CN117215604A - Software updating method and device, vehicle controller and readable storage medium - Google Patents

Abstract

Embodiments of the present invention provide a software update method, device, vehicle controller and readable storage medium. By installing automatic update software in the vehicle controller, the guidance software in the vehicle controller can be updated and updates can be avoided. Vehicle controller damage occurs due to unexpected interruption of the process. Therefore, a highly reliable boot software update method is provided, which not only reduces the tedious operation of updating the boot software, but also improves the reliability of the boot software update.

Description

A software update method, device, vehicle controller and readable storage medium

Technical field

The present invention relates to the field of automotive technology, and in particular to a software update method, device, vehicle controller and readable storage medium.

Background technique

With the advancement of technology, the types and number of controllers included in vehicles are increasing. During the vehicle development and calibration stages, it is often necessary to update the guidance software in each controller.

In related technologies, in order to update the boot software in the controller, it is necessary to remove the controller from the vehicle's bus network, then open the controller's casing to expose the circuit board, and then use a special controller flash tool and control Directly connect to the circuit board of the controller, and update the controller's boot software through the flash tool. After the update is completed, reinstall the controller casing.

However, the above-mentioned method of updating the boot software requires disassembly and assembly of the controller, which is not only cumbersome but can also easily cause damage to the controller.

Contents of the invention

In view of this, the present invention aims to propose a software update method, device, vehicle controller and readable storage medium to solve the problem in the prior art that the boot software operation in the vehicle controller is relatively cumbersome and can easily cause damage to the controller. The problem.

In order to achieve the above objects, the technical solution of the present invention is implemented as follows:

A software update method, applied to a vehicle controller, the method includes:

Receive the automatic update software, store the automatic update software in the second loading address, and erase the first verification data in the first verification address corresponding to the first loading address;

Update the software to be updated in the first loading address by running the automatic update software, and restore the first verification data in the first verification address corresponding to the first loading address after the update is completed;

When the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed verification, it is determined that the update operation for the software to be updated is not completed, and the second loading continues to run. Automatically update the software in the address to update the software to be updated in the first loading address, and restore the first verification data in the first verification address corresponding to the first loading address after the update is completed;

When the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, it is determined that the update operation of updating the software to be updated in the first loading address is completed, and the first verification data is run. Load the updated software to be updated in the address.

A software update device, the device includes:

A receiving module, configured to receive automatic update software, store the automatic update software in the second loading address, and erase the first verification data in the first verification address corresponding to the first loading address;

An operation module, configured to update the software to be updated in the first loading address by running the automatic update software, and restore the first verification address in the first verification address corresponding to the first loading address after the update is completed. test data;

A first loading module configured to determine that the update operation for the software to be updated is not completed if it is determined that the first verification data in the first verification address has not passed verification when the vehicle controller is restarted, Continue to run the automatic update software in the second loading address to update the software to be updated in the first loading address, and restore the first verification address corresponding to the first loading address after the update is completed. Check data;

A second loading module configured to determine an update operation for updating the software to be updated in the first loading address if it is determined that the first verification data in the first verification address passes verification when the vehicle controller is restarted. Completed, run the updated software to be updated in the first loading address.

A vehicle controller, the vehicle controller includes a memory, a processor and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the above software update is implemented. method.

A readable storage medium stores programs or instructions on the readable storage medium. When the programs or instructions are executed by a processor, the above software update method is implemented.

A vehicle includes the above vehicle controller.

Compared with the existing technology, the software update method, device, vehicle controller and readable storage medium of the present invention have the following advantages:

In summary, embodiments of the present invention provide a software update method, which includes: receiving automatic update software, storing the automatic update software in a second loading address, and erasing the first verification address corresponding to the first loading address. The first verification data; by running the automatic update software, the software to be updated stored in the first loading address is updated to the updated software to be updated, and after the update is completed, the first verification address corresponding to the first loading address is restored. The first verification data; when the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed the verification, it is determined that the update operation for the software to be updated is not completed, and the second loading address continues to be run. The automatic update software in the first loading address is used to update the software to be updated stored in the first loading address to the updated software to be updated, and after the update is completed, the first verification data in the first verification address corresponding to the first loading address is restored. ; When the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, it is determined that the update operation of updating the software to be updated stored in the first loading address to the updated software to be updated is completed. , run the updated software to be updated in the first loading address. In the embodiment of the present invention, the guidance software in the vehicle controller can be updated by installing automatic update software in the vehicle controller, and damage to the vehicle controller caused by unexpected interruption of the update process can be avoided. Therefore, it is provided A highly reliable boot software update method is proposed, which not only reduces the tedious operation of updating the boot software, but also improves the reliability of the boot software update.

