Battery management system software upgrade mode selectable method and system

Abstract

The application discloses a battery management system software upgrade mode selectable method and system, relates to the technical field of battery management systems, and aims to solve the problem of insufficient scene adaptability of a single upgrade mode. The application divides a nonvolatile storage unit into a main program running area, an application program standby storage area and a configuration information area, provides two selectable modes of online upgrade and BOOT upgrade, can select a corresponding upgrade process according to a vehicle state and an application program running state, completes program switching according to a program running mark by a Bootloader, and adopts a fault safety mechanism in the dual modes, so that the upgrade continuity and reliability are considered, and the upgrade demand of multiple scenes is adapted.

Description

Technical Field

[0001] This invention relates to the field of battery management system technology, and in particular to a software upgrade method and corresponding system for a battery management system. Background Technology

[0002] The battery management system (BMS) is the core control component of a power battery system, and its software function iterations and defect repairs all rely on software upgrade mechanisms. Currently, mainstream BMS software upgrade technologies are mainly divided into two categories: BOOT upgrades and online upgrades. Figure 4 As shown.

[0003] The working principle of BOOT upgrade is as follows: The system resets and enters the Bootloader, which receives the upgrade data and writes it to the non-volatile storage unit. After the writing is completed, the system resets and starts the new application. During the upgrade process, the BMS business code completely stops running. Most existing BMS upgrade solutions only support the BOOT upgrade method, which has the following limitations:

[0004] Firstly, the BMS stops working during the upgrade, interrupting the monitoring of battery voltage, current, temperature, and other statuses, which poses a safety hazard.

[0005] Secondly, it cannot handle emergency upgrade scenarios. If the BMS is performing critical protection functions such as over-temperature protection, the upgrade must wait for a safe time.

[0006] Third, vehicle-related functions become unusable during the upgrade process, resulting in a poor user experience.

[0007] The working principle of online upgrades is as follows: During application operation, upgrade data is received and written to a backup storage area via a background thread or task. After the data writing is complete, the system resets and switches to the new application; business code continues to run during the upgrade process. However, existing online upgrade solutions only offer a single online upgrade mode, which has the following shortcomings:

[0008] First, online upgrades rely on the application running normally. If the application has serious defects that cause the system to reset frequently, the online upgrade cannot be completed normally.

[0009] Secondly, in the scenario of batch flashing on the production line, the data transmission efficiency of online upgrades is lower than that of BOOT upgrades;

[0010] Third, the resource consumption during application runtime can affect the reliability of upgrade data transmission.

[0011] In summary, existing BMS software upgrade solutions can only support a single upgrade mode, lack a flexible mode selection mechanism, and cannot match the optimal upgrade method based on actual scenario factors such as vehicle status, network conditions, and application running status. It is difficult to simultaneously ensure the continuity, reliability, and comprehensive applicability of the upgrade. Summary of the Invention

[0012] To address the shortcomings of existing technologies, the technical problem this invention aims to solve is to provide a method and system for selecting optional software upgrade modes for a battery management system, supporting flexible selection between online upgrade and BOOT upgrade modes to adapt to different application scenarios, while ensuring the safety and reliability of the upgrade process.

[0013] To achieve the above objectives, the present invention provides the following technical solution:

[0014] On one hand, the present invention provides a method for selecting a battery management system software upgrade mode, comprising the following steps:

[0015] S1. Storage partitioning steps: Logically divide the non-volatile storage unit of the BMS into the main program running area, the application spare storage area, and the configuration information area; the main program running area is used to store the currently running application, the application spare storage area is used to store the new application to be upgraded, and the configuration information area is used to store the program running flag and upgrade-related configuration information.

[0016] S2. Mode Negotiation and Selection Steps: The BMS provides the external upgrade initiator with two upgrade options: online upgrade mode and BOOT upgrade mode. The external upgrade initiator selects the corresponding upgrade mode based on the vehicle status, network conditions, and application running status. In the online upgrade mode, the business code continues to run, while in the BOOT upgrade mode, the business code stops running.

