OTA upgrade method and OTA upgrade device, and computer-readable storage medium

Abstract

To solve a problem with rollback processing caused by failure of over-the-air (OTA) upgrade.SOLUTION: A method includes a step of transmitting software information for a control unit to an OTA server by a terminal. The software information includes information relating to a current software version of the control unit and instruction information, and the instruction information instructs whether a rollback package corresponding to the current software version of the control unit exists. The method also includes receiving upgrade information transmitted by the OTA server by the terminal. When no rollback package corresponding to the current software version of the control unit exists, the upgrade information includes software installation package download information of a current version of the control unit and software installation package download information of a target version.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] This application relates to the fields of Internet of Vehicles and communication technologies, and particularly to an OTA upgrade method, an OTA upgrade device, and a computer-readable storage medium.

Background Art

[0002] With the continuous development of computer technologies, network technologies, etc., current terminals usually have various hardware and software (applications) installed. For example, vehicles are equipped with intelligent cockpits, sensing systems, and autonomous driving systems, and vehicle-mounted operating systems, navigation applications, audio / video playback applications are also installed in vehicles. Hardware and software expand the functions of the terminal, but hardware and software are more likely to have vulnerabilities, or hardware and software need to be replaced with more advanced versions, etc. Therefore, the hardware and software (applications) of the terminal need to be upgraded.

[0003] Over-the-Air (OTA) technology is a technique for downloading data over a wireless network, and it is widely used to upgrade devices such as vehicles, televisions, mobile phones, tablet computers, and set-top boxes. With OTA technology, automatic upgrades are primarily performed by downloading an OTA upgrade package (or the OTA upgrade package can be copied to an SD card for the upgrade). OTA upgrades are fast and have little impact on data. Therefore, OTA upgrades are becoming the primary method for upgrading the functionality of devices. For example, in the case of vehicles, original equipment manufacturers (OEMs) use OTA technology to upgrade the relevant hardware or software of the vehicle. This helps manufacturers reduce recall costs, respond quickly to requirements, and improve the user experience.

[0004] During an OTA upgrade, the upgrade may fail. To restore the pre-upgrade version state in the event of an upgrade failure, the terminal needs to be able to perform a rollback operation. For example, the Automotive Open System Architecture (AutoSar) standard may use an A / B partition upgrade and backup solution. Some manufacturers also use this solution. However, the use of an A / B partition upgrade and backup solution leads to higher costs for the Electronic Control Unit (ECU), and many ECUs do not have A / B partition upgrade and backup functionality. How to better resolve the rollback processing issues caused by OTA upgrade failures is an urgent technical problem that should be addressed by those skilled in the art. [Overview of the project] [Means for solving the problem]

[0005] This application provides an OTA upgrade method and apparatus, as well as a computer-readable storage medium, for better resolving the rollback processing problems caused by OTA upgrade failures.

[0006] According to a first aspect, the present application provides an OTA upgrade method. The method is: A step in which a terminal transmits software information of a control unit to an OTA server, wherein the software information includes information about the current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit. A step in which a terminal receives upgrade information sent by an OTA server, wherein, when there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes the current version software installation package download information and the target version software installation package download information of the control unit, or when there is a rollback package corresponding to the current software version of the control unit, the upgrade information is the target version software installation package download information. The terminal performs a first action on the control unit based on the upgrade information. Includes.

[0007] In one embodiment of this application, when a terminal interacts with an OTA server, instruction information is sent to the OTA server indicating whether a rollback package is available for the current software version of the control unit, regardless of whether the control unit to be upgraded supports A / B partition upgrades and backups. This allows the OTA server to identify whether to distribute the installation package download information used for the rollback, enabling on-demand distribution of the rollback package and effectively reducing traffic consumption.

[0008] In one possible embodiment, the control unit includes either a control unit that supports A / B partition upgrades and backups, or a control unit that does not support A / B partition upgrades and backups.

[0009] In one embodiment of this application, when both control units that support A / B partition upgrade and backup and control units that do not support A / B partition upgrade and backup are present on a terminal, the upgrade rollback procedure can be simplified and unified, and control units that do not support A / B partition upgrade and backup do not need to be rebuilt. In particular, in scenarios where a terminal (e.g., a vehicle) replaces components, the rollback function in the OTA upgrade process can be automatically compatible regardless of whether the newly replaced components support A / B partition upgrade and backup, thereby reducing costs.

[0010] In one possible embodiment, if the control unit supports A / B partition upgrades and backups, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or When the control unit does not support A / B partition upgrades and backups, if the terminal remembers the backup installation package for the current software version of the control unit, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit; or, when the control unit does not support A / B partition upgrades and backups, if the terminal does not remember the backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0011] If it is determined that the control unit supports A / B partition upgrades and backups, instruction information indicating that a corresponding rollback package exists is directly generated. Alternatively, if it is determined that the control unit does not support A / B partition upgrades and backups, it is specifically detected whether a backup installation package for the control unit's current software version is stored. In this way, the upgrade rollback procedure can be simplified and standardized, and rollback processing problems caused by OTA upgrade failures can be better resolved.

[0012] In another possible embodiment, the step of the terminal performing a first action on the control unit based on upgrade information is: If the control unit supports A / B partition upgrade and backup, the terminal downloads the target version of the software installation package based on the software installation package download information for the target version of the control unit, and then performs an upgrade installation on the control unit on the backup partition based on the target version of the software installation package. Includes.

[0013] In one embodiment of this application, if the control unit supports A / B partition upgrade and backup, after the target version of the software installation package has been downloaded, the A / B partition upgrade and backup function may be used to perform an upgrade installation on the control unit on the backup partition based on the target version of the software installation package, thereby enabling an OTA upgrade or rollback. If the upgrade is successful, the downloaded software installation package for the target version of the control unit may be deleted. This saves storage space.

[0014] In another possible embodiment, the step of the terminal performing a first action on the control unit based on upgrade information is: If the control unit does not support A / B partition upgrades and backups, and there is a rollback package corresponding to the current software version of the control unit, the terminal downloads the target version software installation package for the control unit based on the target version software installation package download information, and then performs an upgrade installation on the control unit based on the target version software installation package, or When there is no rollback package corresponding to the current software version of the control unit, the terminal downloads the target version software installation package for the control unit based on the target version software installation package download information, downloads the current version software installation package for the control unit based on the current version software installation package download information for the control unit, and performs an upgrade installation on the control unit based on the target version software installation package. Includes.

[0015] In one embodiment of this application, if the control unit does not support A / B partition upgrade and backup, and there is no corresponding rollback package, the target version of the software installation package is downloaded, and after the current version of the software installation package for the control unit is downloaded, the terminal performs an upgrade based on the target version of the software installation package and a rollback process based on the current version of the software installation package for the control unit. This better solves the rollback processing problems caused by OTA upgrade failures.

[0016] In another possible embodiment, the OTA upgrade method in this application is: If the upgrade is successful, the terminal deletes the current version of the software installation package for the control unit and stores the target version of the software installation package for the control unit as a rollback package. It also includes.

[0017] In one embodiment of this application, if the control unit does not support A / B partition upgrades and backups, after a successful upgrade, the current version of the software installation package for the control unit is deleted, and the target version of the software installation package for the control unit is stored as a new rollback package. This better resolves the rollback processing problems caused by OTA upgrade failures.

[0018] In another possible embodiment, if the control unit supports A / B partition upgrade and backup, the process involves a step of performing an upgrade installation on the control unit on the backup partition based on the target version of the software installation package, but the upgrade fails, and the method is as follows: Steps for the device to restore the partition where the upgrade failed to a mirrored backup partition. It also includes.

[0019] In one embodiment of this application, if the control unit supports A / B partition upgrade and backup, after an upgrade fails, the partition that failed to upgrade is restored to a mirrored backup partition. Specifically, the data in the partition currently in use is mirrored and backed up to the partition that failed to upgrade, and the currently in-use partition continues to be used. In this way, a rollback is performed. Furthermore, the downloaded software installation package for the target version of the control unit may be deleted. This saves storage space.

[0020] In another possible implementation, in the process of performing an upgrade installation on the control unit based on the software installation package of the target version when the control unit does not support A / B partition upgrade and backup, the upgrade fails, and the method is The step in which the terminal performs a rollback operation based on the software installation package of the current version of the control unit and deletes the software installation package of the target version further includes.