Description of drawings

The drawings forming a part of the present invention are used to provide a further understanding of the present invention. The illustrative embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the attached picture:

Figure 1 is a step flow chart of a software update method provided by an embodiment of the present invention;

Figure 2 is a flow chart of steps of another software update method provided by an embodiment of the present invention;

Figure 3 is a flow chart of a software update method provided by an embodiment of the present invention.

Figure 4 is a structural block diagram of a software update device provided by an embodiment of the present invention.

Detailed ways

It should be noted that, as long as there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

Referring to FIG. 1 , a flow chart of steps of a software update method provided by an embodiment of the present invention is shown.

Step 101: Receive automatic update software, store the automatic update software in the second load address, and erase the first verification data in the first verification address.

In the stages of vehicle development, matching and adjustment, the controllers provided by vehicle parts suppliers will have many problems during the vehicle testing process, and may not meet the needs of research and development, and the applications installed on them need to be adjusted. to accommodate vehicles under development.

In order to update the application installed on the controller, it can generally be reflashed through boot software (such as Bootloader) based on Controller Area Network (CAN) or Ethernet Control Automation Technology (EtherCAT) Write. However, the boot software used to flash applications may also have some bugs or may not meet actual needs, and the boot software itself needs to be flashed to update it. However, due to permission settings, interface settings, etc., the boot software usually cannot be updated from the controller's external interface (such as the bus interface). For some controllers where it is difficult to update the boot software, it is usually necessary to directly replace the new controller. For some controllers that can update the boot software, it is usually necessary to disassemble the controller to expose the motherboard, and then connect to the motherboard through a special debugger to re-flash the boot software. The removal and replacement of some controllers, such as the battery management system (BATTERY MANAGEMENT SYSTEM, BMS), is time-consuming and labor-intensive.

In the embodiment of the present invention, when the guidance software in the vehicle controller needs to be updated, the vehicle controller can be removed from the vehicle controller network and connected to the application installation terminal through the bus interface of the vehicle controller. The automatic update software is written into the vehicle controller, and the guidance software in the vehicle controller is updated through the automatic update software running in the vehicle controller. Among them, the application installation terminal is used to install executable applications in the vehicle controller.

Specifically, after the vehicle controller receives the automatic update software, the automatic update software can be stored in the second load address. It should be noted that the second load address is used to indicate a storage space in the memory of the vehicle controller. Storing the automatic update software in the second load address means storing the automatic update software in the storage space in the memory indicated by the second load address.

Since in the embodiment of the present invention, the software that can be updated includes relatively low-level software in the vehicle controller, such as boot software, if the boot software is damaged during the update process (for example, the vehicle controller suddenly loses power during the update process and the boot software fails to The update is completed but is in an unavailable state), which may cause the vehicle controller to be damaged and unable to continue to be used. Therefore, by storing the automatic update software in the second load address, if the subsequent update is not completed, the automatic update program can continue to be started from the second load address and continue to update the boot software in the vehicle controller until booting The software update is successful, avoiding accidents during the update process that may cause damage to the vehicle controller.

In the embodiment of the present invention, after the automatic update software is stored in the second loading address, the first verification data in the first verification address corresponding to the first loading address can be erased. It should be noted that when the vehicle controller is turned on and the software is loaded, the verification data corresponding to each loading address can be verified in the order of the loading addresses, and the software in the loading address corresponding to the verification data that passes the verification first can be loaded. .

For example, if the vehicle controller contains a first loading address and a second loading address, after the vehicle controller is turned on, it will first try to run the software in the first loading address. If the first verification address corresponding to the first loading address If the first verification data in the address is complete, run the software in the first loading address to complete the startup process of the vehicle controller. However, if during the process of trying to run the software in the first loading address, it is determined that the first verification data in the first verification address corresponding to the first loading address is incomplete, then loading the software in the first loading address fails, Continue to try to run the software in the second loading address.

Therefore, in the embodiment of the present invention, if the first verification data in the first verification address corresponding to the first load address is erased, the integrity of the first verification data in the first verification address is destroyed. After the vehicle controller is restarted, if the first verification data in the first verification address is incomplete and cannot pass the verification, the software to be updated stored in the first loading address will not be loaded, but an attempt will be made to load the second loading address. Automatically update software and continue to update pending software.

It should be noted that the software to be updated in the embodiment of the present invention may be boot software, startup program, baseband program, firmware, etc. in the vehicle controller.

Step 102: Update the software to be updated in the first loading address by running the automatic update software, and restore the first verification data in the first verification address corresponding to the first loading address after the update is completed. .