[0017] S3. Online Upgrade Execution Steps: If the online upgrade mode is selected, the BMS keeps the application running continuously, performing battery monitoring and safety protection services without interruption; at the same time, an upgrade receiving task is created in the background of the application to receive upgrade data; if an abnormality occurs during data verification, no data is written to the application's backup storage area, the program running flag is not modified, and the original application continues to run; if the upgrade data is received completely and the verification is successful, the upgrade data is written to the application's backup storage area, the program running flag is set to the first state, and then a system reset is initiated.

[0018] S4. BOOT Upgrade Execution Steps: If the BOOT upgrade mode is selected, the BMS performs a system reset, jumps to the Bootloader program, and stops the execution of business code; the Bootloader receives the upgrade data; if an error occurs during data verification, no data is written to the application's backup storage area, the program's running flag is not modified, and the system is directly reset and jumps to execute the original application; if the upgrade data is received completely and the verification passes, the upgrade data is written to the application's backup storage area, the program's running flag is set to the first state, and then the system reset is performed.

[0019] S5. Boot switching steps: After the system is powered on, the Bootloader reads the program running flag in the configuration information area; if the flag is in the first state, it jumps to execute the new application in the application backup storage area. After the new application starts successfully, the program running flag is restored to the second state; if the flag is in the second state, it directly jumps to execute the original application in the main program running area.

[0020] Furthermore, the online upgrade mode is the first mode, which is suitable for scenarios such as vehicle driving and battery charging and discharging that require continuous battery monitoring and safety protection; the BOOT upgrade mode is the second mode, which is suitable for scenarios such as batch program flashing on the production line and application failures that require rapid recovery.

[0021] Furthermore, the external upgrade initiators include two types of devices: local diagnostic instruments and intelligent connected devices. Both types of devices are able to complete mode negotiation with the BMS and issue the selected upgrade mode command.

[0022] Furthermore, the non-volatile storage unit includes two hardware carriers: the main chip's built-in Flash and external Flash, both of which support the aforementioned logical partitioning.

[0023] Furthermore, the automatic determination logic for mode selection in step S2 is as follows: if the vehicle is in a driving or charging / discharging state, the online upgrade mode is directly selected; if the vehicle is in a parked or stationary state, the application's running status is first determined, and if the application has serious defects and cannot run normally, the BOOT upgrade mode is directly selected; when the application is running normally, the upgrade urgency is distinguished according to the upgrade urgency, and the online upgrade mode is selected for non-urgent silent upgrades, while the BOOT upgrade mode is selected for urgent and rapid upgrades.

[0024] Furthermore, the data verification anomalies defined in steps S3 and S4 include three types of faults: verification error, data reception timeout, and communication link interruption.

[0025] Furthermore, the online upgrade process and the BOOT upgrade process share the same fault-safe logic: in the event of any abnormal data reception, writing data to the application's backup storage area is prohibited, and the program running flag stored in the configuration information area is not modified, ensuring that the original application can be rolled back to normal operation.

[0026] On the other hand, the present invention provides a system for selecting a battery management system software upgrade mode, and a system for executing the above-described method for selecting a battery management system software upgrade mode.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] 1) Selectable modes to achieve full scenario coverage

[0029] This invention provides both online upgrade and BOOT upgrade modes, allowing for flexible selection of the upgrade method based on factors such as vehicle driving / parking status, network conditions, and application running status, covering all scenarios including driving, charging and discharging, production line flashing, and fault recovery.

[0030] 2) Online upgrades ensure business continuity

[0031] In scenarios where the BMS needs to continuously monitor the battery status, such as vehicle driving and battery charging and discharging, the online upgrade mode can ensure that the business code is not interrupted and the battery safety monitoring function is not affected during the upgrade process, thus ensuring the safe operation of the battery.

[0032] 3) BOOT upgrade ensures upgrade reliability and efficiency

[0033] When a serious application defect prevents online upgrades, or in a scenario where batch flashing on a production line is required to maximize efficiency, choosing the BOOT upgrade mode can ensure a reliable upgrade while improving batch flashing efficiency.