[0021] In one embodiment of the present application, when the control unit does not support A / B partition upgrade and backup, after the upgrade fails, the terminal can perform a rollback operation based on the stored software installation package of the current version of the control unit to solve the problem of the rollback process caused by the failure of the OTA upgrade.

[0022] In another possible implementation, before the step of performing an upgrade based on the software installation package of the target version of the control unit, the method further includes the step in which the terminal receives a first key sent by a first server and the step of decrypting the software installation package of the target version of the control unit based on the first key. The software installation package of the target version of the control unit is generated after the first server encrypts the upgrade data of the control unit based on a second key. The first key is a decryption key corresponding to the second key.

[0023] In one embodiment of the present application, the first server may be a component provider for the terminal, and the software installation package of the target version of the control unit is encrypted by the first server. This can prevent the core technology of the component provider from being leaked or related data from being obtained by the OTA server, and can prevent attackers from tampering with the upgrade data, thereby improving the security of the OTA upgrade.

[0024] In another possible embodiment, the step in which the terminal receives the first key transmitted by the first server includes the step in which the terminal establishes a secure channel with the first server, and the step in which the terminal receives the first key transmitted by the first server via the secure channel.

[0025] The secure channel may be a transmission channel based on the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol and is used for secure transmission of data. Since the secure channel is a secure and reliable channel, the first server transmits the first key to the terminal via the secure channel. This can guarantee the security of the first key.

[0026] According to a second aspect, the present application provides an over-the-air (OTA) upgrade method. The method includes the step in which the OTA server receives software information transmitted by the terminal and belonging to the control unit, where the software information includes information about the current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit. The OTA server sends upgrade information to a terminal based on software information, and if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes the current version software installation package download information and the target version software installation package download information of the control unit, or if there is a rollback package corresponding to the current software version of the control unit, the upgrade information is the target version software installation package download information of the control unit. Includes.

[0027] In one possible embodiment, the control unit includes either a control unit that supports A / B partition upgrades and backups, or a control unit that does not support A / B partition upgrades and backups.

[0028] In one embodiment of this application, when a terminal interacts with an OTA server, instruction information is sent to the OTA server indicating whether a rollback package corresponding to the current software version of the control unit is available, regardless of whether the control unit to be upgraded supports A / B partition upgrade and backup. This allows the OTA server to identify whether to distribute the installation package download information used for rollback, enabling on-demand distribution of the rollback package and effectively reducing traffic consumption. When both control units that support A / B partition upgrade and backup and control units that do not support A / B partition upgrade and backup are present on the terminal, the upgrade rollback procedure can be simplified and unified, and control units that do not support A / B partition upgrade and backup do not need to be rebuilt. In particular, in scenarios where a terminal (e.g., a vehicle) replaces components, the rollback function in the OTA upgrade process can be automatically compatible regardless of whether the newly replaced components support A / B partition upgrade and backup, thereby reducing costs.

[0029] According to a third aspect, one embodiment of the present application provides an over-the-air (OTA) upgrade device. The device is A first transmitting unit configured to transmit software information of a control unit to an OTA server, wherein the software information includes information about the current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit; A first receiving unit configured to receive upgrade information transmitted by an OTA server, wherein, if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes the current version software installation package download information and the target version software installation package download information of the control unit, or, if there is a rollback package corresponding to the current software version of the control unit, the upgrade information is the target version software installation package download information, and An execution unit and a control unit configured to perform a first action on the control unit based on upgrade information. Includes.

[0030] In one possible embodiment, the control unit includes either a control unit that supports A / B partition upgrades and backups, or a control unit that does not support A / B partition upgrades and backups.

[0031] In one possible embodiment, if the control unit supports A / B partition upgrades and backups, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or When the control unit does not support A / B partition upgrades and backups, if the device remembers a backup installation package for the current software version of the control unit, the instruction information indicates that a rollback package corresponding to the current software version of the control unit exists; or, when the control unit does not support A / B partition upgrades and backups, if the device does not remember a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0032] In one possible embodiment, the execution unit is A first download and upgrade unit, configured to download the target version of the software installation package for the control unit based on the target version software installation package download information, and perform an upgrade installation on the control unit based on the target version software installation package, when the control unit does not support A / B partition upgrade and backup and a rollback package corresponding to the current software version of the control unit is available, or A second download and upgrade unit is configured to download the target version software installation package for the control unit based on the target version software installation package download information when there is no rollback package corresponding to the current software version of the control unit, download the current version software installation package for the control unit based on the current version software installation package download information for the control unit, and perform an upgrade installation on the control unit based on the target version software installation package. Includes.

[0033] In one possible embodiment, the apparatus, A recovery unit configured to restore the partition where the upgrade failed to a mirror backup partition when the upgrade fails during the process of performing an upgrade installation on the control unit using a backup partition based on the target version of the software installation package. It also includes.

[0034] In one possible embodiment, the apparatus, A rollback unit is configured to perform a rollback operation based on the current version of the software installation package of the control unit and remove the target version of the software installation package if the upgrade fails during the process of performing an upgrade installation on the control unit using the target version of the software installation package. It also includes.

[0035] According to a fourth aspect, one embodiment of the present application provides an over-the-air (OTA) server. The OTA server is A second receiving unit of a control unit, configured to receive software information transmitted by a terminal, wherein the software information includes information about the current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit; A second transmitting unit configured to send upgrade information to a terminal based on software information, wherein, if there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes software installation package download information for the current version and software installation package download information for the target version of the control unit, or, if there is a rollback package corresponding to the current software version of the control unit, the upgrade information is software installation package download information for the target version of the control unit, and Includes.

[0036] According to a fifth aspect, the present application provides a terminal, the terminal including a processor configured to support the terminal in performing the corresponding functions in an OTA upgrade method according to the first aspect or any possible embodiment of the first aspect. The terminal may further include memory, which is coupled to the processor and stores program instructions and data required for the terminal. The terminal may further include a communication interface used for communication between the terminal and another device or communication network.

[0037] According to a sixth aspect, the present application provides an OTA server. The server includes a processor, which is configured to support the server in performing the corresponding functions in an OTA upgrade method according to the second aspect or any possible embodiment of the second aspect. The server may further include memory, which is coupled to the processor and stores program instructions and data required by the server. The server may further include a communication interface used for communication between the server and another device or communication network.

[0038] It should be noted that the program instructions and data in memory of this application may be stored in advance or downloaded from the Internet when the device is used and then stored. The source of the program instructions and data in memory is not particularly limited in this application. The coupling in embodiments of this application may be an indirect coupling or connection between devices, units, or modules, and may be in an electrical, mechanical, or other form, and is used for information exchange between devices, units, or modules.

[0039] According to the seventh aspect, the present application provides a computer-readable storage medium that stores a computer program. The computer program is executed by a processor to carry out the method according to the first or second aspect.

[0040] According to the eighth aspect, the present application provides a computer program product. When the computer program product is read and executed by a processor, the method according to the first or second aspect is performed.

[0041] The solutions provided in the second through eighth aspects can be used to implement or in conjunction with the method provided in the first aspect, and thus can achieve the same or corresponding beneficial effects as those of the first aspect. Further details are not provided here.

[0042] The following describes the accompanying drawings that may be used in the embodiments of this application. [Brief explanation of the drawing]

[0043] [Figure 1a] This is a diagram of the system architecture of an OTA upgrade according to one embodiment of this application. [Figure 1b] This is a diagram of the system architecture of an OTA upgrade according to another embodiment of the present application. [Figure 1c] This is a functional block diagram of a vehicle 10 according to one embodiment of this application. [Figure 2] This is a schematic flowchart of an OTA upgrade method according to one embodiment of this application. [Figure 3] This is a schematic diagram of the structure of an OTA upgrade device according to one embodiment of the present application. [Figure 4] This is a schematic diagram of the structure of an OTA server according to one embodiment of this application. [Figure 5] This is a schematic diagram of the structure of a device according to one embodiment of this application. [Modes for carrying out the invention]

[0044] The embodiments of this application will be described below with reference to the accompanying drawings of the embodiments of this application.

[0045] In the specification, claims, and accompanying drawings of this application, terms such as “first,” “second,” etc., are intended to distinguish different subjects and do not indicate a particular order. In addition, the terms “includes” and “have,” and any other variations thereof, are intended to include non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units may optionally include further steps or units not listed, or optionally include other specific steps or units of the process, method, product, or device.