In this embodiment of the present invention, since the software to be updated may be the underlying software of the vehicle controller (such as boot software), when the underlying software is damaged, it is easy to cause the vehicle controller to be damaged and unable to continue to be used. Therefore, before the software to be updated stored in the first loading address is actually updated by the automatic updating software, the relevant operations in step 101 can be performed to ensure that the software to be updated stored in the first loading address is updated by the automatic updating software. During the actual update process, even if an unexpected situation occurs (such as a sudden power outage of the controller) and the software to be updated fails to update and cannot be run, you can reload and run the automatic update software after the vehicle controller is restarted and try again to complete the update of the software to be updated. Completely avoid the situation where the vehicle controller is damaged due to update failure.

Specifically, the specific operation of updating the software to be updated stored in the first loading address may be: updating the software to be updated stored in the first loading address to the updated software to be updated. The updated data package of the software to be updated can be stored in the automatic update software. When the automatic update software is installed on the vehicle controller, it will enter the vehicle controller together with the automatic update software.

Because after the software to be updated stored in the first loading address is updated to the updated software to be updated, that is, after the software to be updated is updated, the vehicle controller needs to load and run the updated software from the first loading address at startup. software to be updated, therefore, after updating the software to be updated stored in the first loading address to the updated software to be updated, the first verification data in the first verification address corresponding to the first loading address can be restored is the state before the erasing step is performed in step 101, so that when the vehicle controller attempts to load the updated software to be updated in the first loading address, the first verification address in the first verification address corresponding to the first loading address The verification data can be verified and passed.

Step 103: When the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed verification, it is determined that the update operation for the software to be updated is not completed, and the program continues to run. The software in the second loading address is automatically updated to update the software to be updated in the first loading address.

In the embodiment of the present invention, there are two situations for the update operation of the software to be updated. One is that after the automatic update software is installed in the vehicle controller, the automatic update software runs and successfully updates the software to be updated in the vehicle controller to After updating the software to be updated, the update of the software to be updated is completed.

The second is that after the automatic update software is installed in the vehicle controller, before the automatic update software completes the update of the software to be updated, the vehicle controller suffers a power failure or other failure, causing the update operation of the software to be updated to be interrupted, and the vehicle controller restarts. Finally, the vehicle controller tries to run the software to be updated in the first loading address, but because the first verification data in the first verification address is incomplete, the automatic update software in the second loading address continues to be loaded until the update is interrupted. Then continue to update the software to be updated.

The vehicle controller can generally load software during startup through the sequential loading mode. In the sequential loading mode, the vehicle controller can verify the verification data corresponding to each loading address in the order of multiple loading addresses, and load the first Verify the software in the loading address corresponding to the verification data that passes the verification. Therefore, in the embodiment of the present invention, when the first verification data in the first verification address corresponding to the first load address is erased, when the vehicle controller is started, the first verification data cannot be completed. Verification, and then cannot load the software in the first loading address. At this time, the vehicle controller will continue to load the software in the second loading address in sequence, that is, automatically update the software, and restart the update of the software to be updated in the vehicle controller. .

It should be noted that in the embodiment of the present invention, restoring the first verification data in the first verification address corresponding to the first loading address after the update is completed is performed by the automatic update software running in the vehicle controller. After the vehicle controller restarts and runs the automatic update software again, if the automatic update software completes the update of the software to be updated, the step of restoring the first verification data in the first verification address corresponding to the first loading address will be executed to So that the updated software to be updated can be smoothly loaded and run by the vehicle controller.

Step 104: When the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, then it is determined that the update operation of updating the software to be updated in the first loading address is completed, and run the The updated software to be updated in the first loading address.

When the automatic update software updates the software to be updated stored in the first loading address to the updated software to be updated (ie, completes the update of the software to be updated) and restores the first checksum in the first verification address corresponding to the first loading address. If the vehicle controller is restarted at this time, the complete first verification data exists in the first verification space corresponding to the first loading address. The first verification data can pass the verification, and the first storage space will be The updated software to be updated is actually loaded, thereby running the updated software to be updated and completing the startup operation of the vehicle controller.

It should be noted that after the software to be updated is updated to the updated software to be updated, since the updated software to be updated only exists in the first loading address at this time and has not been actually loaded and run, vehicle control is required. Restart the vehicle controller so that the vehicle controller loads and runs the updated software to be updated from the first loading address. Therefore, in the embodiment of the present invention, after the update is completed and the first verification data in the first verification address corresponding to the first loading address is restored, the restart operation of the vehicle controller can be automatically triggered, so that the vehicle controller can be restarted from Load and run the updated software to be updated in the first loading address.

