WO2024087234A1

WO2024087234A1 - Method and apparatus for updating software, and intelligent device

Info

Publication number: WO2024087234A1
Application number: PCT/CN2022/128452
Authority: WO
Inventors: 罗毅
Original assignee: 华为技术有限公司
Priority date: 2022-10-29
Filing date: 2022-10-29
Publication date: 2024-05-02

Abstract

A method and apparatus for updating software, and an intelligent device. The method comprises: when a first functional module is controlled to run a first program in a first storage partition, performing detection on a second storage partition, wherein the first functional module is a functional module of first software of a controller, and a storage area of the controller comprises the first storage partition and the second storage partition; and when data of a second program in the second storage partition is detected, controlling the first functional module to run the second program, wherein the data of the second program comprises data associated with the updating of the first functional module. The method of the present application can be applied to intelligent devices such as an intelligent vehicle and an electric vehicle, and the latest software program can be run without the need for powering on a controller of an intelligent device again, thereby facilitating an improvement in the speed and convenience of software updating.

Description

Method, device and intelligent device for updating software

Technical Field

The present application relates to the field of computer technology, and more specifically, to a method, apparatus and intelligent device for updating software.

Background technique

With the development of intelligent technology, the speed of software updates in intelligent devices is also gradually accelerating. During the life cycle of an intelligent device, multiple software updates may be required. Taking vehicles as an example, the software of the vehicle controller is usually updated through over the air (OTA). When the software is updated by OTA, the controller is usually required to have storage partitions, one of which is used to store new data. When the software needs to be updated, the new data is generally received and stored in the corresponding storage partition when the controller executes the application code. When the controller is powered on again, the bootloader of the controller jumps to the starting address to run the new software program. The above-mentioned process of re-powering the controller affects the speed and convenience of the software update process.

In view of this, an update solution that can run new software without restarting the controller needs to be developed urgently.

Summary of the invention

The embodiments of the present application provide a method, apparatus and intelligent device for updating software, which can enable the controller to run the latest software program without re-powering on, thereby helping to improve the speed and convenience of software updates.

In a first aspect, a method for updating software is provided, which can be executed by a smart device; or, it can also be executed by a controller of the smart device; or, it can also be executed by a chip or circuit used for the smart device, which is not limited in the present application.

The smart devices involved in this application may include road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment, or entertainment equipment, etc. For example, the smart device can be a vehicle, which is a vehicle in a broad sense, and can be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), amusement equipment, a toy vehicle, etc. The embodiment of this application does not specifically limit the type of vehicle. For another example, the smart device can be a vehicle such as an airplane or a ship. Alternatively, the smart device can also include devices such as a smart phone and a smart home.

The method includes: when controlling a first functional module to run a first program in a first storage partition, detecting a second storage partition, the first functional module is a functional module of a first software of a controller, and a storage area of the controller includes the first storage partition and the second storage partition; when detecting data of a second program in the second storage partition, controlling the first functional module to run the second program, wherein the data of the second program includes data associated with the update of the first functional module.

In the above technical solution, when the control function module is running the software program in the first storage partition and detects that the second storage partition has data of a new software program, the new software program in the second storage partition can be run, so that the latest software program can be run without re-powering the controller, which helps to improve the speed and convenience of software updates. In addition, during the software update process, only individual function modules that need to be updated can be updated, reducing the time required for software updates.

In some possible implementations, a controller may include only one software, or may include two or more software.

In some possible implementations, the first software may include only the first functional module; or, in addition to the first functional module, the first software may also include other functional modules.

Taking the controller as a power steering controller of a vehicle as an example, the first software can be software that can realize power steering. The software can include functions such as sensor signal acquisition, torque calculation, and motor control. The software can be divided into multiple functional modules according to the above functions. For example, the software is divided into at least three functional modules, wherein the three functional modules are respectively used to realize the functions of sensor signal acquisition, torque calculation, and motor control. Exemplarily, the first functional module can be one of the above three functional modules; or, in some possible implementations, the functions such as sensor signal acquisition, torque calculation, and motor control can be further refined into smaller functional modules, and the first functional module can also be one of the above smaller functional modules.

In some possible implementations, when controlling a first functional module to run a first program in a first storage partition, a second storage partition is detected, and the first functional module is a functional module of a controller, and a storage area of the controller includes the first storage partition and the second storage partition; when data of a second program in the second storage partition is detected, the first functional module is controlled to run the second program, wherein the data of the second program includes data associated with the update of the first functional module.

In combination with the first aspect, in certain implementations of the first aspect, the data of the second program comes from a flash file, which includes first data and information about the first data, and the information is used to indicate the start and/or end of the first data; wherein the first data is any data of the program of M functional modules of the first software, the M functional modules include the first functional module, and M is an integer greater than or equal to 1.

In some possible implementations, the first software includes more than M functional modules, but only M functional modules need to be updated, and the flash file may only include data corresponding to the M functional modules.

Exemplarily, the information of the first data may include a start address and an end address of the first data in the storage area; or, the information of the first data may include a start address and a data length of the first data in the storage area.

In some possible implementations, the address allocated to the first data in the storage area is pre-set, and verification information can be added to the end of the first data, and padding data is added after the verification information, then the padding data can indicate the end position of the first data, and the padding data can be understood as a kind of information of the first data. Exemplarily, the starting position and the end position of the storage data are pre-configured for the first functional module in the storage area of the controller (such as the first storage partition and/or the second storage partition), for example, 300 bytes are pre-configured for the first functional module, and the first data occupies a total of 150 bytes in the second storage partition; if the length of the verification information is 2 bytes, the 299th byte and the 300th byte are reserved for storing the verification information, and the remaining bytes at the end of the first data (i.e., the 151st byte to the 298th byte) are used to store the padding data. It should be understood that the end position of the first data can be determined based on the padding data.

In the above technical solution, the flash files are modularly divided according to the functional modules of the software, which can reduce the possibility of all data being unavailable due to a sudden interruption of data flashing.

In combination with the first aspect, in certain implementations of the first aspect, the flash file consists of M module data, the M module data correspond one-to-one to the M functional modules, the M module data include first module data, the first module data include the first data and first description information of the first data, and the first description information is used to describe the relationship between the first data and the first functional module.

