WO2024108456A1 - 一种控制器升级方法以及装置 - Google Patents
一种控制器升级方法以及装置 Download PDFInfo
- Publication number
- WO2024108456A1 WO2024108456A1 PCT/CN2022/133870 CN2022133870W WO2024108456A1 WO 2024108456 A1 WO2024108456 A1 WO 2024108456A1 CN 2022133870 W CN2022133870 W CN 2022133870W WO 2024108456 A1 WO2024108456 A1 WO 2024108456A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- storage area
- program
- upgrade
- address
- controller
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 103
- 238000003860 storage Methods 0.000 claims abstract description 483
- 238000012545 processing Methods 0.000 claims description 38
- 238000004891 communication Methods 0.000 claims description 34
- 238000012795 verification Methods 0.000 claims description 26
- 230000001960 triggered effect Effects 0.000 claims description 11
- 238000004590 computer program Methods 0.000 claims description 9
- 230000008569 process Effects 0.000 abstract description 15
- 230000006870 function Effects 0.000 description 18
- 238000010586 diagram Methods 0.000 description 14
- 230000004044 response Effects 0.000 description 11
- 230000009977 dual effect Effects 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 4
- 230000002093 peripheral effect Effects 0.000 description 4
- 101100012902 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) FIG2 gene Proteins 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000005520 cutting process Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 230000018109 developmental process Effects 0.000 description 3
- 238000003745 diagnosis Methods 0.000 description 3
- 230000008672 reprogramming Effects 0.000 description 3
- 101100233916 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) KAR5 gene Proteins 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 2
- VIEYMVWPECAOCY-UHFFFAOYSA-N 7-amino-4-(chloromethyl)chromen-2-one Chemical compound ClCC1=CC(=O)OC2=CC(N)=CC=C21 VIEYMVWPECAOCY-UHFFFAOYSA-N 0.000 description 1
- 101001121408 Homo sapiens L-amino-acid oxidase Proteins 0.000 description 1
- 101000827703 Homo sapiens Polyphosphoinositide phosphatase Proteins 0.000 description 1
- 102100026388 L-amino-acid oxidase Human genes 0.000 description 1
- 102100023591 Polyphosphoinositide phosphatase Human genes 0.000 description 1
- 230000003044 adaptive effect Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009191 jumping Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 238000004092 self-diagnosis Methods 0.000 description 1
- 238000007493 shaping process Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L27/00—Modulated-carrier systems
Definitions
- the present application relates to the field of automobile diagnostic information technology, and in particular to a controller upgrading method and device.
- the boot loader (BL) program is the system's boot loader and is the first code to run after the system is powered on or reset. Its main functions include initialization, security verification and loading of applications.
- the BL program also has a unified diagnosis service (UDS) flash function to update the application program (APP) in BL program mode.
- UDS unified diagnosis service
- the current dual backup controller will back up the APP, and the APP can be upgraded while running in APP mode.
- the BL program can also be upgraded in APP mode, the BL program is responsible for the basic startup initialization and APP loading functions. When upgrading the BL program, it is easily affected by power outages and becomes bricked, and it cannot be reliably upgraded remotely.
- the present application provides a controller upgrade method and device for improving the success rate of remote upgrade.
- a first aspect of the present application provides a controller upgrade method, the controller comprising a first storage area and a second storage area, wherein a boot loader (BL) program is respectively stored in the first storage area and the second storage area, the method comprising: obtaining an upgrade file, wherein the upgrade file comprises a BL program upgrade package; upgrading a BL program in the first storage area according to the BL program upgrade package, wherein the first storage area is a backup storage area, and the second storage area is a running storage area; when the BL program in the first storage area is successfully upgraded, setting the first storage area as a running storage area, and setting the second storage area as a backup storage area.
- BL boot loader
- the BL program is first upgraded in the first storage area of the controller as a backup storage area through the BL program upgrade package in the upgrade file. After the upgrade is successful, the first storage area is set as the running storage area, and the second storage area is set as the backup area.
- the BL program in another storage area can be used to provide services, avoiding power outages during the BL program upgrade process that may cause the controller to become bricked, thereby improving the success rate of remote upgrades.
- the method further includes: upgrading the BL program in the second storage area according to the BL program upgrade package.
- the BL program of the second storage area currently used as the backup area can continue to be upgraded.
- the second storage area with the latest BL program can be switched to run, thereby improving the user experience.
- the method before the above-mentioned steps upgrade the BL program in the first storage area according to the BL program upgrade package, the method further includes: receiving a version number acquisition request from a host computer; sending the bottom soft version number of the application APP in the first storage area to the host computer according to the version number acquisition request; when the bottom soft version number belongs to a blacklist, receiving an instruction from the host computer, the blacklist includes a version number corresponding to which the BL program cannot be upgraded, and the instruction instructs the APP in the first storage area to be upgraded before the BL program in the first storage area.
- the host computer can read the bottom soft version number of the APP in the storage area in the controller through the version number acquisition request, and the controller can feedback the bottom soft version number of the APP in the first storage area or the second storage area to the host computer.
- the host computer matches that the bottom soft version number belongs to the blacklist, it means that the BL program in the storage area cannot be upgraded under the APP of the current bottom soft version number, so it is necessary to instruct the controller through instructions to upgrade the APP in the storage area first, and then upgrade the BL program in the storage area, which can improve the success rate of the BL program upgrade.
- the upgrade file also includes an APP upgrade package and/or a calibration Cal file upgrade package.
- the method also includes: upgrading the APP in the first storage area according to the APP upgrade package; and/or, upgrading the Cal file in the first storage area according to the Cal file.
- the upgrade file may also include an APP upgrade package and/or a Cal file upgrade package, that is, the upgrade file may include an APP upgrade package, or include a Cal file upgrade package, or may include both an APP upgrade package and a Cal file upgrade package, which is not limited here.
- the controller before switching the first storage area from the backup storage area to the running storage area, the controller also needs to upgrade the APP in the first storage area and/or the Cal file in the first storage area, that is, the APP upgrade package covers the storage address of the APP in the first storage area, and the Cal file upgrade package covers the storage address of the Cal file in the first storage area, so as to improve the matching degree of the program version.
- the upgrade file includes an upgrade address
- the above steps of upgrading the BL program in the first storage area according to the BL program upgrade package include: determining a first erase address according to the upgrade address, the first erase address being an address for erasing the BL in the first storage area; verifying whether the first erase address is in the address space where the BL program in the first storage area is located; when the verification passes, erasing the content on the first erase address; and storing the data of the BL program upgrade package at the first erase address.
- the controller when the controller upgrades the BL program in the first storage area according to the BL program upgrade package in the upgrade file, the controller can parse the upgrade address from the upgrade file, wherein the upgrade address can include the erase address corresponding to the BL program upgrade package. Since the storage area of the controller is divided into a first storage area and a second storage area, when the BL program in the first storage area needs to be upgraded, the first erase address of the BL program in the first storage area can be determined according to the erase address. At this time, the controller can verify the first erase address to verify whether the first erase address is in the address space allocated for the BL program in the first storage area.
- the first erase address is incorrect, and a negative response can be fed back to the upper computer. If the first erase address is in the address space, it means that the first erase address is valid, and the data on the first erase address can be directly erased, and then the data of the BL program upgrade package is stored in the erased first erase address to complete the upgrade of the BL program in the first storage area. By verifying the erase address through the allocated address space, the upgrade effect of the BL program is guaranteed and the success rate of the BL program upgrade is improved.
- the above steps of upgrading the BL program in the second storage area according to the BL program upgrade package include: determining a second erase address according to the upgrade address, the second erase address being an address for erasing the BL program in the second storage area; verifying whether the second erase address is in the address space where the BL program in the second storage area is located; when the verification passes, erasing the content on the second erase address; and storing the data of the BL program upgrade software package at the second erase address.
- the controller can also determine the second erase address for erasing the BL program in the second storage area according to the upgrade address in the upgrade file.
- the upgrade address may include the erase address corresponding to the BL program upgrade package. Since the storage area of the controller is divided into a first storage area and a second storage area, when the BL program in the second storage area needs to be upgraded, the second erase address for the BL program in the second storage area can be determined according to the erase address. At this time, the controller can verify the second erase address to verify whether the second erase address is in the address space allocated for the BL program in the second storage area. If it is not in the address space, it means that the second erase address is incorrect, and a negative response can be fed back to the upper computer.
- the second erase address is in the address space, it means that the second erase address is valid, and the data on the second erase address can be directly erased, and then the data of the BL program upgrade package is stored in the erased second erase address to complete the upgrade of the BL program in the second storage area.
- the upgrade effect of the BL program is guaranteed and the success rate of the BL program upgrade is improved.
- the method further includes: verifying whether a hash value of the BL program in the first storage area and a hash value of the BL program in the second storage area are the same; if they are the same, triggering the step of setting the first storage area as the running storage area and the second storage area as the backup storage area; if they are different, verifying the integrity of the BL program in the first storage area; and if the verification is successful, exchanging the secure boot setting values of the first storage area and the second storage area, and triggering the step of setting the first storage area as the running storage area and the second storage area as the backup storage area.
- the controller also needs to detect whether the BL program in the first storage area has completed the upgrade, and can detect whether the BL program in the first storage area is the same as the BL program in the second storage area, such as by verifying whether the hash value of the BL program in the first storage area and the hash value of the BL program in the second storage area are the same, that is, comparing whether the binary of the BL program in the first storage area is the same as the binary of the BL program in the second storage area.
- the controller can be triggered to set the first storage area as the running storage area and the second storage area as the backup storage area.
- the controller can also verify the integrity of the BL program in the first storage area. When the verification fails, that is, the integrity is insufficient, the BL program of the first storage area can be re-flashed, or a negative response can be fed back to the upper computer.
- the safety startup setting value is the verification basis for selecting the startup storage area when the controller is reset, that is, the safety startup setting value of the first storage area is switched to the preferred value, and after the reset, the controller can use the first storage area as the running storage area to complete the steps of setting the first storage area as the running storage area and setting the second storage area as the backup storage area.
- the method further includes: verifying whether a hash value of the BL program in the first storage area and a hash value of the BL program in the second storage area are the same; when they are different, triggering a step of upgrading the BL program in the second storage area according to the BL program upgrade package.
- the step of upgrading the BL program in the second storage area according to the BL program upgrade package can be performed again.
- the method further includes: executing a post-programming phase, where the post-programming phase is used to restore the local communication state.
