OTA upgrade method, OTA upgrade device and computer readable storage medium

Abstract

To solve a problem with rollback processing caused by failure of over-the-air (OTA) upgrade.SOLUTION: A method includes a step of transmitting software information for a control unit to an OTA server by a terminal. The software information includes information relating to a current software version of the control unit and instruction information, and the instruction information instructs whether a rollback package corresponding to the current software version of the control unit exists. The method also includes receiving upgrade information transmitted by the OTA server by the terminal. When no rollback package corresponding to the current software version of the control unit exists, the upgrade information includes software installation package download information of a current version of the control unit and software installation package download information of a target version.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] This application claims priority to Chinese Patent Application No. 202110699630.2, entitled "OTA upgrade method and OTA upgrade device, and computer-readable storage medium," filed with the State Intellectual Property Office of China on June 23, 2021, the entire contents of which are incorporated herein by reference. The present application relates to the field of Internet of Vehicles and communication technologies, and in particular to an OTA upgrade method and an OTA upgrade device, and a computer-readable storage medium. [Background technology]

[0002] With the continuous development of computer technology, network technology, etc., current terminals are usually configured with various hardware and software (applications). For example, vehicles are configured with intelligent cockpits, sensing systems, and autonomous driving systems, and vehicles are also installed with on-board operating systems, navigation applications, and audio / video playback applications. Although hardware and software enhance the functions of terminals, they are more prone to vulnerabilities or need to be replaced with more advanced versions. Therefore, the hardware and software (applications) of terminals need to be upgraded.

[0003] Over-the-air (OTA) technology is used to download data over a wireless network. This technology is widely used to upgrade devices such as vehicles, televisions, mobile phones, tablet computers, and set-top boxes. With OTA technology, automatic upgrades are primarily achieved by downloading an OTA upgrade package (or the OTA upgrade package can be copied to an SD card for upgrades). OTA upgrades are fast and have little impact on data. Therefore, OTA upgrades have become the primary method for upgrading device functions. For example, in the case of vehicles, original equipment manufacturers (OEMs) use OTA technology to upgrade the vehicle's relevant hardware or software. This helps manufacturers reduce recall costs, respond quickly to requirements, and improve user experience.

[0004] During an OTA upgrade, the upgrade may fail. To restore the pre-upgrade version status when the upgrade fails, the terminal must be able to perform a rollback operation. For example, the Automotive Open System Architecture (AutoSar) standard may use an A / B partition upgrade and backup solution. Some manufacturers also use this solution. However, using the A / B partition upgrade and backup solution leads to higher costs for electronic control units (ECUs), and many ECUs do not have the A / B partition upgrade and backup function. How to better solve the rollback processing problem caused by an OTA upgrade failure is an urgent technical problem that needs to be solved by those skilled in the art. Summary of the Invention [Means for solving the problem]

[0005] The present application provides an OTA upgrade method, an OTA upgrade device, and a computer-readable storage medium to better solve the problem of rollback processing caused by a failed OTA upgrade.

[0006] According to a first aspect, the present application provides an OTA upgrade method, the method comprising: a step of the terminal sending software information of the control unit to the OTA server, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; a step of the terminal receiving upgrade information sent by the OTA server, in which when there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of the target version belonging to the control unit, or when there is a rollback package corresponding to the current software version of the control unit, the upgrade information is software installation package download information of the target version; the terminal performing a first operation on the control unit based on the upgrade information; Includes.

[0007] In one embodiment of the present application, when a terminal interacts with an OTA server, regardless of whether the control unit to be upgraded supports A / B partition upgrade and backup, indication information is sent to the OTA server indicating whether there is a rollback package corresponding to the current software version of the control unit, so that the OTA server can identify whether to deliver installation package download information used for rollback, and deliver the rollback package on demand, thereby effectively reducing traffic consumption.

[0008] In one possible implementation, the control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0009] In one embodiment of the present application, when both a control unit that supports A / B partition upgrade and backup and a control unit that does not support A / B partition upgrade and backup exist on a terminal, the upgrade rollback procedure can be simplified and unified, and the control unit that does not support A / B partition upgrade and backup does not need to be rebuilt. In particular, in a scenario where a terminal (e.g., a vehicle) replaces a component, the rollback function in the OTA upgrade process can be automatically compatible regardless of whether the newly replaced component supports A / B partition upgrade and backup, thereby reducing costs.

[0010] In one possible embodiment, if the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, if the terminal stores a backup installation package for the current software version of the control unit, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, if the terminal does not store a backup installation package for the current software version of the control unit, the indication information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0011] If it is determined that the control unit supports A / B partition upgrades and backups, instruction information is generated directly indicating that a corresponding rollback package exists. Alternatively, if it is determined that the control unit does not support A / B partition upgrades and backups, it is specifically detected whether a backup installation package for the control unit's current software version is stored. In this way, the upgrade rollback procedure can be simplified and unified, and rollback processing issues caused by OTA upgrade failures can be better resolved.

[0012] In another possible embodiment, the step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit supports A / B partition upgrade and backup, the terminal downloads a target version software installation package according to the target version software installation package download information of the control unit, and performs an upgrade installation on the control unit in the backup partition according to the target version software installation package. Includes.

[0013] In one embodiment of the present application, if the control unit supports A / B partition upgrade and backup, after the target version software installation package is downloaded, the A / B partition upgrade and backup function can be used to perform an upgrade installation on the control unit in the backup partition based on the target version software installation package, thereby performing an OTA upgrade or rollback. If the upgrade is successful, the downloaded software installation package of the target version on the control unit can be deleted, which saves storage space.

[0014] In another possible embodiment, the step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit does not support A / B partition upgrade and backup, and there is a rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of the target version for the control unit according to the software installation package download information of the target version, and performs an upgrade installation on the control unit according to the software installation package of the target version; or When there is no rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of the target version of the control unit based on the software installation package download information of the target version, downloads a software installation package of the current version of the control unit based on the software installation package download information of the current version of the control unit, and performs an upgrade installation on the control unit based on the software installation package of the target version. Includes.

[0015] In one embodiment of the present application, if the control unit does not support A / B partition upgrade and backup, a target version software installation package is downloaded when there is no corresponding rollback package, and after the control unit's current version software installation package is downloaded, the terminal performs an upgrade based on the target version software installation package and performs rollback processing based on the control unit's current version software installation package, which better solves the rollback processing problem caused by the failure of OTA upgrade.

[0016] In another possible embodiment, the OTA upgrade method in the present application includes: If the upgrade is successful, the terminal deletes the software installation package of the current version of the control unit and stores the software installation package of the target version of the control unit as a rollback package; Further includes:

[0017] In one embodiment of the present application, if the control unit does not support A / B partition upgrade and backup, after the upgrade is successful, the software installation package of the current version of the control unit is deleted, and the software installation package of the target version of the control unit is stored as a new rollback package, which better solves the rollback processing problem caused by the failure of the OTA upgrade.

[0018] In another possible embodiment, when the control unit supports A / B partition upgrade and backup, in the process of performing an upgrade installation on the control unit in the backup partition based on the target version software installation package, the upgrade fails, and the method includes: Steps for the device to restore the failed upgrade partition to the mirror backup partition Further includes:

[0019] In one embodiment of the present application, if the control unit supports A / B partition upgrade and backup, after an upgrade fails, the partition where the upgrade failed is restored to the mirror backup partition. Specifically, data in the active partition is mirrored and backed up to the partition where the upgrade failed, and the currently active partition continues to be used. In this way, a rollback is implemented. Furthermore, the downloaded software installation package for the target version of the control unit may be deleted, which saves storage space.

[0020] In another possible embodiment, if the control unit does not support A / B partition upgrade and backup, in the process of performing upgrade installation on the control unit based on the target version software installation package, the upgrade fails, and the method includes: The terminal performs a rollback operation based on the current version of the software installation package of the control unit, and deletes the target version of the software installation package. Further includes:

[0021] In one embodiment of the present application, if the control unit does not support A / B partition upgrade and backup, after the upgrade fails, the terminal may perform a rollback operation based on the software installation package stored in the current version of the control unit to solve the rollback processing problem caused by the failure of the OTA upgrade.

