An over-the-air firmware update method and electronic control unit

Abstract

The present application relates to an over-the-air firmware update method and an electronic control unit. The over-the-air firmware update method of the present application is used to update a first firmware loaded in a first storage area and a second storage area into a second firmware, and the method comprises the following steps: creating a first hash table and a second hash table for the first firmware and the second firmware respectively, wherein the second hash table comprises at least a change identifier used to identify whether a sector of the second firmware is changed relative to the first firmware; loading the second firmware and the second hash table in the second storage area; exchanging the identities of the second storage area and the first storage area; and synchronizing the second storage area with the first storage area based on the change identifier. According to the present application, the version can be prevented from being rolled back due to the rollback operation, the flash operation time can be saved, and the update efficiency can be improved.

Description

Technical Field

[0001] This invention relates to computer technology, and more specifically to an over-the-air firmware update method and an electronic control unit. Background Technology

[0002] Figure 1 This is a schematic diagram illustrating the FOTA (Firmware Over-The-Air) process for a single electronic control unit in the prior art.

[0003] FOTA (Firmware Over-the-Air) is becoming the mainstream method for updating the firmware of Electronic Control Units (ECUs). In FOTA, the flash memory in the ECU is divided into two parts: active storage area A (i.e., Bank A, hereinafter also referred to as storage area A), which is the area where the ECU is currently running; and backup storage area B (i.e., Bank B, hereinafter also referred to as storage area B), which is used to store newly installed firmware.

[0004] The FOTA solution ensures that the controller still has usable software even if the firmware upgrade fails. However, there are some issues with FOTA solutions where version rollback operations can lead to version reversion. Version rollback will reintroduce fixed issues and may cause incompatibility problems with other controllers in the vehicle network. Summary of the Invention

[0005] In view of the problems in the prior art, the present invention aims to provide an over-the-air firmware update method and an electronic control unit that can avoid version rollback due to rollback operations.

[0006] The disclosed over-the-air firmware update method is used to update the first firmware loaded in the first storage area and the second storage area to the second firmware. The method includes the following steps:

[0007] A first hash table and a second hash table are created for the first firmware and the second firmware respectively. The second hash table includes at least a change identifier for identifying whether the sectors of the second firmware have been changed relative to the first firmware.

[0008] Load the second firmware and the second hash table into the second storage area;

[0009] The identities of the second storage area and the first storage area are swapped; and

[0010] The second storage area is synchronized with the first storage area based on the changed identifier. Attached Figure Description

[0011] Figure 1 This is a schematic diagram illustrating the FOTA (Firmware Over-The-Air) process for a single electronic control unit in the prior art.

[0012] Figure 2 This is a diagram illustrating the rollback operation.

[0013] Figure 3 This shows the ownership of storage area A and storage area B.

[0014] Figure 4 This is a schematic diagram of a hash table.

[0015] Figure 5 This is a detailed flowchart of one embodiment of the over-the-air firmware update method of the present invention.

[0016] Figure 6 This represents a data stream for a sample hexadecimal file post-processing step.

[0017] Figure 7 This is a diagram illustrating the concept of storage partitioning.

[0018] Figure 8 This indicates the synchronization process of a single sector. Detailed Implementation

[0019] The following are some of the various embodiments of the present invention, intended to provide a basic understanding of the invention, and not intended to identify key or decisive elements of the invention or to limit the scope of protection.

[0020] First, the inventors of this invention studied the FOTA process in the prior art.

[0021] Figure 1 This is a schematic diagram illustrating the existing FOTA (Firmware Over-The-Air) process for a single ECU.

[0022] like Figure 1 As shown, the existing FOTA process for a single ECU can be divided into the following three stages:

[0023] Initial stage S1: The ECU has two storage areas, namely storage area A ( Figure 1 (represented by A in the middle) and storage area B ( Figure 1 The initial firmware version (Ver.0) is installed in storage area A (represented by B). The arrow below points to storage area A, indicating that the ECU is running the firmware in storage area A, while storage area B is in a non-running state.