- the controller and the host computer can also execute the post-programming stage, the controller makes the controller software effective by resetting, responds to the service instruction of the host computer, completes the necessary reset work, reopens the communication between the controller and the host computer, and starts controlling the diagnostic trouble code (DTC), clearing the DTC, and jumping the diagnostic session to restore the communication status of the controller, so that the controller can be used normally, restore the traffic status in time, and improve the user experience.
- DTC diagnostic trouble code
- a second aspect of the present application provides a controller upgrade method, the controller comprising a first storage area and a second storage area, wherein a boot loader BL program is respectively stored in the first storage area and the second storage area, the method comprising: sending a version number acquisition request to the controller, the version number acquisition request being used to read a bottom soft version number of an application APP in the first storage area; receiving the bottom soft version number from the controller; when the bottom soft version number belongs to a blacklist, sending an instruction to the controller, the blacklist including a version number corresponding to which the BL program cannot be upgraded, the instruction instructing the APP in the first storage area to be upgraded before the BL program in the first storage area.
- the host computer can read the bottom soft version number of the APP in the storage area of the controller through the version number acquisition request, and the controller can feedback the bottom soft version number of the APP in the first storage area or the second storage area to the host computer.
- the host computer matches that the bottom soft version number belongs to the blacklist, it means that the BL program in the storage area cannot be upgraded under the APP of the current bottom soft version number, so it is necessary to instruct the controller through instructions to upgrade the APP in the storage area first, and then upgrade the BL program in the storage area, which can improve the success rate of the BL program upgrade.
- the method further includes: executing a post-programming phase, where the post-programming phase is used to restore a local communication state.
- the third aspect of the present application provides a controller upgrade device, which can implement the method in the first aspect or any possible implementation of the first aspect.
- the device includes corresponding units or modules for executing the above method.
- the units or modules included in the device can be implemented by software and/or hardware.
- the device can be, for example, a network device, or a chip, a chip system, or a processor that supports the network device to implement the above method, or a logic module or software that can implement all or part of the network device functions.
- a controller upgrade device which can implement the method in the second aspect or any possible implementation of the second aspect.
- the device includes a corresponding unit or module for executing the above method.
- the unit or module included in the device can be implemented by software and/or hardware.
- the device can be, for example, a network device, or a chip, a chip system, or a processor that supports the network device to implement the above method, or a logic module or software that can implement all or part of the network device functions.
- the present application provides a computer device, including: a processor, the processor is coupled to a memory, the memory is used to store instructions, and when the instructions are executed by the processor, the computer device implements the method in the first aspect or any possible implementation of the first aspect.
- the computer device may be, for example, a network device, or a chip or chip system that supports the network device to implement the above method.
- the present application provides a computer device, including: a processor, the processor is coupled to a memory, the memory is used to store instructions, and when the instructions are executed by the processor, the computer device implements the method in the second aspect or any possible implementation of the second aspect.
- the computer device may be, for example, a network device, or a chip or chip system that supports the network device to implement the above method.
- the seventh aspect of the present application provides a computer-readable storage medium, which stores instructions.
- the instructions are executed by a processor, the method provided by the first aspect or any possible implementation of the first aspect, the second method or any possible implementation of the second method is implemented.
- the present application provides a computer program product, which includes a computer program code.
- the computer program code When executed on a computer, it implements the method provided by the first aspect or any possible implementation method of the first aspect, the second method or any possible implementation method of the second method.
- FIG1 is a system architecture diagram of a communication transmission provided by an embodiment of the present application.
- FIG2 is a schematic diagram of a flow chart of a controller upgrade method provided in an embodiment of the present application.
- FIG3 is a schematic diagram of a flow chart of a pre-programming step provided in an embodiment of the present application.
- FIG4 is a schematic diagram of a flow chart of a reprogramming step provided in an embodiment of the present application.
- FIG5 is a schematic flow chart of a section cutting operation step provided in an embodiment of the present application.
- FIG6 is a schematic diagram of an exchange of secure startup setting values provided in an embodiment of the present application.
- FIG7 is a schematic diagram of the overall flow of a controller upgrade BL program provided in an embodiment of the present application.
- FIG8 is a schematic diagram of the structure of a controller upgrading device provided in an embodiment of the present application.
- FIG9 is a schematic diagram of the structure of another controller upgrading device provided in an embodiment of the present application.
- FIG10 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application.
- FIG. 11 is a schematic diagram of the structure of another computer device provided in an embodiment of the present application.
- the embodiments of the present application provide a node upgrade method and device for reducing the workload of a host computer and slave nodes, thereby saving R&D and production costs.
- ECU Electronic control unit
- ECU is also known as driving computer, on-board computer, etc.
- it is a car-specific microcomputer controller, also called a car-specific single-chip microcomputer.
- MCU microprocessor
- read-only memory read-only memory
- RAM random access memory
- I/O input/output interface
- A/D analog-to-digital converter
- large-scale integrated circuits such as shaping and driving.
- the central processing unit is the core part, which has the functions of calculation and control. For example, when the engine is running, it collects signals from various sensors for calculation, and converts the results of the calculation into control signals to control the operation of the controlled object; it also implements the control of memory (such as ROM), I/O and other external circuits.
- ECU generally has fault self-diagnosis and protection functions. When the system fails, it can automatically record the fault code in RAM and use protection measures to read the replacement program from the inherent program to maintain the operation of the corresponding component (such as the engine). At the same time, these fault information will be displayed on the dashboard and remain unchanged, so that the owner can find the problem in time and drive the car to the repair shop. Under normal circumstances, RAM will also continuously record the data of the car during driving, and learn the real-time recorded data through adaptive programs to provide the best control state to adapt to the driving habits of the owner.
- ECUs have a relatively simple structure. There may be dozens or even hundreds of ECUs on a vehicle, such as the ECU used on the engine and the ECU used on the anti-lock braking system. The functions of each ECU are relatively independent. With the development of digital cars, especially autonomous driving technology, the ECUs on cars are becoming increasingly complex and tend to be concentrated on a super ECU. As a result, the difficulty of ECU diagnosis is also increasing.
- the host computer refers to a computer device that can directly issue control commands.
- any computer device that can communicate with the ECU based on the UDS protocol can be called a host computer (also called a diagnostic instrument, diagnostic machine, diagnostic tool, etc.).
- a host computer also called a diagnostic instrument, diagnostic machine, diagnostic tool, etc.
- PC personal computers
- mobile phones mobile phones
- tablet computers and other smart handheld terminal devices as well as smart wearable devices
- smart bracelets and smart watches and even single-chip microcomputers, as long as the device can run the corresponding diagnostic software and can communicate with the ECU based on the UDS protocol
- the specific details are not limited here.
- UDS International Organization for Standardization
- ISO International Organization for Standardization
- UDS is a universal automotive diagnostic protocol that is independent of the data link.
- OSI open system interconnection
- CAN controller area network
- LIN local interconnect network
- Flexray Ethernet
- K-line K-line
- the communication system includes an over-the-air technology (OTA) server 101 and a dual backup controller 102, wherein the dual backup controller 102 includes a CAN/Ethernet communication module 1021, a flash driver (FlashDriver) module 1022, a flash storage area 1023, and a central processing unit (CPU) unit 1024.
- OTA over-the-air technology
- flashDriver flash driver
- CPU central processing unit
- the OTA server remotely manages the software through the mobile communication interface.
- the remote OTA server 101 transmits the upgrade instruction to the controller through the CAN/Ethernet communication module 1021 via the intermediate forwarding node 103 for upgrading.
- the Flash storage area 1023 includes area A and area B, wherein area A and area B respectively store the boot loader (BootLoader, BL), application program (application program, APP), and calibration (calibration, Cal) files.
- boot loader BitLoader
- application program application program, APP
- calibration calibration, Cal
- the above OTA server is the host computer of this application.
- BL is the system's boot loader, which is the first code to run after the system is powered on or reset. Its main functions include initialization, security verification and loading of applications.
- BL also has a unified diagnostic service (UDS) flash function to update the application program (APP) in BL mode.
- UDS unified diagnostic service
- APP application program
- the current dual backup controller will back up the APP, and the APP can be upgraded while running in APP mode.
- the BL can also be upgraded in APP mode, the BL is responsible for the basic startup initialization and APP loading functions. When upgrading the BL, it is easily affected by power outages and becomes bricked, and cannot be reliably upgraded remotely.
- an embodiment of the present application provides a controller upgrade method, which is described as follows.
- FIG. 2 is a flow chart of a controller upgrade method provided by an embodiment of the present application.
- the method includes:
- Step 201 The controller obtains an upgrade file, which includes a BL program upgrade package.
- the upgrade file is provided by the OTA server.
- the OTA server wants to upgrade the BL program of the controller, it can send the upgrade file carrying the BL program upgrade package to the controller.
- the controller can receive the upgrade file from the OTA server.
- the host computer When the host computer determines that the ECU program of the target vehicle needs to be upgraded, it can first query the information of the controller of the target vehicle through the version query instruction, which includes the version information of the APP, and then select the version that matches the other ECU versions of the target vehicle when selecting the APP version of the controller.
- the host computer can package the various upgrade software packages of the controller into a total upgrade file, where the upgrade file includes the BL program upgrade software package, and then enter the host computer upgrade process, that is, the host computer sends the upgrade file to the controller.
- Step 202 The controller upgrades the BL program in the first storage area according to the BL program upgrade package, the first storage area is a backup storage area, and the second storage area is a running storage area.
- the storage area of the controller can be multiple storage areas, one of which is a running storage area, and the other storage areas are backup storage areas.
- Each storage area stores a BL program.
- the embodiment of the present application takes two storage areas as an example.
- the controller currently uses the BL program in the second storage area as the running storage area to provide BL program services.
- the controller can first upgrade the BL program in the first storage area as the backup storage area, that is, the BL program upgrade package overwrites the storage address of the BL program in the first storage area.
- the controller before the controller upgrades the BL program in the first storage area according to the BL program upgrade package, in a pre-programming step, it is also necessary to receive a version number acquisition request from a host computer, and send the bottom soft version number of the application APP in the first storage area to the host computer according to the version number acquisition request; when the bottom soft version number belongs to a blacklist, an instruction from the host computer is received, the blacklist includes version numbers corresponding to which the BL program cannot be upgraded, and the instruction instructs the APP in the first storage area to be upgraded before the BL program in the first storage area.