[0022] In another possible embodiment, before the step of upgrading based on the software installation package of the target version of the control unit, the method further includes the steps of: receiving, by the terminal, a first key sent by the first server; and decrypting the software installation package of the target version of the control unit based on the first key. The software installation package of the target version of the control unit is generated after the first server encrypts the upgrade data of the control unit based on the second key. The first key is a decryption key corresponding to the second key.

[0023] In one embodiment of the present application, the first server may be a component supplier of the terminal, and the software installation package of the target version of the control unit is encrypted by the first server, which can prevent the core technology of the component supplier from being leaked or related data from being obtained by the OTA server, and can prevent attackers from tampering with the upgrade data, thereby improving the security of the OTA upgrade.

[0024] In another possible embodiment, the step of receiving the first key sent by the first server by the terminal comprises: a terminal establishing a secure channel with a first server; receiving, by the terminal, via a secure channel, the first key sent by the first server; Includes.

[0025] The secure channel may be a transmission channel based on the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol, and is used for secure transmission of data. Because the secure channel is a secure and reliable channel, the first server transmits the first key to the terminal through the secure channel, which can guarantee the security of the first key.

[0026] According to a second aspect, the present application provides an over-the-air (OTA) upgrade method, the method comprising: an OTA server of the control unit receiving software information sent by the terminal, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; an OTA server sending upgrade information to the terminal based on the software information, where if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of the target version belonging to the control unit, or if there is a rollback package corresponding to the current software version of the control unit, the upgrade information is software installation package download information of the target version of the control unit; Includes.

[0027] In one possible implementation, the control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0028] In one embodiment of the present application, when a terminal interacts with an OTA server, instruction information is sent to the OTA server indicating whether a rollback package corresponding to the control unit's current software version is available, regardless of whether the control unit to be upgraded supports A / B partition upgrade and backup. This allows the OTA server to determine whether to deliver installation package download information used for rollback and perform on-demand delivery of the rollback package, effectively reducing traffic consumption. When both control units that support A / B partition upgrade and backup and control units that do not support A / B partition upgrade and backup exist on a terminal, the upgrade rollback procedure can be simplified and unified, and the control unit that does not support A / B partition upgrade and backup does not need to be rebuilt. In particular, in a scenario where a terminal (e.g., a vehicle) replaces a component, the rollback function in the OTA upgrade process can be automatically compatible regardless of whether the newly replaced component supports A / B partition upgrade and backup, thereby reducing costs.

[0029] According to a third aspect, an embodiment of the present application provides an over-the-air (OTA) upgrade device, the device comprising: a first sending unit configured to send software information of the control unit to an OTA server, the software information including information related to a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; and a first receiving unit configured to receive upgrade information sent by the OTA server, wherein the upgrade information includes software installation package download information of a current version of the control unit and software installation package download information of a target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of a target version when there is a rollback package corresponding to the current software version of the control unit; an execution unit configured to perform a first action on the control unit based on the upgrade information; Includes.

[0030] In one possible implementation, the control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0031] In one possible embodiment, if the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, and the device stores a backup installation package for the current software version of the control unit, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, and the device does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0032] In one possible implementation, the execution unit comprises: a first download and upgrade unit configured to, when the control unit does not support A / B partition upgrade and backup, download a target version software installation package for the control unit based on the target version software installation package download information when there is a rollback package corresponding to the current software version of the control unit, and perform an upgrade installation on the control unit based on the target version software installation package; or a second download and upgrade unit configured to download a target version software installation package for the control unit based on the target version software installation package download information when there is no rollback package corresponding to the current software version of the control unit, download a current version software installation package for the control unit based on the target version software installation package download information of the control unit, and perform an upgrade installation on the control unit based on the target version software installation package; Includes.

[0033] In one possible embodiment, the device comprises: A restore unit configured to restore a failed upgrade partition to a mirror backup partition when the upgrade fails during a process of performing an upgrade installation on a control unit with a backup partition based on a target version software installation package. Further includes:

[0034] In one possible embodiment, the device comprises: a rollback unit configured to perform a rollback operation based on the software installation package of the current version of the control unit and delete the software installation package of the target version when the upgrade fails in a process of performing an upgrade installation on the control unit in the backup partition based on the software installation package of the target version; Further includes:

[0035] According to a fourth aspect, an embodiment of the present application provides an over-the-air (OTA) server, the OTA server comprising: a second receiving unit of the control unit configured to receive software information sent by the terminal, the software information including information about a current software version of the control unit and indication information, the indication information indicating whether there is a rollback package corresponding to the current software version of the control unit; a second transmitting unit configured to transmit upgrade information to the terminal based on the software information, wherein the upgrade information includes software installation package download information of the current version of the control unit and software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of the target version of the control unit when there is a rollback package corresponding to the current software version of the control unit; and Includes.

[0036] According to a fifth aspect, the present application provides a terminal. The terminal includes a processor configured to support the terminal in performing corresponding functions in the OTA upgrade method according to the first aspect or any one of possible implementations of the first aspect. The terminal may further include a memory. The memory is coupled to the processor and stores program instructions and data required for the terminal. The terminal may further include a communication interface used for communication between the terminal and another device or a communication network.

[0037] According to a sixth aspect, the present application provides an OTA server. The server includes a processor configured to support the server in performing corresponding functions in the OTA upgrade method according to the second aspect or any one of possible implementations of the second aspect. The server may further include a memory. The memory is coupled to the processor and stores program instructions and data required for the server. The server may further include a communication interface used for communication between the server and another device or a communication network.

[0038] It should be noted that the program instructions and data in the memory of the present application may be pre-stored or downloaded from the Internet and then stored when the device is used. The source of the program instructions and data in the memory is not particularly limited in the present application. The coupling in the embodiments of the present application may be an indirect coupling or connection between devices, units, or modules, and may be in an electrical, mechanical, or other form, used to exchange information between devices, units, or modules.

[0039] According to a seventh aspect, the present application provides a computer-readable storage medium storing a computer program, the computer program being executed by a processor to perform a method according to the first or second aspect.

[0040] According to an eighth aspect, the present application provides a computer program product, which, when read and executed by a processor, performs a method according to the first or second aspect.

[0041] The solutions provided in the second to eighth aspects can be used to implement or cooperate with the method provided in the first aspect, and thus can achieve the same or corresponding beneficial effects as those of the first aspect, and will not be described in detail again here.

[0042] The following describes the accompanying drawings that must be used in the embodiments of this application. [Brief explanation of the drawings]

[0043] [Figure 1a] FIG. 1 is a diagram of a system architecture for OTA upgrade according to an embodiment of the present application. [Figure 1b] FIG. 2 is a diagram of a system architecture for OTA upgrade according to another embodiment of the present application. [Figure 1c] 1 is a functional block diagram of a vehicle 10 according to an embodiment of the present application. [Figure 2] 1 is a schematic flowchart of an OTA upgrade method according to an embodiment of the present application; [Figure 3] 1 is a schematic diagram of the structure of an OTA upgrade device according to an embodiment of the present application; [Figure 4] FIG. 1 is a schematic diagram of the structure of an OTA server according to an embodiment of the present application. [Figure 5] 1 is a schematic diagram of the structure of a device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE INVENTION

[0044] The following describes embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application.

[0045] In the specification, claims, and accompanying drawings of this application, terms such as "first," "second," etc. are intended to distinguish between different objects and do not dictate a particular order. Additionally, the terms "comprise" and "have," as well as any other variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units may optionally include additional steps or units not listed, or may optionally include other specific steps or units of the process, method, product, or device.

[0046] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described with reference to this embodiment may be included in at least one embodiment of the present application. Phrases appearing in various places in this specification do not necessarily refer to the same embodiment, nor do they refer to optional embodiments that are independent or incompatible with other embodiments. It is explicitly and implicitly understood by those skilled in the art that an embodiment described herein may be combined with another embodiment.

[0047] As used herein, terms such as “component,” “module,” and “system” refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and / or a computer. As illustrated through the use of diagrams, both computing devices and applications running on computing devices may be components. One or more components may reside within a process and / or thread of execution, and components may be located on one computer and / or distributed between two or more computers. Additionally, these components may execute from various computer-readable media that store various data structures. For example, components may communicate using local and / or remote processes, based on signals having one or more data packets (e.g., data from two components interacting with another component in a local system, in a distributed system, and / or over a network such as the Internet that interacts with another system using signals).

