WO2021008184A1

WO2021008184A1 - Remote upgrading system and upgrading method for fota firmware on new energy automobile

Info

Publication number: WO2021008184A1
Application number: PCT/CN2020/086295
Authority: WO
Inventors: 唐俊安; 叶进; 徐子航; 吴振磊
Original assignee: 南京依维柯汽车有限公司
Priority date: 2019-07-18
Filing date: 2020-04-23
Publication date: 2021-01-21
Also published as: CN110489143B; CN110489143A

Abstract

A remote upgrading technical solution for a Firmware Over-the-Air (FOTA) firmware on a new energy automobile is used for remote upgrading of multiple electronic units (ECUs) of a new energy vehicle on the basis of an intelligent terminal (T-BOX). The remote upgrading system comprises a vehicle control unit (VCU), a battery management system (BMS), a motor controller (IPU) and a vehicle instrument (ICU). Meanwhile, in the uploading process of an upgrade package, a privacy guarantee of a hardware dongle is provided, manufacturing and local storage of an offline upgrade package are also comprised, and the safety and stability of a whole vehicle system in the upgrading process are greatly guaranteed. A vehicle enterprise can achieve large-scale upgrading and repair of vehicle-mounted device software faults by means of the technology, and the development risk and the recall cost are effectively reduced.

Description

[Corrected 09.06.2020 according to Rule 26] 　FOTA firmware remote upgrade system and upgrade method on new energy vehicles

Technical field

The invention belongs to the technical field of automobile firmware maintenance, and in particular relates to a FOTA firmware remote upgrade system and method on a new energy automobile.

Background technique

In the automobile industry, with the development trend of intelligence, automobiles will become the third largest mobile terminal after smart phones and personal computers, gradually evolving from mechanical products to electronic products; in addition, the Internet of Vehicles technology is developing rapidly, and automotive software systems continue to develop. Increasing, and software instability is inevitable, therefore, its demand for FOTA firmware upgrades has also emerged. All car systems, from wipers to navigation, from active safety to advanced driver assistance systems (ADAS), are all realized with the help of various sophisticated and reliable electronic systems. According to statistics, more than 50% of the current car recalls on the market are caused by software defects. Consumers may have to drive the car back to the 4S shop because of a line of code error. This has greatly increased the number of car recalls. But if car owners can upgrade and repair software failures by themselves through the FOTA solution, they do not need to go to a 4S shop or return to the factory, which can also effectively reduce the development risk and recall costs of the OEM. At the same time, for end consumers, the FOTA solution can ensure that the car system is updated in time and introduce new features of the vehicle. For example, the upgrade of autopilot software can help consumers gradually activate the autopilot function of the vehicle, and can also improve the auto cruise function of the vehicle. Speed limit, unlock the automatic lane change function, lane departure and many other functions, so as to continue to help the optimization of the human-machine interface (HMI) and improve the experience of human-computer interaction requirements.

The information disclosed in the background section is only intended to increase the understanding of the general background of the present invention, and should not be regarded as an acknowledgement or any form of suggestion that the information constitutes the prior art already known to those of ordinary skill in the art.

Summary of the invention

The purpose of the present invention is to provide a FOTA firmware remote upgrade system for new energy vehicles, so as to overcome the above-mentioned defects in the prior art.

In order to achieve the above objectives, the present invention provides an end-to-end upgrade method based on the T-BOX for vehicle ECU. The T-BOX needs to include the following functional modules:

(1) Receive FOTA management system data/command module;

(2) Upgrade file processing module;

(3) Communication module with VCU, BMS, ICU controller;

(4) ECU upgrade module;

(5) Upgrade result report module, support offline upgrade package production, support upgrade management of instrument and mobile APP.

Preferably, in the above technical solution, the FOTA system mainly has the following logical units:

Upgrade package (pkg) production unit: store the ECU software program that needs to be upgraded on the platform through the hardware dongle and platform upgrade package production tool, and then synthesize the encrypted upgrade package;

FOTA management system: Provide users with a complete upgrade operation process, allowing users to conveniently use the platform's visual management interface to perform operation confirmation and process monitoring for ECU remote upgrades. It also includes upgrade task management, upgrade log query and other functions;

Vehicle end: Equipped with a vehicle-mounted terminal T-BOX that supports remote flashing, which can communicate with the upgrade management platform and vehicle system, obtain vehicle upgrade information, obtain vehicle upgrade packages and perform safety verification to ensure the safety and integrity of the upgrade files ；

Owner’s mobile phone APP: Confirm whether to upgrade, and effectively interact and exchange information with the owner.

