. Transaction status includes: idle state, pre-erase state, and write execution state; the pre-erase state is marked before the logical evolution module erases; the write execution state is marked when data is started being written to the logical evolution module; the idle state is marked by the dynamic driver unit after all data has been written and the integrity check has passed.

[0023] The power supply voltage detection unit is used to monitor power supply voltage drops and trigger power-down processing. Power-down, i.e., voltage drop triggering, can be triggered by the built-in ADC or LVD (low voltage detection), or by the Power-Down signal of the external power management chip (PMIC) or the GPIO toggle signal of the dedicated monitoring circuit.

[0024] Emergency power supply components are used to provide short-term power during power outages; The snapshot management and power-down persistence unit is used to respond to power-down signals and atomically write the updated snapshot information in the running memory to the snapshot storage area. During power-down processing, only the snapshot information writing operation is performed, and the data that has not been closed is not processed. The snapshot information writing is an atomic operation to ensure that the writing is successful or not written at all. During power-down, only the completed, verified and closed snapshot data are dumped.

[0025] Bus transceivers are used to enable bus communication between the ECU and external devices.

[0026] The global integrity check value is calculated using an incremental iterative method. The check value is updated only after the complete data block is written to the non-volatile memory. The check value is a global data fingerprint from the start address of the write operation to the current physical offset.

[0027] It should be noted that in practical applications, the snapshot storage area can be implemented in external EEPROM, external serial Flash, or SRAM with power-down retention function (such as backup domain RAM), in addition to being allocated in internal non-volatile memory.

[0028] Corresponding to the above system, this invention provides an ECU-guided dynamic self-healing method based on vehicle diagnostic communication protocols and physical sensing, comprising the following steps: Hardware configuration: The ECU bootloader is decoupled into a physically isolated boot assurance module and a logic evolution module. The boot assurance module is fixed in the starting address area of ​​non-volatile memory and configured as read-only and unmodifiable, and includes at least a bus driver, a memory driver, and a download engine. The logic evolution module is used to execute the main business of the bootloader. A snapshot storage area is allocated in the non-volatile memory to store snapshot information of transactions. During the flashing process, the dynamic drive unit monitors the ECU power supply voltage in real time through the power supply voltage detection unit. When the voltage drop reaches the preset threshold, the snapshot management and power-down hardening unit is triggered to perform power-down processing and atomically write the snapshot information in the running memory to the snapshot storage area. When the ECU is powered on or reset, the boot protection module first reads the transaction state of the snapshot storage area and executes the following actions according to the transaction state: Normal boot process during idle state; In the pre-erase state, the logical evolution module is subjected to integrity verification, and the transaction is rolled back or entered into rescue mode based on the verification result. In the pre-erase state, the logical evolution module is first subjected to integrity verification. If the verification passes, the transaction state is rolled back. If the verification fails, the transaction is entered into rescue and resume mode.

[0029] During the write execution state, the bus transmission context is restored based on the snapshot information, and breakpoint resumption is performed. During the write execution state, the download request initialization is skipped during resumption, and the data transmission process is directly entered; the bootstrap protection module verifies the bus message based on the sequence number in the snapshot. If a match is found, the write continues; otherwise, a retransmission is requested.

[0030] Corresponding to the above methods and systems, the present invention also provides an ECU-guided dynamic self-healing device based on vehicle diagnostic communication protocols and physical perception, comprising: a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor implements the above methods when executing the computer program.

[0031] The following are embodiments of the system of the present invention, such as... Figure 1 and Figure 2 As shown, it includes a microcontroller (MCU), non-volatile memory (Flash), a memory protection unit (MPU), a power supply voltage detection unit, a power failure emergency power supply component, and a bus transceiver; In terms of software architecture, this system breaks away from the limitations of the traditional single bootloader architecture and decouples it into a physically isolated boot assurance module (Stage1 Preboot) and a logical evolution module (Stage2 Bootloader). The boot protection module Stage1 is stored in the starting address sector of the physical Flash memory, i.e., the starting address boot area, and is hardware-level read-only locked through the Memory Protection Unit (MPU) to ensure that it cannot be erased or tampered with under any operating conditions. This module simplifies the CAN driver, Flash driver, and a minimal download transmission engine service, completing basic functions with minimal Flash requirements.