Exemplarily, the first description information may include identification information of the first functional module, for example, may include the first functional module ID; or, the first description information may also include information of the storage space associated with the first functional module, for example, may include information of the starting position and/or ending position for storing the first data; or, the first description information may also include information of the data length of the first data.

In combination with the first aspect, in certain implementations of the first aspect, the first description information also includes first verification information, which is set at the header and/or tail of the first data and is used to perform integrity and/or consistency verification on the first data.

In the above technical solution, integrity and/or consistency verification is performed on the first data using the first verification information, which helps to improve data security.

In combination with the first aspect, in certain implementations of the first aspect, the flash file consists of description information and module data, the description information includes first description information of the first data, the first description information is used to describe the relationship between the first data and the first functional module, and the module data includes the first data.

Exemplarily, the description information may also include quantity information of the module data, where the quantity information is used to indicate that the module data includes data of several functional modules.

In combination with the first aspect, in certain implementations of the first aspect, the flash file also includes second verification information, which is set at the header and/or tail of the flash file and is used to perform integrity and/or consistency verification on the flash file.

In the above technical solution, the integrity and/or consistency of the entire flash file is checked through the second verification information to prevent the situation where the entire flash file has problems when the data verification of each functional module passes, which helps to improve data security.

In combination with the first aspect, in certain implementations of the first aspect, the storage area also includes a third storage partition, which is used to store data of a third program of a second functional module, and the second functional module is a new functional module of the first software. The method also includes: when the data of the third program is detected in the third storage partition, controlling the second functional module to run the third program.

In the above technical solution, storage space is reserved for the new functions of the first software. When the first software needs a new function, there is no need to reconfigure the controller because of the new function. When the data of the program in the reserved storage space is detected, the program in the reserved storage space is controlled to run successfully, so as to achieve the successful operation of the new function, which helps to reduce the cost of software updates and save the time required for software updates.

In combination with the first aspect, in certain implementations of the first aspect, the first functional module includes a first function and a second function, the interface address of the first function is associated with the first storage partition, and the interface address of the second function is associated with the second storage partition, and controlling the first functional module to run the second program includes: controlling the first functional module to change from scheduling the interface address of the first function to scheduling the interface address of the second function, and running the second program in the second storage partition through the interface address of the second function.

Exemplarily, the first function may be a function of the first functional module in the first storage partition, and the second function may be a function of the first functional module in the second storage partition. “The interface address of the first function is associated with the first storage partition” may be understood as: data in the first storage partition may be read through the interface address, and/or a program in the first storage partition may be run.

In combination with the first aspect, in certain implementations of the first aspect, the address of the data of the second program in the second storage partition is a pre-set fixed address, and the storage area includes a fourth storage partition, which is used to store the fixed address; before controlling the first functional module to change from scheduling the interface address of the first function to scheduling the interface address of the second function, the method also includes: determining that the interface address of the second function is consistent with the fixed address in the fourth storage partition.

In the above technical solution, before controlling the running of the second program in the second storage partition, the validity of the interface address is first determined, which can prevent the running of unsafe programs when the interface address is tampered with, and help improve the security of the functional module.

In combination with the first aspect, in certain implementations of the first aspect, the data of the second program includes functional data and configuration data, and before controlling the first functional module to run the second program, the method also includes: performing integrity and/or consistency checks on the configuration data and the functional data, respectively.

In the above technical solution, the configuration data and the functional function data are verified separately, which can shorten the time required for data verification and improve the efficiency of data verification.

In combination with the first aspect, in some implementations of the first aspect, the method further includes: controlling erasure of data of the first program in the first storage partition.

In the above technical solution, after running the updated program, the data of the old program is controlled to be erased so that the storage partition storing the old program data can be used to receive the new program data, so that the storage partition can receive the data required for the next program update.

In combination with the first aspect, in certain implementations of the first aspect, the storage area also includes a fifth storage partition, which is used to store identification information of the first functional module, and the identification information is used to indicate that data associated with the update of the first functional module has been written in the second storage partition, and when data of the second program in the second storage partition is detected, the first functional module is controlled to run the second program, including: when data in the second storage partition and the identification information of the first functional module in the fifth storage partition are detected, the first functional module is controlled to run the second program in the second storage partition.

In the above technical solution, whether the data required for program update has been written is determined based on the identification information. When the identification information of the first functional module is detected, it is determined that the first data has been written. Otherwise, it is considered that the first data has not been written, which helps to improve data retrieval efficiency.

In a second aspect, a device for updating software is provided, the device comprising: a detection unit, for detecting a second storage partition when controlling a first functional module to run a first program in a first storage partition, the first functional module being a functional module of a first software of a controller, and a storage area of the controller including the first storage partition and the second storage partition; a processing unit, for controlling the first functional module to run the second program when the detection unit detects data of the second program in the second storage partition, wherein the data of the second program includes data associated with the update of the first functional module.

In combination with the second aspect, in certain implementations of the second aspect, the data of the second program comes from a flash file, which includes first data and information about the first data, and the information is used to indicate the start and/or end of the first data; wherein the first data is any data of the program data of M functional modules of the first software, the M functional modules include the first functional module, and M is an integer greater than or equal to 1.

In combination with the second aspect, in certain implementations of the second aspect, the flash file consists of M module data, the M module data correspond one-to-one to the M functional modules, the M module data include first module data, the first module data include the first data and first description information of the first data, and the first description information is used to describe the relationship between the first data and the first functional module.

In combination with the second aspect, in certain implementations of the second aspect, the first description information also includes first verification information, which is set at the header and/or tail of the first data and is used to perform integrity and/or consistency verification on the first data.

In combination with the second aspect, in certain implementations of the second aspect, the flash file consists of description information and module data, the description information includes first description information of the first data, the first description information is used to describe the relationship between the first data and the first functional module, and the module data includes the first data.

In combination with the second aspect, in certain implementations of the second aspect, the flash file also includes second verification information, which is set at the header and/or tail of the flash file and is used to perform integrity and/or consistency verification on the flash file.

