A fuse protection method, device, electronic device, and storage medium

Abstract

This application provides a fuse protection method, device, electronic device, and storage medium. The method includes: if the fuse protection of the vehicle electronic control unit (ECU) is not enabled, then based on the validity of each flash memory partition in the ECU, if the ECU initiates a partition rollback operation, anomaly monitoring is performed during the partition rollback operation to obtain the number of rollback failures; if the number of rollback failures is greater than or equal to a preset rollback number, then fuse protection is enabled for the ECU, and each flash memory partition is set to invalid; and the ECU is reset to trigger a preset fuse protection event; if fuse protection is enabled for the ECU, then the program execution of the ECU is restricted according to preset restricted operation rules. This application can achieve safe fuse protection and prevent cyclic failures, reducing after-sales maintenance costs.

Description

Technical Field

[0001] This invention relates to the field of automotive electronic systems, and more specifically, to a fuse protection method, device, electronic device, and storage medium. Background Technology

[0002] As automotive electronic and electrical architectures continue to evolve, the software functions of onboard electronic control units (ECUs) are becoming increasingly complex. Over-the-air (OTA) updates and local diagnostic flashing have become standard maintenance practices throughout the product lifecycle. To mitigate the risk of device failure due to data anomalies, power supply fluctuations, electromagnetic interference, and other factors during the upgrade process, A / B dual-partition backup upgrade architectures are widely used in onboard controller design.

[0003] However, existing dual-partition rollback mechanisms generally suffer from a design flaw: a lack of protection against rollback anomalies. When the rollback operation fails, the system will repeatedly determine that the active partition is invalid and continue to trigger the rollback process, thus creating an infinite loop. In this state, the ECU is completely locked in a loop of restarting, unable to respond to external maintenance operations. Without software repair capabilities, the only solution is to replace the hardware controller, significantly increasing after-sales maintenance costs. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a fuse protection method, device, electronic device and storage medium that can achieve safe fuse breaking and prevent cyclic failures, thereby reducing after-sales maintenance costs.

[0005] In a first aspect, embodiments of this application provide a fuse protection method, the fuse protection method comprising: When a preset fuse protection event of the vehicle electronic control unit is triggered, determine whether the fuse protection of the vehicle electronic control unit has been activated. If the vehicle electronic control unit does not enable fuse protection, then determine whether the vehicle electronic control unit should initiate a partition rollback operation based on the validity of each flash memory partition in the vehicle electronic control unit. If a partition rollback operation is initiated for the vehicle electronic control unit, anomaly monitoring is performed during the partition rollback operation of the vehicle electronic control unit to obtain the number of rollback failures. If the number of rollback failures is greater than or equal to the preset number of rollbacks, then the fuse protection for the vehicle electronic control unit is activated, each flash memory partition is set to invalid, and the vehicle electronic control unit is software reset to trigger the preset fuse protection event. If the vehicle electronic control unit has activated its fuse protection, the program operation of the vehicle electronic control unit will be restricted according to preset restricted operation rules.

[0006] In one possible implementation, before determining whether the on-board electronic control unit has activated its fuse protection, the method further includes: The first firmware program executed by the vehicle electronic control unit is started; the power-down non-volatile storage area of ​​the firmware program stores a rollback fuse management structure, which is used to determine the fuse and rollback status; the rollback fuse management structure includes a fuse flag, a valid flag corresponding to each Flash partition, and a rollback failure counter.

[0007] In one possible implementation, determining whether the on-board electronic control unit has activated fuse protection includes: If the value corresponding to the fuse protection flag is the value corresponding to the activated fuse protection, then the vehicle electronic control unit has activated fuse protection. If the value corresponding to the fuse protection flag is the value corresponding to the fuse protection not being enabled, then the vehicle electronic control unit has not enabled the fuse protection.

[0008] In one possible implementation, the flash memory partition is either a primary running partition or a backup partition; the step of determining whether to perform a partition rollback operation for the vehicle electronic control unit based on the validity of each flash memory partition in the vehicle electronic control unit includes: If the valid flag corresponding to the primary running partition is invalid, and the valid flag corresponding to the backup partition is valid, then a rollback operation is initiated. If the valid flag corresponding to the main operating partition is valid, then the partition rollback operation will not be initiated for the vehicle electronic control unit.