[0032] The logic evolution module Stage2, as the main business unit, is responsible for executing the regular UDS diagnostic protocol, secure access, and downloading the FlashDriver program (dynamic driver unit).

[0033] The Flash Driver program is placed in the RAM area, i.e., the running memory, and is responsible for burning and reading / writing operations to the Stage2 area, updating the necessary information for the "Tombstone mechanism" in real time, using the ADC, i.e. the power supply voltage detection unit, to monitor the voltage in real time, and configuring data to be saved when power is lost.

[0034] During flashing, data interaction is performed through the "Tombstone Area," a snapshot storage area pre-defined within the Flash memory. This tombstone area serves as the state anchor point for atomic transactions, storing core snapshot information including tri-state stage flags, physical write offsets, ISO-TP transmission sequence numbers (bus transmission sequence numbers), and the rolling hash value of the written data, i.e., the global integrity check value.

[0035] The system and method of this invention are mainly implemented through a hardware-aware "tombstone information" sealing mechanism, such as... Figure 2 As shown, it specifically includes the following: Preprocessing and Environment Preparation: To avoid the magnitude conflict between Flash erase commands and the residual time after power failure, the FlashDriver performs an erase operation on the Data Flash tombstone area, i.e., the snapshot storage area, before starting the write sequence, initializing this area to 0xFF. This ensures that when a power failure is triggered, the system only needs to execute a very short programming instruction, thereby completing data solidification within a deterministic capacitor discharge cycle.

[0036] Hardware monitoring and interrupt triggering mechanism: System configuration: The ADC sampling module monitors the external power supply voltage (Vbat) of the ECU in real time and maps it to the highest priority non-maskable interrupt (NMI).

[0037] Trigger threshold: Set a precise power failure threshold to reserve enough residual energy to maintain storage operations.

[0038] Atomic write sequence: In the ADC power-down interrupt service function, strictly follow the physical timing, and first batch transfer the snapshot data (Status, Flash_Ptr, SN, Hash) stored in RAM to Flash.

[0039] 3. Snapshot update strategy during dynamic flushing process. The tombstone information structure is defined as shown in Table 1 below: Table 1. Definition of Tombstone Information Structure ; The system dynamically maintains the tombstone image in RAM based on the UDS write timing. The steps are as follows: Pre-Erase: Before executing 0x11 (re-entering after reset) or the erase command, the Status is set to PRE_WIPE, which is the pre-erase state, indicating that the physical risk window is open.

[0040] Transaction Startup: After receiving the 0x34 request to download the service, the memory address is parsed and the Flash_Ptr in the tombstone is initialized. At the same time, the Status is switched to WIPING_DONE, that is, the execution status is written.

[0041] Incremental stepping: Whenever a data packet is successfully written, the following actions are performed: 1. Physical pointer alignment: Update Flash_Ptr to point to the cutoff address of the last fully written page. 2. Communication status synchronization: Update SN (Sequence Number) to record the current progress of the transport layer.

[0042] Rolling verification: The feature values ​​of the written area are accumulated in real time using an incremental hash algorithm and updated to the tombstone snapshot.

[0043] Transaction closure and flag reset: The system only restores the Status to IDLE (idle state) after all data has been downloaded and the final routine development / integrity verification has been completed. This mechanism ensures that any unexpected restart during the entire update cycle will trigger the rescue and resume flashing logic of the Bootstrapping Protection Module Stage1.

[0044] Regarding the global integrity verification value, this embodiment uses a rolling hash value. Specifically, the RollingHash incremental algorithm and the flushing collaborative logic are as follows: 1. Algorithm Selection and Physical Function: This invention uses CRC32 (Cyclic Redundancy Check) or FNV-1a (Unencrypted Hash) algorithms as underlying operators. Its core feature is that the checksum of this byte (32-bit) is not a local checksum for a single communication packet, but rather a global physical fingerprint of all data written to disk from the initial write address (Addr_0) to the current Flash_Ptr.