[0024] Firmware loading stage S2: Firmware Ver.1 is programmed into storage area B. At the same time, the ECU is still running the old firmware Ver.0 in storage area A. The arrow below points to storage area A, which means that the ECU is running the firmware in storage area A and storage area B is in a non-running state.

[0025] Storage Area Exchange Phase S3: Storage Area A and Storage Area B exchange their identities. Storage Area A runs the newly installed firmware Ver.1, while Storage Area B retains the old firmware Ver.0. The arrow below points to Storage Area A, indicating that the ECU is running the firmware in Storage Area A and Storage Area B is in a non-running state. This means that the system has successfully switched to the new firmware version while retaining the old version as a backup.

[0026] However, in the existing technology, no other operations are performed after the storage areas are swapped, and the two storage areas retain different firmware versions. That is, storage area A is switched to the new firmware version, but storage area B still retains the old firmware version. In this case, when the ECU encounters a serious fault, it will perform a rollback operation, which may lead to a firmware version rollback.

[0027] Figure 2 This is a diagram illustrating the rollback operation.

[0028] like Figure 2 As shown, storage area A ( Figure 2 In the storage area (represented by A), the old firmware version (Ver.0) is stored, and storage area B (… Figure 2 The section labeled B stores the new firmware version (Ver.1). During a rollback operation, the firmware version switches from Ver.1 to Ver.0. Figure 2 The F area in the diagram indicates areas where problems may arise after a rollback. Such a rollback operation would reintroduce fixed issues and may also introduce incompatibility problems with other controllers in the vehicle network.

[0029] Based on the above research on the prior art, the inventors of this invention have proposed the over-the-air firmware update method of this invention.

[0030] The over-the-air firmware update method of the present invention enables the software in two storage areas (storage area A and storage area B) to maintain the same version in a low-cost manner. The concept of the over-the-air firmware update method of the present invention mainly includes the following steps:

[0031] Create a hash table for each storage area;

[0032] After the newly installed firmware is running stably (i.e., after the FOTA process is completed), hash tables are compared to identify the modified memory areas; and

[0033] Synchronize storage area B with storage area A.

[0034] Figure 3 This shows the ownership of storage area A and storage area B.

[0035] Storage area A and storage area B are flash memory storage areas. Each storage area consists of multiple sectors. A sector is the smallest unit of an erase operation, and storage areas A and B have the same storage size and sector distribution. Figure 3 As shown, firmware version 1 (represented as Ver.1) is used in storage area A. Storage area A contains multiple sectors (Sec 0, Sec 1, Sec 2, Sec 3, etc.), and the "H" at the bottom indicates that the storage area contains a hash table. Firmware version 0 (represented as Ver.0) is used in storage area B. Storage area B also contains multiple sectors (Sec 0, Sec 1, Sec 2, Sec 3, etc.), and the "H" at the bottom indicates that the storage area contains a hash table.

[0036] Figure 4 This is a schematic diagram of a hash table.

[0037] like Figure 4 As shown, a hash table is used to record the state of each sector in the flash memory storage area. As an example, a hash table contains the following:

[0038] L1: Sector ID, a unique identifier for each sector;

[0039] L2: StartOffset, representing the starting address offset of this sector in the flash memory storage area;

[0040] L3: EndOffset, representing the end address offset of this sector in the flash memory storage area;

[0041] L4: Hash (hash value), representing the hash value of the contents of this sector;

[0042] L5: Changed (change flag), used to identify whether the data in this sector has been changed. N indicates no change, and Y indicates that it has been changed.

[0043] from Figure 4 As shown, the hash table records the status of five sectors (sector IDs from 0 to 4). Each sector has a corresponding start offset, end offset, hash value, and change flag. For example, sector ID 0 has a start offset of 0x00001000, an end offset of 0x00001FFF, a hash value of 0xAAAAAAAA, and this sector has not been changed. Furthermore, the hash table is stored within a specific sector of the flash memory storage area.

[0044] Figure 5 This is a detailed flowchart of one embodiment of the over-the-air firmware update method of the present invention.