[0009] In one possible implementation, the method further includes: If the valid flag corresponding to the main running partition is valid, then the rollback failure counter stored in the rollback circuit breaker management structure is cleared.

[0010] In one possible implementation, the partition rollback operation is monitored for anomalies according to the following steps: During the partition rollback operation, anomalies are monitored in one or more of the following dimensions: the return value of the flash drive, the CRC consistency check between each flash partition, the partition rollback operation duration, the power supply voltage, and the write verification of the rollback fuse management structure.

[0011] In one possible implementation, the step of monitoring for anomalies and obtaining the number of rollback failures during the partition rollback operation of the vehicle electronic control unit includes: Each time an abnormality in a partition rollback operation is detected, the corresponding value of the rollback failure counter stored in the rollback circuit breaker management structure is incremented.

[0012] Secondly, embodiments of this application also provide a fuse protection device, the device comprising: The judgment module is used to determine whether the vehicle electronic control unit has activated fuse protection when a preset fuse protection event of the vehicle electronic control unit is triggered. The judgment module is also used to determine whether the vehicle electronic control unit should start a partition rollback operation if the vehicle electronic control unit has not enabled the fuse protection. An anomaly monitoring module is used to monitor for anomalies during the partition rollback operation of the vehicle electronic control unit if a partition rollback operation is initiated for the vehicle electronic control unit, and to obtain the number of rollback failures. The circuit breaker protection module is used to activate circuit breaker protection for the vehicle electronic control unit if the number of rollback failures is greater than or equal to the preset number of rollback failures, set each flash memory partition to invalid, and perform a software reset on the vehicle electronic control unit to trigger the preset circuit breaker protection event. The operation restriction module is used to restrict the program operation of the vehicle electronic control unit according to preset restricted operation rules if the fuse protection of the vehicle electronic control unit has been activated.

[0013] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the fuse protection method as described in any of the first aspects.

[0014] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the circuit breaker protection method as described in any of the first aspects.

[0015] This application provides a fuse protection method, device, electronic device, and storage medium. The method includes: if the fuse protection of the vehicle electronic control unit (ECU) is not enabled, then based on the validity of each flash memory partition in the ECU, if the ECU initiates a partition rollback operation, anomaly monitoring is performed during the partition rollback operation to obtain the number of rollback failures; if the number of rollback failures is greater than or equal to a preset rollback number, then fuse protection is enabled for the ECU, and each flash memory partition is set to invalid; and the ECU is reset to trigger a preset fuse protection event; if fuse protection is enabled for the ECU, then the program execution of the ECU is restricted according to preset restricted operation rules. This application can achieve safe fuse protection and prevent cyclic failures, reducing after-sales maintenance costs. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of a fuse protection method provided in an embodiment of this application is shown; Figure 2 This application provides a flowchart illustrating the determination process for activating fuse protection according to an embodiment. Figure 3 This paper shows a schematic diagram of the structure of a fuse protection device provided in an embodiment of this application; Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0019] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] To enable those skilled in the art to utilize the content of this application, and in conjunction with the specific application scenario of "automotive electronic systems," the following implementation is provided. Those skilled in the art will be able to apply the general principles defined herein to other embodiments and application scenarios without departing from the spirit and scope of this application. Although this application is primarily described within the "automotive electronic systems field," it should be understood that this is merely an exemplary embodiment.

[0021] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0022] As automotive electronic and electrical architectures continue to evolve, the software functions of on-board electronic control units (ECUs) are becoming increasingly complex. Over-the-air (OTA) updates and local diagnostic flashing have become standard maintenance practices throughout the product lifecycle. To mitigate the risk of device failure due to data anomalies, power supply fluctuations, electromagnetic interference, and other factors during upgrades, the A / B dual-partition backup upgrade architecture is widely used in on-board controller design. This solution divides the Flash memory into two independent program storage partitions. During upgrades, it employs a "backup first, upgrade later, and rollback in case of an error" execution logic. This allows for automatic switching to the existing available partition if the new version of the program fails to boot, thus mitigating the risk of the controller becoming unusable due to upgrade failure and improving the security and reliability of software updates.