[0045] 2. Incremental Calculation Logic During Flashing: To reduce CPU load during power-down interruptions, the system employs a "packet completion triggered" update strategy in Stage 2 (Flash Driver running state). Calculation trigger point: The iterative calculation is only started after the system has received a complete data block and successfully written it to the physical Flash sector by the Flash Driver.

[0046] The iterative formula is: H current =CRC32_Accumulate(H late Data Block_n ); H lateIt is a hash checksum stored in RAM from the first data packet to the previous data packet.

[0047] Data Block_n This refers to the data block content of the complete 36-service that has just completed a write operation.

[0048] The default value of CRC32 is all 0xFF. Each time a complete 36-byte data block is received, the algorithm checks the current data block and then updates the value. After all 36 data packets are received, the CRC32 check value of all data can be calculated.

[0049] Image Update: After the calculation is completed, the system synchronously updates the tombstone snapshot image in the RAM area to ensure that the Rolling_Hash field always remains logically consistent with the physical boundary of the current Flash_Ptr.

[0050] When ADC sampling triggers a power-down interrupt (NMI), the system performs the following operations: Discarding unclosed transactions: If the current 0x36 data packet has not been transmitted or the hash iteration calculation has not been completed when the power failure occurs, the interrupt service function will not update the hash value in RAM.

[0051] Deterministic dump: The interrupt function dumps the last closed-loop data (the hash value up to the previous packet) from RAM along with the corresponding fast dump to the Data Flash tombstone area. This logic ensures that the tombstone data is always a "verified and closed-loop" established fact, avoiding the "half-written data" generated at the moment of power failure that pollutes the verification chain.

[0052] This invention also designs a minimized protocol stack and a self-healing process for the boot protection module Stage1, as follows: 1. Protocol stack architecture, with static customization and resource isolation.

[0053] To ensure security and boot speed, Stage1's protocol stack needs to be precisely tailored, retaining only essential core functions: The Flash read / write driver is retained to ensure Flash operation; the core CAN driver is retained to enable Stage1 to communicate with external systems; and the UDS protocol stack is lightweighted, directly performing logical checks on the CAN communication Receive Buffer, responding only to preset diagnostic request and response IDs, and blocking all non-flash-related bus messages to reduce CPU load.

[0054] 2. ISO-TP layer: State machine "recovery" and synchronization logic.

[0055] This is the core of achieving "seamless resume". The bootstrapping and protection module (Stage 1) prioritizes acquiring MCU control and retrieving the tombstone space. The system dynamically adopts differentiated self-healing strategies by parsing the three-state stage flags in the tombstone: State A: The flag is IDLE (0x00), indicating an idle state. This means the system is in normal operation mode with no pending flush transactions. At this time, the system executes normal jump logic or waits for normal flush instructions.

[0056] State B: The flag is PRE_WIPE (0x5A), indicating a pre-erase state, meaning an error occurred before the system performed the erase operation. At this time, the boot protection module does not blindly determine that the Bootloader is corrupted, but instead performs a physical image integrity check (CRC32). If the check passes, it means the power failure occurred after the flag switch and before the erase operation, and the system can automatically roll back the flag and restore normal booting; if the check fails, it is determined that the Bootloader has been damaged due to the erase operation being interrupted, and the system is forced into rescue mode, using the minimal protocol stack built into Stage 1 (supporting 0x34 and 0x36 services) to rebuild the boot process.

[0057] State C: The flag is WIPING_DONE (0xA5), indicating that an abnormal interruption occurred during the data writing phase. At this time, the boot protection module starts the protocol stack cloning engine. This engine breaks the conventional UDS handshake sequence and forcibly initializes the ISO-TP state machine through tombstone snapshot data, injecting protocol stack variables (such as sequence number SN and data offset) into the instantaneous state before the power failure, thereby logically "replicating" the communication environment before the power failure.

[0058] Silent reception & active RETRY: Stage 1 remains in a bus silent state until a message with a matching diagnostic ID is detected, and does not send any error frames to avoid interfering with normal bus load.

[0059] If the received message is the first frame, it is determined whether the received SN matches the SN+1 of the tombstone area. If they match, the normal flashing logic is triggered, which is equivalent to "seamless resuming".