In summary, embodiments of the present invention provide a software update method, which includes: receiving automatic update software, storing the automatic update software in a second loading address, and erasing the first verification address corresponding to the first loading address. The first verification data; by running the automatic update software, the software to be updated stored in the first loading address is updated to the updated software to be updated, and after the update is completed, the first verification address corresponding to the first loading address is restored. The first verification data; when the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed the verification, it is determined that the update operation for the software to be updated is not completed, and the second loading address continues to be run. The automatic update software in the first loading address is used to update the software to be updated stored in the first loading address to the updated software to be updated, and after the update is completed, the first verification data in the first verification address corresponding to the first loading address is restored. ; When the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, it is determined that the update operation of updating the software to be updated stored in the first loading address to the updated software to be updated is completed. , run the updated software to be updated in the first loading address. In the embodiment of the present invention, the guidance software in the vehicle controller can be updated by installing automatic update software in the vehicle controller, and damage to the vehicle controller caused by unexpected interruption of the update process can be avoided. Therefore, it is provided A highly reliable boot software update method is proposed, which not only reduces the tedious operation of updating the boot software, but also improves the reliability of the boot software update.

Referring to Figure 2, Figure 2 shows a flow chart of steps of another software update method provided by an embodiment of the present invention.

Step 201: Configure the software loading mode corresponding to multiple loading addresses as a sequential loading mode; the multiple loading addresses include at least a first loading address and a second loading address, and the sequential loading mode is used in the vehicle controller. After booting, start the software in each loading address in order.

Since the vehicle controller may have multiple software loading modes, the current software loading mode may not meet the needs of the software update method of the present invention. Therefore, before installing the automatic update software, the parameters in the vehicle controller can be configured so that The configuration parameters of the vehicle controller meet the operation requirements of the software update method in the present invention.

Since there are many types of vehicle controllers, the configuration methods of each vehicle control are different. The software update method provided by the embodiment of the present invention is suitable for vehicle controllers that include sequential loading mode. Infineon Aurix series micro control units ( Microcontroller Unit (MCU) TC27X is used as a vehicle controller as an example for explanation.

First, the vehicle controller needs to provide four boot mode headers for configuration. These four boot tags are BMHD0, BMHD1, BMHD2 and BMHD3. Each boot tag contains 32 bytes. Among them, the address of the 32-byte space preset for each startup tag is as follows:

Table 1 shows:

Table 1

Through the start address and end address of the above startup tag, the data in the startup tag can be modified, and the configuration of each startup tag has been adjusted. Among them, the H at the end of the address indicates that the address is in hexadecimal.

In addition, the 32-byte space contained in the startup tag corresponds to the configuration items shown in Table 2 below:

Table 2

The configuration items contained in each startup tag can include: a loading address (usercodestartaddress, STADABM), a software loading mode (bootmodeindex, BMI), a check space start address (memoryrangetobechecked-startaddress, ChkStart), and a check space end Address (memoryrangetobechecked-endaddress, ChkEnd), and other related configuration items.

Specifically, the target address of the configuration item of the startup tag in the storage space can be determined based on the tag starting address of each startup tag and the offset of a certain configuration item relative to the tag's starting address, and modified The data in the target address matches the software loading mode of each startup tag into the sequential loading mode (Alternate BootMode). In the sequential loading mode, after the vehicle controller is turned on, the software in each loading address is started in sequence.

Step 202: Store the first verification data in the first verification address corresponding to the first loading address, and store the second verification data in the second verification address corresponding to the second loading address.

After configuring the sequential loading mode for the software loading mode corresponding to the first loading address and the second loading address, it is also necessary to configure the verification space start address and verification space end address of the startup tag corresponding to each loading address, and we get A verification address corresponding to each load address, where the verification address is used to store the verification data corresponding to the above-mentioned load address. Store preset verification data at each verification address.

You can first configure the first loading address to correspond to the verification space start address and verification space end address in the startup tag, obtain the first verification address corresponding to the first loading address, and then store the preset first verification data. in the first verification address.

You can first configure the second loading address to correspond to the verification space start address and verification space end address in the startup tag, obtain the second verification address corresponding to the second loading address, and then store the preset second verification data. in the second verification address.

It should be noted that the minimum loading addresses required to implement the software update method in the embodiment of the present invention include the first loading address and the second loading address. Therefore, the above only includes the startup tags corresponding to the first loading address and the second loading address. The configuration method, when more load addresses are included, the configuration method of the startup tag corresponding to the more load address is the same as the configuration method of the startup tag corresponding to the second load address. The above-mentioned more load addresses are used to store automatic updates. software, as a redundant address for the second load address.

Step 203: Receive the automatic update software, store the automatic update software in the second loading address, and erase the first verification data in the first verification address corresponding to the first loading address.

Step 204: Update the software to be updated in the first loading address by running the automatic update software, and restore the first verification data in the first verification address corresponding to the first loading address after the update is completed. .

Optionally, step 204 may also include:

Sub-step 2041: If the update completion flag indicates an incomplete state, erase the software to be updated from the first loading address.