In combination with the second aspect, in some implementations of the second aspect, the storage area also includes a third storage partition, the third storage partition is used to store data of a third program of the second functional module, the second functional module is a newly added functional module of the first software, and the processing unit is also used to: when the detection unit detects the data of the third program in the third storage partition, control the second functional module to run the third program. In combination with the second aspect, in some implementations of the second aspect, the first functional module includes a first function and a second function, the interface address of the first function is associated with the first storage partition, and the interface address of the second function is associated with the second storage partition, and the processing unit is used to: control the first functional module to change from scheduling the interface address of the first function to scheduling the interface address of the second function, and run the second program in the second storage partition through the interface address of the second function.

In combination with the second aspect, in certain implementations of the second aspect, the address of the data of the second program in the second storage partition is a pre-set fixed address, and the storage area includes a fourth storage partition, which is used to store the fixed address; before the control of the first functional module changes from scheduling the interface address of the first function to scheduling the interface address of the second function, the processing unit is also used to: determine that the interface address of the second function is consistent with the fixed address in the fourth storage partition.

In combination with the second aspect, in certain implementations of the second aspect, the data of the second program includes functional data and configuration data, and before the first functional module that controls the second program runs the second program, the processing unit is also used to: perform integrity and/or consistency checks on the configuration data and the functional data, respectively.

In combination with the second aspect, in some implementations of the second aspect, the processing unit is further used to: control erasing of data of the first program in the first storage partition.

In combination with the second aspect, in certain implementations of the second aspect, the storage area also includes a fifth storage partition, which is used to store identification information of the first functional module, and the identification information is used to indicate that data associated with the update of the first functional module has been written in the second storage partition, and the processing unit is used to: when the detection unit detects the data in the second storage partition and the identification information of the first functional module in the fifth storage partition, control the first functional module to run the second program of the second storage partition.

In a third aspect, a device for updating software is provided, the device comprising: a memory for storing a computer program; and a processor for executing the computer program stored in the memory, so that the device performs a method as in any possible implementation of the first aspect.

In a fourth aspect, a smart device is provided, which includes an apparatus as in any possible implementation of the second aspect or the third aspect.

In combination with the fourth aspect, in certain implementations of the fourth aspect, the intelligent driving device is a vehicle.

In a fifth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on a computer, the computer executes the method in any possible implementation of the first aspect.

It should be noted that the above-mentioned computer program code may be stored in whole or in part on a first storage medium, wherein the first storage medium may be packaged together with the processor or may be packaged separately from the processor.

In a sixth aspect, a computer-readable medium is provided, wherein the computer-readable medium stores instructions, and when the instructions are executed by a processor, the processor implements the method in any possible implementation manner of the first aspect.

In a seventh aspect, a chip is provided, the chip comprising a circuit, the circuit being used to execute the method in any possible implementation manner of the first aspect above.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic block diagram of a system architecture required for implementing a method for updating software provided in an embodiment of the present application;

FIG2 is a schematic diagram of a storage area division of a controller provided in an embodiment of the present application;

3 is a schematic diagram of address mapping between data of a program of a functional module and a storage partition provided in an embodiment of the present application;

FIG4 is a schematic flow chart of a method for updating software provided in an embodiment of the present application;

FIG5 is a schematic diagram of a flash file provided in an embodiment of the present application;

FIG6 is another schematic diagram of a flash file provided in an embodiment of the present application;

7 is a schematic flow chart of data verification in the software update process provided by an embodiment of the present application;

FIG8 is a schematic block diagram of a device for updating software provided in an embodiment of the present application;

FIG. 9 is another schematic block diagram of the apparatus for updating software provided in an embodiment of the present application.

Detailed ways

In the description of the embodiments of the present application, unless otherwise specified, "/" means or, for example, A/B can mean A or B; "and/or" in this article is a kind of association relationship that describes associated objects, indicating that three relationships can exist, for example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In the present application, "at least one" means one or more, and "multiple" means two or more. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple.

The prefixes such as "first" and "second" used in the embodiments of the present application are only used to distinguish different description objects, and have no limiting effect on the position, order, priority, quantity or content of the described objects. The use of prefixes such as ordinal numbers used to distinguish description objects in the embodiments of the present application does not constitute a limitation on the described objects. For the statement of the described objects, please refer to the description in the context of the claims or embodiments, and the use of such prefixes should not constitute an unnecessary limitation.

In current vehicle controllers, software updates are often performed in the following ways:

First, when the vehicle is stationary, connect the host computer to the vehicle's controller, and the controller's bootloader writes the data of the new software program sent by the host computer into the controller. After the data is written, the controller is powered on again to start running the updated software program.

Secondly, under the condition that the vehicle's controller has storage partitions, the OTA method is used to write the data of the new software program to the unused storage partition when the vehicle is running or stationary. When the controller is powered on again, the starting address jumps to run the new software program in the storage partition.

Both of the above methods require the controller to be powered on again before the new software program can be run, and do not have the ability to update and run in real time during the same power-on cycle.

In view of this, the present application provides a method, apparatus and intelligent device for updating software, which partitions the storage area of the controller according to the functional modules, and each functional module with an update requirement corresponds to at least two storage partitions, wherein one storage partition (hereinafter referred to as the active area) is used to store the data of the running software program, and the other storage partition (hereinafter referred to as the backup area) is used to store the data of the new software program. By solidifying the address of the configuration data and the main function interface of the functional module, and combining the address mapping between the active area and the backup area and the functional module, when the functional module is running the software program in the active area and detects that there is data of the new software program in the backup area, the new software program in the backup area can be run in the form of a pointer, so that the controller can run the latest software program without re-powering on, which helps to improve the speed and convenience of software updates.

It should be noted that, in the present application, the software program is divided into one or more functional modules, each of which can complete a sub-function of the software program, and the one or more functional modules as a whole can meet the required functions of the entire software program.