[0048] To aid those skilled in the art in better understanding, some terms in this application will first be explained.

[0049] (1) Over-the-air (OTA) technology is a technology for performing firmware or software upgrades via the air interface of mobile communications. OTA technology is widely used for network upgrades of devices such as smart TVs, mobile phones, tablet computers, and set-top boxes. With the development of intelligent connected vehicles, OTA online upgrades will become an important function for automobiles or vehicles.

[0050] (2) Telematics Box, also known as T-Box, is a compound word of telecommunications and information science. A T-Box can be literally defined as a service system that provides information by using a computer system, wireless communication technology, satellite navigation device, or Internet technology for exchanging information such as text and voice, built into a transportation tool such as an automobile, aircraft, ship, or train. In short, the vehicle is connected to the Internet via a wireless network to provide the vehicle owner with various information necessary for driving and daily life.

[0051] (3) An Electronic Control Unit (ECU) is a vehicle-specific microcomputer controller from a usage standpoint. Similar to a typical computer, an ECU includes large-scale integrated circuits such as a microprocessor (CPU), memory (ROM and RAM), input / output (I / O) interfaces, analog-to-digital (A / D) converters, shapers, and drivers. The vehicle control unit in the embodiments of this application is an electronic control unit.

[0052] (4) The vehicle control unit (VCU), sometimes referred to as the vehicle control unit VCU in electric vehicles, is the assembly controller of the electric vehicle's power system. The VCU coordinates the operation of components such as the engine, drive motor, gearbox, and power battery, improving the vehicle's power performance, safety performance, and economic efficiency. The VCU is the core component of the electric vehicle's vehicle control system. It controls the electric vehicle's motor during starting, running, forward / reverse, speed changes, and stopping, as well as other electronic components. As the core component of a pure electric vehicle's control system, the VCU is responsible for tasks such as data exchange, safety management, driver intent interpretation, and power stream management. The VCU collects signals from the motor control system, accelerator pedal signals, brake pedal signals, and other components, performs comprehensive analysis, determines and responds to the driver's driving intent, and monitors the operation of the controllers of lower-level components. The VCU plays a key role in functions such as normal vehicle operation, braking and regenerating battery energy, network management, fault diagnosis and handling, and vehicle status monitoring.

[0053] (5) Human Machine Interface (HMI), also known as user interface, is a medium for interaction and information exchange between a system and a user, and performs the conversion between the internal form of information and a form acceptable to humans.

[0054] (6) The Controller Area Network (CAN) bus is one of the most widely used field buses in the world. The high reliability and powerful error detection capabilities of the CAN bus have attracted much attention. Therefore, the CAN bus is widely used in vehicle computer control systems and industrial environments with harsh ambient temperatures, strong electromagnetic radiation, and severe vibration. The CAN bus is a widely used field bus and has great application prospects in fields such as industrial measurement and control and industrial automation. The CAN bus is a serial communication bus network. Its advantages in data communication are reliability, real-time performance, and flexibility. To ensure transparent design and flexible implementation, the CAN bus structure is divided into a physical layer and a data link layer (including a logical link control (LLC) sublayer and a medium access control (MAC) sublayer) according to the ISO / OSI standard model.

[0055] In order to better understand the OTA upgrade method provided in the embodiment of the present application, the following first describes the system architecture and service scenarios in the embodiment of the present application. It should be noted that the system architecture and service scenarios described in the present application are intended to more clearly explain the technical solutions in the present application, and do not constitute limitations on the technical solutions provided in the present application. Those skilled in the art will understand that with the evolution of system architecture and the emergence of new service scenarios, the technical solutions provided in the present application can also be applied to similar technical problems.

[0056] 1a is a diagram of a system architecture for OTA upgrade according to one embodiment of the present application. The system architecture may include a terminal 101 and an OTA server 102.

[0057] The OTA server 102 is a server that exchanges information with the terminal 101 during the OTA upgrade process. The OTA server 102 may include an OTA service management service module 1020 and an OTA upgrade package download service module 1021. Typically, the OTA server may instruct the terminal to upgrade a specific control unit. Optionally, the OTA server may alternatively send ECU upgrade data to the terminal by using the OTA upgrade package download service module 1021. In some specific implementation scenarios, the OTA server may also be referred to as an OTA cloud server or an OTA cloud-side server.

[0058] Optionally, the OTA upgrade package download service module 1021 and the OTA service management service module 1020 may be two separate pieces of hardware. Specifically, the OTA upgrade package download service module 1021 may be an independent server that provides the terminal 101 with a service for downloading an installation package.

[0059] The terminal 101 is a terminal, such as a vehicle, in which a control unit is installed, and can obtain upgrade data by using the OTA server 102 to upgrade the control unit.

[0060] The control unit in the embodiments of the present application may include all units to which OTA upgrade is applicable in the terminal, such as an ECU. In the following embodiments, the ECU is used as an example for explanation.

[0061] Optionally, the terminal 101 may include an OTA device-side upgrade management unit 1010, an OTA device-side ECU upgrade package management module 1011, and an OTA device-side ECU upgrade management unit 1012. The OTA device-side upgrade management unit 1010 interacts with an OTA service management service module 1020 and obtains upgrade information from the OTA service management service module 1020 based on software information collected by the OTA device-side ECU upgrade management unit 1012 for each ECU in the terminal 101, and may then trigger the OTA device-side ECU upgrade package management module 1011 to download an installation package. The OTA device-side ECU upgrade package management module 1011 may interact with an OTA upgrade package download service module 1021 to download and manage the installation package. The OTA device-side ECU upgrade management unit 1012 is responsible for specific ECU upgrade (rollback) processing.

[0062] In some specific implementation scenarios, FIG. 1b is a system architecture diagram of an OTA upgrade according to another embodiment of the present application. For example, the terminal 101 is a vehicle. The vehicle may be a vehicle based on a vehicle electrical / electronic architecture (E / E). The vehicle may include the following components: a mobile data center (MDC), a human-machine interaction (HMI), a device-side upgrade management unit gateway (GW), a telematics box (T-Box), an electronic control unit (ECU), and other modules. The GW is a core component in the vehicle's electrical / electrical architecture. As a data exchange hub of the vehicle network, the GW can route network data among different networks, such as a controller area network (CAN), a local interconnect network (LIN), and a media-oriented system transport (MOST). The OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit MDC are the vehicle's intelligent on-board computing platform. The T-BOX is configured to communicate with the vehicle's exterior, background system, and applications (APPs) in the mobile phone. The HMI is the vehicle's information and entertainment system. The ECU may be a vehicle-specific microcomputer controller.

[0063] For example, the OTA device-side upgrade management unit 1010, the OTA device-side ECU upgrade package management module 1011, and the OTA device-side ECU upgrade management unit 1012 in the terminal 101 may be units in the MDC. The OTA device-side upgrade management unit 1010 may particularly establish a connection to the OTA service management service module 1020 by using a T-BOX. The OTA device-side ECU upgrade package management module 1011 may also particularly establish a connection to the OTA upgrade package download service module 1021 by using a T-BOX.

[0064] The terminal 101 usually has only one OTA device-side upgrade management unit 1010, which may be located in a T-BOX or a gateway. The OTA device-side ECU upgrade package management module 1011 may be independently located in the terminal 101. Optionally, function-related ECUs in the terminal 101 may be integrated and then managed by co-locating the OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit 1012. The OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit 1012 are interconnected by using a GW.

[0065] 1c is a functional block diagram of a vehicle 10 according to one embodiment of the present application. The vehicle 10 may include various subsystems, such as a traction system 110, a sensor system 120, a control system 130, one or more peripheral devices 140, a power source 150, a computer system 160, and a user interface 170. Optionally, the vehicle 10 may include more or fewer subsystems, and each subsystem may include multiple components. Additionally, all subsystems and components of the vehicle 10 may be interconnected in a wired or wireless manner.