[0046] The “embodiments” described herein mean that certain features, structures, or characteristics described with reference to these embodiments may be included in at least one embodiment of this application. The terms used in various parts of this specification do not necessarily mean the same embodiment, nor do they mean any independent or incompatible optional embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0047] As used herein, terms such as “component,” “module,” and “system” refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or running software. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable file, a thread of execution, a program, and / or a computer. Both computing devices and applications running on computing devices can be components, as illustrated by the use of diagrams. One or more components may reside in a process and / or a thread of execution, and components may be located on a single computer and / or distributed across two or more computers. In addition, these components may run from various computer-readable media that store various data structures. For example, components may communicate based on signals having one or more data packets (e.g., data from two components interacting with another component via a network such as the Internet, which interacts with another system via signals, in a distributed system and / or via signals) by using local and / or remote processes.

[0048] To help those skilled in the art better understand, some terms used in this application will be explained first.

[0049] (1) Over-the-Air (OTA) technology is a technology for performing firmware or software upgrades via the air interface of mobile communications. OTA technology is widely used for network upgrades of devices such as smart TVs, mobile phones, tablet computers, and set-top boxes. With the development of intelligent connected vehicles, OTA online upgrades will become an important function of automobiles or vehicles.

[0050] (2) A Telematics Box, also known as a T-Box, is a compound word of Telecommunications and Informatics. A T-Box can be literally defined as a service system that provides information by using computer systems, wireless communication technology, satellite navigation equipment, or Internet technology for exchanging information such as text and voice, which are incorporated into transport tools such as automobiles, aircraft, ships, or trains. In short, the vehicle is connected to the Internet via a wireless network to provide the vehicle owner with various information necessary for driving and daily life.

[0051] (3) An Electronic Control Unit (ECU) is a vehicle-specific microcomputer controller from a usage perspective. Like a general computer, an electronic control unit includes a large integrated circuit such as a microprocessor (CPU), memory (ROM or RAM), input / output (I / O) interfaces, analog-to-digital (A / D) converters, shapers, and drivers. In the embodiments of this application, the vehicle control unit is an electronic control unit.

[0052] (4) The Vehicle Control Unit (VCU), sometimes called the Vehicle Control Unit of an electric vehicle, is the assembly controller of the electric vehicle's power system. The VCU is responsible for coordinating the operation of components such as the engine, drive motor, gearbox, and power battery, and has the function of improving the vehicle's power performance, safety performance, and economic efficiency. The VCU is the core component of the electric vehicle's vehicle control system and is a core controller configured to control the electric vehicle's motors in starting, operating, forward / reverse, speed changes, and stopping, and to control other electronic components of the electric vehicle. As the core component of the control system of a pure electric vehicle, the VCU is responsible for tasks such as data exchange, safety management, driver intent interpretation, and power stream management. The VCU collects signals from the motor control system, accelerator pedal signals, brake pedal signals, and signals from other components, performs a comprehensive analysis, determines and responds to the driver's driving intent, and monitors the operation of controllers of lower-layer components. The VCU plays a crucial role in functions such as normal vehicle operation, battery energy braking and regeneration, network management, fault diagnosis and handling, and vehicle status monitoring.

[0053] (5) A human-machine interface (HMI), also known as a user interface, is a medium for interaction and information exchange between a system and a user, and performs the conversion between the internal format of information and a format that is acceptable to humans.

[0054] (6) The Controller Area Network (CAN) bus is one of the most widely used fieldbuses in the world. The high reliability and robust error detection capabilities of the CAN bus have attracted much attention, and therefore the CAN bus is widely used in vehicle computer control systems, as well as in industrial environments with harsh ambient temperatures, strong electromagnetic radiation, and severe vibrations. The CAN bus is a widely used fieldbus with great application prospects in fields such as industrial measurement and control and industrial automation. CAN is a serial communication bus network. The CAN bus has the advantages of reliability, real-time capabilities, and flexibility in data communication. To ensure transparent design and flexible execution, the structure of the CAN bus is divided into a physical layer and a data link layer (including the Logical Link Control LLC sublayer and the Media Access Control MAC sublayer) according to the ISO / OSI standard model.

[0055] To better understand the OTA upgrade method provided in the embodiments of this application, the system architecture and service scenarios in the embodiments of this application are described below. It should be noted that the system architecture and service scenarios described in this application are intended to more clearly illustrate the technical solutions in this application and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will understand that, as system architectures evolve and new service scenarios emerge, the technical solutions provided in this application are still applicable to similar technical problems.

[0056] Figure 1a is a diagram of a system architecture for OTA upgrade according to one embodiment of the present application. The system architecture may include a terminal 101 and an OTA server 102.

[0057] The OTA server 102 is a server that exchanges information with the terminal 101 during the OTA upgrade process. The OTA server 102 may include an OTA service management service module 1020 and an OTA upgrade package download service module 1021. Typically, the OTA server can instruct the terminal to upgrade a specific control unit. Optionally, the OTA server may instead send ECU upgrade data to the terminal by using the OTA upgrade package download service module 1021. In some specific implementation scenarios, the OTA server is also referred to as an OTA cloud server or OTA cloud-side server.

[0058] Optionally, the OTA upgrade package download service module 1021 and the OTA service management service module 1020 may be two separate pieces of hardware. Specifically, the OTA upgrade package download service module 1021 may be an independent server that provides a service to terminal 101 for downloading installation packages.

[0059] Terminal 101 is a terminal, such as a vehicle, on which a control unit is located. Terminal 101 can obtain upgrade data by using OTA server 102 in order to upgrade the control unit.

[0060] The control unit in the embodiments of this application may include all units in the terminal to which OTA upgrades can be applied, such as an ECU. In the following embodiments, an ECU is used as an example for illustrative purposes.

[0061] Optionally, terminal 101 may include an OTA device-side upgrade management unit 1010, an OTA device-side ECU upgrade package management module 1011, and an OTA device-side ECU upgrade management unit 1012. The OTA device-side upgrade management unit 1010 interacts with the OTA service management service module 1020 to obtain upgrade information from the OTA service management service module 1020 based on software information collected by the OTA device-side ECU upgrade management unit 1012, which belongs to each ECU in terminal 101, and can then trigger the OTA device-side ECU upgrade package management module 1011 to download an installation package. The OTA device-side ECU upgrade package management module 1011 may interact with the OTA upgrade package download service module 1021 to download and manage the installation package. The OTA device-side ECU upgrade management unit 1012 is responsible for specific ECU upgrade (rollback) processing.

[0062] In some specific implementation scenarios, Figure 1b is a diagram of the system architecture of an OTA upgrade according to another embodiment of the present application. For example, terminal 101 is a vehicle. The vehicle may be a vehicle electrical / electronic architecture (E / E) based vehicle. The vehicle may include the following components, namely a mobile data center (MDC), human-machine interaction (HMI), device-side upgrade management unit gateway (GW), telematics box (T-Box), electronic control unit (ECU), and other modules. The GW is the core component in the vehicle's electronic / electrical architecture. As a data exchange hub for the vehicle network, the GW can route network data such as Controller Area Network (CAN), Local Interconnect Network (LIN), and Media Oriented System Transport (MOST) across different networks. The OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit MDC are the vehicle's intelligent vehicle-mounted computing platform. The T-BOX is configured to communicate with external systems, background systems, and applications (APPs) on mobile phones. The HMI is the vehicle's information and entertainment system. The ECU may be a vehicle-specific microcomputer controller.

[0063] For example, the OTA device-side upgrade management unit 1010, the OTA device-side ECU upgrade package management module 1011, and the OTA device-side ECU upgrade management unit 1012 within terminal 101 may be units within the MDC. The OTA device-side upgrade management unit 1010 may specifically establish a connection to the OTA service management service module 1020 by using a T-BOX. The OTA device-side ECU upgrade package management module 1011 may also specifically establish a connection to the OTA upgrade package download service module 1021 by using a T-BOX.

[0064] Terminal 101 typically has only one OTA device-side upgrade management unit 1010, which may be located in a T-BOX or gateway. The OTA device-side ECU upgrade package management module 1011 may be located independently in terminal 101. Optionally, the function-related ECUs within terminal 101 may be integrated and then managed by placing the OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit 1012 together. The OTA device-side ECU upgrade package management module 1011 and the OTA device-side ECU upgrade management unit 1012 are interconnected using a gateway (GW).

[0065] Figure 1c is a functional block diagram of a vehicle 10 according to one embodiment of the present application. The vehicle 10 may include various subsystems such as a driving system 110, a sensor system 120, a control system 130, one or more peripheral devices 140, a power supply 150, a computer system 160, and a user interface 170. Optionally, the vehicle 10 may include more or fewer subsystems, and each subsystem may include multiple components. In addition, all subsystems and components of the vehicle 10 may be interconnected by wire or wireless means.