[0023] However, existing dual-partition rollback mechanisms generally suffer from a design flaw: a lack of protection against rollback anomalies. Traditional solutions only assess boot validity in cases of "partition program corruption," executing a fixed process of "invalid activation of partition → triggering backup partition rollback → restarting and attempting boot," without monitoring or mitigating risks during the rollback operation itself. In real-world engineering scenarios, rollback involves critical steps such as Flash erasure, data copying, and verification writing, making it susceptible to uncontrollable factors like physical Flash damage, abnormal erase / write drivers, power supply voltage drops, and strong electromagnetic interference, potentially leading to interruptions or data write errors during the rollback process.

[0024] When the rollback operation fails, the system will repeatedly determine that the active partition is invalid and continue to trigger the rollback process, thus forming an infinite loop of "rollback failure → system restart → rollback executed again". In this state, the ECU is completely locked in the loop restart process, unable to respond to external maintenance operations such as diagnostic tool commands and OTA server interactions. Software repair is not available on-site, and the fault can only be resolved by replacing the hardware controller, significantly increasing after-sales maintenance costs. At the same time, it is difficult to meet the relevant design requirements of ISO26262 functional safety and vehicle network security.

[0025] In view of this, embodiments of this application provide a fuse protection method, device, electronic device, and storage medium. The method includes: when a preset fuse protection event of an on-board electronic control unit (OECU) is triggered, determining whether the OECU has enabled fuse protection; if the fuse protection flag indicates that the OECU has not enabled fuse protection, determining whether the OECU should initiate a partition rollback operation based on the validity of each flash memory partition in the OECU; if the OECU has initiated a partition rollback operation, performing anomaly monitoring during the partition rollback operation to obtain the number of rollback failures; if the number of rollback failures is greater than or equal to a preset rollback number, enabling fuse protection for the OECU, invalidating each flash memory partition; and resetting the OECU to trigger the preset fuse protection event; if the OECU has enabled fuse protection, restricting the program execution of the OECU according to preset restricted operation rules. This application achieves safe fuse protection and prevents cyclic failures, reduces after-sales maintenance costs, and meets the relevant design requirements of ISO 26262 functional safety and on-board network security.

[0026] Reference Figure 1 The diagram shown is a flowchart of a fuse protection method provided in an embodiment of this application. The specific execution process of this method is as follows: S101. When the preset fuse protection event of the vehicle electronic control unit is triggered, determine whether the fuse protection of the vehicle electronic control unit has been activated.

[0027] In this embodiment, the fuse protection process is triggered when a preset fuse protection event occurs. The preset fuse protection events include power-on of the vehicle electronic control unit (ECU) and software reset. That is, when the ECU is powered on or undergoes a software reset, the first firmware program (Bootloader) executed by the ECU is started; and it is determined whether fuse protection has been enabled for the ECU.

[0028] The bootloader's power-down non-volatile memory (EEPROM) can store a rollback fuse management structure for determining fuse failure and rollback states. This rollback fuse management structure can include a fuse flag, valid flags for each Flash partition, and a rollback failure counter. Assuming the Flash partitions include partition A and partition B, Table 1 shows the extended definition table of the status word for the rollback fuse management structure provided in this embodiment: Table 1

[0029] Specifically, refer to Figure 2 The following is a flowchart illustrating the process of determining whether to activate fuse protection according to an embodiment of this application: S201. If the value corresponding to the fuse protection flag is the same as the value corresponding to the activated fuse protection flag, then the vehicle electronic control unit has activated the fuse protection.

[0030] In the embodiments of this application, the corresponding flag value for the activated fuse protection is 0x5A as shown in the table above.

[0031] S202. If the value corresponding to the fuse protection flag is the value corresponding to the fuse protection not being enabled, then the vehicle electronic control unit has not enabled the fuse protection.