- the host computer can read the bottom soft version number of the APP in the storage area in the controller through the version number acquisition request, and the controller can feedback the bottom soft version number of the APP in the first storage area or the second storage area to the host computer. If the host computer matches that the bottom soft version number belongs to the blacklist, it means that the BL program in the storage area cannot be upgraded under the APP with the current bottom soft version number, so it is necessary to instruct the controller through instructions to upgrade the APP in the storage area first, and then upgrade the BL program in the storage area.
- step 301 Entering the extended session ($10$03); step 302.
- Pre-programming condition check ($31); step 303.
- step 303 Turning off the control diagnostic trouble code (DTC) ($85$02); step 304.
- step 304 Turning off the communication ($28); step 305.
- Reading the bottom soft version number ($22$F1FF).
- the controller turns off the DTC and communication to avoid communication errors and DTC errors.
- the upgrade file may also include an APP upgrade package and/or a Cal file upgrade package, that is, the upgrade file may include an APP upgrade package, or include a Cal file upgrade package, or may include both an APP upgrade package and a Cal file upgrade package, which is not limited here.
- the controller before switching the first storage area from the backup storage area to the running storage area, the controller also needs to upgrade the APP in the first storage area and/or the Cal file in the first storage area, that is, the APP upgrade package covers the storage address of the APP in the first storage area, and the Cal file upgrade package covers the storage address of the Cal file in the first storage area.
- the controller can parse the upgrade address from the upgrade file, wherein the upgrade address can include the erase address corresponding to the BL program upgrade package. Since the storage area of the controller is divided into a first storage area and a second storage area, when the BL program in the first storage area needs to be upgraded, the first erase address of the BL program in the first storage area can be determined according to the erase address. At this time, the controller can verify the first erase address to verify whether the first erase address is within the address space allocated for the BL program in the first storage area. If it is not within the address space, it means that the first erase address is incorrect, and a negative response can be fed back to the upper computer.
- the first erase address is within the address space, it means that the first erase address is valid, and the data on the first erase address can be directly erased, and then the data of the BL program upgrade package is stored in the erased first erase address to complete the upgrade of the BL program in the first storage area.
- Step 203 When the BL program in the first storage area is successfully upgraded, the controller sets the first storage area as the running storage area, and sets the second storage area as the backup storage area.
- the currently running storage area can be switched to the first storage area with the upgraded BL program to provide better service.
- the first storage area is the running storage area and the second storage area is the backup storage area.
- the controller Before executing step 203, the controller also needs to detect whether the BL program in the first storage area has been upgraded. It can detect whether the BL program in the first storage area is the same as the BL program in the second storage area, such as by checking whether the hash value of the BL program in the first storage area is the same as the hash value of the BL program in the second storage area, that is, comparing whether the binary of the BL program in the first storage area is the same as the binary of the BL program in the second storage area. When the binary of the BL program in the first storage area is the same as the hash value of the BL program in the second storage area, the controller can be triggered to set the first storage area as the running storage area and the second storage area as the backup storage area.
- the controller can also verify the integrity of the BL program in the first storage area. When the verification fails, that is, the integrity is insufficient, the BL program of the first storage area can be re-flashed, or a negative response can be fed back to the upper computer.
- the controller can use the first storage area as the running storage area to complete the steps of setting the first storage area as the running storage area and setting the second storage area as the backup storage area.
- the embodiment of the present application modifies the execution method of erasing memory in the reprogramming stage, and adds a zone cutting operation.
- the process of the reprogramming stage is shown in Figure 4, step 401. Enter programming session ($10$02); step 402. Security unlock ($27); step 403. Write fingerprint ($2E$F184); step 404. Download flash driver (FlashDriver); step 405. Erase the memory of the first storage area ($31$01$FF00); step 406. Download BL program/APP/Cal file; step 407. Determine whether all bytes have been downloaded, if yes, execute step 408, otherwise execute step 405; step 408. Programming dependency check; step 409. Zone cutting operation.
- step 501 Calculate the hash value of the BL program in the first storage area and the hash value of the BL program in the second storage area; step 502. Compare whether the two hash values are inconsistent, if yes, execute step 503, otherwise execute step 511; step 503. Verify the integrity of the BL program in the first storage area; step 504. Determine whether the verification is passed, if yes, execute step 505, otherwise execute step 510; step 505. Exchange the security startup setting values of the first storage area and the second storage area; step 506. Determine whether the exchange is successful, if yes, execute step 507, otherwise execute step 510; step 507.
- UMB user configuration block
- the original secure boot setting value of the second storage area is entry1
- the secure boot setting value of the first storage area is entry12.
- the secure boot setting value of the second storage area is entry12
- the secure boot setting value of the first storage area is entry1. Then, each subsequent time the controller is started, entry1 will be firstly checked for startup, and if the check passes, the first storage area will be used for startup.
- the BL program in the second storage area currently used as the backup area can be continuously upgraded.
- the second storage area with the latest BL program can be switched to run, thereby improving user experience.
- the controller can also determine the second erase address for erasing the BL program in the second storage area according to the upgrade address in the upgrade file.
- the upgrade address may include the erase address corresponding to the BL program upgrade package. Since the storage area of the controller is divided into a first storage area and a second storage area, when the BL program in the second storage area needs to be upgraded, the second erase address for the BL program in the second storage area can be determined according to the erase address. At this time, the controller can verify the second erase address to verify whether the second erase address is within the address space allocated for the BL program in the second storage area. If it is not within the address space, it means that the second erase address is incorrect, and a negative response can be fed back to the upper computer.
- the second erase address is within the address space, it means that the second erase address is valid, and the data on the second erase address can be directly erased, and then the data of the BL program upgrade package is stored in the erased second erase address to complete the upgrade of the BL program in the second storage area.
- the process of the controller upgrading the BL program in the second storage area can also refer to the process in FIG. 4 , which will not be described in detail here.
- the BL program in the second storage area After the BL program in the second storage area is upgraded, it is also possible to verify whether the hash value of the BL program in the first storage area is the same as the hash value of the BL program in the second storage area, that is, to determine whether the BL program in the second storage area is upgraded successfully.
- the verification fails, that is, the hash value of the BL program in the first storage area is different from the hash value of the BL program in the second storage area, it means that the BL program in the second storage area has failed to be upgraded and needs to be upgraded again.
- the step of upgrading the BL program in the second storage area according to the BL program upgrade package can be executed again.
- the controller and the host computer can also execute the post-programming stage.
- the controller makes the controller software effective by resetting, responds to the service instructions of the host computer, completes the necessary reset work, reopens the communication between the controller and the host computer, and turns on DTC, clears DTC, and jumps the diagnostic session to restore the communication status of the controller so that the controller can be used normally.
- the overall flow chart of the controller upgrading the BL program in the embodiment of the present application can be shown in Figure 7, step 701.
- the controller obtains the upgrade file; step 702.
- the controller upgrades the BL program, APP and Cal files in the first storage area; step 703. Detect whether the first storage area is upgraded successfully, if yes, execute step 705, otherwise execute step 704; step 704:
- the controller stays in the second storage area to run and re-upgrades the program in the first storage area; step 705.
- the controller switches the running storage area to the first storage area; step 706.
- the controller upgrades the BL program in the second storage area; step 707. Detect whether the BL program in the second storage area is upgraded successfully, if yes, execute step 708, otherwise execute step 706; step 708.
- the BL program is first upgraded in the first storage area of the controller as a backup storage area through the BL program upgrade package in the upgrade file. After the upgrade is successful, the first storage area is set as the running storage area, and the second storage area is set as the backup storage area.
- the BL program in another storage area can be used to provide services, thereby avoiding power failure during the BL program upgrade process that may cause the controller to become bricked, thereby improving the success rate of remote upgrades.
- the controller upgrade method is described above, and the device for executing the method is described below.
- the controller includes a first storage area and a second storage area.
- the first storage area and the second storage area respectively store a boot loader BL program.
- the device 80 includes:
- the processing unit 801 is used to obtain an upgrade file, where the upgrade file includes a BL program upgrade package, and upgrade the BL program in the first storage area according to the BL program upgrade package, where the first storage area is a backup storage area, and the second storage area is a running storage area.
- the first storage area is set as the running storage area
- the second storage area is set as the backup storage area.
- the processing unit 801 is used to execute steps 201 to 203 in the method embodiment of FIG. 2 .
- processing unit 801 is further configured to: upgrade the BL program in the second storage area according to the BL program upgrade package.
- the device 80 further includes a transceiver unit 802, and the transceiver unit 802 is specifically configured to:
- the blacklist includes the version number corresponding to which the BL program cannot be upgraded, and the instruction instructs the APP in the first storage area to be upgraded before the BL program in the first storage area.
- the upgrade file also includes an APP upgrade package and/or a calibration Cal file upgrade package, and the processing unit 801 is further used to:
- the Cal file in the first storage area is updated according to the Cal file.
- the upgrade file includes an upgrade address
- the processing unit 801 is specifically configured to:
- the first erasing address is an address for erasing the BL of the first storage area
- the data of the BL program upgrade package is stored in the first erasing address.
- processing unit 801 is specifically configured to:
- the data of the BL program upgrade software package is stored in the second erase address.
- processing unit 801 is further configured to:
- the secure boot setting values of the first storage area and the second storage area are exchanged, and the step of setting the first storage area as the running storage area and setting the second storage area as the backup storage area is triggered.
- processing unit 801 is further configured to:
- processing unit 801 is further configured to:
- the post-programming phase is executed, and the post-programming phase is used to restore the local communication status.
- FIG. 9 another controller upgrade device provided by an embodiment of the present application is shown.
- the controller includes a first storage area and a second storage area.
- the first storage area and the second storage area respectively store a boot loader BL program.
- the device 90 includes:
- the transceiver unit 901 is used to send a version number acquisition request to the controller, the version number acquisition request is used to read the bottom soft version number of the application APP in the first storage area, receive the bottom soft version number from the controller, and when the bottom soft version number belongs to the blacklist, send an instruction to the controller, the blacklist includes the version number corresponding to the BL program that cannot be upgraded, and the instruction instructs the APP in the first storage area to be upgraded before the BL program in the first storage area.
- the device 90 further includes a processing unit 902, and the processing unit 902 is specifically configured to:
- the post-programming phase is executed, and the post-programming phase is used to restore the local communication status.
- FIG10 shows a possible logical structure diagram of a computer device 100 provided in an embodiment of the present application.
- the computer device 100 includes: a processor 1001, a communication interface 1002, a storage system 1003 and a bus 1004.
- the processor 1001, the communication interface 1002 and the storage system 1003 are interconnected via the bus 1004.