[0066] The running system 110 may include components that provide power for the vehicle 10 to move. In one embodiment, the running system 110 may include an engine 111, a transmission 112, an energy source 113, and wheels 114. The engine 111 may be an internal combustion engine, an electric motor, an air-compressor engine, or a combination of other types of engines, for example, a hybrid engine including a gasoline engine and an electric motor, or a hybrid engine including an internal combustion engine and an air-compressor engine. The engine 111 converts the energy source 113 into mechanical energy. Examples of energy sources 113 include gasoline, diesel, other petroleum-based fuels, propane, other compressed gas-based fuels, anhydrous alcohol, solar panels, batteries, and other power sources. The energy source 113 may supply energy to another system of the vehicle 10. The transmission 112 may transmit mechanical power from the engine 111 to the wheels 114. The transmission 112 may include a gearbox, a differential, and a drive shaft. In one embodiment, the transmission 112 may further include other components, such as a clutch. The drive shaft may include one or more shafts that can be coupled to one or more wheels 114.

[0067] The sensor system 120 may include several sensors that sense information about the surrounding environment of the vehicle 10. For example, the sensor system 120 may include a global positioning system 121 (the positioning system may be a GPS system, a Beidou system, or another positioning system), an inertial measurement unit (IMU) 122, a radar 123, a laser rangefinder 124, and a camera 125. The sensor system 120 may further include sensors for internal systems of the vehicle 10 being monitored (e.g., an in-cabin air quality monitor, a fuel gauge, and an oil temperature gauge). Sensor data from one or more of these sensors can be used to detect objects and their corresponding features (such as position, shape, orientation, and velocity). Such detection and identification are critical functions for the safe operation of the vehicle 10. The global positioning system 121 may be configured to estimate the geographical location of the vehicle 10. The IMU 122 is configured to sense changes in the position and leading orientation of the vehicle 10 based on inertial acceleration. In one embodiment, the IMU 122 may be a combination of an accelerometer and a gyroscope. The radar 123 may sense objects in the environment surrounding the vehicle 10 by using radio signals. In some embodiments, in addition to sensing objects, the radar 123 may be further configured to sense the speed and / or direction of travel of objects. The laser rangefinder 124 may sense objects in the environment surrounding the vehicle 10 by using lasers. In some embodiments, the laser rangefinder 124 may include one or more laser light sources, a laser scanner, one or more detectors, and other system components. The camera 125 may be configured to capture multiple images of the environment surrounding the vehicle 10. The camera 125 may be a still camera or a video camera.

[0068] The control system 130 controls the operation of the vehicle 10 and its components. The control system 130 may include various components, namely, a steering system 131, a throttle 132, a brake unit 133, a computer vision system 134, a route control system 135, and an obstacle avoidance system 136. The steering system 131 may be operated to adjust the direction of travel of the vehicle 10. For example, in one embodiment, the steering system 131 may be a steering wheel system. The throttle 132 is configured to control the operating speed of the engine 111 and to further control the speed of the vehicle 10. The brake unit 133 is configured to control the deceleration of the vehicle 10. The brake unit 133 may use friction to decelerate the wheels 114. In another embodiment, the brake unit 133 may convert the kinetic energy of the wheels 114 into an electric current. Alternatively, the brake unit 133 may reduce the rotational speed of the wheels 114 in other forms to control the speed of the vehicle 10. The computer vision system 134 may be operated to process and analyze images captured by the camera 125 to identify objects and / or features in the environment surrounding the vehicle 10. These objects and / or features may include traffic lights, road boundaries, and obstacles. The computer vision system 134 may use object recognition algorithms, Structure from Motion (SFM) algorithms, video tracking, and other computer vision techniques. In some embodiments, the computer vision system 134 may be configured to map the environment, track objects, and estimate the speed of objects. The route control system 135 is configured to determine the driving path of the vehicle 10. In some embodiments, the route control system 135 may determine the driving path of the vehicle 10 by referring to data from the sensor system 120 and one or more predetermined maps. The obstacle avoidance system 136 is configured to identify, evaluate, and avoid or otherwise bypass potential obstacles in the environment surrounding the vehicle 10.

[0069] Naturally, in one example, the control system 130 may include additional or substitute components in addition to those illustrated and described, or it may omit some of the above components.

[0070] The control unit in the embodiments of this application may be one or more control units within the control system 130. The control unit typically controls the vehicle using applications or program instructions. The original equipment manufacturer (OTA) upgrades the applications within the control unit based on actual conditions and provides OTA upgrade services to the user.

[0071] Vehicle 10 interacts with external sensors, other vehicles, other computer systems, or users by using peripheral devices 140. Peripheral devices 140 may include a wireless communication system 141, an onboard computer 142, a microphone 143, and / or a speaker 144.

[0072] In some embodiments, peripheral devices 140 provide means for the user of the vehicle 10 to interact with the user interface 170. For example, an onboard computer 142 may provide information to the user of the vehicle 10. The user interface 170 may further operate the onboard computer 142 to receive input from the user. The onboard computer 142 may perform operations on a touchscreen. In other cases, peripheral devices 140 may provide means for the vehicle 10 to communicate with other devices located within the vehicle. For example, a microphone 143 may receive voice (e.g., voice commands or other voice input) from the user of the vehicle 10. Similarly, a speaker 144 may output voice to the user of the vehicle 10. A wireless communication system 141 may communicate wirelessly with one or more devices, either directly or via a communication network. For example, the wireless communication system 141 may use 3G cellular communication, such as Code Division Multiple Access (CDMA), Evolution-Data Optimized (EVDO), Global System for Mobile Communications (GSM) / General packet radio service (GPRS), or the 4th generation mobile networks (4G) cellular communication, such as Long Term Evolution (LTE), or the 5th generation mobile networks (or 5th generation wireless systems, 5th-Generation, 5G) cellular communication. The wireless communication system 141 may also communicate with a wireless local area network (WLAN) by using Wi-Fi.In some embodiments, the wireless communication system 141 may communicate directly with devices using an infrared link, Bluetooth®, or ZigBee. Other wireless protocols, such as various vehicle communication systems, may be used. For example, the wireless communication system 141 may include one or more Dedicated Short Range Communications (DSRC) devices, which may include public and / or private data communications between vehicles and / or roadside stations.

[0073] The power source 150 can supply power to various components of the vehicle 10. In one embodiment, the power source 150 may be a rechargeable lithium-ion battery or a lead-acid battery. One or more battery packs of such batteries may be configured as power sources to supply power to the components of the vehicle 10. In some embodiments, for example, in some all-electric vehicles, the power source 150 and the energy source 113 may be implemented together.

[0074] Some or all of the functions of vehicle 10 are controlled by computer system 160. Computer system 160 may include at least one processor 161. Processor 161 executes instructions 163 stored in a non-temporary computer-readable medium, such as memory 162. Alternatively, computer system 160 may be multiple computing devices that control individual components or subsystems of vehicle 10 in a distributed manner.

[0075] The processor 161 may be any conventional processor, such as a commercially available Central Processing Unit (CPU). Alternatively, the processor may be a dedicated device such as an Application Specific Integrated Circuit (ASIC) or another hardware-based processor. Although Figure 1c functionally illustrates the processor, memory, and other components of the computer system 160 in the same block, those skilled in the art will understand that the processor, computer system, or memory may actually include multiple processors, computers, or memory, which may or may not be housed in the same physical housing. For example, the memory may be a hard disk drive or another storage medium located in a housing different from that of the computer system 160. Thus, it will be understood that references to a processor or computer include references to a set of processors or computers or memory, which may or may not operate in parallel. Unlike performing the steps described herein using a single processor, some components, such as steering and deceleration components, may include their own processors. The processors perform only the computational processing related to the component-specific function.

[0076] In various embodiments described in this book, the processor may be located far from the vehicle and may communicate with the vehicle wirelessly. In another embodiment, some of the processes described in this book are performed on a processor located inside the vehicle, while other processes, including performing steps necessary for a single operation, are performed by a remote processor.

[0077] In some embodiments, memory 162 may include instructions 163 (e.g., program logic). Instructions 163 may be executed by processor 161 to perform various functions of vehicle 10, including the functions described above. Memory 162 may also include additional instructions, including instructions for sending data to one or more of the driving system 110, sensor system 120, control system 130, and peripheral devices 140, receiving data from one or more of them, interacting with one or more of them, and / or controlling one or more of them.