The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

FIG1 is a schematic block diagram of a system architecture required for implementing a method for updating software provided in an embodiment of the present application. As shown in FIG1 , the system includes a communication bus, a controller, a gateway, and a host computer. Wherein, when the controller needs to perform a software update, the data of the new software program can be transmitted to the controller via a wireless communication system such as wireless fidelity (Wi-Fi) via a gateway; or, the data of the new software program can be transmitted to the controller via a host computer. Taking the system in a vehicle as an example, the communication bus can be a controller area network/local interconnect network bus (controller area network/local interconnect network bus, CAN/LIN bus), and the controller can include at least one of an electronic control unit (ECU), a micro control unit (MCU), a vehicle domain controller (VDC), a mobile data center (MDC), and a chassis domain controller (CDC), or the controller can also be other programmable electronic control units with storage functions.

In order to implement the method for updating software provided in the embodiment of the present application, it is necessary to divide the storage area of the controller in advance and configure the address mapping between the storage partitions and the functional modules.

Exemplarily, the storage area of the controller is partitioned according to the functional modules. For example, only one storage partition (such as an active area) can be set for the functional modules without update requirements, and at least two storage partitions (for example, including an active area and a backup area) can be set for each functional module with update requirements. Figure 2 shows a schematic diagram of the storage area division of a controller provided by an embodiment of the present application. As shown in Figure 2, for all functional modules (i.e., functional modules 1 to m), an active area is divided for them in the storage area; for functional modules with update requirements (such as functional modules 3 to m), a backup area is divided for them in the storage area. Among them, the active area is the storage partition required for the operation of the functional module, which is used to store the data of the running program; the backup area is a storage partition for storing the data of the new program of the functional module, and the new data is used for the update of the functional module. Exemplarily, a cache area can also be divided in the storage area for caching the data of the above-mentioned new program. Among them, the space of the cache area is greater than or equal to the space required for the maximum functional module to store program data. In some possible implementations, reserved storage partitions can also be divided in the storage area, such as reserved active areas and reserved backup areas, which are used to meet the operation requirements of the newly added functional modules and the update requirements of the newly added functional modules, respectively. For the newly added functional modules, the interfaces also need to be designed and the addresses need to be fixed in the above-mentioned reserved storage partitions. In some possible implementations, the number of newly added functional modules and the size of the space occupied need to be simulated and scheduled in the operating system in advance to prevent uncontrollable phenomena in the operating system scheduling timing or insufficient storage space. For example, when designing a new functional module, a timing analysis tool can be used to simulate the mounting test of the new functional module, and appropriate storage space and interface addresses can be reserved in the storage space and operating system without affecting the safe operation of the controller.

Exemplarily, the data of the program of the functional module is composed of a functional function and configuration data. Each functional module may include one or more functional functions and configuration data. The one or more functional functions may be placed in a main function, or may be placed in multiple main functions. Each main function includes a logic code that implements the corresponding function of the functional module. Furthermore, the operating system of the controller implements the normal operation of the functional module by calling the main function interface. In an embodiment of the present application, when configuring the address mapping between the storage partition and the functional module, the configuration data, the functional function interface, and the main function interface in the functional module are respectively set to correspond to the address in the storage area. Exemplarily, FIG3 shows a schematic diagram of the address mapping between the data of the program of a functional module and a storage partition (active area or backup area). It should be understood that other configuration data can be found based on the first address of the configuration data in the storage area.

FIG4 shows a schematic flow chart of a method 400 for updating software provided in an embodiment of the present application. The method may be executed by a controller, and exemplarily, may be executed by an operating system of the controller. The method 400 may include:

S401, detecting a second storage partition when controlling a first function module to run a first program of a first storage partition, wherein the first function module is a function module of a first software of a controller, and a storage area of the controller includes the first storage partition and the second storage partition.

Exemplarily, the first functional module can be one of the functional modules 3 to m in the above-mentioned embodiment, or it can also be other functional modules with update requirements; the first storage partition can be an active area pre-configured for the first functional module; the second storage partition can be a backup area pre-configured for the first functional module.

S402: When detecting data of a second program in a second storage partition, control the first functional module to run the second program, wherein the data of the second program includes data associated with updating of the first functional module.

In some possible implementations, before controlling the first functional module to run the second program, the validity, integrity and consistency of the data of the second program need to be checked. After the check passes, the first functional module is controlled to run the second program of the second storage partition.

It should be understood that when the first functional module runs the second program of the second storage partition and detects the data of the new program of the first storage partition, the first functional module can be controlled to run the new data of the first storage partition.

In some possible implementations, in order to realize the alternating operation of the program in the first storage area and the second storage area, the pointer variables of the configuration data of the first storage partition and the second storage partition, and the function pointers pointing to the function functions of the first storage partition and the second storage partition can be pre-defined for the first functional module, and the addresses of the function functions in the first storage partition and the second storage partition are solidified respectively. Further, the function functions of the first functional module corresponding to the first storage partition and the second storage partition are defined. Exemplarily, the function function can use the if-else logic structure to determine the configuration data it calls. Further, when the operating system controls the operation of the first functional module, when the module is initialized, the addresses of the configuration data of the pre-configured first functional module in the first storage partition and the second storage partition, and the address of the main function interface are assigned to the pointer variable and the function pointer respectively. The function pointer pointing to the interface address of the first functional module in the first storage partition and the second storage partition is set in the main function of the first functional module, and the program of only one storage partition is run through conditional judgment.

In some possible implementations, when the operating system runs the program of the first functional module, it scans all reserved new module interface addresses. If it detects that there is new program data in the reserved storage partition, it means that there is a new functional module; the operating system then performs corresponding scheduling to run the program of the new functional module.

In some possible implementations, the data of the second program is derived from a flash file. In order to perform software updates through the method for updating software provided in the embodiment of the present application, it is necessary to modularize the flash file (including the data for updating the software). Exemplarily, the flash file includes first data and information about the first data, which is used to indicate the start and/or end of the first data; wherein the first data is any data in the data of the program of the M functional modules of the first software, the M functional modules include the first functional module, and M is an integer greater than or equal to 1. In one example, as shown in FIG5, for all functional modules of the software (such as functional modules 1 to n), keywords are used to segment the header and tail of each functional module, so that when the controller receives the data, the start and end of each functional module data (i.e., the data of the above-mentioned new program) can be determined. In another example, as shown in FIG6, taking the first data as the data of functional module 1 as an example, the information of the first data can include the start address of functional module 1, and at least one of the end address and data length.