[0032] S102. If the vehicle electronic control unit has not enabled fuse protection, determine whether the vehicle electronic control unit should initiate a partition rollback operation based on the validity of each flash memory partition in the vehicle electronic control unit.

[0033] In this embodiment, the success of the upgrade of the vehicle electronic control unit (ECU) can be determined by checking the validity of each flash memory partition in the ECU. If the upgrade is unsuccessful, a partition rollback operation needs to be initiated for the ECU, i.e., copying code from the backup partition to the main running partition. If the upgrade is successful, no rollback is required, and the ECU can operate normally. Specifically, the following steps are used to determine whether to initiate a partition rollback operation for the ECU: Step 1: If the valid flag corresponding to the primary running partition is invalid, and the valid flag corresponding to the backup partition is valid, then start the rollback operation.

[0034] In this embodiment, the flash partition can be either a primary running partition or a backup partition. A validity flag is used to indicate whether the flash partition is valid. If the validity flag corresponding to the primary running partition is invalid, but the validity flag corresponding to the backup partition is valid, it indicates that the upgrade of the vehicle electronic control unit has failed, and a rollback operation is initiated.

[0035] Step 2: If the valid flag corresponding to the main operating partition is valid, then the partition rollback operation will not be initiated for the vehicle electronic control unit.

[0036] In this embodiment of the application, if the valid flag corresponding to the main operating partition is valid, it indicates that the vehicle electronic control unit has been successfully upgraded. In this case, the partition rollback operation is not started for the vehicle electronic control unit, and the rollback failure counter stored in the rollback fuse management structure is cleared to prepare for the next fuse protection.

[0037] S103. If a partition rollback operation is initiated for the vehicle electronic control unit, anomaly monitoring will be performed during the partition rollback operation of the vehicle electronic control unit to obtain the number of rollback failures.

[0038] In this embodiment, during the partition rollback operation, anomaly monitoring is performed on one or more dimensions, including the return value of the flash drive, the CRC consistency check between each flash partition, the partition rollback operation duration, the power supply voltage, and the write verification of the rollback fuse management structure. Each time an anomaly is detected in the partition rollback operation, the corresponding value of the rollback failure counter stored in the rollback fuse management structure is incremented (by 1 each time). The value of the rollback failure counter represents the number of rollback failures.

[0039] Optionally, anomaly monitoring can be performed on the return values ​​of the flash drive: the flash drive returns an error code (erase / write operation returns a non-zero value), and the rollback operation is abnormal.

[0040] In this embodiment, Flash memory is the hardware that stores code / data (similar to a computer hard drive). Rollback essentially involves "copying" the code from the backup partition to the main running partition. This process requires first erasing the old data in the main running partition and then writing the new data. Normally, after erasing / writing is complete, the Flash driver returns "0" (representing success). Abnormally, a non-zero value (e.g., 1, 2, 0xFF) is returned, indicating that erasing / writing has failed (e.g., Flash hardware damage, address error).

[0041] Optionally, CRC consistency checks between various flash memory partitions are monitored: after the code of the backup partition is written to the main running partition, if the CRC check value corresponding to the code of the backup partition stored in the rollback circuit breaker management structure is inconsistent with the CRC check value corresponding to the code of the main running partition, the rollback operation is abnormal.

[0042] In the implementation of this application, CRC is equivalent to the "digital fingerprint" of the code - the code in the backup partition has a fixed CRC check value (e.g., 0x12345678). After the code is written to the main running partition, the CRC check value of the main running partition is recalculated. If it is different from that of the backup partition, it means that the data transmission during the copying process has failed (e.g., lost bytes, wrong bytes); the written code is incomplete / tampered with.

[0043] Optionally, the partition rollback operation duration can be monitored: if the write duration during this partition rollback operation exceeds the preset write duration threshold, the rollback operation is abnormal.

[0044] In this embodiment, the write duration can be the write duration for a single page or the copy duration for the entire area, and the corresponding preset write duration threshold can be 50ms or 500ms.