A remote upgrade method of FOTA firmware on a new energy vehicle is characterized in that it is performed according to the following steps:

S1 Upgrade preparation: Before upgrading in the management system, operators need to be assigned reasonable operation permissions according to the upgrade process;

S2 upgrade task creation and upload: task creation includes upgrade file upload, upgrade task creation, vehicle batch setting, automatic version number comparison;

S3 task execution: first distribute the key file and upgrade package file from the car networking platform to T-BOX, T-BOX decrypts the file and feeds the decryption result to the platform, flashes the task creation interface on the platform, and the user manually starts the upgrade task , Issue the upgrade request command AFN=0X05, FN=F32, the terminal broadcasts the upgrade request through the CAN bus, pushes the upgrade notification to the mobile phone APP simultaneously, and describes the conditions required for the upgrade, and the user feedback agrees the upgrade and keeps the vehicle in an upgradeable state To the FOTA platform, the platform issues an upgrade permission instruction AFN=0X05, FN=F40, T-BOX issues an upgrade instruction to the VCU, the VCU judges the flashing environment, and confirms that the vehicle speed to be flashed is 0 & the gear is in N gear & throttle opening When it is 0, feedback the DID mark (0A06) to T-BOX, T-BOX notifies the platform and mobile phone APP to start upgrading, and synchronously informs the vehicle instrument to start upgrading through the CAN bus, reminding the owner to keep the vehicle in a flashable state;

S4 completes the above confirmation work: the upgrade task officially starts, the T-BOX closes the remote communication, the S19 file is analyzed and sent to the VCU for software update, the update is completed and the VCU restart instruction is issued, and the T-BOX update result is fed back after the VCU restarts, T- After the BOX resumes communication, it will send an upgrade completion notification to the platform, mobile phone APP and instrument, prompting the owner to exit the upgrade mode and delete the upgrade file at the same time.

Preferably, in the above technical solution, in S2, the encrypted upgrade file is uploaded to the IoV platform by entering an independent operation password. To ensure the correctness and safety of the file, the operation code set by the administrator needs to be verified; the system will record Task creator, creation time, and flashing authorization signature file. On the pop-up add page, select the vehicle terminal that needs to be upgraded, search for the uploaded upgrade file and key file, and enter the operation password.

Preferably, in the above technical solution, in S3, the required condition is specifically: the vehicle speed is 0 or the gear is in the N gear or the accelerator opening is 0.

Preferably, in the above technical solution, in S2, the current version number of the selected upgrade vehicle is compared with the version number to be flashed in real time, and the upgrade is prohibited for the inconsistent version to avoid incorrect flashing.

Preferably, in the above technical solution, the instrument and mobile phone APP can feedback the upgrade status in real time during the ECU upgrade process, so that the vehicle owner can understand the current upgrade status.

Preferably, in the above technical solution, four upgrade states need to be fed back to the driver: a. During the remote upgrade, do not power off: the instrument will display for a long time during the upgrade; b. The remote upgrade is completed: the terminal sends an upgrade completion instruction After the indicator displays 2s; c. Upgrade failed, initialized: the indicator displays 2s after receiving the rollback completion command sent by the terminal; d. Upgrade failure: After receiving the upgrade failed and the rollback failed command from the terminal, the indicator lights up continuously Until the state changes.

Preferably, in the above technical solution, in step S3, the FOTA system and the T-BOX interface processing logic is as follows: when the vehicle meets the conditions for flashing, TBOX receives the start upgrade instruction AFN=0X05, FN=F40:

The S3.1 terminal will actively report the instruction to start the upgrade AFN=0X22, FN=F4, and execute step S3.2;

S3.2 Close the remote control service, reset various UDS flashing related state bases, and execute step S3.3;

S3.3 judge whether the pkg is the second phase pkg according to the flag bit in the upgrade package, if it is to execute S3.4, otherwise execute S3.5;

S3.4 Compare the versions before flashing. T-BOX sends and reads the parts, hardware version, and software version of the ECU, and compares them with the original version in the flashed pkg package. If the comparison is consistent, execute S3.5. Otherwise execute S3.11;

S3.5 suspends other related tasks, retains the UDS flashing task, converts the s19 file in the pkg package into a bin file, and obtains the address information of the file to be erased and the canid and porter of the flashed file in the pkg package To prepare for subsequent flashing and other related information, perform S3.6;