[0034] 4) Unified fault-tolerant mechanism, upgrade risks are controllable

[0035] Both upgrade modes employ a security mechanism that "abnormalities are not written to the backup storage area and the program running flag is not modified," ensuring that the BMS always retains the original program that can run normally in any scenario of communication abnormalities or data verification abnormalities, thus avoiding system paralysis caused by upgrade failure. Attached Figure Description

[0036] Figure 1 This is a schematic diagram illustrating the overall architecture and dual-mode selection of the present invention;

[0037] Figure 2 This is a schematic diagram comparing the online upgrade and BOOT upgrade processes of this invention;

[0038] Figure 3This is a schematic diagram of the mode selection decision logic of the present invention;

[0039] Figure 4 This is a schematic diagram comparing the present invention with existing technical solutions. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] This embodiment provides a method and system for selecting the software upgrade mode of a battery management system. Through a dual-mode selectable upgrade architecture, it adapts to the upgrade needs of different application scenarios of BMS, while ensuring the safety and reliability of the upgrade process.

[0042] One possible method for upgrading battery management system software, such as Figure 1-4 As shown, it includes the following steps:

[0043] I. System Storage Architecture

[0044] First, the non-volatile memory unit of the BMS is logically partitioned. In this embodiment, the non-volatile memory unit can be the Flash memory built into the BMS main chip or an external Flash memory. Both hardware carriers can achieve the same logical partitioning function.

[0045] The functions of the three logically partitioned storage areas are as follows:

[0046] 1. Main program execution area: Used to store the currently executing BMS application, that is, the program file corresponding to the business code. It is the program execution area when the BMS is working normally.

[0047] 2. Application Backup Storage Area: Used to store new application files to be upgraded. During the upgrade process, the new program is first written to this partition. Only after the verification is passed and the switch is completed can it become a running program.

[0048] 3. Configuration Information Area: This area stores configuration information such as upgrade mode identifier, program running flag, and upgrade status flag. The program running flag is used by the Bootloader to determine which storage partition's program should be started. It is divided into a first state and a second state. The first state indicates that a new program in the backup storage area needs to be started, while the second state indicates that the existing program in the main program running area needs to be started.

[0049] II. Upgrade Mode Negotiation and Selection Mechanism

[0050] The BMS provides two optional upgrade modes to external upgrade initiators through a communication interface. The external upgrade initiator can be a local diagnostic tool (suitable for production lines and after-sales maintenance scenarios) or an in-vehicle intelligent connected device (suitable for remote OTA upgrade scenarios). The characteristics and applicable scenarios of the two modes are as follows:

[0051] First mode: Online upgrade mode. During the upgrade process, the business code continues to run, and the BMS continuously performs battery voltage, current, temperature monitoring and safety protection functions. It is suitable for scenarios where the vehicle is in motion, the battery is charging or discharging, and continuous battery monitoring is required.

[0052] Second mode: BOOT upgrade mode. During the upgrade process, the system resets and enters the Bootloader, and the business code stops running. It is suitable for scenarios such as batch flashing on the production line, application with serious defects, and need to quickly restore the system.

[0053] External upgrade initiators can manually select the upgrade mode based on the actual scenario, or they can automatically select the mode through built-in decision logic. In this embodiment, the automatic selection decision logic is as follows: Figure 3 As shown, the specific determination process is as follows:

[0054] 1. First, determine the current status of the vehicle. If the vehicle is in motion or charging / discharging, directly select the online upgrade mode to ensure uninterrupted battery monitoring.

[0055] 2. If the vehicle is parked or stationary, further determine the application's running status;

[0056] 3. If the application has serious bugs and cannot run normally, directly select the BOOT upgrade mode to ensure that the upgrade can be executed normally;

[0057] 4. If the application is running normally, then determine the urgency of the upgrade: for non-urgent silent upgrades, choose the online upgrade mode; for urgent upgrades that need to be completed quickly, choose the BOOT upgrade mode.