[0066] The traction system 110 may include components that provide power for the vehicle 10 to move. In one embodiment, the traction system 110 may include an engine 111, a transmission 112, an energy source 113, and wheels 114. The engine 111 may be an internal combustion engine, a motor, an air-compression engine, or a combination of other types of engines, such as a hybrid engine including a gasoline engine and a motor, or a hybrid engine including an internal combustion engine and an air-compression engine. The engine 111 converts the energy source 113 into mechanical energy. Examples of the energy source 113 include gasoline, diesel, other petroleum-based fuels, propane, other compressed gas-based fuels, anhydrous alcohol, solar panels, batteries, and other power sources. The energy source 113 may also provide energy to other systems of the vehicle 10. The transmission 112 may transfer mechanical power from the engine 111 to the wheels 114. The transmission 112 may include a gearbox, a differential, and a drive shaft. In one embodiment, the transmission 112 may further include other components, such as a clutch. The drive shaft may include one or more shafts that may be coupled to one or more wheels 114.

[0067] The sensor system 120 may include several sensors that sense information about the vehicle 10's surrounding environment. For example, the sensor system 120 may include a global positioning system 121 (the positioning system may be a GPS system, a Beidou system, or another positioning system), an inertial measurement unit (IMU) 122, a radar 123, a laser range finder 124, and a camera 125. The sensor system 120 may further include sensors of the vehicle 10's internal systems being monitored (e.g., an interior air quality monitor, a fuel gauge, and an oil temperature gauge). Sensor data from one or more of these sensors can be used to detect objects and their corresponding characteristics (such as position, shape, orientation, speed, etc.). Such detection and identification are important functions for the safe operation of the vehicle 10. The global positioning system 121 may be configured to estimate the vehicle 10's geographic location. The IMU 122 is configured to sense changes in the vehicle 10's position and heading orientation based on inertial acceleration. In one embodiment, the IMU 122 may be a combination of an accelerometer and a gyroscope. The radar 123 may sense objects in the vehicle 10's environment by using radio signals. In some embodiments, in addition to sensing objects, the radar 123 may further be configured to sense the object's speed and / or direction of travel. The laser range finder 124 may sense objects in the vehicle 10's environment by using a laser. In some embodiments, the laser range finder 124 may include one or more laser sources, a laser scanner, one or more detectors, and other system components. The camera 125 may be configured to capture multiple images of the vehicle 10's environment. The camera 125 may be a still camera or a video camera.

[0068] The control system 130 controls the operation of the vehicle 10 and its components. The control system 130 may include various components, namely, a steering system 131, a throttle 132, a braking unit 133, a computer vision system 134, a route control system 135, and an obstacle avoidance system 136. The steering system 131 may be operated to adjust the direction of travel of the vehicle 10. For example, in one embodiment, the steering system 131 may be a steering wheel system. The throttle 132 is configured to control the operating speed of the engine 111, further controlling the speed of the vehicle 10. The braking unit 133 is configured to control the deceleration of the vehicle 10. The braking unit 133 may slow the wheels 114 using friction. In another embodiment, the braking unit 133 may convert the kinetic energy of the wheels 114 into electric current. The braking unit 133 may alternatively slow the rotational speed of the wheels 114 in other ways to control the speed of the vehicle 10. The computer vision system 134 may be operated to process and analyze images captured by the camera 125 to identify objects and / or features in the vehicle 10's environment. The objects and / or features may include traffic lights, road boundaries, and obstacles. The computer vision system 134 may use object identification algorithms, structure from motion (SFM) algorithms, video tracking, and other computer vision techniques. In some embodiments, the computer vision system 134 may be configured to draw a map of the environment, track objects, and estimate object speeds. The route control system 135 is configured to determine a driving path for the vehicle 10. In some embodiments, the route control system 135 may determine the driving path for the vehicle 10 with reference to data from the sensor system 120 and one or more predetermined maps. The obstacle avoidance system 136 is configured to identify, evaluate, and avoid or otherwise circumvent potential obstacles in the vehicle 10's environment.

[0069] Of course, in one example, control system 130 may include additional or alternative components in addition to those shown and described, or may omit some of the above components.

[0070] The control unit in the embodiment of the present application may be one or more control units in the control system 130. The control unit typically controls the vehicle by using an application or program instructions. The original equipment manufacturer upgrades the application in the control unit based on the actual situation and provides users with an OTA upgrade service.

[0071] Vehicle 10 interacts with external sensors, other vehicles, other computer systems, or a user by using peripheral devices 140. Peripheral devices 140 may include a wireless communication system 141, an onboard computer 142, a microphone 143, and / or a speaker 144.

[0072] In some embodiments, peripheral devices 140 provide a means for a user of vehicle 10 to interact with user interface 170. For example, onboard computer 142 may provide information to the user of vehicle 10. User interface 170 may further operate onboard computer 142 to receive input from the user. Onboard computer 142 may operate a touchscreen. Alternatively, peripheral devices 140 may provide a means for vehicle 10 to communicate with other devices located within the vehicle. For example, microphone 143 may receive audio (e.g., voice commands or other audio input) from the user of vehicle 10. Similarly, speaker 144 may output audio to the user of vehicle 10. Wireless communication system 141 may wirelessly communicate with one or more devices, either directly or via a communications network. For example, the wireless communication system 141 may use 3G cellular communications, such as Code Division Multiple Access (CDMA), Evolution-Data Optimized (EVDO), Global System for Mobile Communications (GSM) / General packet radio service (GPRS), or the 4th generation mobile networks (4G) cellular communications, such as Long Term Evolution (LTE), or the 5th generation mobile networks or 5th generation wireless systems (5th-Generation, 5G) cellular communications. The wireless communication system 141 may communicate with a wireless local area network (WLAN) by using Wi-Fi.In some embodiments, wireless communication system 141 may communicate directly with devices by using infrared links, Bluetooth, or ZigBee. Other wireless protocols, such as various vehicle communication systems, may also be used. For example, wireless communication system 141 may include one or more Dedicated Short Range Communications (DSRC) devices, which may include public and / or private data communications between vehicles and / or roadside stations.

[0073] Power supply 150 may provide power to various components of vehicle 10. In one embodiment, power supply 150 may be a rechargeable lithium-ion battery or a lead-acid battery. One or more battery packs of such batteries may be configured as the power source to power the components of vehicle 10. In some embodiments, for example, in some purely electric vehicles, power supply 150 and energy source 113 may be implemented together.

[0074] Some or all of the functions of vehicle 10 are controlled by computer system 160. Computer system 160 may include at least one processor 161. Processor 161 executes instructions 163 stored on a non-transitory computer-readable medium, such as memory 162. Computer system 160 may alternatively be multiple computing devices that control individual components or subsystems of vehicle 10 in a distributed manner.

[0075] Processor 161 may be any conventional processor, such as a commercially available central processing unit (CPU). Alternatively, the processor may be a dedicated device such as an application-specific integrated circuit (ASIC) or another hardware-based processor. While FIG. 1c functionally illustrates the processor, memory, and other components of computer system 160 in the same block, those skilled in the art will understand that the processor, computer system, or memory may actually include multiple processors, computers, or memories, which may or may not be housed in the same physical housing. For example, the memory may be a hard disk drive or another storage medium located in a housing different from that of computer system 160. Thus, reference to a processor or computer is understood to include reference to a set of processors, computers, or memories, which may or may not operate in parallel. Unlike using a single processor to perform the steps described herein, some components, such as the steering component and the deceleration component, may include their own processors. The processors only perform computations related to the component's specific functions.

[0076] In various aspects described herein, the processor may be located remotely from the vehicle and in wireless communication with the vehicle. In other aspects, some processes described herein are performed on a processor located within the vehicle, while other processes, including performing steps necessary for a single operation, are performed by a remote processor.

[0077] In some embodiments, memory 162 may include instructions 163 (e.g., program logic) that may be executed by processor 161 to perform various functions of vehicle 10, including those described above. Memory 162 may also include additional instructions, including instructions for transmitting data to, receiving data from, interacting with, and / or controlling one or more of travel system 110, sensor system 120, control system 130, and peripheral devices 140.

[0078] In addition to instructions 163, memory 162 may also store data, such as software installation packages, target files, and other information, which may be used by vehicle 10 and computer system 160 when software is installed on vehicle 10 or when a target function is performed.