S3.6 Perform ECU flashing according to BJEV's boot flashing specification. When the execution reaches 11 service (resetting the ECU after flashing), wait 5s and execute step S3.7;

S3.7 Compare the version after flashing, TBOX sends to read the ECU parts, hardware version, software version, and compare it with the target version in the flashing pkg package, if they are consistent, execute S3.8, otherwise execute S3.12 Normal flashing or rollback flashing after the upgrade fails;

S3.8 judge whether there are ECUs in the pkg package that need to be flashed, if there are any ECUs, skip to step S3.6, otherwise execute S3.9;

S3.9T-BOX actively reports the upgrade completion instruction regularly and waits for the platform to respond. After the platform responds, it stops the upgrade completion report and actively deletes pkg, key and other related files, and executes S3.10;

S3.10 upgrade is over;

S3.11T-BOX actively reports the failure code of upgrade failure, resets the ECU to write the relevant status base, and executes step S3.10;

S3.12 performs the rollback of the old version and skips to S3.6.

Preferably, in the above technical solution, the target version is the original version for rollback.

Compared with the prior art, the present invention has the following beneficial effects:

The invention provides a FOTA firmware remote upgrade technical solution on a new energy vehicle, establishes a complete vehicle FOTA system and business process, reduces the complexity and cycle of the whole vehicle design, and reduces labor costs and maintenance delivery time , Alleviate security threats and enhance brand image.

Description of the drawings:

Figure 1 is a diagram of the remote ECU upgrade architecture.

Figure 2 shows the operation interface of the ECU remote upgrade platform.

Figure 3 shows the confirmation interface of the owner's mobile phone APP upgrade.

Figure 4 shows an example of the remote upgrade process of the vehicle VCU.

Detailed ways:

The specific embodiments of the present invention are described in detail below, but it should be understood that the protection scope of the present invention is not limited by the specific embodiments.

Unless otherwise expressly stated otherwise, throughout the specification and claims, the term "comprising" or its transformations such as "comprising" or "including" will be understood to include the stated elements or components, and not Other elements or other components are not excluded.

One such method is based on the end-to-end upgrade method implemented by the T-BOX to the vehicle ECU. The T-BOX needs to include the following functional modules:

(1) Receive FOTA management system data/command module;

The FOTA system mainly has the following logical units:

(2) Upgrade file processing module;

(3) Communication module with VCU, BMS, ICU controller;

(4) ECU upgrade module;

A method for remote upgrade of FOTA firmware on new energy vehicles, according to the following steps:

S2 upgrade task creation and upload: task creation includes upgrade file upload, upgrade task creation, vehicle batch setting, automatic version number comparison; upload the encrypted upgrade file to the car networking platform by entering an independent operation password to ensure the correctness of the file For security and safety, the operation code set by the administrator needs to be verified; the system will record the task creator, creation time, and write authorization signature file. On the pop-up add page, select the vehicle terminal that needs to be upgraded, and search for the uploaded upgrade file and Key file, enter the operation password. The current version number of the selected upgrade vehicle is compared with the version number to be flashed in real time. If the version does not meet the requirements, the upgrade is prohibited to avoid incorrect flashing.

S3 task execution: first distribute the key file and upgrade package file from the car networking platform to T-BOX, T-BOX decrypts the file and feeds the decryption result to the platform, flashes the task creation interface on the platform, and the user manually starts the upgrade task , Issue the upgrade request command AFN=0X05, FN=F32, the terminal broadcasts the upgrade request through the CAN bus, pushes the upgrade notification to the mobile phone APP simultaneously, and describes the conditions required for the upgrade, and the user feedback agrees the upgrade and keeps the vehicle in an upgradeable state To the FOTA platform, the platform issues an upgrade permission instruction AFN=0X05, FN=F40, T-BOX issues an upgrade instruction to the VCU, the VCU judges the flashing environment, and confirms that the vehicle speed to be flashed is 0 & the gear is in N gear & throttle opening When it is 0, the DID mark (0A06) is fed back to the T-BOX, and the T-BOX notifies the platform and mobile phone APP to start upgrading, and synchronously informs the vehicle instrument to start upgrading through the CAN bus, reminding the owner to keep the vehicle in a flashable state; the specific conditions required are : The vehicle speed is 0 or the gear is in N gear or the throttle opening is 0.