[0045] Here, Flash writing is done in "pages" (the smallest storage unit). Engineers have set two time thresholds based on hardware performance: Single-page write: Under normal circumstances, writing one page of data takes a maximum of 50 milliseconds (0.05 seconds); Full-area copy: Copying all code from the backup partition to the primary running partition takes a maximum of 500 milliseconds (0.5 seconds). Abnormal situations: Exceeding these times indicates slow Flash response, hardware lag, or even a bus (data transmission channel) failure.

[0046] Optionally, the power supply voltage can be monitored: if the power supply voltage of the vehicle electronic control unit is less than a preset minimum voltage threshold (e.g., 0.3V), the rollback operation is abnormal.

[0047] In the embodiments of this application, Flash erasure / writing requires a stable power supply voltage. For example, the hardware design requires a minimum of 3.0V to work normally. Under normal circumstances, the voltage is ≥3.0V and the Flash operation is stable. Under abnormal circumstances, the voltage is <3.0V (such as when the device battery is dead or the external power supply fluctuates). In this case, the data written is likely to be erroneous or even damage the Flash.

[0048] Optionally, write verification monitoring is performed on the rollback circuit breaker management structure: if the write values ​​of the circuit breaker flag and the rollback failure counter in the rollback circuit breaker management structure are inconsistent with the read values, the rollback operation is abnormal.

[0049] In this embodiment of the application, no write operation is performed between the write time corresponding to the write value and the readback time corresponding to the readback value.

[0050] Here, these flag values ​​are first written to EEPROM (a storage area that is not lost when power is off), and then immediately read back to compare whether they are consistent with the written values. Abnormal situation: if "1" is written but "0" is read back, it means that the flag bit was not written successfully.

[0051] S104. If the number of rollback failures is greater than or equal to the preset number of rollbacks, the fuse protection for the vehicle electronic control unit is activated, each flash memory partition is set to invalid, and the vehicle electronic control unit is software reset to trigger the preset fuse protection event.

[0052] In this embodiment, enabling fuse protection for the vehicle electronic control unit (ECU) means setting the corresponding value of the fuse flag in the rollback fuse management structure to the value corresponding to the enabled fuse protection flag. Setting each flash memory partition to invalid means setting the corresponding valid flag value for each flash partition in the rollback fuse management structure to the invalid flag value. After a software reset of the ECU, it can be determined again whether the ECU has enabled fuse protection, thereby restricting the program execution of the ECU according to preset restricted operation rules.

[0053] S105. If the on-board electronic control unit has activated its fuse protection, the program operation of the on-board electronic control unit shall be restricted according to the preset restricted operation rules.

[0054] In this application's implementation, the preset restricted operation rules include: (1) Only respond to the following UDS diagnostic services for the service whitelist: a. 0x10 (Session control, supports default / extended / programmable sessions).

[0055] In this application's implementation, maintenance personnel are allowed to switch the device's operating mode (default / extended / programming). For example, to re-flash the system, it is necessary to first switch to the "programming session," which is a basic prerequisite.

[0056] b. 0x27 (Secure access unlock).

[0057] In this embodiment, the device uses a "maintenance password verification". Only by entering the correct authorization password can subsequent operations such as flashing and clearing the counter be performed, preventing malicious operations.

[0058] c. 0x31 (Routine control, providing 0xFF01 to clear the fuse counter routine).

[0059] In this application implementation, the core maintenance command is used by the engineer after troubleshooting the problem to clear the "fuse counter" (reset Fuse_Flag), allowing the device to exit the fuse-out state and restore normal startup logic.

[0060] d, 0x34 / 36 / 37 (Download service, supports full package flashing).

[0061] In this embodiment, full software package flashing is supported. For example, if all flash memory partitions are damaged, engineers can use this set of instructions to rewrite the complete system package into the device to repair the damaged partitions.

[0062] Here, UDS diagnostic service refers to equipment debugging / repair instructions commonly used in the automotive / industrial control field (which can be understood as a "set of equipment repair instructions"). The "whitelist" means that only these few instructions are allowed to take effect, while all other instructions are rejected.

[0063] 2. Disable jump service: Deny execution of 0x11 (ECU reset) to enter the application layer to prevent invalid rollback from being triggered again.