[0045] like Figure 5As shown, the over-the-air firmware update method of the present invention can be divided into three main steps:

[0046] Hexadecimal file post-processing step S100;

[0047] Flash memory and storage area exchange step S200; and

[0048] Synchronization step S300.

[0049] In this invention, the post-processing step S100 and the synchronization step S300 of the hexadecimal file have been improved. The flash memory and storage area exchange step S200 is a conventional FOTA process (which includes a loading process of compiling the new firmware into storage area B and a swapping process of exchanging the identities of storage area A and storage area B). The specific description of the flash memory and storage area exchange step S200 is omitted here.

[0050] Next, the content of the hexadecimal file post-processing step S100 and the synchronization step S300 will be described in detail.

[0051] The hexadecimal file post-processing step S100 includes the following sub-steps:

[0052] S101: Calculate the hash value of each sector and record it in the active hash table (in... Figure 5 The activity hash table is represented as AT).

[0053] S102: Traverse all physical flash sectors, read inactive hash tables from the old firmware's HEX file with hash tables (in... Figure 5 The active hash table (INAT) is used to compare the active and inactive hash tables. HEX files refer to files represented in hexadecimal format.

[0054] S103: Based on the comparison between the active hash table and the inactive hash table, if a difference is found between the two, set the "change flag" of the relevant sector to "Y";

[0055] S104: Update the hash table; and

[0056] S105: Merge the hash table into the HEX file of the new firmware.

[0057] Figure 6 This represents a data stream for a sample hexadecimal file post-processing step.

[0058] like Figure 6 As shown, the input data (IN1 and IN2) for the hexadecimal file post-processing step S100 includes:

[0059] IN1: The hexadecimal file of the new firmware, which refers to the HEX file of the new firmware that needs to be processed;

[0060] IN2: Hexadecimal file and hash table of old firmware, referring to the HEX file of old firmware and its corresponding hash table.

[0061] The output data (O) of the hexadecimal file post-processing step includes: the new firmware's HEX file and its corresponding hash table.

[0062] In synchronization step S300, all sectors are traversed and their "modified flags" are checked. Modified sectors are added to the synchronization list. If the synchronization list is empty, synchronization step S300 ends. If the synchronization list is not empty, the sectors in the list in storage area B are synchronized with the corresponding sectors in storage area A. Specifically, the relevant software blocks are marked as invalid, the modified sectors in storage area B are erased, the sector data in storage area A is copied to the RAM buffer, and the data in the RAM buffer is programmed into the sectors in storage area B. After all sectors are synchronized, the hash table in storage area B is updated, all "modified" flags are set to "N", and the relevant software blocks are marked as valid. All erase and programming operations in synchronization step S300 are performed in storage area B.

[0063] Specifically, such as Figure 5 As shown, synchronization step S300 includes the following sub-steps:

[0064] Step S301: Begin;

[0065] Step S302: Set variable n = -1;

[0066] Step S303: n = n + 1;

[0067] Step S304: Retrieve the entry related to sector n from the hash table;

[0068] Step S305: Check the "Change Flag". If the "Change Flag" is "N", it means that there is no change (N). Then continue to step S307. If the "Change Flag" is "Y", it means that there is a change (Y). Then continue to step S306.

[0069] Step S306: For the modified sector, add it to the synchronization list;

[0070] Step S307: Determine if this is the last sector. If yes (Y), continue to step S308. If no (N), return to step S302.

[0071] Step S308: Determine if the synchronization list is empty. If yes (Y), proceed to step S314. If no (N), continue to step S309.

[0072] Step S309: Obtain the sector from the synchronization list;

[0073] Step S310: Mark the relevant software block as invalid;

[0074] Step S311: Erase the altered sectors in storage area B;

[0075] Step S312: Copy data from storage area A to RAM buffer;

[0076] Step S313: Program the modified sector in storage area B;

[0077] Step S314: Determine whether it is the last sector in the synchronization list. If yes (Y), continue to step S314; if no (N), return to step S309.

[0078] Step S315: Update the hash table of storage area B;

[0079] Step S316: Mark the relevant software block as valid;

[0080] Step S317: Synchronization ends.