[0078] In addition to instruction 163, memory 162 may further store data, such as software installation packages, target files, and other information. This information can be used by the vehicle 10 and the computer system 160 when the software is installed on the vehicle 10 or when the target function is performed.

[0079] The user interface 170 is configured to provide information to or receive information from the user of the vehicle 10. Optionally, the user interface 170 may include one or more input / output devices within a set of peripheral devices 140, such as a wireless communication system 141, an onboard computer 142, a microphone 143, and a speaker 144.

[0080] The computer system 160 can control the functions of the vehicle 10 based on inputs received from various subsystems (e.g., the driving system 110, the sensor system 120, and the control system 130) and the user interface 170. For example, the computer system 160 may generate target requests by using target service information from an external device. In some embodiments, the computer system 160 may be operated to provide control over many aspects of the vehicle 10 and its subsystems.

[0081] Optionally, one or more of the components may be installed separately from the vehicle 10 or associated with the vehicle 10. For example, memory 162 may be partially or completely isolated from the vehicle 10. The aforementioned components may be coupled to communicate with each other via wired and / or wireless means.

[0082] The components described above are merely examples, and are optional. In actual application, components within the aforementioned modules may be added or removed based on actual requirements. Figure 1c should not be construed as an limitation to embodiments of this application.

[0083] Vehicle 10 can be a passenger car, truck, motorcycle, bus, boat, airplane, helicopter, lawnmower, recreational vehicle, playground ride, construction machinery, trolley, golf cart, train, wheelbarrow, etc. This is not particularly limited to the embodiments of this application.

[0084] In existing OTA upgrade processes for control units, some terminals use A / B partition upgrade and backup solutions to restore the pre-upgrade version state in the event of an upgrade failure. However, the use of A / B partition upgrade and backup solutions leads to higher costs for the ECU. Therefore, many ECUs do not have A / B partition upgrade and backup functionality. When some ECUs in a vehicle support A / B partition upgrade and backup, but others do not, how to perform OTA upgrades for terminals that do not have A / B partition upgrade and backup functionality, and how to resolve the rollback processing issues caused by OTA upgrade failures, is an urgent technical problem that should be solved by those skilled in the art. The following describes an OTA upgrade method provided in one embodiment of this application with reference to Figure 2.

[0085] Figure 2 is a schematic flowchart of an OTA upgrade method according to one embodiment of the present application. In this embodiment, an example in which the control unit is an ECU is used for explanation. The method includes the following steps:

[0086] Step S200: The OTA server sends request information to the terminal.

[0087] Specifically, the request information is used to request the retrieval of software information for the ECU on the terminal. The OTA server may send the request information to the terminal periodically, or it may send the request information when the software version of the ECU is updated.

[0088] For example, the OTA server may send request information to the OTA device-side upgrade management unit within the terminal by using the OTA service management service module.

[0089] It will be understood that a terminal may include multiple ECUs. According to the OTA upgrade method in this embodiment of the present application, the OTA upgrade may be performed synchronously or asynchronously on multiple ECUs. For simplicity of explanation, an example in which the ECU to be upgraded is a single ECU will be used below.

[0090] Step S202: The terminal receives the request information and generates instruction information for the ECU to be upgraded in response to the request information.

[0091] Specifically, in response to the request information, the terminal may collect the current version information of the ECU, then, based on the current version information, detect whether the terminal has a backup installation package for the current software version of the ECU, and generate instruction information based on the detection result.

[0092] Optionally, in response to the requested information, the terminal may first determine whether the ECU supports A / B partition upgrades and backups. If the ECU supports A / B partition upgrades and backups, the terminal may directly generate instructional information indicating that a corresponding rollback package exists. If the ECU does not support A / B partition upgrades and backups, the terminal may further collect the current version information of the ECU, and then, based on the current version information, detect whether the terminal has a backup installation package for the current software version of the ECU, and generate instructional information based on the detection result.

[0093] The step of generating instruction information based on the detection result may specifically be the step of generating instruction information indicating that a corresponding rollback package exists when it is detected that the terminal remembers the backup installation package for the current software version of the ECU, or the step of generating instruction information indicating that a corresponding rollback package does not exist when it is detected that the terminal does not remember the backup installation package for the current software version of the ECU.

[0094] For example, the instruction information may be a specific identifier that has been negotiated. For instance, identifier "00" represents instruction information indicating that there is no corresponding rollback package, and identifier "01" represents instruction information indicating that there is a corresponding rollback package.

[0095] For example, an OTA device-side upgrade management unit within a terminal may collect current ECU version information by using an OTA device-side ECU upgrade management unit, and then generate instruction information for which ECUs should be upgraded based on the collected current version information.

[0096] It should be noted that in this embodiment of the present application, the step of a terminal generating instruction information for an ECU to be upgraded is not limited to being triggered by step S200, in which an OTA server sends request information to the terminal, or to being triggered in another form. For example, the terminal generates instruction information for an ECU to be upgraded based on a pre-configured period, or based on a pre-configured time node.

[0097] Step S204: The terminal sends ECU software information to the OTA server.

[0098] Specifically, after generating instruction information for the ECU to be upgraded, the terminal may assemble the ECU's software information. The software information generated through assembly may include information and instruction information regarding the ECU's current software version. For example, assembling the ECU's software information may specifically involve assembling a software information tree for information and instruction information regarding the ECU's current software version.

[0099] A software tree may include node branches stacked layer by layer. Specifically, a software tree can be assembled by integrating identical or similar ECUs into modules based on their functionality, and then associating those modules with terminals (e.g., vehicles). Specifically, software may contain multiple modules. Each module corresponds to a node in the software tree. In other words, each module included in the software can find its corresponding node in the software tree. A software information tree may contain information and instructions regarding the current software version for each of multiple ECUs. Information and instructions regarding the current software version for different ECUs may reside in nodes on the same layer or different layers.

[0100] For example, after completing the assembly of the ECU's software information using the OTA device-side upgrade management unit, the terminal returns the ECU's software information to the OTA service management service module in the OTA server using the OTA device-side upgrade management unit.

[0101] Step S206: The OTA server receives software information from the ECU.

[0102] For example, an OTA server may receive software information of the ECU returned by the OTA device-side upgrade management unit within the terminal by using an OTA service management service module.

[0103] Step S208: The OTA server sends upgrade information to the terminal based on the ECU's software information.

[0104] Specifically, the OTA server can analyze the ECU's software information to obtain the current version information and instruction information for the ECU to be upgraded. Then, based on the current version information of the ECU to be upgraded, the OTA server determines or selects the corresponding target version software installation package (equivalent to the software installation package upgraded to the target version), obtains the target version software installation package download information, and, based on the instruction information, decides whether to provide the terminal with the installation package download information corresponding to the current version information of the ECU to be upgraded. After the target version software installation package download information (or the installation package download information corresponding to the current version information) is encapsulated in the upgrade information, the upgrade information is sent to the terminal. For example, the current version is V1.0 and the target version is V1.5.

[0105] The OTA server parses the instruction information to determine whether the terminal has a rollback package stored for the current software version of the ECU. For example, if the instruction information is a specific identifier, such as the aforementioned identifier "00" or "01". In this case, after obtaining the value of the identifier through parsing, the OTA server determines whether the terminal has a rollback package stored for the current software version of the ECU. If the instruction information indicates that there is no rollback package for the current software version of the terminal's ECU, the encapsulated upgrade information includes installation package download information for the current version. If the instruction information indicates that there is a rollback package for the current software version of the terminal's ECU, the encapsulated upgrade information is the software installation package download information for the target version and does not include the installation package download information for the current version.

[0106] The target version software installation package download information may specifically be address information for downloading the target version software installation package. The installation package download information corresponding to the current version information of the ECU to be upgraded may specifically be address information for downloading the installation package corresponding to the current version information of the ECU to be upgraded.

[0107] For example, an OTA server may analyze the ECU's software information by using an OTA service management service module. After determining or selecting the software installation package corresponding to the target version, the OTA service management service module may upload the software installation package for the target version to an OTA upgrade package download service module and retrieve the address information of the software installation package of the target version stored in the OTA upgrade package download service module. If the OTA service management service module decides, based on the instruction information, to provide the terminal with installation package download information corresponding to the current version information of the ECU to be upgraded, the OTA service management service module may also upload the installation package corresponding to the current version information to an OTA upgrade package download service module and retrieve the address information of the installation package corresponding to the current version information stored in the OTA upgrade package download service module. Then, after encapsulating the software installation package download information for the target version (or including the installation package download information corresponding to the current version information) into upgrade information, the OTA service management service module sends the upgrade information to the terminal.