[0064] In this application implementation, the 0x11 instruction is "to restart the device and start the main system (application layer)". This instruction is disabled after the fuse is blown. Even if the maintenance personnel send a "reset and start" instruction, the device will not execute it - because at this time all flash memory partitions are bad. Starting the main system will only trigger an invalid rollback again, causing the device to freeze.

[0065] 3. Status Indication: The fault status word (0x5A5A) is sent periodically via CAN message and an external LED is driven to flash at a frequency of 1Hz to alert maintenance personnel and force the equipment to remain in Bootloader maintenance mode to prevent accidental operation from causing the equipment to fall back into the fault loop.

[0066] In this embodiment, the CAN bus serves as the communication channel between the device and an external controller / diagnostic instrument. A fixed fault code 0x5A5A is sent, and the diagnostic instrument can immediately identify that "the device has entered the fuse protection state." Maintenance personnel can determine the fault type without disassembling the device. This provides a clear hardware-level indication—even without a diagnostic instrument, maintenance personnel can determine that the device has triggered fuse protection and requires repair simply by looking at the indicator lights.

[0067] 4. Timing optimization: Startup time has been reduced from the normal 150ms to 50ms by skipping all partition detection logic.

[0068] In this implementation, during normal startup (without circuit breaker): the bootloader needs to spend 150ms checking the validity of all flash partitions, verifying CRC, reading version numbers, etc., and only starts the system after confirming that there are no problems. During startup after circuit breaker: all partition detection logic is skipped (because all partitions are marked as invalid, so detection is useless), and the system directly enters the restricted operation mode, reducing the startup time to 50ms.

[0069] In addition, this application also provides a mechanism for clearing the fuse status after fuse protection has been activated. Maintenance personnel or OTA platforms can clear the fuse status and restore the system through the following process: Step 1: Connect the diagnostic tool to the vehicle's electronic control unit (ECU) and enter the extended session (0x10 0x03).

[0070] In this embodiment, the diagnostic instrument establishes diagnostic communication with the ECU, sends the UDS session control command 0x100x03, switches the ECU from the default session to the extended diagnostic session, and unlocks advanced operating privileges.

[0071] Step 2: Perform a security unlock (0x27) to obtain Level 2 privileges.

[0072] In this embodiment of the application, the UDS secure access command 0x27 is sent in the extended session to complete two-way authentication. After the ECU verifies the authentication, Level 2 operation permissions (fuse clearing and partition flashing permissions) are granted.

[0073] Step 3: Send routine control command: 0x31 0x01 0xFF 0x01.

[0074] In this embodiment of the application, the UDS routine control instruction 0x31 0x01 0xFF0x01 (0x01 is the startup routine, and 0xFF01 is the dedicated sub-function for clearing the circuit breaker) is sent in the extended session to trigger the Bootloader to execute the circuit breaker clearing logic.

[0075] Step 4: After receiving the instruction, the firmware program Bootloader erases the Fuse_Flag and Rollback_Fail_Cnt fields in the EEPROM.

[0076] In this embodiment, the Bootloader responds to routine control instructions by erasing the fuse flag (Fuse_Flag) and rollback failure counter (Rollback_Fail_Cnt) stored in the non-volatile memory area (EEPROM), and resetting the fuse protection state. Erasing does not mean deleting the field; it means setting the fuse flag (Fuse_Flag) to indicate that fuse protection is not enabled and clearing the rollback failure counter to zero.

[0077] Step 5: The diagnostic instrument starts the software download process (0x34 / 36 / 37), forcibly flashing the complete code of all dual partitions.

[0078] In this embodiment, the diagnostic tool sends a UDS download command (0x34 Request Download, 0x36 Transfer Data, 0x37 Request Exit Download) in an extended session to force the writing of complete application code to all flash memory partitions of the ECU and complete the partition validity verification.

[0079] Step 6: After the flashing is complete, perform an ECU reset (0x11 0x01), and the system will resume the normal boot process.