[0058] III. Online Upgrade Mode Execution Process

[0059] When the external upgrade initiator chooses the online upgrade mode, the upgrade process is as follows:

[0060] 1. The BMS keeps the application running continuously, continuing to perform all business functions such as battery voltage acquisition, current acquisition, temperature acquisition, and overvoltage, overcurrent, and overtemperature protection, ensuring uninterrupted battery monitoring and safety protection;

[0061] 2. The BMS creates an independent upgrade receiving task in the background of the application, and receives upgrade data packets transmitted by the external initiator through the CAN bus or vehicle network channel. The background task does not affect the normal execution of the foreground business code.

[0062] 3. During data reception, real-time data verification is performed. If any abnormal situation occurs, such as verification error, data reception timeout, or communication link interruption, the BMS will not write any data to the application backup storage area, nor will it modify the program running flag in the configuration information area. The original application will continue to run normally to ensure that the system function is not affected.

[0063] 4. If all upgrade data has been received and the integrity verification has passed, the BMS will write the complete new application data to the application backup storage area and set the program running flag in the configuration information area to the first state.

[0064] 5. After the data writing is complete, the BMS initiates a system reset request, and the system enters the restart process.

[0065] IV. BOOT Upgrade Mode Execution Process

[0066] When the external upgrade initiator selects the BOOT upgrade mode, the upgrade process is as follows:

[0067] 1. After receiving the BOOT upgrade command, the BMS performs a system reset operation. After the system restarts, it jumps to the Bootloader program. At this time, the original applications stop running and business functions are suspended.

[0068] 2. The bootloader program receives upgrade data packets transmitted by the external upgrade initiator via the CAN bus or network channel;

[0069] 3. During data reception, the Bootloader performs real-time data verification. If any abnormal situation occurs, such as verification error, data reception timeout, or communication link interruption, the Bootloader will not write any data to the application's backup storage area, nor will it modify the program running flag in the configuration information area. Instead, it will directly perform a reset operation and, after restarting, jump to run the original application in the main program running area to ensure that the system can roll back normally.

[0070] 4. If all upgrade data has been received and the integrity verification has passed, the Bootloader will write the complete new application data to the application's backup storage area and set the program running flag in the configuration information area to the first state.

[0071] 5. After the data writing is complete, the Bootloader performs a system reset operation, and the system restarts.

[0072] V. Bootstrap Program Switching Mechanism

[0073] Regardless of the upgrade mode used, after a system reset and restart, the Bootloader executes the program partition switching logic. The specific process is as follows:

[0074] After the bootloader starts, it first reads the program running flags from the configuration information area:

[0075] If the program running flag is in the first state, it means that the new program that has passed verification has been written to the backup storage area. The Bootloader jumps to execute the new application in the application backup storage area. After the new application starts successfully and runs stably, the program running flag in the configuration information area is automatically restored to the second state, and the upgrade process is completed.

[0076] If the program running flag is in the second state, it means there is no valid new program to switch to. The Bootloader will directly jump to execute the existing application in the main program running area, and the system will start normally.

[0077] This guided switching mechanism enables a unified program switch between two upgrade modes. The upgrade switching process is seamless for upper-layer business processes, while ensuring that the system can be stably rolled back in the event of an upgrade failure.

[0078] like Figure 4 As shown, compared with the existing technical solutions, this application supports flexible selection of two modes: online upgrade and BOOT upgrade, which can be adapted to different application scenarios, while ensuring the security and reliability of the upgrade process.

[0079] A system with selectable battery management system software upgrade mode, and a system for executing the aforementioned method for selectable battery management system software upgrade mode.

[0080] Finally, the following points should be noted: First, in the description of this application, it should be noted that, unless otherwise specified and limited, the terms "installation", "connection", and "linkage" should be interpreted broadly, and can be mechanical or electrical connections, or internal connections between two components, or direct connections. "Up", "down", "left", "right", etc. are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may change.