[0108] Step S210: The terminal receives upgrade information and downloads the installation package based on that information.

[0109] Specifically, this applies when the upgrade information includes download information for the current version of the ECU's software installation package and the target version of the ECU's software installation package. Specifically, this applies when the ECU does not support A / B partition upgrades and backups, and the terminal does not locally store the backup installation package for the current version of the ECU's software as a rollback package. In this case, the terminal downloads the backup installation package for the current version of the ECU's software and the target version of the ECU's software installation package, respectively, based on the download information for the current version of the ECU's software installation package and the target version of the ECU's software installation package.

[0110] If the upgrade information is the software installation package download information for the target version of the ECU, that is, if the ECU supports A / B partition upgrades and backups, or if the terminal locally stores the backup installation package for the current software version of the ECU as a rollback package when the ECU does not support A / B partition upgrades and backups, then the terminal only needs to download the software installation package for the target version of the ECU based on the software installation package download information for the target version of the ECU.

[0111] For example, after receiving upgrade information using an OTA device-side upgrade management unit, the terminal may trigger an OTA device-side ECU upgrade package management module based on the upgrade information to download the installation package.

[0112] Step S212: The terminal performs the upgrade based on the downloaded software installation package for the target version of the ECU.

[0113] Specifically, if the ECU supports A / B partition upgrades and backups, the terminal can directly perform an upgrade installation on the backup partition based on the downloaded software installation package for the target version of the ECU. If the ECU does not support A / B partition upgrades and backups, the terminal can upgrade the ECU in the currently running system environment based on the downloaded software installation package for the target version of the ECU.

[0114] For example, a terminal may use an OTA device-side upgrade management unit to trigger an OTA device-side ECU upgrade management unit, which then upgrades the ECUs that should be upgraded based on the downloaded software installation package for the target version of the ECU. After the upgrade is complete, the OTA device-side ECU upgrade management unit may return upgrade completion information to the OTA device-side upgrade management unit. The OTA device-side upgrade management unit may query the OTA device-side ECU upgrade management unit for the upgrade results.

[0115] If the upgrade result is successful, and the ECU supports A / B partition upgrades and backups, the terminal may directly delete the target version of the software installation package for the ECU and switch to the backup partition. In this case, the original partition in use becomes the new backup partition. Alternatively, if the ECU does not support A / B partition upgrades and backups, the terminal may delete the current version of the software installation package for the ECU and store the target version of the software installation package for the ECU as a rollback package.

[0116] If the upgrade result is an upgrade failure, step S214 may be performed.

[0117] Step S214: If the upgrade fails, the device will perform a rollback action.

[0118] Specifically, if the ECU supports A / B partition upgrades and backups, the terminal restores the partition where the upgrade failed to a mirrored backup partition. More precisely, the terminal mirrors and backs up the data in the partition currently in use to the partition where the upgrade failed, continues to use the currently used partition, and may delete the downloaded software installation package for the ECU's target version. In other words, after an upgrade fails on the backup partition, the terminal does not switch to the mirrored backup partition, but continues to mirror and back up the data in the partition currently in use to the backup partition.

[0119] If the ECU does not support A / B partition upgrades and backups, the terminal may perform a rollback operation based on the stored software installation package for the current version of the ECU (the software installation package is always stored in the terminal or stored after being downloaded by using step S210), and then delete the software installation package for the target version of the ECU.

[0120] In this embodiment of the present application, when a terminal interacts with an OTA server, instruction information is sent to the OTA server indicating whether a rollback package corresponding to the current software version of the ECU is available, regardless of whether the ECU to be upgraded supports A / B partition upgrade and backup. This allows the OTA server to identify whether to distribute the installation package download information used for rollback, enabling on-demand distribution of the rollback package and effectively reducing traffic consumption. In addition, when both ECUs that support A / B partition upgrade and backup and ECUs that do not support A / B partition upgrade and backup are present on the terminal, the upgrade rollback procedure can be simplified and unified, and ECUs that do not support A / B partition upgrade and backup do not need to be rebuilt. In particular, in scenarios where a terminal (e.g., a vehicle) replaces components, the rollback function in the OTA upgrade process can be automatically compatible regardless of whether the newly replaced components support A / B partition upgrade and backup, thereby reducing costs.

[0121] In another possible embodiment, prior to the step of performing an upgrade based on a target version software installation package for the ECU, the method may further include the steps of: the terminal receiving a first key transmitted by a first server; and decrypting the target version software installation package for the ECU based on the first key. The target version software installation package for the ECU is generated after the first server encrypts the upgrade data for the ECU based on a second key, the first key being the decryption key corresponding to the second key.

[0122] The existing OTA upgrade model is controlled by the Original Equipment Manufacturer (OEM). The OEM is responsible for reviewing the software version of the upgrade package and distributing it. However, with the evolution of intelligent connected vehicles, when certain sensitive components and special applications need to be upgraded, if the upgrade package is submitted to the OEM for review and then downloaded using an OTA server, there is a possibility that core technology from the component supplier or related data may be leaked.

[0123] In this embodiment of the present application, the first server may be a component supplier for the terminal. Specifically, the first server may encrypt the upgrade data by obtaining the target version of the software installation package (i.e., the upgrade package) using a second key, and then upload the software installation package to the OTA server. Specifically, the target version of the software installation package for the ECU is encrypted by the first server, and after downloading the target version of the software installation package, the terminal may decrypt the software installation package using the corresponding decryption key (the first key). This prevents the core technology of the component supplier from being leaked or related data from being obtained by the OTA server, and prevents attackers from tampering with the upgrade data, thereby improving the security of the OTA upgrade.

[0124] It should be noted that the first server in this embodiment of the present application may be a server cluster in which multiple servers are arranged by using a distributed architecture. The cluster may include cloud computing servers, content delivery network (CDN) servers, network time protocol (NTP) servers, domain name system (DNS) servers, and the like.

[0125] The second key may be a symmetric or asymmetric key. Specifically, when ciphertext is obtained by encryption using an asymmetric encryption algorithm, the encryption key is usually different from the decryption key. When ciphertext is obtained by encryption using a symmetric encryption algorithm, the encryption key is the same as the decryption key.

[0126] In another possible embodiment, the step of a terminal receiving a first key sent by a first server is: The terminal establishes a secure channel with the first server, The terminal receives a first key sent by a first server via a secure channel. Includes.

[0127] A secure channel may be a transmission channel based on the Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol, and is used for the secure transmission of data. Because a secure channel is a secure and trusted channel, the first server transmits the first key to the terminal over the secure channel. This can guarantee the security of the first key.

[0128] The above describes in detail the method in the embodiment of this application, and the following provides related devices in the embodiment of this application.

[0129] Figure 3 is a schematic diagram of the structure of an OTA upgrade device according to one embodiment of the present application. The OTA upgrade device 30 corresponds to the terminal in the method embodiment described above and may include a first transmitting unit 300, a first receiving unit 302, and an execution unit 304.

[0130] The first transmitting unit 300 is configured to transmit software information of the control unit to the OTA serve. The software information includes information about the current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit.

[0131] The first receiving unit 302 is configured to receive upgrade information sent by the OTA server. If there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes the current version software installation package download information and the target version software installation package download information for the control unit; or, if there is a rollback package corresponding to the current software version of the control unit, the upgrade information is the target version software installation package download information.

[0132] The execution unit 304 is configured to perform a first action on the control unit based on upgrade information.

[0133] In one possible embodiment, the control unit includes either a control unit that supports A / B partition upgrades and backups, or a control unit that does not support A / B partition upgrades and backups.

[0134] In one possible embodiment, if the control unit supports A / B partition upgrades and backups, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or When the control unit does not support A / B partition upgrades and backups, if the device remembers a backup installation package for the current software version of the control unit, the instruction information indicates that a rollback package corresponding to the current software version of the control unit exists; or, when the control unit does not support A / B partition upgrades and backups, if the device does not remember a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0135] In one possible embodiment, the execution unit 304 is A first download and upgrade unit, configured to download the target version of the software installation package based on the target version's software installation package download information, and perform an upgrade installation on the control unit based on the target version's software installation package, when the control unit does not support A / B partition upgrades and backups and a rollback package corresponding to the control unit's current software version is available, or A second download and upgrade unit is configured to download the target version software installation package based on the target version software installation package download information when there is no rollback package corresponding to the current software version of the control unit, download the current version software installation package based on the current version software installation package download information of the control unit, and perform an upgrade installation on the control unit based on the target version software installation package. This may include in particular.