In some possible implementations, the flash file is composed of M module data, the M module data correspond one-to-one to the M functional modules, and the M module data include first module data, the first module data includes the first data and first description information of the first data, and the first description information is used to describe the relationship between the first data and the first functional module. Exemplarily, taking the flash file as the file shown in FIG5 as an example, if the first data is the data of the program of functional module 1 (i.e., the functional module 1 data shown in the figure), the first module data can be as shown in the dotted box 501 in FIG5. Further, the first description information can include adding a unique code (Identity document, ID) of the module to the header of the functional module data, or can also include one or more of the starting address, data length, end address, and security check value.

In some possible implementations, the flash file is composed of description information and module data, the description information includes first description information of the first data, the first description information is used to describe the relationship between the first data and the first functional module, and the module data includes the first data. Exemplarily, taking the flash file as the file shown in FIG. 6 as an example, the description information may be as shown in the dotted box 601 in FIG. 6, the description information may include relevant information of all functional modules of the software that need to be updated, and the module data may be as shown in the dotted box 602 in FIG. 6.

In some possible implementations, in the flash file shown in FIG5 , relevant information of the data may be added to the header and/or tail of each functional module data, so that the operating system can perform integrity and consistency checks on the received data. The security check value is used to perform cyclic redundancy check (CRC) or other types of checks on the functional module data. In some possible implementations, null bytes or other byte data may be filled at both the header and tail of the functional module data to align the file width.

In some possible implementations, a security check value (such as a check value of all module data) may be written into the header and/or tail of the flash file shown in FIG. 5 to verify the entire file.

In some possible implementations, in the flash file shown in FIG. 6 , a security check value (such as a check value of all module data) may be written at the head and/or tail of the flash file to verify the entire file.

The method for updating software provided in the embodiment of the present application can realize that when the functional module is running the software program in the active area and detects that there is new software program data in the backup area, the new software program in the backup area can be run, so that the controller can run the latest software program without re-powering on, which helps to improve the speed and convenience of software updates. In addition, by modularizing the software, only individual functional modules or new functional modules can be updated, and online real-time updates of the software can be achieved without recompiling the entire software, which helps to reduce the time required for software updates. In addition, the data block segmentation of the flash file according to the functional module can prevent the situation where all data is unavailable due to a sudden interruption of data flashing, and the security of the data can be improved by adding security checks.

By way of example, the principle of implementing the alternating operation of data in the first storage area and the second storage area in S402 is described below by taking the C language environment as an example. It should be noted that the text within the symbol "/*...*/" is used to explain the meaning of the next code segment, and the text after the symbol "//" is used to explain the meaning of the previous code segment.

First, for the first functional module, pointer variables pointing to the configuration data of the first storage partition and the second storage partition, as well as function pointers pointing to the function functions of the first storage partition and the second storage partition corresponding to the first functional module can be defined respectively. Exemplarily, the implementation code is as follows (lines 1 to 36), using memory mapping (memorymap, memmap) for address fixing:

Furthermore, the function functions of the first function module corresponding to the first storage partition and the second storage partition are defined respectively, and the above function functions can determine the configuration data they call through logical structures such as if-else. Exemplarily, the implementation code is as follows (lines 37 to 75):

When the operating system controls the operation of the first functional module, when the module is initialized, the address of the configuration data of the pre-configured first functional module in the first storage partition and the second storage partition, and the address of the main function interface are assigned to the pointer variable and the function pointer respectively. The main function of the first functional module sets a function pointer pointing to the interface address of the first functional module in the first storage partition and the second storage partition, and only runs the program of one storage partition through conditional judgment. Exemplarily, the following code (lines 76 to 104) can be used to implement running only the program in one storage partition at a time:

It should be understood that the above codes are only exemplary. In the specific implementation process, other languages may be used to implement the alternating operation of the programs in the first storage area and the second storage area.

In some possible implementations, in order to achieve real-time update of the first functional module during operation, the operating system will scan the second storage area for new program data when controlling the operation of the program in the first storage area. If the second storage area has new program data written, and the validity, integrity, and consistency of the data are verified, the operating system controls the functional module to run the program in the second storage area. Exemplarily, the process is shown in FIG7 and may include:

S701, controlling the program of the first functional module in the first storage partition to run.

S702, detecting data of an update program in a cache area.

Exemplarily, the data of the update program may be data for updating the first functional module. It should be understood that the data of the update program includes configuration data and functional data of the first functional module.

S703, determining whether the integrity and consistency check of the data of the update program has passed.

Specifically, if the integrity and consistency check of the data of the update program passes, execute S704, otherwise execute S704'.

S704, controlling the writing of the data of the update program into the second storage partition.

S704’, erase the data of the update program in the cache area.

Further, after erasing the data of the update program, the software update process ends.

S705: Determine whether the validity check of the data in the second storage partition passes.

S706: Determine whether the integrity and consistency check of the second storage partition configuration data passes.

Specifically, if the integrity and consistency check of the second storage partition configuration data passes, execute S7063; otherwise, execute S7061.

S707, determine whether the integrity and consistency check of the function data of the second storage partition passes.

Specifically, if the integrity and consistency check of the functional data of the second storage partition passes, execute S7073; otherwise, execute S7071.

S7061, rewrite the corresponding data from the cache area to the second storage partition and perform verification.

S7062, determine whether the integrity and consistency check of the second storage partition configuration data passes.

Specifically, if the integrity and consistency check of the second storage partition configuration data passes, execute S7063; otherwise, execute S708.

S7063, control the second storage partition configuration data valid flag to be set.

S7064, the control function calls the second storage partition configuration data.

S7065, control erasing the first storage partition configuration data.

S7071, rewrite the corresponding data from the cache area to the second storage partition and perform verification.

S7072, determine whether the integrity and consistency check of the function data of the second storage partition passes.

Specifically, if the integrity and consistency check of the functional data of the second storage partition passes, execute S7073; otherwise, execute S708.

S7073, control the second storage partition function data valid flag bit to be set.

S7074, control the main function to call the second storage partition function data.

S7075, control erasing the function data of the first storage partition.

S708, determining that the verification has failed.