In step S3, the processing logic of the interface between the FOTA system and the T-BOX is as follows: When the vehicle meets the conditions for flashing and writing, the TBOX receives the start upgrade instruction AFN=0X05, FN=F40:

S3.7 Compare the version after flashing. TBOX sends to read the ECU parts, hardware version, and software version, and compares it with the target version in the flashed pkg package (original version for rollback). If they are consistent, Perform S3.8, otherwise perform S3.12 normal flashing or rollback flashing after the upgrade fails;

S3.10 upgrade is over;

S3.12 performs the rollback of the old version and skips to S3.6.

S4 completes the above confirmation work: the upgrade task officially starts, the T-BOX closes the remote communication, the S19 file is analyzed and sent to the VCU for software update, the update is completed and the VCU restart instruction is issued, and the T-BOX update result is fed back after the VCU restarts, T- After the BOX resumes communication, it will send an upgrade completion notification to the platform, mobile phone APP and instrument, prompting the owner to exit the upgrade mode and delete the upgrade file at the same time. During the ECU upgrade process, the instrument and mobile APP can provide real-time feedback on the upgrade status, so that the owner can understand the current upgrade status. There are four upgrade statuses that need to be reported to the driver: a. Do not power off during remote upgrade: the instrument will display for a long time during the upgrade process; b. Remote upgrade completed: the instrument will display for 2 seconds after receiving the upgrade completion instruction from the terminal; c. Upgrade Failed and initialized: the indicator will display for 2s after receiving the rollback completion command sent by the terminal; d. Upgrade failure: After receiving the upgrade failed and rollback failed command sent by the terminal, the indicator will be on for a long time until the status changes.

The foregoing description of specific exemplary embodiments of the present invention is for the purpose of illustration and illustration. These descriptions are not intended to limit the invention to the precise form disclosed, and it is obvious that many changes and changes can be made based on the above teachings. The purpose of selecting and describing the exemplary embodiments is to explain the specific principles of the present invention and its practical application, so that those skilled in the art can realize and use various exemplary embodiments of the present invention and various different Choice and change. The scope of the present invention is intended to be defined by the claims and their equivalents.

Claims

A FOTA firmware remote upgrade system for new energy vehicles, which is characterized in that the system is an end-to-end upgrade method based on T-BOX for vehicle ECUs, and T-BOX needs to include the following functional modules:

(1) Receive FOTA management system data/command module;

(2) Upgrade file processing module;

(3) Communication module with VCU, BMS, ICU controller;

(4) ECU upgrade module;

(5) Upgrade result report module, support offline upgrade package production, support upgrade management of instrument and mobile APP.
The FOTA firmware remote upgrade system on a new energy vehicle according to claim 1, wherein the FOTA system mainly has the following logical units:

Upgrade package (pkg) production unit: store the ECU software program that needs to be upgraded on the platform through the hardware dongle and platform upgrade package production tool, and then synthesize the encrypted upgrade package;

FOTA management system: Provide users with a complete upgrade operation process, allowing users to conveniently use the platform's visual management interface to perform operation confirmation and process monitoring for ECU remote upgrades. It also includes upgrade task management, upgrade log query and other functions;

Vehicle end: Equipped with a vehicle-mounted terminal T-BOX that supports remote flashing, which can communicate with the upgrade management platform and vehicle system, obtain vehicle upgrade information, obtain vehicle upgrade packages and perform safety verification to ensure the safety and integrity of the upgrade files ；

Owner’s mobile phone APP: Confirm whether to upgrade, and effectively interact and exchange information with the owner.
A remote upgrade method of FOTA firmware on a new energy vehicle is characterized in that it is performed according to the following steps:

S1 Upgrade preparation: Before upgrading in the management system, operators need to be assigned reasonable operation permissions according to the upgrade process;

S2 upgrade task creation and upload: task creation includes upgrade file upload, upgrade task creation, vehicle batch setting, automatic version number comparison;

S3 task execution: first distribute the key file and upgrade package file from the car networking platform to T-BOX, T-BOX decrypts the file and feeds the decryption result to the platform, flashes the task creation interface on the platform, and the user manually starts the upgrade task , Issue the upgrade request command AFN=0X05, FN=F32, the terminal broadcasts the upgrade request through the CAN bus, pushes the upgrade notification to the mobile phone APP simultaneously, and describes the conditions required for the upgrade, and the user feedback agrees the upgrade and keeps the vehicle in an upgradeable state To the FOTA platform, the platform issues an upgrade permission instruction AFN=0X05, FN=F40, T-BOX issues an upgrade instruction to the VCU, the VCU judges the flashing environment, and confirms that the vehicle speed to be flashed is 0 & the gear is in N gear & throttle opening When it is 0, feedback the DID mark (0A06) to T-BOX, T-BOX notifies the platform and mobile phone APP to start upgrading, and synchronously informs the vehicle instrument to start upgrading through the CAN bus, reminding the owner to keep the vehicle in a flashable state;