- the processor 1001 is used to control and manage the actions of the computer device 100.
- the processor 1001 is used to execute the steps performed by the controller in the method embodiment of FIG2.
- the communication interface 1002 is used to support the computer device 100 to communicate.
- the storage system 1003 is used to store program codes and data of the computer device 100.
- the processor 1001 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application.
- the processor 1001 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.
- the bus 1004 can be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, etc.
- PCI peripheral component interconnect standard
- EISA Extended Industry Standard Architecture
- the bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in FIG. 10, but it does not mean that there is only one bus or
- the transceiver unit 802 in the apparatus 80 is equivalent to the communication interface 1002 in the computer device 100
- the processing unit 801 in the apparatus 80 is equivalent to the processor 1001 in the computer device 100 .
- the computer device 100 of this embodiment may correspond to the controller in the method embodiment of FIG. 2 .
- the communication interface 1002 in the computer device 100 may implement the functions and/or various steps of the controller in the method embodiment of FIG. 2 . For the sake of brevity, they will not be described in detail here.
- the computer device 110 includes: a processor 1101, a communication interface 1102, a storage system 1103 and a bus 1104.
- the processor 1101, the communication interface 1102 and the storage system 1103 are interconnected via the bus 1104.
- the processor 1101 is used to control and manage the actions of the computer device 110.
- the processor 1101 is used to execute the steps performed by the host computer in the method embodiment of FIG2.
- the communication interface 1102 is used to support the computer device 110 to communicate.
- the storage system 1103 is used to store the program code and data of the computer device 110.
- the processor 1101 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application.
- the processor 1101 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.
- the bus 1104 can be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an extended industry standard architecture (Extended Industry Standard Architecture, EISA) bus, etc.
- PCI peripheral component interconnect standard
- EISA Extended Industry Standard Architecture
- the bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in Figure 11, but it does not mean that there is only one bus or one
- the transceiver unit 901 in the apparatus 90 is equivalent to the communication interface 1102 in the computer device 110
- the processing unit 902 in the apparatus 90 is equivalent to the processor 1101 in the computer device 110 .
- the computer device 110 of this embodiment may correspond to the host computer in the method embodiment of FIG. 2 .
- the communication interface 1102 in the computer device 110 may implement the functions and/or various steps of the host computer in the method embodiment of FIG. 2 . For the sake of brevity, they will not be described in detail here.
- each unit in the above device can be fully or partially integrated into one physical entity, or they can be physically separated.
- the units in the device can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some units can also be implemented in the form of software calling through processing elements, and some units can be implemented in the form of hardware.
- each unit can be a separately established processing element, or it can be integrated in a certain chip of the device.
- it can also be stored in the memory in the form of a program, and called and executed by a certain processing element of the device. The function of the unit.
- each step of the above method or each unit above can be implemented by an integrated logic circuit of hardware in the processor element or in the form of software calling through a processing element.
- the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuit forms.
- ASIC application specific integrated circuits
- DSP digital singnal processors
- FPGA field programmable gate arrays
- the unit in the device can be implemented in the form of a processing element scheduler
- the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call a program.
- CPU central processing unit
- these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).
- a computer-readable storage medium in which computer-executable instructions are stored.
- the processor of the device executes the computer-executable instructions
- the device executes the method executed by the main control node in the above method embodiment.
- a computer program product comprising computer executable instructions, the computer executable instructions being stored in a computer readable storage medium.
- the device executes the method executed by the main control node in the above method embodiment.
- the disclosed systems, devices and methods can be implemented in other ways.
- the device embodiments described above are only schematic.
- the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
- Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.
- the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
- each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
- the above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
- the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
- the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.
- the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Stored Programmes (AREA)
Abstract
一种控制器升级方法以及装置，该方法包括：控制器通过升级文件中的引导装载BL程序升级包先对控制器中作为备份存储区域的第一存储区域进行BL程序升级，升级成功后将第一存储区域设置为运行存储区域，将第二存储区域设置为备份区域，在升级一个存储区域的BL程序时，可以使用另一个存储区域的BL程序提供服务，避免BL程序升级过程断电导致控制器变砖，提高远程升级的成功率。