[0081] In step S310, the “related software block” refers to a logical block that contains sectors in the synchronization list, such as a “bootloader” or “application software section”.

[0082] To more clearly describe the relationship between storage areas, logical blocks, and sectors, please refer to [reference needed]. Figure 7 , Figure 7 This is a diagram illustrating the concept of storage partitioning. For example... Figure 7 As shown, the outermost circle C1 represents the storage area, the middle circle C2 represents the logical block, and the innermost circle C3 represents the sector. That is to say, the storage area is the largest concept, and the sector is the smallest concept. The storage area includes logical blocks, and the logical blocks further include sectors.

[0083] Figure 8 This indicates the synchronization process of a single sector.

[0084] Figure 8 The described process corresponds to steps S311 to S313 in the above explanation. For example... Figure 8As shown, when a sector (e.g., Sec:2) in storage area B is marked, the modified sector in storage area B is erased. Then, the data in sector Sec:2 of storage area A is copied to the RAM buffer, and the data in the RAM buffer is programmed into sector Sec:2 of storage area B. Thus, erasing the modified sector in storage area B, copying the data from storage area A to the RAM buffer, and then programming the data in the RAM buffer into the sector of storage area B achieves a synchronization process that ensures data consistency between storage areas A and B.

[0085] As described above, according to the over-the-air firmware update method of the present invention, after the synchronization step, the two storage areas in the ECU will be completely identical, thus ensuring that even if a rollback or accidental storage area swap occurs, firmware rollback and the resulting compatibility issues will not occur.

[0086] Furthermore, according to the over-the-air firmware update method of the present invention, the hash table designed by the present invention can quickly locate the storage area that needs to be synchronized. In particular, in the hexadecimal file post-processing step, by judging based on the "change flag", the computationally expensive hash calculation can be avoided on the ECU.

[0087] Moreover, in most cases, firmware updates involve only a small number of software modules, thus requiring only a small number of memory areas to be updated. For example, taking the widely used microcontroller TC375 as an example, each memory area has 192 sectors, and in the best case, synchronization involves only 3 sectors, thereby saving 98.4% of flash memory operation time according to the over-the-air firmware update method of the present invention.

[0088] The present invention also provides an over-the-air firmware update system, comprising: a compilation tool and an electronic control unit, wherein the compilation tool is used to create a first hash table and a second hash table for a first firmware and a second firmware respectively, the second hash table including at least a change identifier for identifying whether the second firmware has changed a sector relative to the first firmware, the electronic control unit having a first storage area and a second storage area, wherein the first firmware has been loaded in the first storage area and the second storage area, the control unit being used to perform the following operations: loading the second firmware and the second hash table in the second storage area; exchanging identities between the second storage area and the first storage area; and synchronizing the second storage area with the first storage area based on the change identifier.

[0089] The present invention also provides an electronic control unit having a first storage area and a second storage area, wherein a first firmware is loaded in the first storage area and the second storage area, and the electronic control unit is configured to perform the following operations: loading a second firmware and a second hash table in the second storage area, wherein a first hash table and a second hash table are created using compilation tools for the first firmware and the second firmware respectively, and the second hash table includes at least a change identifier for identifying whether the second firmware has changed sectors relative to the first firmware; exchanging identities between the second storage area and the first storage area; and synchronizing the second storage area with the first storage area based on the change identifier.

[0090] The present invention also provides a battery management system having a first storage area and a second storage area, wherein a first firmware is stored in the first storage area, and the battery management system is configured to perform the following operations: loading a second firmware and a second hash table in the second storage area, wherein a first hash table and a second hash table are created using compilation tools for the first firmware and the second firmware respectively, and the second hash table includes at least a change identifier for identifying whether the second firmware has changed sectors relative to the first firmware; exchanging identities between the second storage area and the first storage area; and synchronizing the second storage area with the first storage area based on the change identifier.

[0091] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned over-the-air firmware update method.