S4 completes the above confirmation work: the upgrade task officially starts, the T-BOX closes the remote communication, the S19 file is analyzed and sent to the VCU for software update, the update is completed and the VCU restart instruction is issued, and the T-BOX update result is fed back after the VCU restarts, T- After the BOX resumes communication, it will send an upgrade completion notification to the platform, mobile phone APP and instrument, prompting the owner to exit the upgrade mode and delete the upgrade file at the same time.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 3, characterized in that: in S2, the encrypted upgrade file is uploaded to the Internet of Vehicles platform by inputting an independent operation password to ensure the correctness and safety of the file It is necessary to verify the operation code set by the administrator; the system will record the task creator, the creation time, and the authorization to write the batch file. On the pop-up add page, select the vehicle terminal that needs to be upgraded, and search for the uploaded upgrade file and key file , Enter the operation password.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 3, wherein in S3, the required condition is specifically: the vehicle speed is 0 or the gear is in the N gear or the accelerator opening is 0.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 3, characterized in that: in S2, the current version number of the selected upgrade vehicle is compared with the version number to be flashed in real time, and the upgrade is prohibited if the version does not meet the requirements. Brush by mistake.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 3, wherein the instrument and mobile phone APP can feedback the upgrade status in real time during the ECU upgrade process, so that the vehicle owner can understand the current upgrade status.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 7, characterized in that: four upgrade statuses need to be fed back to the driver: a. During the remote upgrade, do not power off: the instrument will display for a long time during the upgrade process ; B. Remote upgrade completed: the instrument displays 2s after receiving the upgrade completion instruction from the terminal; c. Upgrade failed and initialized: the instrument displays 2s after receiving the rollback completion instruction from the terminal; d. Upgrade failure: the terminal sends After the upgrade failed and the rollback failed command, the meter will keep on until the status changes.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 3, characterized in that: in step S3, the FOTA system and the T-BOX interface processing logic is as follows: when the vehicle meets the conditions for flashing, TBOX receives the upgrade After instruction AFN=0X05, FN=F40:

The S3.1 terminal will actively report the instruction to start the upgrade AFN=0X22, FN=F4, and execute step S3.2;

S3.2 Close the remote control service, reset various UDS flashing related state bases, and execute step S3.3;

S3.3 judge whether the pkg is the second phase pkg according to the flag bit in the upgrade package, if it is to execute S3.4, otherwise execute S3.5;

S3.4 Compare the versions before flashing. T-BOX sends and reads the parts, hardware version, and software version of the ECU, and compares them with the original version in the flashed pkg package. If the comparison is consistent, execute S3.5. Otherwise execute S3.11;

S3.5 suspends other related tasks, retains the UDS flashing task, converts the s19 file in the pkg package into a bin file, and obtains the address information of the file to be erased and the canid and porter of the flashed file in the pkg package To prepare for subsequent flashing and other related information, perform S3.6;

S3.6 Perform ECU flashing according to BJEV's boot flashing specification. When the execution reaches 11 service (resetting the ECU after flashing), wait 5s and execute step S3.7;

S3.7 Compare the version after flashing, TBOX sends to read the ECU parts, hardware version, software version, and compare it with the target version in the flashing pkg package, if they are consistent, execute S3.8, otherwise execute S3.12 Normal flashing or rollback flashing after the upgrade fails;

S3.8 judge whether there are ECUs in the pkg package that need to be flashed, if there are any ECUs, skip to step S3.6, otherwise execute S3.9;

S3.9 T-BOX actively reports the upgrade completion instructions regularly and waits for the platform to respond. After the platform responds, it stops the upgrade completion report and actively deletes pkg, key and other related files, and executes S3.10;

S3.10 upgrade is over;

S3.11 T-BOX actively reports the failure code of upgrade failure, resets the ECU to write the relevant status base, and executes step S3.10;

S3.12 performs the rollback of the old version and skips to S3.6.
The FOTA firmware remote upgrade method on a new energy vehicle according to claim 9, wherein the target version is the original version for rollback.