[0060] If a non-first frame message is received, NRC72 is responded to, triggering the host computer to retry the data packet. If the SN of this data can also match the SN+1 of the tombstone information, then transmission continues.

[0061] If the serial number (SN) does not match, it will actively report to NRC73, guiding the host computer to reset the entire flashing process.

[0062] 3. UDS Service Layer: Minimal Functionality Implementation: Stage 1 retains only the minimum service logic to maintain the write / fetch closed loop: 0x34 (Request Download): In the normal process, service 34 requests the download address and data packet length. In the "self-healing" process, service 34 is not executed. Instead, information is read from the tombstone information and synchronized, and the callback function of service 36 is started directly.

[0063] 0x36 (Transfer Data): Data transfer: Service 36 is the main service for data transfer, responsible for transferring each data packet.

[0064] 0x37 (End): Reporting status: Request 37 has been replied to, indicating that the reporting process to the host computer has ended.

[0065] 4. Security and Exit Mechanism: One-way state transition: Stage1's protocol stack only allows transitions from rescue state to normal state. Once a final (verification successful) or (reset) instruction is detected, Stage1 will completely relinquish bus control, reset Status to IDLE, and jump to the main program.

[0066] It should be noted that the Stage1 boot protection module can be implemented as an independent hard image, or through the ROM Bootloader interface of the hardware chip, or by using the Hypervisor virtualization layer to achieve isolation and protection of the underlying logic.

[0067] When Stage1 takes over the flashing process, in addition to using the offset logic of service 36, you can also define a private diagnostic ID or carry the breakpoint offset parameter through service 34 (Request Download) to achieve the same purpose.

[0068] As can be seen from the above embodiments, the main technical advantages of the present invention are: A context-based resurrection mechanism based on protocol snapshots: By recording the ISO-TP layer sequence number (SN) and state machine offset at the moment of power failure, Stage 1 can directly "hijack" and take over the original communication session after restarting. Unlike ordinary fault recording, which carries the risk of "bricking" the Flash Driver after a power failure, simply recording fault codes is meaningless if the ECU cannot start after a reset. Furthermore, under conditions of extremely short voltage fluctuations, even executing the complete UDS process, starting from service 34, incurs significant overhead for the host computer's flashing process. Implementing seamless breakpoint resumption for the host computer minimizes this overhead, requiring only support for standard UDS retransmission data packet mechanisms. Hardware voltage sensing and "last words" sealing logic: Utilizing the residual charge of the capacitor, the real-time flashing progress (Flash pointer) and communication transients are atomically written to the protected tombstone area (snapshot storage area).

[0069] Dual backtracking verification based on three-state semantics (IDLE / PRE / DONE) and physical CRC: By combining software flag presets with actual hardware physical image testing, the actual situation in the current Flash is dynamically identified, solving the logical inconsistency problems caused by false flags and only part of the physical layer being written.

[0070] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this invention should be included within the protection scope of this invention.

[0071] It should be understood that, in order to simplify the present invention and help those skilled in the art understand its various aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes described in a single embodiment or with reference to a single figure. However, the present invention should not be construed as implying that all features included in the exemplary embodiments are essential technical features of the claims of the present invention.

[0072] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0073] It should be understood that the modules, units, components, etc., included in the device of one embodiment of the present invention can be adaptively changed to be placed in a device different from that embodiment. Different modules, units, or components included in the device of the embodiment can be combined into a single module, unit, or component, or they can be divided into multiple sub-modules, sub-units, or sub-components.

[0074] The modules, units, or components in the embodiments of the present invention can be implemented in hardware, in software running on one or more processors, or in a combination thereof. Those skilled in the art should understand that... In practice, microprocessors or digital signal processors (DSPs) can be used to implement embodiments of the invention. The invention can also be implemented on computer program products or computer-readable media for performing some or all of the methods described herein.