The automatic update software may also include an update completion flag, where the update completion flag may indicate whether the update of the software to be updated is completed. For example, in the initial state, that is, when the automatic update software is installed in the vehicle controller, the update completion flag Bits can default to 0.

In addition, due to the particularity of vehicle controllers, in order to ensure the security of data stored in the vehicle controller, some vehicle controllers are equipped with read-only memory (ROM), and the software to be updated is stored in the read-only memory. , in this case, in order to update the software to be updated to the updated software to be updated, the software to be updated needs to be erased from the first loading address first.

Sub-step 2042: Write the updated software to be updated into the first loading address, and adjust the completion flag to a completion state.

After the software to be updated is erased, the updated software to be updated is written into the first loading address, and the update of the software to be updated is completed. After the update is completed, the completion flag can be adjusted to the completion state and sent to the user to prompt the user that the software update is completed. For example, after writing the updated software to be updated, the completion flag bit can be adjusted to 1 and sent to the user.

It should be noted that the update completion flag can also be used as a starting condition for the automatic update software to start updating the software to be updated. For example, after the automatic update software is installed on the vehicle controller and the automatic update software is run, and the update completion flag indicates that the update is not completed, the automatic update software performs the update steps. If the update process is unexpectedly interrupted, the automatic update software runs again after restarting, and detects that the update completion flag indicates that the update is not completed, and the automatic update process starts again.

Step 205: When the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed verification, it is determined that the update operation for the software to be updated is not completed, and the program continues to run. The software in the second loading address is automatically updated to update the software to be updated in the first loading address, and after the update is completed, the first verification data in the first verification address corresponding to the first loading address is restored.

Optionally, step 205 may also include:

Sub-step 2051: Verify the second verification data stored in the second verification address.

In the embodiment of the present invention, before running the software in the loading address, the vehicle controller needs to first verify the verification data stored in the verification address corresponding to the loading address. In the above steps, since the first verification data in the first loading address corresponding to the first verification data is deleted during the update process, if the update process is unexpectedly interrupted, the first verification data in the first loading address will not be in place. In the complete state, if the verification cannot be passed, the software in the first loading address will not be executed, but the second verification data in the second verification address will continue to be verified.

Sub-step 2052: If the second verification data stored in the second verification address passes the verification, start the automatic update software stored in the second loading address.

If the second verification data can pass the verification, the software stored in the second loading address corresponding to the second verification address is executed, that is, the software is automatically updated, and the software to be updated is continued to be updated.

Sub-step 2053: If the second verification data stored in the second verification address fails verification, verify the third verification data stored in the third verification address.

In this embodiment of the present invention, the vehicle controller may contain more than two load addresses. In this case, the third load address other than the first load address and the second load address among all the load addresses may be used as redundant. Backup, at this time, the third loading address and the second loading address also store the automatic updating software, and when the automatic updating software in the second loading address cannot be started, try to start the automatic updating software in the third loading address.

It should be noted that the third loading address may be one loading address or multiple loading addresses. In order to prevent the data in the second verification address from being damaged and affecting the execution of the software in the third loading address, the third verification address and the second verification address may be different, and the third verification data and the second verification data may be the same. Can be different. In the case where the third loading address contains multiple loading addresses, the verification data stored in the verification addresses corresponding to each of the third loading addresses may be the same or different.

Sub-step 2054: If the third verification data stored in the third verification address passes the verification, run the automatic update software stored in the third loading address.

It should be noted that when the third load address contains multiple load addresses, the verification data corresponding to each load address in the third load address is verified in order, and the first one that passes the verification is run. The software in the loading address corresponding to the verification data.

Sub-step 2055: Delete the automatic update software in the second loading address and restart the vehicle controller.

After restoring the first verification data in the first verification address corresponding to the first loading address, the vehicle controller can be automatically restarted, so that the vehicle controller loads and runs the updated to-be-updated data in the first loading address. software.

In addition, since after restoring the first verification data in the first verification address corresponding to the first loading address, the vehicle controller can already run the updated software to be updated after restarting, that is, the software to be updated has been completed. Therefore, in order to save the storage space consumption of the vehicle controller, the automatic update software in the second loading address can also be deleted after restoring the first verification data in the first verification address corresponding to the first loading address.

It should be noted that in the embodiment of the present invention, the automatic update software in the second loading address may not be deleted, and it may be retained in the second loading address for a long time after the update of the software to be updated is completed, so that the vehicle controller hardware or When a software failure causes the updated software to be updated in the first loading address to fail to load, you can still try to repair the software in the first loading address by loading the automatic update software in the second loading address to avoid system failure. Corruption occurs when updated software to be updated cannot be loaded.

Step 206: When the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, then it is determined that the update operation of updating the software to be updated in the first loading address is completed, and run the The updated software to be updated in the first loading address.