[0079] User interface 170 is configured to provide information to or receive information from a user of vehicle 10. Optionally, user interface 170 may include one or more input / output devices in a set of peripheral devices 140, such as, for example, a wireless communication system 141, an onboard computer 142, a microphone 143, and a speaker 144.

[0080] Computer system 160 may control the functions of vehicle 10 based on inputs received from various subsystems (e.g., traction system 110, sensor system 120, and control system 130) and user interface 170. For example, computer system 160 may generate target requests by using target service information from external devices. In some embodiments, computer system 160 may be operated to provide control over many aspects of vehicle 10 and its subsystems.

[0081] Optionally, one or more of the components may be installed separately from or associated with the vehicle 10. For example, the memory 162 may be partially or completely separate from the vehicle 10. The aforementioned components may be communicatively coupled to each other in a wired and / or wireless manner.

[0082] Optionally, the above components are merely examples. In practical applications, components in the above modules may be added or deleted based on practical requirements. Figure 1c should not be construed as a limitation on the embodiments of the present application.

[0083] The vehicle 10 may be a car, truck, motorcycle, bus, boat, airplane, helicopter, lawn mower, recreational vehicle, playground vehicle, construction equipment, trolley, golf cart, train, pushcart, etc. This is not a particular limitation of the embodiments of the present application.

[0084] In the existing OTA upgrade process for control units, some terminals use an A / B partition upgrade and backup solution to restore the pre-upgrade version status when the upgrade fails. However, using an A / B partition upgrade and backup solution leads to higher ECU costs. Therefore, many ECUs do not have the A / B partition upgrade and backup function. When some ECUs in a vehicle support A / B partition upgrade and backup while other ECUs do not, how to perform an OTA upgrade for a terminal that does not have the A / B partition upgrade and backup function and how to solve the rollback processing problem caused by the OTA upgrade failure are urgent technical problems that need to be solved by those skilled in the art. The following describes an OTA upgrade method provided in one embodiment of the present application with reference to FIG. 2.

[0085] 2 is a schematic flowchart of an OTA upgrade method according to an embodiment of the present application. In this embodiment, an example in which the control unit is an ECU is used for explanation. The method includes the following steps:

[0086] Step S200: The OTA server sends request information to the terminal.

[0087] Specifically, the request information is used to request the terminal to acquire software information of the ECU on the terminal. The OTA server may periodically send the request information to the terminal, or may send the request information when the software version of the ECU is updated.

[0088] For example, the OTA server may send the request information to an OTA device-side upgrade management unit in the terminal by using an OTA service management service module.

[0089] It should be understood that the terminal may include multiple ECUs. According to the OTA upgrade method in this embodiment of the present application, the OTA upgrade may be performed synchronously or asynchronously on the multiple ECUs. For ease of explanation, the following description uses an example in which the ECU is a single ECU to be upgraded.

[0090] Step S202: The terminal receives the request information, and generates instruction information for the ECU to be upgraded in response to the request information.

[0091] Specifically, in response to the request information, the terminal may collect current version information of the ECU, and then detect, based on the current version information, whether the terminal has stored a backup installation package of the current software version of the ECU, and generate instruction information based on the detection result.

[0092] Optionally, in response to the request information, the terminal may first determine whether the ECU supports A / B partition upgrade and backup. If the ECU supports A / B partition upgrade and backup, the terminal may directly generate instruction information indicating that a corresponding rollback package is available. If the ECU does not support A / B partition upgrade and backup, the terminal may further collect current version information of the ECU, and then detect, based on the current version information, whether the terminal has stored a backup installation package for the ECU's current software version, and generate instruction information based on the detection result.

[0093] The step of generating instruction information based on the detection result may specifically be a step of generating instruction information indicating that a corresponding rollback package is available when it is detected that the terminal has stored a backup installation package for the current software version of the ECU, or a step of generating instruction information indicating that a corresponding rollback package is not available when it is detected that the terminal has not stored a backup installation package for the current software version of the ECU.

[0094] For example, the indication information may be a negotiated specific identifier, for example, an identifier "00" represents indication information indicating that there is no corresponding rollback package, and an identifier "01" represents indication information indicating that there is a corresponding rollback package.

[0095] For example, the OTA device-side upgrade management unit in the terminal may collect current version information of the ECU by using the OTA device-side ECU upgrade management unit, and then generate instruction information for the ECU to be upgraded based on the collected current version information.

[0096] It should be noted that in this embodiment of the present application, the step of the terminal generating the instruction information for the ECU to be upgraded is not limited to being triggered by the OTA server using step S200 of sending request information to the terminal, or being triggered in another form. For example, the terminal generates the instruction information for the ECU to be upgraded based on a preset period, or generates the instruction information for the ECU to be upgraded based on a preset time node.

[0097] Step S204: The terminal transmits the software information of the ECU to the OTA server.

[0098] Specifically, after generating the instruction information for the ECU to be upgraded, the terminal may assemble software information for the ECU. The software information generated through the assembly may include information about the current software version of the ECU and the instruction information. For example, assembling the software information for the ECU may specifically assemble a software information tree for the information about the current software version of the ECU and the instruction information.

[0099] The software tree may include node branches stacked layer by layer. Specifically, the software tree may be assembled by integrating identical or similar ECUs into modules based on their functions and then associating the modules with terminals (e.g., vehicles). Specifically, the software may include multiple modules. Each module corresponds to a node in the software tree. In other words, each module included in the software can find a corresponding node in the software tree. The software information tree may include information and instruction information about the current software version corresponding to each of the multiple ECUs. Information and instruction information about the current software version corresponding to different ECUs may exist in nodes in the same layer or different layers.

[0100] For example, after completing the assembly of the software information of the ECU by using the OTA device-side upgrade management unit, the terminal returns the software information of the ECU to the OTA service management service module in the OTA server by using the OTA device-side upgrade management unit.

[0101] Step S206: The OTA server receives the software information of the ECU.

[0102] For example, the OTA server may receive ECU software information returned by an OTA device-side upgrade management unit in the terminal by using an OTA service management service module.

[0103] Step S208: The OTA server sends upgrade information to the terminal based on the software information of the ECU.

[0104] Specifically, the OTA server may analyze the software information of the ECU to obtain the current version information and instruction information of the ECU to be upgraded. Then, based on the current version information of the ECU to be upgraded, the OTA server determines or selects a corresponding target version software installation package (corresponding to the software installation package upgraded to the target version), obtains the target version software installation package download information, and, based on the instruction information, determines whether to provide the installation package download information corresponding to the current version information of the ECU to be upgraded to the terminal. After the target version software installation package download information (or including the installation package download information corresponding to the current version information) is encapsulated in upgrade information, the upgrade information is sent to the terminal. For example, the current version is V1.0 and the target version is V1.5.

[0105] The OTA server analyzes the instruction information to determine whether the terminal has stored a rollback package corresponding to the ECU's current software version. For example, the instruction information may contain a specific identifier, such as the aforementioned identifier "00" or "01." In this case, after obtaining the identifier value through analysis, the OTA server determines whether the terminal has stored a rollback package corresponding to the ECU's current software version. If the instruction information indicates that there is no rollback package corresponding to the terminal's ECU's current software version, the encapsulated upgrade information includes installation package download information corresponding to the current version information. If the instruction information indicates that there is a rollback package corresponding to the terminal's ECU's current software version, the encapsulated upgrade information is software installation package download information for the target version, but does not include installation package download information corresponding to the current version information.

[0106] The target version software installation package download information may specifically be address information for downloading the target version software installation package.The installation package download information corresponding to the current version information of the ECU to be upgraded may specifically be address information for downloading the installation package corresponding to the current version information of the ECU to be upgraded.

[0107] For example, the OTA server may analyze the software information of the ECU by using the OTA service management service module. After determining or selecting a software installation package corresponding to the target version, the OTA service management service module may upload the software installation package of the target version to the OTA upgrade package download service module and obtain address information of the software installation package for the target version stored in the OTA upgrade package download service module. If the OTA service management service module determines, based on the instruction information, to provide the terminal with installation package download information corresponding to the current version information of the ECU to be upgraded, the OTA service management service module may also upload the installation package corresponding to the current version information to the OTA upgrade package download service module and obtain address information of the installation package corresponding to the current version information and stored in the OTA upgrade package download service module. Then, after encapsulating the software installation package download information of the target version (or including the installation package download information corresponding to the current version information) into upgrade information, the OTA service management service module transmits the upgrade information to the terminal.