[0081] Secondly: The accompanying drawings of the embodiments disclosed in this invention only involve the structures involved in the embodiments disclosed in this invention. Other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of this invention can be combined with each other.

[0082] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for selecting a battery management system software upgrade mode, characterized in that, Includes the following steps: S1. Storage partitioning steps: Logically divide the BMS non-volatile storage unit into the main program running area, the application backup storage area, and the configuration information area; the main program running area stores the currently running application, the backup storage area stores the new program to be upgraded, and the configuration information area stores the program running flags; S2. Mode negotiation and selection steps: BMS provides two optional modes to the external upgrade initiator: online upgrade and BOOT upgrade. The external upgrade initiator selects the upgrade mode based on the vehicle, network and application running status. In online upgrade mode, the business code continues to run; in BOOT upgrade mode, the business code stops running. S3. Online upgrade execution steps: If the online upgrade mode is selected, the BMS will continue to run the battery monitoring and safety protection business, and the background will create a task to receive upgrade data. When data verification fails, it is not written to the spare area or the program running flag is not modified. After the data verification is successful, it is written to the spare area and the program running flag is set to the first state, and then a system reset is initiated; S4. BOOT upgrade execution steps: If the BOOT upgrade mode is selected, the system resets and enters the Bootloader and stops the business code; the Bootloader receives the upgrade data. If the data verification fails, it is not written to the spare area, the program running flag is not changed, and the original program is reset and rolled back; after the data verification passes, it is written to the spare area and the program running flag is set to the first state, and the system reset is performed again. S5. Boot switching steps: After power-on, the Bootloader reads the program running flag in the configuration information area; if the flag is in the first state, it jumps to run the new program in the backup area. After the new program starts successfully, the flag is restored to the second state; if the flag is in the second state, it directly runs the original program in the main program running area.

2. The method for selecting a battery management system software upgrade mode according to claim 1, characterized in that, The online upgrade mode is the first mode, which is suitable for scenarios such as vehicle driving and battery charging and discharging that require continuous battery monitoring and safety protection; the BOOT upgrade mode is the second mode, which is suitable for scenarios such as batch program flashing on the production line and application failures that require rapid recovery.

3. The method for selecting a battery management system software upgrade mode according to claim 1, characterized in that, The external upgrade initiators include two types of devices: local diagnostic instruments and intelligent connected devices. Both types of devices can complete mode negotiation with BMS and issue selected upgrade mode instructions.

4. The method for selecting a battery management system software upgrade mode according to claim 1, characterized in that, The non-volatile storage unit includes two hardware carriers: the main chip's built-in Flash and external Flash. Both types of storage carriers support logical partitioning.

5. The method for selecting a battery management system software upgrade mode according to claim 1, characterized in that, The automatic determination logic for mode selection in step S2 is as follows: if the vehicle is in driving / charging / discharging state, the online upgrade mode is selected directly; if the vehicle is in parking / parking state, the application running status is first determined, and if the application has serious bugs and cannot run normally, the BOOT upgrade mode is selected directly; when the application is running normally, the upgrade urgency is distinguished according to the upgrade urgency: the online upgrade mode is selected for non-urgent silent upgrades, and the BOOT upgrade mode is selected for urgent fast upgrades.

6. The method for selecting a battery management system software upgrade mode according to claim 1, characterized in that, The data verification exceptions defined in steps S3 and S4 include three types of faults: verification error, data reception timeout, and communication link interruption.

7. The method for selecting a battery management system software upgrade mode according to claim 1, characterized in that, The online upgrade process and the BOOT upgrade process share the same fault-safe logic: in the event of any abnormal data reception, writing data to the application's backup storage area is prohibited, and the program running flag stored in the configuration information area is not modified, ensuring that the original application can be rolled back to normal operation.

8. A system with selectable battery management system software upgrade modes, characterized in that, A system for performing the method of optional battery management system software upgrade mode as described in any one of claims 1 to 5.

Images