Description
本申请涉及汽车诊断信息技术领域，尤其涉及一种控制器升级方法以及装置。
随着整车电子电气架构的演进，新能源汽车上会有许多重要的电子控制单元。而绝大部分电子控制单元在启动时需要通过引导装载(BootLoader，BL)程序进行启动。BL程序是系统的引导加载程序，是系统上电或复位后运行的第一段代码，主要功能包括初始化，应用程序的安全校验和加载。对于非双备份控制器，BL程序还具备统一诊断服务(unified diagnosis service，UDS)刷写功能，在BL程序模式下更新应用程序(application program，APP)。当控制器量产后，加载在控制器中的程序可能存在错误，需要进行软件优化或漏洞(bug)修复。
当前双备份控制器会对APP进行备份，可以在APP模式下运行APP的同时升级APP。虽然从机制上APP模式下也可以升级BL程序，但是BL程序承担着基本的启动初始化和加载APP的功能，当升级BL程序时容易受断电影响导致变砖，无法可靠地远程升级。
发明内容
本申请提供了一种控制器升级方法以及装置，用于提高远程升级的成功率。
本申请第一方面提供了一种控制器升级方法，该控制器包括第一存储区域和第二存储区域，第一存储区域和第二存储区域中分别保存有引导装载(BootLoader，BL)程序，该方法包括：获取升级文件，升级文件包括BL程序升级包；根据BL程序升级包对第一存储区域的BL程序进行升级，第一存储区域为备份存储区域，第二存储区域为运行存储区域；当第一存储区域的BL程序升级成功时，将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域。
上述方面中，通过升级文件中的BL程序升级包先对控制器中作为备份存储区域的第一存储区域进行BL程序升级，升级成功后将第一存储区域设置为运行存储区域，将第二存储区域设置为备份区域，在升级一个存储区域的BL程序时，可以使用另一个存储区域的BL程序提供服务，避免BL程序升级过程断电导致控制器变砖，提高远程升级的成功率。
一种可能的实施方式中，在将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域之后，该方法还包括：根据BL程序升级包对第二存储区域的BL程序进行升级。
上述可能的实施方式中，在将第一存储区域切换为运行存储区域后，还可以继续将当前作为备份区域的第二存储区域的BL程序进行升级，在第一存储区域故障时，可以切换到有最新的BL程序的第二存储区域运行，提高用户体验。
一种可能的实施方式中，上述步骤根据BL程序升级包对第一存储区域的BL程序进行升级之前，该方法还包括：接收来自上位机的版本号获取请求；根据版本号获取请求向上位机发送第一存储区域的应用程序APP的底软版本号；当底软版本号属于黑名单时，接收 来自上位机的指令，黑名单包括BL程序无法升级对应的版本号，指令指示第一存储区域的APP在第一存储区域的BL程序之前升级。
上述可能的实施方式中，由于存储区域的BL程序升级有时候受该存储区域的APP的版本影响，即存在BL程序无法升级对应的APP的版本号的黑名单，上位机可以通过版本号获取请求，来读取控制器中存储区域的APP的底软版本号，控制器可以向上位机反馈第一存储区域或第二存储区域的APP的底软版本号。如果上位机匹配到该底软版本号属于该黑名单，则表明存储区域的BL程序无法在当前底软版本号的APP下升级，因此需要通过指令指示控制器先升级存储区域的APP，再升级存储区域的BL程序，可以提高BL程序的升级成功率。
一种可能的实施方式中，升级文件还包括APP升级包和/或标定Cal文件升级包，上述步骤将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域之前，该方法还包括：根据APP升级包升级第一存储区域的APP；和/或，根据Cal文件升级第一存储区域的Cal文件。
上述可能的实施方式中，在升级文件中还可以包括APP升级包和/或Cal文件升级包,即该升级文件中可以包括APP升级包，或者包括Cal文件升级包，还可以同时包括APP升级包和Cal文件升级包，此处不作限定。则在将第一存储区域由备份存储区域切换成运行存储区域之前，控制器还需要将第一存储区域的APP和/或第一存储区域的Cal文件进行升级，即将APP升级包覆盖第一存储区域的APP的存储地址，将Cal文件升级包覆盖第一存储区域的Cal文件的存储地址，提高程序版本匹配度。
一种可能的实施方式中，升级文件包括升级地址，上述步骤根据BL程序升级包对第一存储区域的BL程序进行升级包括：根据升级地址确定第一擦除地址，第一擦除地址为对第一存储区域的BL进行擦除的地址；校验第一擦除地址是否在第一存储区域的BL程序所在的地址空间；当校验通过时，将第一擦除地址上的内容擦除；将BL程序升级包的数据存储在第一擦除地址。
上述可能的实施方式中，对于控制器根据升级文件中的BL程序升级包对第一存储区域的BL程序进行升级的过程中，控制器可以从升级文件中解析出升级地址，其中，该升级地址可以包括该BL程序升级包对应的擦除地址，由于控制器的存储区域分为第一存储区域和第二存储区域，当需要对第一存储区域的BL程序进行升级时，可以根据该擦除地址确定第一存储区域中对BL程序的第一擦除地址。此时，控制器可以对该第一擦除地址进行校验，校验该第一擦除地址是否在该第一存储区域中为BL程序分配的地址空间内，如果不在该地址空间内，则表示该第一擦除地址有误，可以向上位机反馈否定响应。如果第一擦除地址在该地址空间内，则表示该第一擦除地址有效，可以直接将该第一擦除地址上的数据擦除，然后再将该BL程序升级包的数据存储在擦除后的第一擦除地址上，以完成第一存储区域的BL程序的升级。通过分配的地址空间校验擦写地址，保障BL程序的升级效果，提高BL程序的升级成功率。
一种可能的实施方式中，上述步骤根据BL程序升级包对第二存储区域的BL程序进行升级包括：根据升级地址确定第二擦除地址，第二擦除地址为对第二存储区域的BL程序进 行擦除的地址；校验第二擦除地址是否在第二存储区域的BL程序所在的地址空间；当校验通过时，将第二擦除地址上的内容擦除；将BL程序升级软件包的数据存储在第二擦除地址。
上述可能的实施方式中，控制器也可以同样根据升级文件中的升级地址确定对第二存储区域的BL程序进行擦除的第二擦除地址，该升级地址可以包括该BL程序升级包对应的擦除地址，由于控制器的存储区域分为第一存储区域和第二存储区域，当需要对第二存储区域的BL程序进行升级时，可以根据该擦除地址确定第二存储区域中对BL程序的第二擦除地址。此时，控制器可以对该第二擦除地址进行校验，校验该第二擦除地址是否在该第二存储区域中为BL程序分配的地址空间内，如果不在该地址空间内，则表示该第二擦除地址有误，可以向上位机反馈否定响应。如果第二擦除地址在该地址空间内，则表示该第二擦除地址有效，可以直接将该第二擦除地址上的数据擦除，然后再将该BL程序升级包的数据存储在擦除后的第二擦除地址上，以完成第二存储区域的BL程序的升级。通过分配的地址空间校验擦写地址，保障BL程序的升级效果，提高BL程序的升级成功率。
一种可能的实施方式中，上述步骤将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域之前，该方法还包括：校验第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值是否相同；当相同时，则触发将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤；当不同时，校验第一存储区域的BL程序的完整性；当校验成功时，交换第一存储区域和第二存储区域的安全启动设置值，并触发将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。
上述可能的实施方式中，控制器还需要检测第一存储区域的BL程序是否完成升级，可以检测第一存储区域的BL程序和第二存储区域的BL程序的是否相同，如通过校验第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值是否相同，即比较第一存储区域的BL程序的二进制与第二存储区域的BL程序的二进制是否相同。当第一存储区域的BL程序的二进制与第二存储区域的BL程序的哈希值相同时，可以触发控制器将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。当第一存储区域的BL程序的二进制与第二存储区域的BL程序的哈希值不同时，则表示第一存储区域的BL程序已经过升级，不过不清楚升级是否成功，则控制器还可以校验该第一存储区域的BL程序的完整性。当校验失败，即完整性不足时，则可以重刷第一存储区域的BL程序，或者向上位机反馈否定响应，当校验成功时，则表示第一存储区域的BL程序已升级成功，可以交换第一存储区域和第二存储区域的安全启动设置值，其中，该安全启动设置值为控制器复位时选择启动存储区域的校验依据，即第一存储区域的安全启动设置值切换到优先选择的值，复位后控制器可以将第一存储区域作为运行存储区域，以完成将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。通过哈希值校验以及完整性校验，提高切换到允许存储区域的第一存储区域的升级成功准确度。
一种可能的实施方式中，上述步骤根据BL程序升级包对第二存储区域的BL程序进行升级之后，该方法还包括：校验第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值是否相同；当不同时，触发根据BL程序升级包对第二存储区域的BL程序进行 升级的步骤。
上述可能的实施方式中，当对第二存储区域中的BL程序进行升级后，还可以校验第一存储区域的BL程序哈希值和第二存储区域的BL程序的哈希值是否相同，即判断第二存储区域的BL程序是否升级成功，当校验失败，即第一存储区域的BL程序哈希值和第二存储区域的BL程序的哈希值不同时，则表示该第二存储区域的BL程序升级失败，需要重新升级，则可以再次执行根据BL程序升级包对第二存储区域的BL程序进行升级的步骤。通过校验两个存储区域的BL程序的哈希值，在哈希值不同的情况下重新升级，提高升级成功率。
一种可能的实施方式中，上述步骤根据BL程序升级包对第二存储区域的BL程序进行升级之后，该方法还包括：执行后编程阶段，后编程阶段用于恢复本地的通信状态。
上述可能的实施方式中，当升级完第二存储区域中的BL程序后，控制器和上位机还可以执行后编程阶段，控制器通过复位使得控制器的软件生效，响应上位机的服务指令，完成必要的重置工作，重新开启控制器和上位机的通信，并开启控制诊断故障代码(diagnostic trouble code，DTC)、清DTC，以及诊断会话跳转，以恢复控制器的通信状态，使得控制器可以正常使用，及时恢复通行状态，提高用户体验。
本申请第二方面提供了一种控制器升级方法，控制器包括第一存储区域和第二存储区域，第一存储区域和第二存储区域中分别保存有引导装载BL程序，该方法包括：向控制器发送版本号获取请求，版本号获取请求用于读取第一存储区域的应用程序APP的底软版本号；接收来自控制器的底软版本号；当底软版本号属于黑名单时，向控制器发送指令，黑名单包括BL程序无法升级对应的版本号，指令指示第一存储区域的APP在第一存储区域的BL程序之前升级。
上述方面中，由于存储区域的BL程序升级有时候受该存储区域的APP的版本影响，即存在BL程序无法升级对应的APP的版本号的黑名单，上位机可以通过版本号获取请求，来读取控制器中存储区域的APP的底软版本号，控制器可以向上位机反馈第一存储区域或第二存储区域的APP的底软版本号。如果上位机匹配到该底软版本号属于该黑名单，则表明存储区域的BL程序无法在当前底软版本号的APP下升级，因此需要通过指令指示控制器先升级存储区域的APP，再升级存储区域的BL程序，可以提高BL程序的升级成功率。
一种可能的实施方式中，该方法还包括：执行后编程阶段，后编程阶段用于恢复本地的通信状态。
本申请第三方面提供了一种控制器升级装置，可以实现上述第一方面或第一方面中任一种可能的实施方式中的方法。该装置包括用于执行上述方法的相应的单元或模块。该装置包括的单元或模块可以通过软件和/或硬件方式实现。该装置例如可以为网络设备，也可以为支持网络设备实现上述方法的芯片、芯片系统、或处理器等，还可以为能实现全部或部分网络设备功能的逻辑模块或软件。
本申请实施例第四方面提供了一种控制器升级装置，可以实现上述第二方面或第二方面中任一种可能的实施方式中的方法。该装置包括用于执行上述方法的相应的单元或模块。该装置包括的单元或模块可以通过软件和/或硬件方式实现。该装置例如可以为网络设备，也可以为支持网络设备实现上述方法的芯片、芯片系统、或处理器等，还可以为能实现全 部或部分网络设备功能的逻辑模块或软件。
本申请第五方面提供了一种计算机设备，包括：处理器，该处理器与存储器耦合，该存储器用于存储指令，当指令被处理器执行时，使得该计算机设备实现上述第一方面或第一方面中任一种可能的实施方式中的方法。该计算机设备例如可以为网络设备，也可以为支持网络设备实现上述方法的芯片或芯片系统等。
本申请第六方面提供了一种计算机设备，包括：处理器，该处理器与存储器耦合，该存储器用于存储指令，当指令被处理器执行时，使得该计算机设备实现上述第二方面或第二方面中任一种可能的实施方式中的方法。该计算机设备例如可以为网络设备，也可以为支持网络设备实现上述方法的芯片或芯片系统等。