Optionally, step 206 also includes:

Sub-step 2061: Store the initial check code corresponding to the first check data; the initial check code is calculated by calculating the first check data through a preset algorithm.

In order to verify the first verification data, a corresponding initial verification code needs to be generated in advance based on the first verification data. The initial verification code can be obtained by encrypting and calculating the first verification data using a preset encryption algorithm. For example, Calculate the CRC32 value corresponding to the first check data in the first check address based on the IEEE 802.3 standard, and use the CRC32 value and the inverse value corresponding to the CRC32 value as the initial check code corresponding to the first check data.

It should be noted that the above process of configuring the initial check code can be completed when configuring the startup tag corresponding to the first loading address.

Specifically, taking Infineon's Aurix series Microcontroller Unit (MCU) TC27X as a vehicle controller as an example, each startup tag of the vehicle controller also contains CRCrange Filed, and The CRCrange Filed is used to store the CRC32 value of the first verification data stored in the first verification address corresponding to the startup tag,/> The inverted value of the CRC32 value used to store the first verification data stored in the first verification address corresponding to the startup tag is obtained by bitwise inversion. Among them,/> The horizontal bar above is the negation sign.

Sub-step 2062: Calculate the target check code corresponding to the data stored in the first check address through the preset algorithm.

After the vehicle controller is turned on, the data contained in the storage space indicated by the first verification address is read, and the CRC32 value corresponding to the data is calculated through a preset algorithm (such as the IEEE 802.3 standard) to obtain the CRC32 value including the CRC32 value and the The target check code that is the inverse of the CRC32 value.

It should be noted that the preset algorithm is not limited to the IEEE 802.3 standard. Other algorithms can also be used to calculate the CRC32 value of the first verification data and the data in the first verification address. This embodiment of the present invention is not specifically limited here.

Sub-step 2063: If the target check code matches the initial check code, determine that the first check data stored in the first check address passes the check.

Compare the CRC32 value in the target check code with the CRC32 value in the initial check code. If the two match, continue to compare the negated value in the target check code with the negated value in the initial check code. A comparison is performed, and if the comparison result shows that the two match, it is determined that the first verification data stored in the first verification address passes the verification.

In order to explain more clearly the software update method provided by the embodiment of the present invention, refer to Figure 3. Figure 3 shows a flow chart of the software update method provided by the embodiment of the present invention. As shown in Figure 3, the micro control unit of the Infineon Aurix series (Microcontroller Unit, MCU) TC27X is used as a vehicle controller as an example. The vehicle controller performs step 301: power on; after powering on, perform step 302: determine whether the memory startup error occurs. If the judgment result is yes, perform step 303: report an error memory exception. If the judgment result is no, perform step 304: check the nth startup tag (the initial value of n is 0), and perform step 305: judge that the nth startup tag is valid. If the judgment result is no, perform step 306: judge Whether n is equal to 3, if n is equal to 3, then execute step 307: error is reported and all startup tags are invalid. If n is not equal to 3, then execute step 308: enter the next startup tag (increment n by 1), and return to step 304 Continue execution. If the judgment result of whether the nth startup tag is valid is yes, then execute step 309: judge whether n is equal to 0. If n is equal to 0, then execute step 310: load the boot software (since n=0 corresponds to the first Startup tag, that is, corresponding to the first loading address in the first startup tag, the boot software is stored in the first load address by default); after loading the boot software, the vehicle controller is started, and automatic updates can be installed to the vehicle controller at this time software, after installing the automatic update software, the vehicle controller performs step 311: start the automatic update software; after starting the automatic update software, perform step 312: determine whether the update completion flag indicates that the update has not been completed. If the completion flag indicates that the update has been completed, then Execute step 318: end the update process. If the completion flag indicates that the update is not completed, then execute step 313: erase the first verification data in the first verification address; after erasing the first verification data, execute step 314: erase Remove the boot software in the first loading address; after erasing the boot software, perform step 315: write the updated boot software in the first loading address, that is, update the software to be updated to the updated software to be updated; write After updating the boot software, perform step 316: restore the first verification data in the first verification address; after restoring the first verification data, perform step 317: set the update completion flag bit to the update completion state; and finally enter step 318. : End the update process.

It should be noted that after step 313 is executed and before step 316 is executed, if the vehicle controller encounters an unexpected power outage or other failure that causes the update to be interrupted, the execution will start again from step 301. Since in the embodiment of the present invention, the installation When the software is automatically updated, the automatic update software will be written to other loading addresses other than the first loading address, and the first verification data in the first verification address has been erased in step 313, and execution starts from step 301 again. Finally, the boot software cannot be loaded through the first loading address, but the automatic update software will be loaded through other loading addresses, and execution continues from step 311.