S709, controlling erasure of data corresponding to the second storage partition (and the cache area).

S710, end.

In some possible implementations, if the format of the flash data is as shown in Figure 5, the operating system can perform integrity and consistency checks by comparing the module ID and address information recorded at the beginning and end of the first module data with the pre-set information, and comparing the calculated check value with the security check value to see if they are consistent. If the comparison results are the same, the data is considered to be received complete and consistent.

It should be noted that when the storage area of the controller is not configured with a cache area, after executing S701, S702 to S704 may be skipped and S705 may be directly executed.

It can be understood that after the function data and configuration data of the first storage partition are controlled to be erased, the first storage partition can be used to store data required for the next software update.

In some possible implementations, the solutions of any one of S704', S7065, S7075 and S709 are implemented by a function for erasing a storage area. Exemplarily, when designing a function for erasing a storage area, at least one of the following information needs to be included in the function parameters: the starting address and length of the target location of the storage area, and the starting address and length of the data to be written. In addition, the function needs to be designed as a non-reentrant type, and has corresponding return values for the erasing results and errors in the process.

In some possible implementations, the above-mentioned processing measure for data verification failure can be to copy the data multiple times and verify, and if the number of failures exceeds a preset number, the data copying is stopped and the error type is returned. Exemplarily, the preset number of failures can be 10 times, or 20 times, or other values.

In some possible implementations, when the first software in the above embodiment is updated, the first software may have a corresponding new function module after the update, and the main function interface pointer of the new function module may be set in advance in the operating system. The operating system will scan the reserved storage partition (such as the third storage partition) used to store the interface address of the new module during operation. If it is checked that the reserved storage partition has the data of the program of the new function module, and the verification result of the data is valid, the operating system schedules the corresponding function pointer and runs the function of the new module. Exemplarily, the operation of the new function module can be implemented by the following code (lines 105 to 117):

In some possible implementations, in order to improve security, before the above-mentioned scheduling of the pointer, it is first determined whether the address pointed to by the pointer is valid. If the address is valid, the pointer is scheduled, otherwise an error value is returned and the scheduling of the pointer is stopped. In one example, it is possible to determine whether the address pointed to by the pointer is a null address to determine whether the address is valid. If the address is not a null address, the address is valid, otherwise the address is invalid. In another example, when it is determined that the address pointed to by the pointer is not a null address, it is determined whether the address pointed to by the pointer is consistent with the address expected by the pointer. If they are consistent, the address is valid, otherwise the address is invalid.

In some possible implementations, after the controller performs storage partitioning on all functional modules, the interface address data of all functional modules are saved to a certain area of the controller (e.g., the fourth storage partition) for solidification when the controller leaves the factory, wherein the interface addresses of all functional modules include the pre-designed interface addresses of newly added functional modules. Furthermore, when judging the validity of the backup area data, the operating system compares the pointer value with the pre-stored functional module interface address. If they are consistent, the validity of the backup area data can be further judged; if they are inconsistent, the corresponding error value is returned.

Since it takes a certain amount of time to write data into a storage area, the presence of data in the corresponding storage area does not mean that the data has been written. In some possible implementations, in order to improve the efficiency of software updates, after the data of the new program of the functional module is written, the functional module ID is written into an array or an allocated fixed storage area (e.g., the fifth storage partition). The operating system can determine which functional module data has been written by cyclically searching the array data or the functional module ID of the fixed storage area. Furthermore, the security and consistency of the functional module data can be checked, and the functional module ID is deleted from the fixed storage area after the check is successful.

The address allocation of configuration data and function functions in the above embodiments is to facilitate the main function call within a function module. In some possible implementations, for configuration data and function functions that need to be called between function modules, it is necessary to set up an independent storage space in the storage area to store the configuration data and function functions called across function modules. For configuration data that needs to be used for multiple read/write operations, a spin lock can also be used for protection.

In the various embodiments of the present application, unless otherwise specified or provided for by logic, the terms and/or descriptions between the various embodiments are consistent and may be referenced to each other, and the technical features in different embodiments may be combined to form new embodiments according to their inherent logical relationships.

The method provided by the embodiment of the present application is described in detail above in conjunction with Figures 1 to 7. The device provided by the embodiment of the present application will be described in detail below in conjunction with Figures 8 and 9. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, the content not described in detail can be referred to the method embodiment above, and for the sake of brevity, it will not be repeated here.

FIG8 shows a schematic block diagram of a software updating device 800 provided in an embodiment of the present application. The device 800 includes a detection unit 810 and a processing unit 820 .

The device 800 may include units for executing the method in Fig. 4. Moreover, each unit in the device 800 and the other operations and/or functions described above are respectively for implementing the corresponding processes of the method embodiment in Fig. 4.

When the device 800 is used to execute the method 400 in FIG. 4 , the detection unit 810 may be used to execute S401 in the method 400 , and the processing unit 820 may be used to execute S402 in the method 400 .

Specifically, the detection unit 810 is used to: detect the second storage partition when controlling the first functional module to run the first program of the first storage partition, the first functional module is a functional module of the first software of the controller, and the storage area of the controller includes the first storage partition and the second storage partition; the processing unit 820 is used to: when the detection unit 810 detects data of the second program of the second storage partition, control the first functional module to run the second program, wherein the data of the second program includes data associated with the update of the first functional module.

In some possible implementations, the data of the second program comes from a flash file, which includes first data and information about the first data, and the information is used to indicate the start and/or end of the first data; wherein the first data is any data of the program of M functional modules of the first software, the M functional modules include the first functional module, and M is an integer greater than or equal to 1.

In some possible implementations, the flash file consists of M module data, the M module data correspond one-to-one to the M functional modules, the M module data include first module data, the first module data includes the first data and first description information of the first data, and the first description information is used to describe the relationship between the first data and the first functional module.

In some possible implementations, the first description information also includes first verification information, which is set at the header and/or tail of the first data and is used to perform integrity and/or consistency verification on the first data.

In some possible implementations, the flash file consists of description information and module data, the description information includes first description information of the first data, the first description information is used to describe the relationship between the first data and the first functional module, and the module data includes the first data.