本申请第七方面提供了一种计算机可读存储介质，该计算机可读存储介质中保存有指令，当该指令被处理器执行时，实现前述第一方面或第一方面任一种可能的实施方式、前述第二方法或第二方法任一种可能的实施方式提供的方法。
本申请第八方面提供了一种计算机程序产品，计算机程序产品中包括计算机程序代码，当该计算机程序代码在计算机上执行时，实现前述第一方面或第一方面任一种可能的实施方式、前述第二方法或第二方法任一种可能的实施方式提供的方法。
图1为本申请实施例提供的一种通信传输的系统架构图；
图2为本申请实施例提供的一种控制器升级方法的流程示意图；
图3为本申请实施例提供的一种预编程步骤的流程示意图；
图4为本申请实施例提供的一种重编程步骤的流程示意图；
图5为本申请实施例提供的一种切区操作步骤的流程示意图；
图6为本申请实施例提供的一种安全启动设置值的交换示意图；
图7为本申请实施例提供的一种控制器升级BL程序的总流程示意图；
图8为本申请实施例提供的一种控制器升级装置的结构示意图；
图9为本申请实施例提供的另一种控制器升级装置的结构示意图；
图10为本申请实施例提供的一种计算机设备的结构示意图；
图11为本申请实施例提供的另一种计算机设备的结构示意图。
本申请实施例提供了一种节点升级方法以及装置，用于降低上位机和从属节点的工作量，节约了研发和生产成本。
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况 下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
下面先对本申请实施例可能涉及的相关术语和概念进行介绍。
(1)电子控制单元(electronic control unit，ECU)
ECU又称为行车电脑、车载电脑等，从用途上讲则是汽车专用微机控制器，也叫汽车专用单片机，它和普通的电脑一样，由微处理器(microcontroller Unit，MCU)、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、输入/输出接口(I/O)、模数转换器(A/D)以及整形、驱动等大规模集成电路组成。
在ECU中，中央处理器(central processing unit，CPU)是核心部分，它具有运算与控制的功能，例如，发动机在运行时，它采集各传感器的信号进行运算，并将运算的结果转变为控制信号，控制被控对象的工作；它还实行对存储器(如，ROM)、I/O和其它外部电路的控制。ECU一般都具备故障自诊断和保护功能，当系统产生故障时，它能在RAM中自动记录故障代码并采用保护措施从固有程序中读取替代程序来维持对应组件的(如，发动机)运转，同时这些故障信息会显示在仪表盘上并保持不灭，可以使车主及时发现问题并将车能开到修理店。正常情况下，RAM也会不停地记录汽车在行驶过程中的数据，并通过自适应程序对实时记录的数据进行学习，为适应车主的驾驶习惯提供最佳的控制状态。
传统的ECU相对来说结构比较简单，整车上面可能会有几十上百个ECU，例如，发动机上应用的ECU、防抱死制动系统上应用的ECU等，每个ECU的功能都是相对独立的，随着数字汽车尤其是自动驾驶技术的发展，汽车上的ECU逐渐变得复杂并有集中在一个超级ECU上的趋势，随之而来对ECU的诊断难度也越来越大。
(2)上位机
上位机是指可以直接发出操控命令的计算机设备，在本申请实施例中，能够对ECU基于UDS协议进行通信的计算机设备都可称为上位机(也可称为诊断仪、诊断机、诊断工具等)，例如，个人计算机(personal computer，PC)、手机、平板电脑等智能手持终端设备，以及智能手环、智能手表等智能可穿戴设备，甚至是单片机，只要该设备能够运行相应的诊断软件，且能与ECU基于UDS协议进行通信的设备都可作为本申请实施例中的上位机，具体此处不做限定。
(3)统一诊断服务(unified diagnosis service，UDS)
不同诊断通信协议的开发、调整、实施和维护会给车辆制造商、系统供应商和ECU供应商带来不必要的成本。为了解决此问题，将不同的技术协议和数据通信原理编译为一个国际标准化组织(international organization for standardization，ISO)制定的标准，通常称为UDS(也可称为ISO 14229-1)，UDS是一种汽车通用诊断协议，与数据链路无关，其中，UDS面向于开放式系统互联(open system interconnection，OSI)模型中的应用层，它可在不同的汽车总线(如，控制器局域网(controller area network，CAN)、局域互 联网络(local interconnect network，LIN)、Flexray、以太网(ethernet)、杀线(K-line)等)上实现。目前，大部分汽车厂商均采用UDS on CAN的诊断协议，形象的说，就是使用一套仪器(一般称为上位机)，对当前汽车上ECU内部的信息/数据进行分析，而这套仪器与ECU交谈所使用的语言就是UDS(不是唯一方法)。
请参阅图1，如图1所示为本申请实施例提供的一种通信传输的系统架构图，该通信系统包括空中下载技术(over-the-airtechnology，OTA)服务器101和双备份控制器102，其中，双备份控制器102包括CAN/以太通信模块1021，闪存驱动(FlashDriver)模块1022，闪存(Flash)存储区1023，中央处理器(central processing unit，CPU)单元1024。
其中，OTA服务器通过移动通信的接口实现对软件进行远程管理，固件升级时，远端OTA服务器101通过中间转发节点103将升级指令通过CAN/以太通信模块1021传递给控制器进行升级。
Flash存储区1023包括A区和B区，其中，A区和B区分别存储有引导装载程序(BootLoader，BL)，应用程序(application program，APP)，标定(calibration，Cal)文件。
上面的OTA服务器为本申请的上位机。
随着整车电子电气架构的演进，新能源汽车上会有许多重要的电子控制单元。而绝大部分电子控制单元在启动时需要通过BL进行启动。BL是系统的引导加载程序，是系统上电或复位后运行的第一段代码，主要功能包括初始化，应用程序的安全校验和加载。对于非双备份控制器，BL还具备统一诊断服务(unified diagnosis service，UDS)刷写功能，在BL模式下更新应用程序(application program，APP)。当控制器量产后，加载在控制器中的程序可能存在错误，需要进行软件优化或漏洞(bug)修复。
当前双备份控制器会对APP进行备份，可以在APP模式下运行APP的同时升级APP。虽然从机制上APP模式下也可以升级BL，但是BL承担着基本的启动初始化和加载APP的功能，当升级BL时容易受断电影响导致变砖，无法可靠地远程升级。
为解决上述问题，本申请实施例提供了一种控制器升级方法，该方法如下所述。
请参阅图2，如图2所示为本申请实施例提供的一种控制器升级方法的流程示意图，该方法包括：
步骤201.控制器获取升级文件，升级文件包括BL程序升级包。
本实施例中，该升级文件为OTA服务器提供，当OTA服务器要升级控制器的BL程序时，可以向控制器发送携带BL程序升级包的升级文件，相应的，控制器可以接收来自OTA服务器的升级文件。
上位机在确定需要升级目标车辆的ECU程序时，可以先通过版本查询指令，向该目标车辆的控制器的信息，该信息包括APP的版本信息，再在选取该控制器的APP版本时选择与目标车辆其他ECU版本匹配的版本。上位机可以将该控制器的各个升级软件包打包到总的升级文件中，其中，该升级文件包括BL程序升级软件包，然后进入上位机升级流程，即上位机将该升级文件发送给控制器。
步骤202.控制器根据BL程序升级包对第一存储区域中的BL程序进行升级，第一存储 区域为备份存储区域，第二存储区域为运行存储区域。
本实施例中，该控制器的存储区域可以多个存储区域，其中一个存储区域为运行存储区域，其他存储区域为备份存储区域，每个存储区域都保存有BL程序，本申请实施例以两个存储区域为例。控制器当前使用作为运行存储区域的第二存储区域的BL程序提供BL程序服务，为不停止BL程序服务，控制器可以先对作为备份存储区域的第一存储区域的BL程序进行升级，即将BL程序升级包对第一存储区域的BL程序的存储地址进行覆盖。
在一个示例中，控制器在根据BL程序升级包对第一存储区域中的BL程序进行升级之前，在预编程步骤，还需要接收来自上位机的版本号获取请求，根据版本号获取请求向上位机发送第一存储区域的应用程序APP的底软版本号，当底软版本号属于黑名单时，接收来自上位机的指令，黑名单包括BL程序无法升级对应的版本号，指令指示第一存储区域的APP在第一存储区域的BL程序之前升级。
具体的，由于存储区域的BL程序升级有时候受该存储区域的APP的版本影响，即存在BL程序无法升级对应的APP的版本号的黑名单，上位机可以通过版本号获取请求，来读取控制器中存储区域的APP的底软版本号，控制器可以向上位机反馈第一存储区域或第二存储区域的APP的底软版本号。如果上位机匹配到该底软版本号属于该黑名单，则表明存储区域的BL程序无法在当前底软版本号的APP下升级，因此需要通过指令指示控制器先升级存储区域的APP，再升级存储区域的BL程序。
具体的，该预编程步骤的流程如图3所示，步骤301.进入扩展会话($10$03)；步骤302.预编程条件检查($31)；步骤303.关控制诊断故障代码(diagnostic trouble code，DTC)($85$02)；步骤304.关通信($28)，步骤305.读底软版本号($22$F1FF)。其中，控制器关DTC和通信是为了避免通信出错以及DTC报错。
其中，在升级文件中还可以包括APP升级包和/或Cal文件升级包,即该升级文件中可以包括APP升级包，或者包括Cal文件升级包，还可以同时包括APP升级包和Cal文件升级包，此处不作限定。则在将第一存储区域由备份存储区域切换成运行存储区域之前，控制器还需要将第一存储区域的APP和/或第一存储区域的Cal文件进行升级，即将APP升级包覆盖第一存储区域的APP的存储地址，将Cal文件升级包覆盖第一存储区域的Cal文件的存储地址。
对于控制器根据升级文件中的BL程序升级包对第一存储区域的BL程序进行升级的过程中，控制器可以从升级文件中解析出升级地址，其中，该升级地址可以包括该BL程序升级包对应的擦除地址，由于控制器的存储区域分为第一存储区域和第二存储区域，当需要对第一存储区域的BL程序进行升级时，可以根据该擦除地址确定第一存储区域中对BL程序的第一擦除地址。此时，控制器可以对该第一擦除地址进行校验，校验该第一擦除地址是否在该第一存储区域中为BL程序分配的地址空间内，如果不在该地址空间内，则表示该第一擦除地址有误，可以向上位机反馈否定响应。如果第一擦除地址在该地址空间内，则表示该第一擦除地址有效，可以直接将该第一擦除地址上的数据擦除，然后再将该BL程序升级包的数据存储在擦除后的第一擦除地址上，以完成第一存储区域的BL程序的升级。
步骤203.当第一存储区域中的BL程序升级成功时，控制器将第一存储区域设置为运 行存储区域，并将第二存储区域设置为备份存储区域。
本实施例中，在升级完第一存储区域的BL程序后，可以将当前运行的存储区切换成升级了BL程序的第一存储区域，以提供更好的服务，此时第一存储区域为运行存储区域，第二存储区域为备份存储区域。
在执行步骤203之前，控制器还需要检测第一存储区域的BL程序是否完成升级，可以检测第一存储区域的BL程序和第二存储区域的BL程序的是否相同，如通过校验第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值是否相同，即比较第一存储区域的BL程序的二进制与第二存储区域的BL程序的二进制是否相同。当第一存储区域的BL程序的二进制与第二存储区域的BL程序的哈希值相同时，可以触发控制器将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。当第一存储区域的BL程序的二进制与第二存储区域的BL程序的哈希值不同时，则表示第一存储区域的BL程序已经过升级，不过不清楚升级是否成功，则控制器还可以校验该第一存储区域的BL程序的完整性。当校验失败，即完整性不足时，则可以重刷第一存储区域的BL程序，或者向上位机反馈否定响应，当校验成功时，则表示第一存储区域的BL程序已升级成功，可以交换第一存储区域和第二存储区域的安全启动设置值，其中，该安全启动设置值为控制器复位时选择启动存储区域的校验依据，即第一存储区域的安全启动设置值切换到优先选择的值，复位后控制器可以将第一存储区域作为运行存储区域，以完成将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。
即本申请实施例在重编程阶段修改了擦内存的执行方式，以及增加了切区操作，该重编程阶段的流程如图4所示，步骤401.进入编程会话($10$02)；步骤402.安全解锁($27)；步骤403.写指纹($2E$F184)；步骤404.下载闪存驱动程序(FlashDriver)；步骤405.擦除第一存储区域的内存($31$01$FF00)；步骤406.下载BL程序/APP/Cal文件；步骤407.判断是否下载完所有字节，是则执行步骤408，否则执行步骤405；步骤408.编程依赖性检查；步骤409.切区操作。