[0080] Based on the same inventive concept, this application also provides a fuse protection device corresponding to the fuse protection method. Since the principle of the device in this application is similar to that of the fuse protection method described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0081] Reference Figure 3 The diagram shown is a schematic of a fuse protection device provided in an embodiment of this application. The device includes: The judgment module 301 is used to determine whether the vehicle electronic control unit has enabled fuse protection when a preset fuse protection event of the vehicle electronic control unit is triggered. The judgment module 301 is also used to determine whether the vehicle electronic control unit should start a partition rollback operation if the vehicle electronic control unit has not enabled the fuse protection. The anomaly monitoring module 302 is used to perform anomaly monitoring during the partition rollback operation of the vehicle electronic control unit if a partition rollback operation is initiated for the vehicle electronic control unit, and to obtain the number of rollback failures. The fuse protection module 303 is used to activate fuse protection for the vehicle electronic control unit if the number of rollback failures is greater than or equal to the preset number of rollbacks, set each flash memory partition to invalid, and perform a software reset on the vehicle electronic control unit to trigger the preset fuse protection event. The operation restriction module 304 is used to restrict the program operation of the vehicle electronic control unit according to preset restricted operation rules if the fuse protection of the vehicle electronic control unit has been activated.

[0082] In one possible implementation, the device further includes a startup module 305, which, before determining whether the vehicle electronic control unit has activated fuse protection, is used to start the first firmware program executed by the vehicle electronic control unit; the firmware program stores a rollback fuse management structure in its power-down non-volatile storage area, used to determine the fuse and rollback status; the rollback fuse management structure includes a fuse flag, valid flags corresponding to each Flash partition, and a rollback failure counter.

[0083] In one possible implementation, the determination module 301 is specifically used to determine if the value corresponding to the fuse protection flag is the value corresponding to the activated fuse protection, then the vehicle electronic control unit has activated fuse protection; if the value corresponding to the fuse protection flag is the value corresponding to the deactivated fuse protection, then the vehicle electronic control unit has deactivated fuse protection.

[0084] In one possible implementation, the flash memory partition is either a primary running partition or a backup partition; the judgment module 301 is specifically used to initiate a rollback operation if the valid flag corresponding to the primary running partition is invalid and the valid flag corresponding to the backup partition is valid; if the valid flag corresponding to the primary running partition is valid, then the partition rollback operation is not initiated for the vehicle electronic control unit.

[0085] In one possible implementation, the device further includes: a reset module 306; The clearing module 306 is used to clear the rollback failure counter stored in the rollback circuit breaker management structure if the valid flag corresponding to the main running partition is valid.

[0086] In one possible implementation, the anomaly monitoring module 302 is specifically configured to perform anomaly monitoring on the partition rollback operation according to the following steps: During the partition rollback operation, anomalies are monitored in one or more of the following dimensions: the return value of the flash drive, the CRC consistency check between each flash partition, the partition rollback operation duration, the power supply voltage, and the write verification of the rollback fuse management structure.

[0087] In one possible implementation, the anomaly monitoring module 302 is specifically used to increment the corresponding value of the rollback failure counter stored in the rollback circuit breaker management structure each time an anomaly in the partition rollback operation is detected.

[0088] This device enables safe fuse breaking and prevents cyclical failures, reducing after-sales maintenance costs.

[0089] like Figure 4 As shown in the embodiment of this application, an electronic device 400 includes a processor 401, a memory 402, and a bus. The memory 402 stores machine-readable instructions that can be executed by the processor 401. When the electronic device is running, the processor 401 communicates with the memory 402 via the bus, and the processor 401 executes the machine-readable instructions to perform the steps of the above-described fuse protection method.

[0090] Specifically, the memory 402 and processor 401 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 401 runs the computer program stored in the memory 402, it can execute the above-mentioned circuit breaker protection method.

[0091] Corresponding to the above-described fuse protection method, this application embodiment also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the above-described fuse protection method.