In summary, embodiments of the present invention provide another software update method, which includes: receiving automatic update software, storing the automatic update software in the second loading address, and erasing the first verification address corresponding to the first loading address. The first verification data; by running the automatic update software, the software to be updated stored in the first loading address is updated to the updated software to be updated, and after the update is completed, the first verification address corresponding to the first loading address is restored. the first verification data in; when the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed the verification, it is determined that the update operation for the software to be updated is not completed, and the second load continues to run Automatically update the software in the address to update the software to be updated stored in the first loading address to the updated software to be updated, and restore the first verification in the first verification address corresponding to the first loading address after the update is completed data; when the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, then the update operation of updating the software to be updated stored in the first loading address to the updated software to be updated is determined. Completed, run the updated software to be updated in the first loading address. In the embodiment of the present invention, the guidance software in the vehicle controller can be updated by installing automatic update software in the vehicle controller, and damage to the vehicle controller caused by unexpected interruption of the update process can be avoided. Therefore, it is provided A highly reliable boot software update method is proposed, which not only reduces the tedious operation of updating the boot software, but also improves the reliability of the boot software update.

Based on the above embodiments, embodiments of the present invention also provide a software update device.

Referring to Figure 4, Figure 4 shows a structural block diagram of a software update device provided by an embodiment of the present invention:

The receiving module 401 is used to receive automatic update software, store the automatic update software in the second loading address, and erase the first verification data in the first verification address corresponding to the first loading address;

The operation module 402 is configured to update the software to be updated in the first loading address by running the automatic update software, and restore the first verification address corresponding to the first loading address after the update is completed. Check data;

The first loading module 403 is configured to determine that the update operation for the software to be updated is not completed if it is determined that the first verification data in the first verification address fails verification when the vehicle controller is restarted. , continue to run the automatic update software in the second loading address to update the software to be updated in the first loading address, and restore the first verification address corresponding to the first loading address after the update is completed. 1. Check data;

The second loading module 404 is configured to update the software to be updated in the first loading address if it is determined that the first verification data in the first verification address passes verification when the vehicle controller is restarted. After the operation is completed, run the updated software to be updated in the first loading address.

Optionally, the device also includes:

Configuration submodule, used to configure the software loading mode corresponding to multiple loading addresses as a sequential loading mode; the multiple loading addresses include at least a first loading address and a second loading address, and the sequential loading mode is used to load the software in the sequential loading mode. After the vehicle controller is turned on, the software in each loading address is started in sequence;

A verification storage submodule, configured to store the first verification data in the first verification address corresponding to the first loading address, and store the second verification data in the second verification address corresponding to the second loading address. Verifying address.

Optionally, the running module includes:

An erasure submodule, used to erase the software to be updated from the first loading address when the update completion flag bit indicates an incomplete state;

A writing submodule is used to write the updated software to be updated into the first loading address, and adjust the completion flag to a completion state.

Optionally, the first loading module includes:

Verification sub-module, used to verify the second verification data stored in the second verification address;

A start submodule, configured to start the automatic update software stored in the second loading address when the second verification data stored in the second verification address passes the verification.

Optionally, the device also includes:

An initial check code submodule is used to store the initial check code corresponding to the first check data; the initial check code is calculated by calculating the first check data through a preset algorithm;

The target check code submodule is used to calculate the target check code corresponding to the data stored in the first check address through the preset algorithm;

A check submodule, configured to determine that the first check data stored in the first check address passes the check when the target check code matches the initial check code.

Optionally, the device also includes:

A redundant submodule configured to store the third verification data in the third verification address corresponding to the third loading address, and store the automatic update software in the third loading address;

A redundant check sub-module that verifies the third check data stored in the third check address when the second check data stored in the second check address fails the check;

A redundant running submodule, configured to run the automatic update software stored in the third loading address when the third verification data stored in the third verification address passes verification.

Optionally, the device also includes:

Post-processing submodule, configured to delete the automatic update software in the second loading address and restart the vehicle control after restoring the first verification data in the first verification address corresponding to the first loading address. device.

To sum up, embodiments of the present invention provide a software update device, which includes: receiving automatic update software, storing the automatic update software in a second loading address, and erasing the first verification address corresponding to the first loading address. the first verification data in; by running the automatic update software, the software to be updated stored in the first loading address is updated to the updated software to be updated, and after the update is completed, the first verification corresponding to the first loading address is restored The first verification data in the address; when the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed the verification, it is determined that the update operation for the software to be updated is not completed, and the second verification process continues to run. Automatically update the software in the loading address to update the software to be updated stored in the first loading address to the updated software to be updated, and restore the first checksum in the first verification address corresponding to the first loading address after the update is completed. verification data; when the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes verification, it is determined that the software to be updated stored in the first loading address is updated to the updated software to be updated. After the operation is completed, run the updated software to be updated in the first loading address. In the embodiment of the present invention, the guidance software in the vehicle controller can be updated by installing automatic update software in the vehicle controller, and damage to the vehicle controller caused by unexpected interruption of the update process can be avoided. Therefore, it is provided A highly reliable boot software update method is proposed, which not only reduces the tedious operation of updating the boot software, but also improves the reliability of the boot software update.