Claims

1. An ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocols and physical sensing, characterized in that: Includes a microcontroller, non-volatile memory, memory protection unit, power supply voltage detection unit, power failure emergency power supply component, and bus transceiver; The non-volatile memory is divided into: a start address boot region, an updatable boot region, and a snapshot storage region; The microcontroller includes: a boot protection module, a logic evolution module, a dynamic driving unit, and a snapshot management and power-down hardening unit. The boot protection module is fixed in the boot area of ​​the starting address and is configured as read-only and unmodifiable by the memory protection unit. It is used for power-on priority startup, reading snapshot status, performing fault self-healing and breakpoint resume. The logical evolution module is stored in the updatable boot area and is used to execute the main business of the bootloader. The dynamic driving unit is loaded into the running memory to perform erase and write operations on the updatable boot area, and to update the snapshot information in the running memory in real time during the writing process; The power supply voltage detection unit is used to monitor power supply voltage drops and trigger power-off processing. The power failure emergency power supply component is used to provide short-term power during power failure; The snapshot management and power-off persistence unit is used to respond to a power-off signal and atomically write the updated snapshot information in the running memory into the snapshot storage area. The bus transceiver is used to enable bus communication between the ECU and external devices.

2. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception as described in claim 1, characterized in that: The snapshot information includes transaction status, physical write offset, bus transmission sequence number, and global integrity check value.

3. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception as described in claim 1, characterized in that: Before initiating the write sequence, the dynamic drive unit pre-erases the snapshot storage area, so that power failure interruption only performs a fast programming operation to complete the snapshot information solidification.

4. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception as described in claim 2, characterized in that: Transaction states include: idle state, pre-erase state, and write execution state; The pre-erasure status is marked before the execution logic evolution module erases the operation; The execution status is written when data is started being written to the logic evolution module; The idle state is marked by the dynamic driving unit after all data has been written and the integrity check has passed.

5. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception according to claim 1, characterized in that: During power failure processing, only snapshot information writing operations are performed, and unclosed data is not processed; Snapshot information is written atomically, ensuring either a successful write or no write at all. In the event of a power outage, only snapshot data that has been completed, verified, and closed-loop is dumped.

6. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception according to claim 4, characterized in that: In the pre-erase state, the logical evolution module is first checked for integrity. If the check passes, the transaction state is rolled back. If the check fails, the rescue and continuation mode is entered.

7. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception according to claim 4, characterized in that: In the write execution state, the download request initialization is skipped during the resume transmission, and the data transmission process is directly entered; the bootstrap protection module verifies the bus message according to the sequence number in the snapshot. If it matches, the write continues; if it does not match, a retransmission is requested.

8. The ECU-guided dynamic self-healing system based on vehicle diagnostic communication protocol and physical perception according to claim 2, characterized in that: The global integrity check value is calculated using an incremental iterative method. The check value is updated only after the complete data block is written to the non-volatile memory. The check value is a global data fingerprint from the start address of the write operation to the current physical offset.

9. An ECU-guided dynamic self-healing method based on vehicle diagnostic communication protocol and physical perception, characterized by: Includes the following steps: Hardware configuration: The ECU bootloader is decoupled into a physically isolated boot protection module and a logic evolution module. The boot protection module is fixed in the starting address area of ​​a non-volatile memory and configured as read-only and unmodifiable, and includes at least a bus driver, a memory driver, and a download engine. The logic evolution module is used to execute the main business logic of the bootloader; A snapshot storage area is allocated in the non-volatile memory to store snapshot information of transactions; During the flashing process, the ECU power supply voltage is monitored in real time. When the voltage drop reaches a preset threshold, a power-down process is triggered, and the snapshot information in the running memory is atomically written to the snapshot storage area. When the ECU is powered on or reset, the boot protection module first reads the transaction status of the snapshot storage area and performs the following actions according to the transaction status: in the idle state, normal booting; in the pre-erase state, integrity verification is performed on the logic evolution module, and rollback or rescue mode is performed according to the verification result; in the write execution state, the bus transmission context is restored based on the snapshot information and breakpoint resume is performed.

10. An ECU-guided dynamic self-healing device based on vehicle diagnostic communication protocol and physical perception, characterized in that: include: A processor and a memory, the memory storing a computer program executable by the processor, wherein the processor, when executing the computer program, implements the method of claim 9.

Images