其中，步骤409的具体执行流程可以如图5所示，步骤501.计算第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值；步骤502.比较两个哈希值是不是不一致，是则执行步骤503，否则执行步骤511；步骤503.校验第一存储区域的BL程序的完整性；步骤504.判断校验是否通过，是则执行步骤505，否则执行步骤510；步骤505.交换第一存储区域和第二存储区域的安全启动设置值；步骤506.判断交换是否成功，是则执行步骤507，否则执行步骤510；步骤507.修改用户配置块(user configuration block，UCB)的配置，将第一存储区域设置为下一次启动运行区；步骤508.判断是否设置成功，是则执行步骤509，否则执行步骤510；步骤509.回复肯定响应；步骤510.回复否定响应；步骤511.重新对第一存储区域的BL程序进行升级。
对于该第一存储区域和第二存储区域的安全启动设置值的交换示意图可以参阅图6所示，原本第二存储区域的安全启动设置值为entry1，第一存储区域的安全启动设置值为entry12，交换后第二存储区域的安全启动设置值为entry12，第一存储区域的安全启动设置值为entry1。则后续每次控制器启动时会先对entry1进行启动校验，校验通过就使用 第一存储区域进行启动。
其中，完整性校验的方式可以是，如果最近一次刷写的是BL程序文件，先校验BL程序版本号的格式是否正确(用来校验刷写的是BL程序文件而非APP或其他文件，BL程序版本号固定存放在BL程序代码段的起始位置)，如果校验不通过，则记录对区BL程序完整性标志位BootOK_Flag(uint8)＝0，并存储EEPROM，之后回复否定响应；如果BL程序版本号校验通过，说明刷写的是BL程序文件，再对BL程序进行完整性校验，验签通过，更新对区BL程序的加密信息识别码(cypher-based message authentication code，CMAC)值，存放在UCB的某个位置(如entry12)，之后回复肯定响应，否则记录对区Boot完整性标志位BootOK_Flag(uint8)＝0，并存储EEPROM，之后回复否定响应。
在将第一存储区域切换为运行存储区域后，还可以继续将当前作为备份区域的第二存储区域的BL程序进行升级，在第一存储区域故障时，可以切换到有最新的BL程序的第二存储区域运行，提高用户体验。
在一个示例中，控制器也可以同样根据升级文件中的升级地址确定对第二存储区域的BL程序进行擦除的第二擦除地址，该升级地址可以包括该BL程序升级包对应的擦除地址，由于控制器的存储区域分为第一存储区域和第二存储区域，当需要对第二存储区域的BL程序进行升级时，可以根据该擦除地址确定第二存储区域中对BL程序的第二擦除地址。此时，控制器可以对该第二擦除地址进行校验，校验该第二擦除地址是否在该第二存储区域中为BL程序分配的地址空间内，如果不在该地址空间内，则表示该第二擦除地址有误，可以向上位机反馈否定响应。如果第二擦除地址在该地址空间内，则表示该第二擦除地址有效，可以直接将该第二擦除地址上的数据擦除，然后再将该BL程序升级包的数据存储在擦除后的第二擦除地址上，以完成第二存储区域的BL程序的升级。
其中，控制器升级第二存储区域的BL程序的流程也可以参阅图4的流程，此处不再赘述。
当对第二存储区域中的BL程序进行升级后，还可以校验第一存储区域的BL程序哈希值和第二存储区域的BL程序的哈希值是否相同，即判断第二存储区域的BL程序是否升级成功，当校验失败，即第一存储区域的BL程序哈希值和第二存储区域的BL程序的哈希值不同时，则表示该第二存储区域的BL程序升级失败，需要重新升级，则可以再次执行根据BL程序升级包对第二存储区域的BL程序进行升级的步骤。
当升级完第二存储区域中的BL程序后，控制器和上位机还可以执行后编程阶段，控制器通过复位使得控制器的软件生效，响应上位机的服务指令，完成必要的重置工作，重新开启控制器和上位机的通信，并开启DTC、清DTC，以及诊断会话跳转，以恢复控制器的通信状态，使得控制器可以正常使用。
本申请实施例控制器升级BL程序的总流程示意图可以是参阅图7所示，步骤701.控制器获取升级文件；步骤702.控制器升级第一存储区域的BL程序、APP和Cal文件；步骤703.检测第一存储区域是否升级成功，是则执行步骤705，否则执行步骤704；步骤704：控制器停留在第二存储区域运行并重新升级第一存储区域的程序；步骤705.控制器将运行存储区域切换到第一存储区域；步骤706.控制器升级第二存储区域的BL程序；步骤707.检测第二存 储区域的BL程序是否升级成功，是则执行步骤708，否则执行步骤706；步骤708.校验第一存储区域和第二存储区域的BL程序是否具有一致性，是则完成升级，否则执行步骤702。
本申请实施例通过升级文件中的BL程序升级包先对控制器中作为备份存储区域的第一存储区域进行BL程序升级，升级成功后将第一存储区域设置为运行存储区域，将第二存储区域设置为备份存储区域，在升级一个存储区域的BL程序时，可以使用另一个存储区域的BL程序提供服务，避免BL程序升级过程断电导致控制器变砖，提高远程升级的成功率。
上面讲述了控制器升级方法，下面对执行该方法的装置进行描述。
请参阅图8，如图8所示为本申请实施例提供的一种控制器升级装置，控制器包括第一存储区域和第二存储区域，第一存储区域和第二存储区域中分别保存有引导装载BL程序，装置80包括：
处理单元801，用于获取升级文件，升级文件包括BL程序升级包，根据BL程序升级包对第一存储区域的BL程序进行升级，第一存储区域为备份存储区域，第二存储区域为运行存储区域，当第一存储区域的BL程序升级成功时，将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域。
其中，处理单元801用于执行图2方法实施例中的步骤201至步骤203。
可选的，处理单元801还用于：根据BL程序升级包对第二存储区域的BL程序进行升级。
可选的，装置80还包括收发单元802，收发单元802具体用于：
接收来自上位机的版本号获取请求；
根据版本号获取请求向上位机发送第一存储区域的应用程序APP的底软版本号；
当底软版本号属于黑名单时，接收来自上位机的指令，黑名单包括BL程序无法升级对应的版本号，指令指示第一存储区域的APP在第一存储区域的BL程序之前升级。
可选的，升级文件还包括APP升级包和/或标定Cal文件升级包，处理单元801还用于：
根据APP升级包升级第一存储区域的APP；和/或，
根据Cal文件升级第一存储区域的Cal文件。
可选的，升级文件包括升级地址，处理单元801具体用于：
根据升级地址确定第一擦除地址，第一擦除地址为对第一存储区域的BL进行擦除的地址；
校验第一擦除地址是否在第一存储区域的BL程序所在的地址空间；
当校验通过时，将第一擦除地址上的内容擦除；
将BL程序升级包的数据存储在第一擦除地址。
可选的，处理单元801具体用于：
根据升级地址确定第二擦除地址，第二擦除地址为对第二存储区域的BL程序进行擦除的地址；
校验第二擦除地址是否在第二存储区域的BL程序所在的地址空间；
当校验通过时，将第二擦除地址上的内容擦除；
将BL程序升级软件包的数据存储在第二擦除地址。
可选的，处理单元801还用于：
校验第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值是否相同；
当相同时，则触发将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤；
当不同时，校验第一存储区域的BL程序的完整性；
当校验成功时，交换第一存储区域和第二存储区域的安全启动设置值，并触发将第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。
可选的，处理单元801还用于：
校验第一存储区域的BL程序的哈希值和第二存储区域的BL程序的哈希值是否相同；
当不同时，触发根据BL程序升级包对第二存储区域的BL程序进行升级的步骤。
可选的，处理单元801还用于：
执行后编程阶段，后编程阶段用于恢复本地的通信状态。
请参阅图9，如图9所示为本申请实施例提供的另一种控制器升级装置，控制器包括第一存储区域和第二存储区域，第一存储区域和第二存储区域中分别保存有引导装载BL程序，该装置90包括：
收发单元901，用于向控制器发送版本号获取请求，版本号获取请求用于读取第一存储区域的应用程序APP的底软版本号，接收来自控制器的底软版本号，当底软版本号属于黑名单时，向控制器发送指令，黑名单包括BL程序无法升级对应的版本号，指令指示第一存储区域的APP在第一存储区域的BL程序之前升级。
可选的，装置90还包括处理单元902，处理单元902具体用于：
执行后编程阶段，后编程阶段用于恢复本地的通信状态。
图10所示，为本申请的实施例提供的计算机设备100的一种可能的逻辑结构示意图。计算机设备100包括：处理器1001、通信接口1002、存储系统1003以及总线1004。处理器1001、通信接口1002以及存储系统1003通过总线1004相互连接。在本申请的实施例中，处理器1001用于对计算机设备100的动作进行控制管理，例如，处理器1001用于执行图2方法实施例中控制器所执行的步骤。通信接口1002用于支持计算机设备100进行通信。存储系统1003，用于存储计算机设备100的程序代码和数据。
其中，处理器1001可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器1001也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。总线1004可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
装置80中的收发单元802相当于计算机设备100中的通信接口1002，装置80中的处理单元801相当于计算机设备100中的处理器1001。
本实施例的计算机设备100可对应于上述图2方法实施例中的控制器，该计算机设备100中的通信接口1002可以实现上述图2方法实施例中的控制器所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
图11所示，为本申请的实施例提供的计算机设备110的一种可能的逻辑结构示意图。计算机设备110包括：处理器1101、通信接口1102、存储系统1103以及总线1104。处理器1101、通信接口1102以及存储系统1103通过总线1104相互连接。在本申请的实施例中，处理器1101用于对计算机设备110的动作进行控制管理，例如，处理器1101用于执行图2方法实施例中上位机所执行的步骤。通信接口1102用于支持计算机设备110进行通信。存储系统1103，用于存储计算机设备110的程序代码和数据。
其中，处理器1101可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器1101也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。总线1104可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图11中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
装置90中的收发单元901相当于计算机设备110中的通信接口1102，装置90中的处理单元902相当于计算机设备110中的处理器1101。
本实施例的计算机设备110可对应于上述图2方法实施例中的上位机，该计算机设备110中的通信接口1102可以实现上述图2方法实施例中的上位机所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
应理解以上装置中单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且装置中的单元可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分单元以软件通过处理元件调用的形式实现，部分单元以硬件的形式实现。例如，各个单元可以为单独设立的处理元件，也可以集成在装置的某一个芯片中实现，此外，也可以以程序的形式存储于存储器中，由装置的某一个处理元件调用并执行该单元的功能。此外这些单元全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件又可以成为处理器，可以是一种具有信号的处理能力的集成电路。在实现过程中，上述方法的各步骤或以上各个单元可以通过处理器元件中的硬件的集成逻辑电路实现或者以软件通过处理元件调用的形式实现。
在一个例子中，以上任一装置中的单元可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(application specific integrated circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)，或这些集成电路形式中至少两种的组合。再如，当装置中的单元可以通过处理元件调度程序的形式实现时，该处理元件可以是通用处理器，例如中央处理器(central processing unit，CPU)或其它可以调用程序的处理器。再如，这些单元可以集成在一起，以片上系统(system-on-a-chip，SOC)的形式实现。
在本申请的另一个实施例中，还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的处理器执行该计算机执行指令时，设备执行上述方法实施例中主控制节点所执行的方法。