[0108] Step S210: The terminal receives the upgrade information and downloads an installation package according to the upgrade information.

[0109] Specifically, if the upgrade information includes software installation package download information for the current version of the ECU and software installation package download information for the target version of the ECU. Specifically, if the ECU does not support A / B partition upgrade and backup, and the terminal does not locally store the backup installation package for the current software version of the ECU as a rollback package, the terminal downloads the backup installation package for the current software version of the ECU and the software installation package for the target version of the ECU, respectively, based on the software installation package download information for the current version of the ECU and the software installation package download information for the target version of the ECU.

[0110] If the upgrade information is software installation package download information for the target version of the ECU, that is, if the ECU supports A / B partition upgrade and backup, or if the ECU does not support A / B partition upgrade and backup and the terminal locally stores a backup installation package for the current software version of the ECU as a rollback package, the terminal only needs to download the software installation package for the target version of the ECU based on the software installation package download information for the target version of the ECU.

[0111] For example, after receiving upgrade information by using the OTA device-side upgrade management unit, the terminal may trigger the OTA device-side ECU upgrade package management module to download the installation package based on the upgrade information.

[0112] Step S212: The terminal performs an upgrade based on the downloaded software installation package of the target version of the ECU.

[0113] Specifically, if the ECU supports A / B partition upgrade and backup, the terminal may directly perform upgrade installation on the backup partition based on the downloaded software installation package of the target version of the ECU. If the ECU does not support A / B partition upgrade and backup, the terminal may upgrade the ECU in the currently running system environment based on the downloaded software installation package of the target version of the ECU.

[0114] For example, the terminal may use the OTA device-side upgrade management unit to trigger the OTA device-side ECU upgrade management unit to upgrade the ECU to be upgraded based on the downloaded software installation package of the target version of the ECU. After completing the upgrade, the OTA device-side ECU upgrade management unit may return upgrade completion information to the OTA device-side upgrade management unit. The OTA device-side upgrade management unit may query the OTA device-side ECU upgrade management unit for the upgrade result.

[0115] If the upgrade result is successful, and the ECU supports A / B partition upgrade and backup, the terminal may directly delete the software installation package for the target version of the ECU and switch to the backup partition. In this case, the original partition in use becomes the new backup partition. Alternatively, if the ECU does not support A / B partition upgrade and backup, the terminal may delete the software installation package for the current version of the ECU and store the software installation package for the target version of the ECU as a rollback package.

[0116] If the upgrade result is that the upgrade has failed, step S214 may be performed.

[0117] Step S214: If the upgrade fails, the terminal performs a rollback operation.

[0118] Specifically, if the ECU supports A / B partition upgrade and backup, the device restores the partition where the upgrade failed to the mirror backup partition. Specifically, the device mirrors and backs up the data in the partition in use to the partition where the upgrade failed, continues to use the partition currently in use, and deletes the downloaded software installation package for the target version of the ECU. In other words, after an upgrade fails on the backup partition, the device does not switch to the mirror backup partition but continues to mirror and back up the data in the partition in use to the backup partition.

[0119] If the ECU does not support A / B partition upgrade and backup, the terminal may perform a rollback operation based on the stored software installation package of the current version of the ECU (the software installation package is always stored in the terminal or is stored after being downloaded by using step S210), and then delete the software installation package of the target version of the ECU.

[0120] In this embodiment of the present application, when a terminal interacts with an OTA server, regardless of whether the ECU to be upgraded supports A / B partition upgrade and backup, instruction information indicating whether there is a rollback package corresponding to the ECU's current software version is sent to the OTA server. This allows the OTA server to identify whether to deliver installation package download information used for rollback and perform on-demand delivery of the rollback package, effectively reducing traffic consumption. In addition, when both ECUs that support A / B partition upgrade and backup and ECUs that do not support A / B partition upgrade and backup exist on a terminal, the upgrade rollback procedure can be simplified and unified, and the ECU that does not support A / B partition upgrade and backup does not need to be rebuilt. In particular, in a scenario where a terminal (e.g., a vehicle) replaces a component, the rollback function in the OTA upgrade process can be automatically compatible regardless of whether the newly replaced component supports A / B partition upgrade and backup, thereby reducing costs.

[0121] In another possible embodiment, before the step of performing the upgrade based on the software installation package of the target version of the ECU, the method may further include the steps of: receiving, by the terminal, a first key sent by the first server; and decrypting the software installation package of the target version of the ECU based on the first key. The software installation package of the target version of the ECU is generated after the first server encrypts the upgrade data of the ECU based on the second key. The first key is a decryption key corresponding to the second key.

[0122] The existing OTA upgrade model is controlled by the original equipment manufacturer (OEM). The OEM is responsible for reviewing the software version of the upgrade package and distributing the upgrade package. However, with the development of intelligent connected vehicles, when some sensitive components and special applications need to be upgraded, if the upgrade package is submitted to the OEM for review and then downloaded using an OTA server, the core technology of the component supplier may be leaked or related data may be made public.

[0123] The first server in this embodiment of the present application may be a component supplier of the terminal. Specifically, the first server may encrypt upgrade data by obtaining a target version software installation package (i.e., upgrade package) using a second key and then upload the software installation package to the OTA server. Specifically, the target version software installation package of the ECU is encrypted by the first server. After downloading the target version software installation package, the terminal may decrypt the software installation package by using the corresponding decryption key (first key). This can prevent the component supplier's core technology from being leaked or related data from being obtained by the OTA server, and can prevent attackers from tampering with the upgrade data, thereby improving the security of the OTA upgrade.

[0124] It should be noted that the first server in this embodiment of the present application may be a server cluster in which multiple servers are deployed by using a distributed architecture, and the cluster may include cloud computing servers, Content Delivery Network (CDN) servers, Network Time Protocol (NTP) servers, Domain Name System (DNS) servers, etc.

[0125] The second key may be a symmetric key or an asymmetric key. Specifically, when the ciphertext is obtained by encryption using an asymmetric encryption algorithm, the encryption key is usually different from the decryption key. When the ciphertext is obtained by encryption using a symmetric encryption algorithm, the encryption key is the same as the decryption key.

[0126] In another possible embodiment, the step of receiving the first key sent by the first server by the terminal comprises: a terminal establishing a secure channel with a first server; receiving, by the terminal, via a secure channel, the first key sent by the first server; Includes.

[0127] The secure channel may be a transmission channel based on the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol, and is used for secure transmission of data. Because the secure channel is a secure and reliable channel, the first server transmits the first key to the terminal through the secure channel, which can guarantee the security of the first key.

[0128] The above describes in detail the method in the embodiment of the present application, and the following provides the related apparatus in the embodiment of the present application.

[0129] 3 is a schematic diagram of the structure of an OTA upgrade device according to an embodiment of the present application. The OTA upgrade device 30 corresponds to the terminal in the above-mentioned method embodiment and may include a first sending unit 300, a first receiving unit 302, and an executing unit 304.

[0130] The first sending unit 300 is configured to send software information of the control unit to the OTA server, the software information including information about a current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit.

[0131] The first receiving unit 302 is configured to receive upgrade information sent by the OTA server, where the upgrade information includes software installation package download information for the current version of the control unit and software installation package download information for a target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information for the target version when there is a rollback package corresponding to the current software version of the control unit.

[0132] The execution unit 304 is configured to perform a first action on the control unit based on the upgrade information.

[0133] In one possible implementation, the control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0134] In one possible embodiment, if the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, and the device stores a backup installation package for the current software version of the control unit, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, and the device does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0135] In one possible implementation, the execution unit 304: a first download and upgrade unit configured to, when the control unit does not support A / B partition upgrade and backup, download a target version software installation package according to the target version software installation package download information when there is a rollback package corresponding to the current software version of the control unit, and perform an upgrade installation on the control unit based on the target version software installation package; or a second download and upgrade unit configured to download a software installation package of a target version based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, download a software installation package of a current version of the control unit based on the software installation package download information of the current version of the control unit, and perform an upgrade installation on the control unit based on the software installation package of the target version; It may particularly include:

[0136] In one possible embodiment, the OTA upgrade device 30 may further include a restore unit 306 configured to restore the partition where the upgrade failed to the mirror backup partition when the upgrade fails in the process of performing an upgrade installation on the control unit in the backup partition based on the target version software installation package.