[0092] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0093] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0094] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0095] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0096] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A fuse protection method, characterized in that, The method includes: When a preset fuse protection event of the vehicle electronic control unit is triggered, determine whether the fuse protection of the vehicle electronic control unit has been activated. If the vehicle electronic control unit does not enable fuse protection, then determine whether the vehicle electronic control unit should initiate a partition rollback operation based on the validity of each flash memory partition in the vehicle electronic control unit. If a partition rollback operation is initiated for the vehicle electronic control unit, anomaly monitoring is performed during the partition rollback operation of the vehicle electronic control unit to obtain the number of rollback failures. If the number of rollback failures is greater than or equal to the preset number of rollbacks, then the fuse protection for the vehicle electronic control unit is activated, each flash memory partition is set to invalid, and the vehicle electronic control unit is software reset to trigger the preset fuse protection event. If the vehicle electronic control unit has activated its fuse protection, the program operation of the vehicle electronic control unit will be restricted according to preset restricted operation rules.

2. The fuse protection method according to claim 1, characterized in that, Before determining whether the on-board electronic control unit has activated its fuse protection, the method further includes: The first firmware program executed by the vehicle electronic control unit is started; the power-down non-volatile storage area of ​​the firmware program stores a rollback fuse management structure, which is used to determine the fuse and rollback status; the rollback fuse management structure includes a fuse flag, a valid flag corresponding to each Flash partition, and a rollback failure counter.

3. The fuse protection method according to claim 2, characterized in that, The determination of whether the vehicle electronic control unit has activated fuse protection includes: If the value corresponding to the fuse protection flag is the value corresponding to the activated fuse protection, then the vehicle electronic control unit has activated fuse protection. If the value corresponding to the fuse protection flag is the value corresponding to the fuse protection not being enabled, then the vehicle electronic control unit has not enabled the fuse protection.

4. The fuse protection method according to claim 2, characterized in that, The flash memory partition is either the primary running partition or a backup partition; the step of determining whether to perform a partition rollback operation for the vehicle electronic control unit based on the validity of each flash memory partition in the vehicle electronic control unit includes: If the valid flag corresponding to the primary running partition is invalid, and the valid flag corresponding to the backup partition is valid, then a rollback operation is initiated. If the valid flag corresponding to the main operating partition is valid, then the partition rollback operation will not be initiated for the vehicle electronic control unit.

5. The fuse protection method according to claim 4, characterized in that, The method further includes: If the valid flag corresponding to the main running partition is valid, then the rollback failure counter stored in the rollback circuit breaker management structure is cleared.

6. The fuse protection method according to claim 2, characterized in that, The following steps are used to monitor for anomalies in the partition rollback operation: During the partition rollback operation, anomalies are monitored in one or more of the following dimensions: the return value of the flash drive, the CRC consistency check between each flash partition, the partition rollback operation duration, the power supply voltage, and the write verification of the rollback fuse management structure.

7. The fuse protection method according to claim 1 or 6, characterized in that, The process of performing a partitioned rollback operation on the vehicle electronic control unit includes anomaly monitoring to obtain the number of rollback failures, including: Each time an abnormality in a partition rollback operation is detected, the corresponding value of the rollback failure counter stored in the rollback circuit breaker management structure is incremented.

8. A fuse protection device, characterized in that, The device includes: The judgment module is used to determine whether the vehicle electronic control unit has activated fuse protection when a preset fuse protection event of the vehicle electronic control unit is triggered. The judgment module is also used to determine whether the vehicle electronic control unit should start a partition rollback operation if the vehicle electronic control unit has not enabled the fuse protection. An anomaly monitoring module is used to monitor for anomalies during the partition rollback operation of the vehicle electronic control unit if a partition rollback operation is initiated for the vehicle electronic control unit, and to obtain the number of rollback failures. The circuit breaker protection module is used to activate circuit breaker protection for the vehicle electronic control unit if the number of rollback failures is greater than or equal to the preset number of rollback failures, set each flash memory partition to invalid, and perform a software reset on the vehicle electronic control unit to trigger the preset circuit breaker protection event. The operation restriction module is used to restrict the program operation of the vehicle electronic control unit according to preset restricted operation rules if the fuse protection of the vehicle electronic control unit has been activated.

9. An electronic device, characterized in that, include: The device includes a processor, a storage medium, and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is in operation, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the fuse protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the circuit breaker protection method as described in any one of claims 1 to 7.

Images