In some possible implementations, the flash file further includes second verification information, which is set at the header and/or tail of the flash file and is used to perform integrity and/or consistency verification on the flash file.

In some possible implementations, the storage area also includes a third storage partition, which is used to store data of a third program of a second functional module. The second functional module is a new functional module of the first software. The processing unit 820 is also used to control the second functional module to run the third program when the detection unit 810 detects the data of the third program in the third storage partition.

Exemplarily, the third storage partition may include the reserved backup area and/or the reserved active area in the above embodiment.

In some possible implementations, the first functional module includes a first function and a second function, the interface address of the first function is associated with the first storage partition, and the interface address of the second function is associated with the second storage partition, and the processing unit 820 is used to: control the first functional module to change from scheduling the interface address of the first function to scheduling the interface address of the second function, and run the second program in the second storage partition through the interface address of the second function.

In some possible implementations, the address of the data of the second program in the second storage partition is a pre-set fixed address, and the storage area includes a fourth storage partition, which is used to store the fixed address; before the control of the first functional module changes from scheduling the interface address of the first function to scheduling the interface address of the second function, the processing unit 820 is also used to: determine that the interface address of the second function is consistent with the fixed address in the fourth storage partition.

In some possible implementations, the data of the second program includes functional data and configuration data. Before controlling the first functional module to run the second program, the processing unit 820 is further used to perform integrity and/or consistency checks on the configuration data and the functional data, respectively.

In some possible implementations, the processing unit 820 is further used to: control erasure of data of the first program in the first storage partition.

In some possible implementations, the storage area also includes a fifth storage partition, which is used to store identification information of the first functional module, and the identification information is used to indicate that data associated with the update of the first functional module has been written into the second storage partition. The processing unit 820 is used to: when the detection unit 810 detects the data of the second storage partition and the identification information of the first functional module in the fifth storage partition, control the first functional module to run the second program of the second storage partition.

Exemplarily, the identification information of the first functional module may include the functional module ID in the above embodiment.

Exemplarily, the device 800 may be provided in the controller shown in FIG. 1 .

It should be understood that the division of the units in the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. In addition, the units in the device can be implemented in the form of a processor calling software; for example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of the units of the device, wherein the processor is, for example, a general-purpose processor, such as a CPU or a microprocessor, and the memory is a memory in the device or a memory outside the device. Alternatively, the units in the device can be implemented in the form of hardware circuits, and the functions of some or all of the units can be realized by designing the hardware circuits. The hardware circuit can be understood as one or more processors; for example, in one implementation, the hardware circuit is an ASIC, and the functions of some or all of the above units are realized by designing the logical relationship of the components in the circuit; for example, in another implementation, the hardware circuit can be implemented by PLD. Taking FPGA as an example, it can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured through the configuration file, so as to realize the functions of some or all of the above units. All units of the above device may be implemented entirely in the form of a processor calling software, or entirely in the form of a hardware circuit, or partially in the form of a processor calling software and the rest in the form of a hardware circuit.

In the embodiment of the present application, the processor is a circuit with the ability to process signals. In one implementation, the processor can be a circuit with the ability to read and run instructions, such as a CPU, a microprocessor, a GPU, or a DSP; in another implementation, the processor can implement certain functions through the logical relationship of the hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, DPU, etc.

It can be seen that each unit in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

In addition, the units in the above device can be fully or partially integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of each unit of the device. The type of the at least one processor may be different, for example, including a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

FIG9 is a schematic block diagram of a device for updating software according to an embodiment of the present application. The device 900 for updating software shown in FIG9 may include: a processor 910, a transceiver 920, and a memory 930. The processor 910, the transceiver 920, and the memory 930 are connected via an internal connection path, the memory 930 is used to store instructions, the processor 910 is used to execute the instructions stored in the memory 930, and the transceiver 920 receives/sends some parameters. In some possible implementations, the memory 930 may be coupled to the processor 910 via an interface, or may be integrated with the processor 910.

It should be noted that the above-mentioned transceiver 920 may include but is not limited to a transceiver device such as an input/output interface to achieve communication between the device 900 and other devices or communication networks.

Memory 930 can be a read-only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM).

The transceiver 920 uses a transceiver device such as, but not limited to, a transceiver to implement communication between the apparatus 900 and other devices or a communication network.

In some possible implementations, the device 900 may be disposed in the controller shown in FIG. 1 .

An embodiment of the present application further provides a smart device, which may include the above-mentioned device 800 or the above-mentioned device 900.

In some possible implementations, the smart device may be a vehicle.

The embodiment of the present application also provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer implements the method in the embodiment of the present application.

The embodiment of the present application also provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer implements the method in the embodiment of the present application.

The embodiment of the present application also provides a chip, including a circuit, for executing the method in the embodiment of the present application.

In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or a power-on erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

A method for updating software, comprising:

When controlling a first function module to run a first program of a first storage partition, detecting a second storage partition, the first function module being a function module of a first software of a controller, and the storage area of the controller including the first storage partition and the second storage partition;

When data of a second program in the second storage partition is detected, the first functional module is controlled to run the second program, wherein the data of the second program includes data associated with updating of the first functional module.
The method as claimed in claim 1 is characterized in that the data of the second program comes from a flash file, the flash file includes first data and information about the first data, and the information is used to indicate the start and/or end of the first data; wherein the first data is any data of the program data of M functional modules of the first software, the M functional modules include the first functional module, and M is an integer greater than or equal to 1.
The method as claimed in claim 2 is characterized in that the flash file is composed of M module data, the M module data correspond one-to-one to the M functional modules, the M module data include first module data, the first module data includes the first data and first description information of the first data, and the first description information is used to describe the relationship between the first data and the first functional module.
The method as claimed in claim 3 is characterized in that the first description information also includes first verification information, and the first verification information is set at the header and/or tail of the first data, and is used to perform integrity and/or consistency verification on the first data.
The method as claimed in claim 2 is characterized in that the flash file consists of description information and module data, the description information includes first description information of the first data, the first description information is used to describe the relationship between the first data and the first functional module, and the module data includes the first data.
The method as described in any one of claims 2 to 5 is characterized in that the flash file also includes second verification information, and the second verification information is set at the header and/or tail of the flash file, and is used to perform integrity and/or consistency verification on the flash file.
The method according to any one of claims 1 to 6, characterized in that the storage area further includes a third storage partition, the third storage partition is used to store data of a third program of a second functional module, the second functional module is a newly added functional module of the first software, and the method further includes:

When the third storage partition detects data of the third program, the second functional module is controlled to run the third program.
The method according to any one of claims 1 to 7, characterized in that the first functional module includes a first function and a second function, the interface address of the first function is associated with the first storage partition, the interface address of the second function is associated with the second storage partition, and the controlling the first functional module to run the second program comprises:

The first functional module is controlled to change from scheduling the interface address of the first function to scheduling the interface address of the second function, and the second program in the second storage partition is run through the interface address of the second function.
The method as claimed in claim 8, characterized in that the address of the data of the second program in the second storage partition is a preset fixed address, the storage area includes a fourth storage partition, and the fourth storage partition is used to store the fixed address;

Before controlling the first functional module to change the interface address for scheduling the first function to the interface address for scheduling the second function, the method further includes:

It is determined that the interface address of the second function is consistent with the fixed address in the fourth storage partition.
The method according to any one of claims 1 to 9, characterized in that the data of the second program includes functional data and configuration data, and before controlling the first functional module to run the second program, the method further comprises:

The configuration data and the functional function data are respectively checked for integrity and/or consistency.
The method according to any one of claims 1 to 10, characterized in that the method further comprises:

Control erasing data of the first program in the first storage partition.
The method according to any one of claims 1 to 11, characterized in that the storage area further includes a fifth storage partition, the fifth storage partition is used to store identification information of the first functional module, the identification information is used to indicate that data associated with the update of the first functional module is written to the second storage partition, and when the data of the second program of the second storage partition is detected, controlling the first functional module to run the second program comprises:

When the data in the second storage partition and the identification information of the first functional module in the fifth storage partition are detected, the first functional module is controlled to run the second program of the second storage partition.
A device for updating software, comprising:

a detection unit, configured to detect the second storage partition when controlling a first function module to run a first program of a first storage partition, wherein the first function module is a function module of a first software of a controller, and a storage area of the controller includes the first storage partition and the second storage partition;

A processing unit is used to control the first functional module to run the second program when the detection unit detects the data of the second program in the second storage partition, wherein the data of the second program includes data associated with the update of the first functional module.
The device as described in claim 13 is characterized in that the data of the second program comes from a flash file, and the flash file includes first data and information about the first data, and the information is used to indicate the start and/or end of the first data; wherein the first data is any data of the program data of M functional modules of the first software, and the M functional modules include the first functional module, and M is an integer greater than or equal to 1.
The device as described in claim 14 is characterized in that the flash file is composed of M module data, the M module data correspond one-to-one to the M functional modules, the M module data include first module data, the first module data includes the first data and first description information of the first data, and the first description information is used to describe the relationship between the first data and the first functional module.
The device as described in claim 15 is characterized in that the first description information also includes first verification information, and the first verification information is set at the header and/or tail of the first data, and is used to perform integrity and/or consistency verification on the first data.
The device as described in claim 14 is characterized in that the flash file consists of description information and module data, the description information includes first description information of the first data, the first description information is used to describe the relationship between the first data and the first functional module, and the module data includes the first data.
The device as described in any one of claims 14 to 17 is characterized in that the flash file also includes second verification information, which is set at the header and/or tail of the flash file and is used to perform integrity and/or consistency verification on the flash file.
The device according to any one of claims 13 to 18, characterized in that the storage area further includes a third storage partition, the third storage partition is used to store data of a third program of a second functional module, the second functional module is a newly added functional module of the first software, and the processing unit is further used to:

When the detection unit detects the data of the third program in the third storage partition, the second functional module is controlled to run the third program.
The device according to any one of claims 13 to 19, characterized in that the first functional module includes a first function and a second function, the interface address of the first function is associated with the first storage partition, the interface address of the second function is associated with the second storage partition, and the processing unit is used to:

The first functional module is controlled to change from scheduling the interface address of the first function to scheduling the interface address of the second function, and the second program in the second storage partition is run through the interface address of the second function.
The device as claimed in claim 20, characterized in that the address of the data of the second program in the second storage partition is a preset fixed address, and the storage area includes a fourth storage partition, and the fourth storage partition is used to store the fixed address;

Before controlling the first functional module to change the interface address for scheduling the first function to the interface address for scheduling the second function, the processing unit is further configured to:

It is determined that the interface address of the second function is consistent with the fixed address in the fourth storage partition.
The device according to any one of claims 13 to 21, characterized in that the data of the second program includes functional data and configuration data, and before the controlling the first functional module to run the second program, the processing unit is further used to:

The configuration data and the functional function data are respectively checked for integrity and/or consistency.
The device according to any one of claims 13 to 22, characterized in that the processing unit is further used for:

Control erasing data of the first program in the first storage partition.
The device according to any one of claims 13 to 23, characterized in that the storage area further includes a fifth storage partition, the fifth storage partition is used to store identification information of the first functional module, the identification information is used to indicate that data associated with the update of the first functional module is written in the second storage partition, and the processing unit is used to:

When the detection unit detects the data in the second storage partition and the identification information of the first functional module in the fifth storage partition, the first functional module is controlled to run the second program of the second storage partition.
A device for updating software, characterized by comprising:

Memory for storing computer programs;

A processor, configured to execute the computer program stored in the memory, so that the apparatus performs the method according to any one of claims 1 to 12.
A smart device, characterized by comprising the apparatus as described in any one of claims 13 to 25.
The smart device as described in claim 26 is characterized in that the smart device is a vehicle.
A computer-readable storage medium, characterized in that instructions are stored thereon, and when the instructions are executed by a processor, the processor implements the method as claimed in any one of claims 1 to 12.
A chip, characterized in that the chip comprises a circuit, and the circuit is used to execute the method according to any one of claims 1 to 12.
A computer program product, characterized in that the computer program product comprises: computer program code, when the computer program code is run on a computer, the computer executes the method as described in any one of claims 1 to 12.