[0137] In one possible embodiment, the OTA upgrade device 30 may further include a rollback unit 308 configured to perform a rollback operation based on the current version software installation package of the control unit and delete the target version software installation package when the upgrade fails in the process of performing an upgrade installation on the control unit in the backup partition based on the target version software installation package.

[0138] In one possible embodiment, the first receiving unit 302 in the OTA upgrade device 30 may be further configured to receive a first key sent by the first server before the upgrade is performed based on the software installation package of the target version of the ECU, and decrypt the software installation package of the target version of the ECU based on the first key. The software installation package of the target version of the ECU is generated after the first server encrypts the upgrade data of the ECU based on the second key. The first key is a decryption key corresponding to the second key.

[0139] The OTA upgrade device 30 may further include an establishing unit configured to establish a secure channel with the first server. Then, the first receiving unit 302 may receive the first key sent by the first server via the secure channel.

[0140] Please note that for the implementation of the units in the OTA upgrade device 30 described in this embodiment of the present application, please refer to the relevant description of the terminal in the above method embodiment, and the details will not be described again here.

[0141] It should be understood that the OTA upgrade device 30 may further integrate functions of an intelligent driving system, a life service system, a security protection system, a location information service system, a vehicle service system, etc. by using technologies such as computers, advanced sensing, information fusion, communication, artificial intelligence, and automatic control, which are not particularly limited in this application and will not be described in detail again.

[0142] 4 is a schematic diagram of the structure of an OTA server according to an embodiment of the present application. The OTA server 40 corresponds to the OTA server in the above-mentioned method embodiment, and may include: a second receiving unit 400 and a second sending unit 402.

[0143] The second receiving unit 400 is of the control unit and is configured to receive software information sent by the terminal, the software information including information about the current software version of the control unit and indication information, and the indication information indicates whether there is a rollback package corresponding to the current software version of the control unit.

[0144] The second sending unit 402 is configured to send upgrade information to the terminal based on the software information, where the upgrade information includes software installation package download information for the current version of the control unit and software installation package download information for a target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information for the target version when there is a rollback package corresponding to the current software version of the control unit.

[0145] Please note that for the implementation of the units in the OTA server 40 described in this embodiment of the present application, please refer to the relevant description of the OTA server in the preceding method embodiment, and the details will not be described again here.

[0146] 5 is a schematic diagram of the structure of a device according to an embodiment of the present application. Both the terminal and the server in the embodiment of the present application may be implemented by using the structure of FIG. 5. The device 50 includes at least one processor 501, at least one memory 502, and at least one communication interface 503. In addition, the device may further include general-purpose components such as an antenna. Details will not be described again here.

[0147] The processor 501 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling program execution of the aforementioned solutions.

[0148] The communication interface 503 is configured to communicate with another device or communication network, for example, an OTA server, a key server, or an in-vehicle device.

[0149] The memory 502 may be, but is not limited to, read-only memory (ROM) or another type of static storage device capable of storing static information and instructions, random access memory (RAM) or another type of dynamic storage device capable of storing information and instructions, Electrically Erasable Programmable Read-Only Memory (EEPROM), Compact Disc Read-Only Memory (CD-ROM) or another optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or another magnetic storage device, or any other medium that can be used to hold or store expected program code in the form of instructions or data structures and that can be accessed by a computer. The memory may exist independently or be connected to the processor via a bus. Alternatively, the memory may be integrated with the processor.

[0150] The memory 502 is configured to store application code for implementing the aforementioned solution, and the processor 501 controls the execution. The processor 501 is configured to execute the application code stored in the memory 502.

[0151] If the device 50 shown in FIG. 5 is a terminal, the code stored in the memory 502 may be used to perform terminal-side processing steps in the OTA upgrade method provided in FIG. 2, including steps of sending software information of the control unit to an OTA server, receiving upgrade information sent by the OTA server, and performing a first operation on the control unit based on the upgrade information.

[0152] The control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

[0153] If the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or When the control unit does not support A / B partition upgrade and backup, if the terminal stores a backup installation package for the current software version of the control unit, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit, or when the control unit does not support A / B partition upgrade and backup, if the terminal does not store a backup installation package for the current software version of the control unit, the indication information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0154] The step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit supports A / B partition upgrade and backup, the terminal downloads the software installation package of the target version according to the software installation package download information of the target version, and performs upgrade installation on the control unit in the backup partition according to the software installation package of the target version. Includes.

[0155] The step of the terminal performing a first operation on the control unit based on the upgrade information includes: When the control unit does not support A / B partition upgrade and backup, and there is a rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of the target version according to the software installation package download information of the target version, and performs an upgrade installation on the control unit according to the software installation package of the target version; or When there is no rollback package corresponding to the current software version of the control unit, the terminal downloads a software installation package of the target version based on the software installation package download information of the target version, downloads a software installation package of the current version of the control unit based on the software installation package download information of the current version of the control unit, and performs an upgrade installation on the control unit based on the software installation package of the target version. Includes.

[0156] In the process of performing an upgrade installation on a control unit in a backup partition based on a target version software installation package, the upgrade fails, and the method Steps for the device to restore the failed upgrade partition to the mirror backup partition Further includes:

[0157] In the process of performing an upgrade installation on the control unit based on the target version software installation package, the upgrade fails, and the method includes: The terminal performs a rollback operation based on the current version of the software installation package of the control unit, and deletes the target version of the software installation package. Further includes:

[0158] Please note that if the device 50 is a terminal, for implementation, please refer to the relevant description of the terminal in the preceding method embodiment, and the details will not be described again here.

[0159] If the device shown in FIG. 5 is an OTA server, the code stored in memory 502 is of a control unit and can be used to perform OTA server-side processing steps in the OTA upgrade method provided in FIG. 2, including receiving software information sent by the terminal and sending upgrade information to the terminal based on the software information.

[0160] Please note that if the device 50 is an OTA server, for implementation, please refer to the relevant description of the OTA server in the preceding method embodiment, and the details will not be described again here.

[0161] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, which, when executed on one or more processors, performs the method of the embodiment shown in FIG.

[0162] An embodiment of the present application further provides a computer program or computer program product, which, when run on one or more processors, performs the method of the embodiment shown in FIG.

[0163] An embodiment of the present application further provides a chip system. The chip system includes a communication interface and at least one processor. The communication interface is configured to provide information input / output to the at least one processor, and / or the communication interface is configured to send or receive data. The processor is configured to call a computer program (or computer instruction) to perform processing steps on the terminal side or the OTA server side in the embodiment shown in FIG. 2.

[0164] All or part of the above-described embodiments may be implemented using software, hardware, firmware, or any combination thereof. When software is used to implement an embodiment, all or part of the embodiment may be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, radio wave, microwave) method. The computer-readable storage medium may be any available medium accessible by a computer, or may be a data storage device, such as a server or data center, that integrates one or more available media. The available media may be magnetic media (eg, floppy disks, hard disks, or magnetic tapes), optical media (eg, DVDs), semiconductor media (eg, solid state drives), and the like.