[0136] In one possible embodiment, the OTA upgrade device 30 may further include a restore unit 306 configured to restore a partition that failed to be upgraded to a mirror backup partition when the upgrade fails in the process of performing an upgrade installation on the control unit on a backup partition based on a target version of the software installation package.

[0137] In one possible embodiment, the OTA upgrade device 30 may further include a rollback unit 308 configured to perform a rollback operation based on the current version of the software installation package of the control unit and delete the target version of the software installation package if the upgrade fails in the process of performing an upgrade installation on the control unit on a backup partition based on the target version of the software installation package.

[0138] In one possible embodiment, a first receiving unit 302 within the OTA upgrade device 30 may be further configured to receive a first key transmitted by a first server before the upgrade is performed based on a software installation package for a target version of the ECU, and to decrypt the software installation package for a target version of the ECU based on the first key. The software installation package for a target version of the ECU is generated after the first server encrypts the upgrade data for the ECU based on a second key. The first key is the decryption key corresponding to the second key.

[0139] The OTA upgrade device 30 may further include an establishment unit configured to establish a secure channel with a first server. The first receiving unit 302 may then receive a first key transmitted by the first server via the secure channel.

[0140] For embodiments of the units within the OTA upgrade device 30 described in this embodiment of the present application, please refer to the relevant descriptions of the terminals in the method embodiments described above. Details will not be described again here.

[0141] It should be understood that the OTA upgrade device 30 can further integrate functions such as intelligent driving systems, lifestyle service systems, security protection systems, location information service systems, and vehicle service systems by using technologies such as computers, advanced sensing, information fusion, communication, artificial intelligence, and automatic control. This is not particularly limited in this application, and further details will not be described again.

[0142] Figure 4 is a schematic diagram of the structure of an OTA server according to one embodiment of the present application. The OTA server 40 corresponds to the OTA server in the method embodiment described above and may include a second receiving unit 400 and a second transmitting unit 402.

[0143] The second receiving unit 400 belongs to the control unit and is configured to receive software information transmitted by the terminal. The software information includes information about the current software version of the control unit and instruction information, the instruction information indicating whether there is a rollback package corresponding to the current software version of the control unit.

[0144] The second transmission unit 402 is configured to send upgrade information to the terminal based on software information. If there is no rollback package corresponding to the current software version of the control unit, the upgrade information includes the current version software installation package download information and the target version software installation package download information of the control unit; or if there is a rollback package corresponding to the current software version of the control unit, the upgrade information is the target version software installation package download information.

[0145] For embodiments of the units within the OTA server 40 described in this embodiment of the present application, please refer to the relevant description of the OTA server in the method embodiment described above. Details will not be described again here.

[0146] Figure 5 is a schematic diagram of the structure of a device according to one embodiment of the present application. Both the terminal and the server in the embodiment of the present application may be implemented using the structure of Figure 5. The device 50 includes at least one processor 501, at least one memory 502, and at least one communication interface 503. In addition, the device may further include general-purpose components such as an antenna. Details are not described again here.

[0147] The processor 501 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the program execution of the aforementioned solution.

[0148] The communication interface 503 is configured to communicate with another device or communication network, such as an OTA server, a key server, or an in-vehicle device.

[0149] Memory 502 may be, but is not limited to, read-only memory (ROM) or another type of static storage device capable of storing static information and instructions, random access memory (RAM) or another type of dynamic storage device capable of storing information and instructions, electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or another optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital multipurpose discs, Blu-ray discs, etc.), magnetic disk storage medium or another magnetic storage device, or any other medium that can be used to hold or store expected program code in the form of instructions or data structures and can be accessed by the computer. Memory may exist independently or be connected to the processor via a bus. Alternatively, memory may be integrated with the processor.

[0150] Memory 502 is configured to store application code for executing the aforementioned solution, and processor 501 controls its execution. Processor 501 is configured to execute the application code stored in memory 502.

[0151] If the device 50 shown in Figure 5 is a terminal, the code stored in memory 502 may be used to perform terminal-side processing steps in the OTA upgrade method provided in Figure 2, which include the steps of sending software information of the control unit to the OTA server, receiving upgrade information sent by the OTA server, and performing a first operation on the control unit based on the upgrade information.

[0152] The control units include control units that support A / B partition upgrades and backups, and control units that do not support A / B partition upgrades and backups.

[0153] If the control unit supports A / B partition upgrades and backups, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or When the control unit does not support A / B partition upgrades and backups, if the terminal remembers the backup installation package for the current software version of the control unit, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit. Alternatively, when the control unit does not support A / B partition upgrades and backups, if the terminal does not remember the backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit.

[0154] The step in which the terminal performs a first action on the control unit based on the upgrade information is: If the control unit supports A / B partition upgrade and backup, the terminal downloads the target version of the software installation package based on the target version software installation package download information, and then performs an upgrade installation on the control unit on the backup partition based on the target version software installation package. Includes.

[0155] The step in which the terminal performs a first action on the control unit based on the upgrade information is: If the control unit does not support A / B partition upgrades and backups, and there is a rollback package corresponding to the current software version of the control unit, the terminal downloads the target version software installation package based on the target version software installation package download information, and performs an upgrade installation on the control unit based on the target version software installation package, or When there is no rollback package corresponding to the current software version of the control unit, the terminal downloads the target version software installation package based on the target version software installation package download information, downloads the current version software installation package based on the current version software installation package download information for the control unit, and performs an upgrade installation on the control unit based on the target version software installation package. Includes.

[0156] In the process of performing an upgrade installation on the control unit using a backup partition based on the target version of the software installation package, the upgrade failed, and the method was as follows: Steps for the device to restore the partition where the upgrade failed to a mirrored backup partition. It also includes.

[0157] In the process of performing an upgrade installation on the control unit based on the target version of the software installation package, the upgrade fails, and the method is as follows: The terminal performs a rollback operation based on the current version of the software installation package of the control unit, and removes the target version of the software installation package. It also includes.

[0158] If device 50 is a terminal, please refer to the description of the terminal in the method embodiment described above for details of the embodiment. Details will not be explained again here.

[0159] If the device shown in Figure 5 is an OTA server, the code stored in memory 502 belongs to the control unit and can be used to perform the OTA server-side processing steps in the OTA upgrade method provided in Figure 2, which include the steps of receiving software information sent by the terminal and sending upgrade information to the terminal based on the software information.

[0160] If device 50 is an OTA server, please refer to the relevant description of the OTA server in the method embodiment described above for details. Details will not be explained again here.

[0161] One embodiment of this application further provides a computer-readable storage medium that stores a computer program. When the computer program is executed on one or more processors, the method of the embodiment shown in Figure 2 is carried out.

[0162] One embodiment of this application further provides a computer program or a computer program product. When the computer program product runs on one or more processors, the method of the embodiment shown in Figure 2 is carried out.

[0163] One embodiment of this application further provides a chip system. The chip system includes a communication interface and at least one processor. The communication interface is configured to provide information input / output to at least one processor and / or to transmit or receive data. The processor is configured to invoke a computer program (or computer instruction) to perform terminal-side or OTA server-side processing steps in the embodiment shown in Figure 2.

[0164] All or part of the embodiments described above may be implemented using software, hardware, firmware, or any combination thereof. If software is used to implement the embodiments, all or part of the embodiments may be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of this application are generated, either as a whole or in part. The computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by a wired method (e.g., coaxial cable, optical fiber, digital subscriber line) or by a wireless method (e.g., infrared, radio waves, microwave). The computer-readable storage medium may be any available medium accessible by a computer, or it may be a data storage device integrating one or more available media, such as a server or data center. The usable media may include magnetic media (e.g., floppy disks, hard disks, and magnetic tapes), optical media (e.g., DVDs), and semiconductor media (e.g., solid-state drives).