An embodiment of the present invention also provides a vehicle controller. The vehicle controller includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The feature is that the processor executes the above software update method.

An embodiment of the present invention also provides a vehicle, including the above vehicle controller.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can be referred to the corresponding processes in the foregoing device embodiments, and will not be described again here.

The above descriptions are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the protection of the present invention. within the range.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention. should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims (10)

1. A software update method, characterized in that it is applied to a vehicle controller, and the method includes: Receive the automatic update software, store the automatic update software in the second loading address, and erase the first verification data in the first verification address corresponding to the first loading address; Update the software to be updated in the first loading address by running the automatic update software, and restore the first verification data in the first verification address corresponding to the first loading address after the update is completed; When the vehicle controller restarts, if it is determined that the first verification data in the first verification address has not passed verification, it is determined that the update operation for the software to be updated is not completed, and the second loading continues to run. Automatically update the software in the address to update the software to be updated in the first loading address, and restore the first verification data in the first verification address corresponding to the first loading address after the update is completed; When the vehicle controller restarts, if it is determined that the first verification data in the first verification address passes the verification, it is determined that the update operation of updating the software to be updated in the first loading address is completed, and the first verification data is run. Load the updated software to be updated in the address. 2. The method according to claim 1, characterized in that before running the automatic update software, the method further includes: The software loading mode corresponding to the multiple loading addresses is configured as a sequential loading mode; the multiple loading addresses include at least a first loading address and a second loading address, and the sequential loading mode is used to load the software after the vehicle controller is powered on. Start the software in each loading address in order; The first verification data is stored in the first verification address corresponding to the first loading address, and the second verification data is stored in the second verification address corresponding to the second loading address. 3. The method of claim 1, wherein updating the software to be updated in the first loading address includes: When the update completion flag indicates an incomplete state, erase the software to be updated from the first loading address; The updated software to be updated is written into the first loading address, and the completion flag bit is adjusted to a completion state. 4. The method according to claim 2, characterized in that said continuing to run the automatic update software in the second loading address includes: Verify the second verification data stored in the second verification address; If the second verification data stored in the second verification address passes the verification, the automatic update software stored in the second loading address is started. 5. The method according to claim 1, characterized in that, the method further comprises: Store the initial check code corresponding to the first check data; the initial check code is calculated by calculating the first check data through a preset algorithm; Calculate the target check code corresponding to the data stored in the first check address through the preset algorithm; When the target check code matches the initial check code, it is determined that the first check data stored in the first check address passes the check. 6. The method according to claim 2, wherein the storage space further includes a third load address corresponding to the third verification address, and the method further includes: Store the third verification data in the third verification address corresponding to the third loading address, and store the automatic update software in the third loading address; When the second verification data stored in the second verification address fails verification, verify the third verification data stored in the third verification address; If the third verification data stored in the third verification address passes the verification, run the automatic update software stored in the third loading address. 7. The method of claim 1, wherein after restoring the first verification data in the first verification address corresponding to the first loading address, the method further includes: Delete the automatic update software in the second loading address, and restart the vehicle controller. 8. A software update device, characterized in that the device includes: A receiving module, configured to receive automatic update software, store the automatic update software in the second loading address, and erase the first verification data in the first verification address corresponding to the first loading address; An operation module, configured to update the software to be updated in the first loading address by running the automatic update software, and restore the first verification address in the first verification address corresponding to the first loading address after the update is completed. test data; A first loading module configured to determine that the update operation for the software to be updated is not completed if it is determined that the first verification data in the first verification address has not passed verification when the vehicle controller is restarted, Continue to run the automatic update software in the second loading address to update the software to be updated in the first loading address, and restore the first verification address corresponding to the first loading address after the update is completed. Check data; A second loading module configured to determine an update operation for updating the software to be updated in the first loading address if it is determined that the first verification data in the first verification address passes verification when the vehicle controller is restarted. Completed, run the updated software to be updated in the first loading address. 9. A vehicle controller, characterized in that the vehicle controller includes a memory, a processor and a computer program stored on the memory and executable on the processor, and the processor executes the computer program The program implements the software update method according to any one of claims 1 to 7. 10. A readable storage medium, the readable storage medium stores programs or instructions, and when the programs or instructions are executed by a processor, the software update method according to any one of claims 1 to 7 is implemented.