[0165] Those skilled in the art will understand that all or part of the steps of the methods in the embodiments can be implemented by a computer program that instructs relevant hardware. The program may be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments can be performed. The above-mentioned storage medium includes any medium that can store program code, such as a ROM, a random access memory (RAM), a magnetic disk, or an optical disk. [Explanation of symbols]

[0166] 10 Vehicles 30 OTA upgrade device 40 OTA Server 50 devices 101 terminals 102 OTA Server 110 Running System 111 Engine 112 Transmission 113 Energy Sources 114 Wheels 120 Sensor System 121 Global Positioning System 122 Inertial Measurement Unit 123 Radar 124 Laser Rangefinder 125 Camera 130 Control System 131 Steering System 132 Throttle 133 Brake unit 134 Computer Vision Systems 135 Route Control System 136 Obstacle Avoidance System 140 Peripheral Devices 141 Wireless Communication Systems 142 Onboard Computer 143 Microphone 144 Speaker 150 Power supply 160 Computer Systems 161 processors 162 memory 163 Command 170 User Interface 300 First transmitting unit 302 first receiving unit 304 Execution Unit 306 Restoration Unit 308 Rollback Unit 400 Second receiving unit 402 second transmitting unit 501 processor 502 memory 503 Communication Interface 1010 OTA device-side upgrade management unit 1011 OTA device-side ECU upgrade package management module 1012 OTA device side ECU upgrade management unit 1020 OTA Service Management Service Module 1021 OTA Upgrade Package Download Service Module

Claims

1. 1. An over-the-air (OTA) upgrade method, comprising: sending, by the terminal, software information of a control unit to an OTA server, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; receiving, by the terminal, upgrade information sent by the OTA server, where if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of a target version belonging to the control unit, or if there is the corresponding rollback package for the current software version of the control unit, the upgrade information is software installation package download information of a target version; performing, by the terminal, a first action on the control unit based on the upgrade information; A method comprising:

2. The method of claim 1 , wherein the control unit includes a control unit that supports A / B partition upgrade and backup or a control unit that does not support A / B partition upgrade and backup.

3. If the control unit supports A / B partition upgrade and backup, the indication information indicates that the current software version of the control unit has the corresponding rollback package; or 2. The method of claim 1, wherein, when the control unit does not support A / B partition upgrade and backup, if the terminal stores a backup installation package for the current software version of the control unit, the instruction information indicates that the current software version of the control unit has the corresponding rollback package, or when the control unit does not support A / B partition upgrade and backup, if the terminal does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

4. The step of causing the terminal to perform a first operation on the control unit based on the upgrade information includes: If the control unit supports A / B partition upgrade and backup, downloading, by the terminal, a software installation package of the target version according to the software installation package download information of the target version, and performing an upgrade installation on the control unit in a backup partition according to the software installation package of the target version.

4. The method of claim 1, comprising:

5. The step of causing the terminal to perform a first operation on the control unit based on the upgrade information includes: When the control unit does not support A / B partition upgrade and backup, and the current software version of the control unit has the corresponding rollback package, downloading, by the terminal, a software installation package of the target version according to the software installation package download information of the target version, and performing an upgrade installation on the control unit according to the software installation package of the target version; or downloading, by the terminal, a software installation package of the target version based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, downloading a software installation package of the current version of the control unit based on the software installation package download information of the current version of the control unit, and performing an upgrade installation on the control unit based on the software installation package of the target version.

4. The method of claim 1, comprising:

6. In the process of performing an upgrade installation on the control unit in the backup partition based on the software installation package of the target version, the upgrade fails, and the method includes: restoring the failed upgrade partition to a mirror backup partition by the terminal; 5. The method of claim 4, further comprising:

7. In the process of the step of performing an upgrade installation on the control unit based on the software installation package of the target version, the upgrade fails, and the method includes: performing a rollback operation by the terminal based on the software installation package of the current version of the control unit, and deleting the software installation package of the target version; 6. The method of claim 5, further comprising:

8. The method comprises: If the upgrade is successful, deleting, by the terminal, the software installation package of the current version of the control unit and storing the software installation package of the target version of the control unit as a rollback package.

6. The method of claim 4 or 5, further comprising:

9. Before the terminal performs an upgrade installation based on the software installation package of the target version of the control unit, the method includes: receiving, by the terminal, a first key sent by a first server; decrypting, by the terminal, the software installation package of the target version of the control unit based on the first key, where the software installation package of the target version of the control unit is generated after the first server encrypts upgrade data of the control unit based on a second key, and the first key is a decryption key corresponding to the second key; 9. The method of claim 4, further comprising:

10. The step of receiving, by the terminal, a first key sent by a first server includes: establishing, by the terminal, a secure channel with the first server; receiving, by the terminal, the first key sent by the first server via the secure channel; 10. The method of claim 9, comprising:

11. 1. An over-the-air (OTA) upgrade method, comprising: receiving, by an OTA server, software information of a control unit sent by a terminal, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; sending, by the OTA server, upgrade information to the terminal based on the software information, where if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of a target version belonging to the control unit, or if there is the corresponding rollback package for the current software version of the control unit, the upgrade information is software installation package download information of a target version; A method comprising:

12. The method of claim 11 , wherein the control unit includes a control unit that supports A / B partition upgrade and backup or a control unit that does not support A / B partition upgrade and backup.

13. An over-the-air (OTA) upgrade device, comprising: a first sending unit configured to send software information of a control unit to an OTA server, the software information including information about a current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit; and a first receiving unit configured to receive upgrade information sent by the OTA server, wherein the upgrade information includes software installation package download information of the current version of the control unit and software installation package download information of a target version when there is no rollback package corresponding to the current software version of the control unit, or the upgrade information is software installation package download information of a target version when there is a corresponding rollback package for the current software version of the control unit; an execution unit configured to perform a first action on the control unit based on the upgrade information; 1. An apparatus comprising:

14. The apparatus of claim 13 , wherein the control unit includes a control unit that supports A / B partition upgrade and backup or a control unit that does not support A / B partition upgrade and backup.

15. If the control unit supports A / B partition upgrade and backup, the indication information indicates that there is a rollback package corresponding to the current software version of the control unit; or 14. The device of claim 13, wherein, if the control unit does not support A / B partition upgrade and backup and the device stores a backup installation package for the current software version of the control unit, the instruction information indicates that the current software version of the control unit has the corresponding rollback package, or if the control unit does not support A / B partition upgrade and backup and the device does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

16. The execution unit: a first download and upgrade unit configured to, when the control unit does not support A / B partition upgrade and backup, download a software installation package of the target version based on the software installation package download information of the target version when the current software version of the control unit has the corresponding rollback package, and perform an upgrade installation on the control unit based on the software installation package of the target version; or a second download and upgrade unit configured to download a software installation package of the target version based on the software installation package download information of the target version when there is no rollback package corresponding to the current software version of the control unit, download a software installation package of the current version of the control unit based on the software installation package download information of the current version of the control unit, and perform an upgrade installation on the control unit based on the software installation package of the target version.

16. The apparatus of claim 13, further comprising:

17. The device comprises: a restore unit configured to restore the partition where the upgrade failed to a mirror backup partition when the upgrade fails in the process of performing an upgrade installation on the control unit in a backup partition based on the software installation package of the target version.

16. The apparatus of claim 15, further comprising:

18. The device comprises: a rollback unit configured to perform a rollback operation based on the software installation package of the current version of the control unit and delete the software installation package of the target version when the upgrade fails in the process of performing an upgrade installation on the control unit in a backup partition based on the software installation package of the target version.

17. The apparatus of claim 16, further comprising:

19. 19. The device of claim 15, wherein the first receiving unit is further configured to receive a first key sent by a first server before an upgrade installation is performed based on the software installation package of the target version of the control unit, and to decrypt the software installation package of the target version of the control unit based on the first key, wherein the software installation package of the target version of the control unit is generated after the first server encrypts upgrade data of the control unit based on a second key, and the first key is a decryption key corresponding to the second key.

20. the apparatus further includes an establishing unit configured to establish a secure channel with the first server; 20. The apparatus of claim 19, wherein the first receiving unit 302 receives the first key sent by the first server via the secure channel.

21. an over-the-air (OTA) server, a second receiving unit of the control unit configured to receive software information sent by a terminal, the software information including information related to a current software version of the control unit and indication information, the indication information indicating whether there is a rollback package corresponding to the current software version of the control unit; a second sending unit configured to send upgrade information to the terminal based on the software information, wherein if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information of the current version and software installation package download information of a target version belonging to the control unit, or if there is the corresponding rollback package for the current software version of the control unit, the upgrade information is software installation package download information of a target version; and Including the OTA server.

22. An over-the-air (OTA) upgrade system, A device and an OTA server are included. The terminal comprises an apparatus according to any one of claims 13 to 20, The OTA server is an OTA server according to claim 21. OTA upgrade system.

23. 13. A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to perform the method of any one of claims 1 to 10, or to perform the method of claim 11 or 12.

24. 13. A computer program comprising instructions that, when executed by a computer, enable the computer to perform the method of any one of claims 1 to 10 or the method of claim 11 or 12.

Images