[0165] Those skilled in the art will understand that all or part of the steps of the method in the embodiments may be carried out by a computer program that instructs the relevant hardware. The program may be stored in a computer-readable storage medium. When the program is executed, the steps of the aforementioned method embodiments can be carried out. The aforementioned storage medium is any medium capable of storing program code, including, for example, ROM, random access memory (RAM), magnetic disk, and optical disk. [Explanation of symbols]

[0166] 10 Vehicles 30 OTA Upgrade Devices 40 OTA servers 50 devices 101 terminals 102 OTA Servers 110 Driving System 111 Engine 112 Transmission 113 Energy Sources 114 Wheels 120 Sensor Systems 121 Global Positioning System 122 Inertial Measuring Device 123 Radar 124 Laser Rangefinder 125 Camera 130 Control Systems 131 Steering System 132 Throttle 133 Brake Unit 134 Computer Vision Systems 135 Route control system 136 Obstacle Avoidance System 140 Peripheral Devices 141 Wireless communication systems 142 Onboard Computer 143 Microphone 144 speakers 150 Power supply 160 Computer Systems 161 processors 162 memory 163 Command 170 User Interfaces 300 First Transmitter Unit 302 First receiving unit 304 execution units 306 Restoration Unit 308 Rollback Unit 400 Second receiving unit 402 Second Transmitting Unit 501 Processor 502 memory 503 Communication Interface 1010 OTA Device-Side Upgrade Management Unit 1011 OTA Device-Side ECU Upgrade Package Management Module 1012 OTA Device Side ECU Upgrade Management Unit 1020 OTA Service Management Service Module 1021 OTA Upgrade Package Download Service Module

Claims

1. This is an over-the-air (OTA) upgrade method. A step of transmitting software information of a control unit to an OTA server via a terminal, wherein the software information includes information about the current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit. Steps include: when the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit, the terminal receiving first upgrade information transmitted by the OTA server in response to the instruction information, wherein the first upgrade information includes software installation package download information for downloading the current version of the software installation package which is for the control unit and software installation package download information for downloading the target version of the software installation package; or when the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, the terminal receiving second upgrade information transmitted by the OTA server in response to the instruction information, wherein the second upgrade information includes software installation package download information for downloading the target version of the software installation package; The terminal performs a first operation on the control unit based on the first upgrade information received or the second upgrade information received. Methods that include...

2. The method according to claim 1, wherein the control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

3. If the control unit supports A / B partition upgrades and backups, the instruction information indicates that the current software version of the control unit has the corresponding rollback package, or The method according to claim 1, wherein, when the control unit does not support A / B partition upgrades and backups, if the terminal has stored a backup installation package for the current software version of the control unit, the instruction information indicates that there is a corresponding rollback package for the current software version of the control unit, or, when the control unit does not support A / B partition upgrades and backups, if the terminal has not stored a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package for the current software version of the control unit.

4. The step of performing the first operation on the control unit using the terminal is as follows: If the control unit supports A / B partition upgrade and backup, the terminal downloads the software installation package for the target version based on the software installation package download information for the target version, and performs an upgrade installation on the control unit on the backup partition based on the software installation package for the target version. The method according to any one of claims 1 to 3, including the method described in any one of claims 1 to 3.

5. The step of performing the first operation on the control unit using the terminal is as follows: If the control unit does not support A / B partition upgrade and backup, and the current software version of the control unit has the corresponding rollback package, the terminal downloads the software installation package for the target version based on the software installation package download information for the target version, and performs an upgrade installation on the control unit based on the software installation package for the target version, or When there is no rollback package corresponding to the current software version of the control unit, the terminal downloads the software installation package for the target version based on the software installation package download information for the target version, downloads the software installation package for the current version of the control unit based on the software installation package download information for the current version of the control unit, and performs an upgrade installation on the control unit based on the software installation package for the target version. The method according to any one of claims 1 to 3, including the method described in any one of claims 1 to 3.

6. In the process of the step in which an upgrade installation is performed on the control unit on the backup partition based on the target version of the software installation package, the upgrade fails, and the method The aforementioned terminal performs the step of restoring the partition where the upgrade failed to a mirror backup partition. The method according to claim 4, further comprising:

7. In the process of the step of performing an upgrade installation on the control unit based on the target version of the software installation package, the upgrade fails, and the method The terminal performs a rollback operation based on the current version of the software installation package of the control unit and deletes the target version of the software installation package. The method according to claim 5, further comprising:

8. The aforementioned method, If the upgrade is successful, the terminal deletes the current version of the software installation package for the control unit and stores the target version of the software installation package for the control unit as a rollback package. The method according to claim 4, further comprising:

9. Before the terminal performs an upgrade installation based on the software installation package of the target version of the control unit, the method The terminal receives the first key transmitted by the first server, The steps of the terminal decrypting the software installation package for the target version of the control unit based on the first key, wherein the software installation package for the target version of the control unit is generated after the first server encrypts the upgrade data for the control unit based on the second key, and the first key is the decryption key corresponding to the second key. The method according to any one of claims 6 to 8, further comprising:

10. The step of the terminal receiving the first key transmitted by the first server is as follows: The steps include establishing a secure channel with the first server using the aforementioned terminal, The terminal receives the first key transmitted by the first server via the secure channel. The method according to claim 9, including the method described in claim 9.

11. Over-the-air (OTA) upgrade device, A first transmitting unit configured to transmit software information of a control unit to an OTA server, wherein the software information includes information about the current software version of the control unit and instruction information, and the instruction information indicates whether there is a rollback package corresponding to the current software version of the control unit; A first receiving unit is configured to receive first upgrade information transmitted by the OTA server in response to the instruction information, wherein if the instruction information indicates that there is no rollback package corresponding to the current software version of the control unit, the first upgrade information includes software installation package download information for downloading the current version of the software installation package belonging to the control unit and software installation package download information for downloading the target version of the software installation package, or to receive second upgrade information transmitted by the OTA server in response to the instruction information, wherein if the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, the second upgrade information includes software installation package download information for downloading the target version of the software installation package, An execution unit configured to perform a first operation on the control unit based on the received first upgrade information or the received second upgrade information, A device including a device.

12. The apparatus according to claim 11, wherein the control unit includes a control unit that supports A / B partition upgrade and backup, or a control unit that does not support A / B partition upgrade and backup.

13. If the control unit supports A / B partition upgrades and backups, the instruction information indicates that there is a rollback package corresponding to the current software version of the control unit, or The apparatus according to claim 11, wherein, when the control unit does not support A / B partition upgrades and backups, if the apparatus stores a backup installation package for the current software version of the control unit, the instruction information indicates that there is a corresponding rollback package for the current software version of the control unit, or, when the control unit does not support A / B partition upgrades and backups, if the apparatus does not store a backup installation package for the current software version of the control unit, the instruction information indicates that there is no rollback package for the current software version of the control unit.

14. The execution unit is If the control unit does not support A / B partition upgrade and backup, and the current software version of the control unit has the corresponding rollback package, a first download and upgrade unit is configured to download the software installation package for the target version based on the software installation package download information for the target version, and to perform an upgrade installation on the control unit based on the software installation package for the target version, or A second download and upgrade unit is configured to download the software installation package for the target version based on the software installation package download information for the target version when there is no rollback package corresponding to the current software version of the control unit, download the software installation package for the current version of the control unit based on the software installation package download information for the current version of the control unit, and perform an upgrade installation on the control unit based on the software installation package for the target version. The apparatus according to any one of claims 11 to 13, further comprising:

15. The aforementioned device is A recovery unit configured to restore the partition where the upgrade failed to a mirror backup partition when the upgrade fails during the process of performing an upgrade installation on the control unit on a backup partition based on the target version of the software installation package. The apparatus according to claim 13, further comprising:

16. The aforementioned device is A rollback unit is configured to perform a rollback operation based on the current version of the software installation package on the control unit and delete the target version of the software installation package if the upgrade fails during the process of performing an upgrade installation on the control unit on a backup partition based on the target version of the software installation package. The apparatus according to claim 14, further comprising:

17. The apparatus according to claim 13, wherein the first receiving unit receives a first key transmitted by a first server before an upgrade installation is performed based on the target version of the software installation package of the control unit, decrypts the target version of the software installation package of the control unit based on the first key, and the target version of the software installation package of the control unit is generated after the first server encrypts the upgrade data of the control unit based on a second key, the first key being a decryption key corresponding to the second key.

18. The device further includes an establishment unit configured to establish a secure channel with the first server, The apparatus according to claim 17, wherein the first receiving unit receives the first key transmitted by the first server via the secure channel.

19. It is a vehicle, Including the terminal, The terminal includes the device described in any one of claims 11 to 13. Vehicle.

20. A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, the computer program is executed by a processor to carry out the method according to any one of claims 1 to 3.

Images