[0092] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Those skilled in the art can conceive of other feasible variations or substitutions based on the technical scope disclosed in this application, and such variations or substitutions are all covered within the scope of protection of this application. Where there is no conflict, the embodiments and features described in the embodiments of this application can also be combined with each other. The scope of protection of this application is determined by the claims.

Claims

1. An over-the-air firmware update method, characterized in that, This method is used to update the first firmware loaded in the first storage area and the second storage area to the second firmware. The method includes the following steps: A first hash table and a second hash table are created for the first firmware and the second firmware respectively. The second hash table includes at least a change identifier for identifying whether the sectors of the second firmware have been changed relative to the first firmware. Load the second firmware and the second hash table into the second storage area; The identities of the second storage area and the first storage area are swapped; and The second storage area is synchronized with the first storage area based on the changed identifier.

2. The over-the-air firmware update method as described in claim 1, characterized in that, The step of creating a first hash table and a second hash table for the first firmware and the second firmware respectively includes: For the first firmware, the hash value of each sector is calculated to build the first hash table; For the second firmware, the hash value of each sector is calculated to build a second hash table; Compare the first hash table and the second hash table; If the first hash table and the second hash table are different, update the second hash table to include the change identifier.

3. The over-the-air firmware update method as described in claim 1, characterized in that, The first hash table and the second hash table further include: The identifier of each sector, the start position of each sector, the end position of each sector, and the hash value of each sector.

4. The over-the-air firmware update method as described in claim 3, characterized in that, The step of synchronizing the second storage area with the first storage area based on the changed identifier includes: Based on the change identifier, add the identifier of the changed sector to the synchronization list; If the synchronization list is not empty, the sectors in the second storage area are synchronized with the corresponding sectors in the first storage area according to the sector identifier; If the synchronization list is empty, synchronization ends.

5. The over-the-air firmware update method as described in claim 4, characterized in that, The step of synchronizing the sectors in the second storage area with the corresponding sectors in the first storage area according to the sector identifier includes: Mark the logical block in the second memory area where the target sector identified by the sector identifier is located as invalid; Erase the data in the target sector of the second storage area; Copy the data of the sector corresponding to the target sector in the first storage area to the buffer; The data in the buffer is loaded into the target sector of the second storage area.

6. The over-the-air firmware update method as described in claim 1, characterized in that, The first storage area and the second storage area have the same storage size and sector distribution.

7. An over-the-air firmware update system, comprising: The compilation tools and electronic control unit are characterized by, The compilation tool is used to create a first hash table and a second hash table for the first firmware and the second firmware, respectively. The second hash table includes at least a change identifier to identify whether the sectors of the second firmware have been modified relative to the first firmware. The electronic control unit has a first storage area and a second storage area, in which first firmware has been loaded. The control unit is used to perform the following operations: Load the second firmware and the second hash table into the second storage area; The identities of the second storage area and the first storage area are swapped; and The second storage area is synchronized with the first storage area based on the changed identifier.

8. An electronic control unit having a first storage area and a second storage area, wherein first firmware is loaded in the first storage area and the second storage area, characterized in that, The electronic control unit is used to perform the following operations: The second firmware and the second hash table are loaded in the second storage area. The first hash table and the second hash table are created using the compilation tool for the first firmware and the second firmware respectively. The second hash table includes at least a change identifier for identifying whether the sectors of the second firmware have been changed relative to the first firmware. The identities of the second storage area and the first storage area are swapped; and The second storage area is synchronized with the first storage area based on the changed identifier.

9. A battery management system, comprising a first storage area and a second storage area, wherein first firmware is stored in the first storage area, characterized in that, The battery management system is used to perform the following operations: The second firmware and the second hash table are loaded in the second storage area. The first hash table and the second hash table are created using the compilation tool for the first firmware and the second firmware respectively. The second hash table includes at least a change identifier for identifying whether the sectors of the second firmware have been changed relative to the first firmware. The identities of the second storage area and the first storage area are swapped; and The second storage area is synchronized with the first storage area based on the changed identifier.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the over-the-air firmware update method according to any one of claims 1 to 6.

Images