在本申请的另一个实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中。当设备的处理器执行该计算机执行指令时，设备执行上述方法实施例中主控制节点所执行的方法。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，read-only memory)、随机存取存储器(RAM，random access memory)、磁碟或者光盘等各种可以存储程序代码的介质。
Claims (26)
- 一种控制器升级方法，其特征在于，所述控制器包括第一存储区域和第二存储区域，所述第一存储区域和第二存储区域中分别保存有引导装载BL程序，所述方法包括：获取升级文件，所述升级文件包括BL程序升级包；根据所述BL程序升级包对所述第一存储区域的BL程序进行升级，所述第一存储区域为备份存储区域，所述第二存储区域为运行存储区域；当所述第一存储区域的BL程序升级成功时，将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域。
- 根据权利要求1所述的方法，其特征在于，在将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域之后，所述方法还包括：根据所述BL程序升级包对所述第二存储区域的BL程序进行升级。
- 根据权利要求1或2所述的方法，其特征在于，所述根据所述BL程序升级包对第一存储区域的BL程序进行升级之前，所述方法还包括：接收来自上位机的版本号获取请求；根据所述版本号获取请求向所述上位机发送所述第一存储区域的应用程序APP的底软版本号；当所述底软版本号属于黑名单时，接收来自所述上位机的指令，所述黑名单包括BL程序无法升级对应的版本号，所述指令指示所述第一存储区域的APP在所述第一存储区域的BL程序之前升级。
- 根据权利要求1-3任一项所述的方法，其特征在于，所述升级文件还包括APP升级包和/或标定Cal文件升级包，所述将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域之前，所述方法还包括：根据所述APP升级包升级所述第一存储区域的APP；和/或，根据所述Cal文件升级所述第一存储区域的Cal文件。
- 根据权利要求1-4任一项所述的方法，其特征在于，所述升级文件包括升级地址，所述根据所述BL程序升级包对所述第一存储区域的BL程序进行升级包括：根据所述升级地址确定第一擦除地址，所述第一擦除地址为对所述第一存储区域的BL进行擦除的地址；校验所述第一擦除地址是否在所述第一存储区域的BL程序所在的地址空间；当校验通过时，将所述第一擦除地址上的内容擦除；将所述BL程序升级包的数据存储在所述第一擦除地址。
- 根据权利要求5所述的方法，其特征在于，所述根据所述BL程序升级包对第二存储区域的BL程序进行升级包括：根据所述升级地址确定第二擦除地址，所述第二擦除地址为对所述第二存储区域的BL程序进行擦除的地址；校验所述第二擦除地址是否在所述第二存储区域的BL程序所在的地址空间；当校验通过时，将所述第二擦除地址上的内容擦除；将所述BL程序升级软件包的数据存储在所述第二擦除地址。
- 根据权利要求1-6任一项所述的方法，其特征在于，所述将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域之前，所述方法还包括：校验所述第一存储区域的BL程序的哈希值和所述第二存储区域的BL程序的哈希值是否相同；当相同时，则触发所述将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤；当不同时，校验所述第一存储区域的BL程序的完整性；当校验成功时，交换所述第一存储区域和所述第二存储区域的安全启动设置值，并触发所述将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。
- 根据权利要求2所述的方法，其特征在于，所述根据所述BL程序升级包对第二存储区域的BL程序进行升级之后，所述方法还包括：校验所述第一存储区域的BL程序的哈希值和所述第二存储区域的BL程序的哈希值是否相同；当不同时，触发所述根据所述BL程序升级包对所述第二存储区域的BL程序进行升级的步骤。
- 根据权利要求2或8所述的方法，其特征在于，所述根据所述BL程序升级包对第二存储区域的BL程序进行升级之后，所述方法还包括：执行后编程阶段，所述后编程阶段用于恢复本地的通信状态。
- 一种控制器升级方法，其特征在于，所述控制器包括第一存储区域和第二存储区域，所述第一存储区域和第二存储区域中分别保存有引导装载BL程序，所述方法包括：向控制器发送版本号获取请求，所述版本号获取请求用于读取所述第一存储区域的应用程序APP的底软版本号；接收来自所述控制器的所述底软版本号；当所述底软版本号属于黑名单时，向所述控制器发送指令，所述黑名单包括BL程序无法升级对应的版本号，所述指令指示所述第一存储区域的APP在所述第一存储区域的BL程序之前升级。
- 根据权利要求10所述的方法，其特征在于，所述方法还包括：执行后编程阶段，所述后编程阶段用于恢复本地的通信状态。
- 一种控制器升级装置，其特征在于，所述控制器包括第一存储区域和第二存储区域，所述第一存储区域和第二存储区域中分别保存有引导装载BL程序，所述装置包括：处理单元，用于获取升级文件，所述升级文件包括BL程序升级包，根据所述BL程序升级包对所述第一存储区域的BL程序进行升级，所述第一存储区域为备份存储区域，所述第二存储区域为运行存储区域，当所述第一存储区域的BL程序升级成功时，将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域。
- 根据权利要求12所述的装置，其特征在于，所述处理单元还用于：根据所述BL程序升级包对所述第二存储区域的BL程序进行升级。
- 根据权利要求12或13所述的装置，其特征在于，所述装置还包括收发单元，所述收发单元具体用于：接收来自上位机的版本号获取请求；根据所述版本号获取请求向所述上位机发送所述第一存储区域的应用程序APP的底软版本号；当所述底软版本号属于黑名单时，接收来自所述上位机的指令，所述黑名单包括BL程序无法升级对应的版本号，所述指令指示所述第一存储区域的APP在所述第一存储区域的BL程序之前升级。
- 根据权利要求12-14任一项所述的装置，其特征在于，所述升级文件还包括APP升级包和/或标定Cal文件升级包，所述处理单元还用于：根据所述APP升级包升级所述第一存储区域的APP；和/或，根据所述Cal文件升级所述第一存储区域的Cal文件。
- 根据权利要求12-15任一项所述的装置，其特征在于，所述升级文件包括升级地址，所述处理单元具体用于：根据所述升级地址确定第一擦除地址，所述第一擦除地址为对所述第一存储区域的BL进行擦除的地址；校验所述第一擦除地址是否在所述第一存储区域的BL程序所在的地址空间；当校验通过时，将所述第一擦除地址上的内容擦除；将所述BL程序升级包的数据存储在所述第一擦除地址。
- 根据权利要求16所述的装置，其特征在于，所述处理单元具体用于：根据所述升级地址确定第二擦除地址，所述第二擦除地址为对所述第二存储区域的BL程序进行擦除的地址；校验所述第二擦除地址是否在所述第二存储区域的BL程序所在的地址空间；当校验通过时，将所述第二擦除地址上的内容擦除；将所述BL程序升级软件包的数据存储在所述第二擦除地址。
- 根据权利要求12-17任一项所述的装置，其特征在于，所述处理单元还用于：校验所述第一存储区域的BL程序的哈希值和所述第二存储区域的BL程序的哈希值是否相同；当相同时，则触发所述将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤；当不同时，校验所述第一存储区域的BL程序的完整性；当校验成功时，交换所述第一存储区域和所述第二存储区域的安全启动设置值，并触发所述将所述第一存储区域设置为运行存储区域，并将第二存储区域设置为备份存储区域的步骤。
- 根据权利要求13所述的装置，其特征在于，所述处理单元还用于：校验所述第一存储区域的BL程序的哈希值和所述第二存储区域的BL程序的哈希值是 否相同；当不同时，触发所述根据所述BL程序升级包对所述第二存储区域的BL程序进行升级的步骤。
- 根据权利要求13或19所述的装置，其特征在于，所述处理单元还用于：执行后编程阶段，所述后编程阶段用于恢复本地的通信状态。
- 一种控制器升级装置，其特征在于，所述控制器包括第一存储区域和第二存储区域，所述第一存储区域和第二存储区域中分别保存有引导装载BL程序，所述装置包括：收发单元，用于向控制器发送版本号获取请求，所述版本号获取请求用于读取所述第一存储区域的应用程序APP的底软版本号，接收来自所述控制器的所述底软版本号，当所述底软版本号属于黑名单时，向所述控制器发送指令，所述黑名单包括BL程序无法升级对应的版本号，所述指令指示所述第一存储区域的APP在所述第一存储区域的BL程序之前升级。
- 根据权利要求21所述的装置，其特征在于，所述装置还包括处理单元，所述处理单元具体用于：执行后编程阶段，所述后编程阶段用于恢复本地的通信状态。
- 一种计算机设备，其特征在于，包括：处理器，所述处理器与存储器耦合，所述处理器用于执行所述存储器中存储的指令，使得所述计算机设备执行如权利要求1至9中任一项所述的方法。
- 一种计算机设备，其特征在于，包括：处理器，所述处理器与存储器耦合，所述处理器用于执行所述存储器中存储的指令，使得所述计算机设备执行如权利要求10至11中任一项所述的方法。
- 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当所述指令被处理器执行时，实现如权利要求1至11中任一项所述的方法。
- 一种计算机程序产品，其特征在于，所述计算机程序产品中包括计算机程序代码，其特征在于，当所述计算机程序代码在计算机上运行时，实现如权利要求1至11中任一项所述的方法。
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2022/133870 WO2024108456A1 (zh) | 2022-11-24 | 2022-11-24 | 一种控制器升级方法以及装置 |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2022/133870 WO2024108456A1 (zh) | 2022-11-24 | 2022-11-24 | 一种控制器升级方法以及装置 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2024108456A1 true WO2024108456A1 (zh) | 2024-05-30 |
Family
ID=91194827
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2022/133870 WO2024108456A1 (zh) | 2022-11-24 | 2022-11-24 | 一种控制器升级方法以及装置 |
Country Status (1)
| Country | Link |
|---|---|
| WO (1) | WO2024108456A1 (zh) |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070083744A1 (en) * | 2005-10-10 | 2007-04-12 | Samsung Electronics Co., Ltd. | Digital broadcast processing apparatus and boot loader upgrade method thereof |
| CN110096300A (zh) * | 2019-04-08 | 2019-08-06 | 上海赛治信息技术有限公司 | 一种fpga程序文件备份管理系统、运行方法及升级方法 |
| CN110134415A (zh) * | 2019-04-12 | 2019-08-16 | 深圳市致宸信息科技有限公司 | 一种控制器及其软件升级方法和装置 |
| CN112506535A (zh) * | 2020-05-22 | 2021-03-16 | 上海擎度汽车科技有限公司 | 一种汽车ECU控制器更新升级Bootloader软件的方法 |
| CN113918200A (zh) * | 2021-09-30 | 2022-01-11 | 深圳市戴升智能科技有限公司 | 高效可靠的嵌入式设备应用程序无线升级方法 |
| CN114064095A (zh) * | 2020-08-10 | 2022-02-18 | 威马智慧出行科技（上海）有限公司 | 车载软件的升级方法、车载控制器、车辆及存储介质 |
| CN115061713A (zh) * | 2021-03-08 | 2022-09-16 | 华为技术有限公司 | 升级电子设备的方法及装置 |
-
2022
- 2022-11-24 WO PCT/CN2022/133870 patent/WO2024108456A1/zh unknown
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070083744A1 (en) * | 2005-10-10 | 2007-04-12 | Samsung Electronics Co., Ltd. | Digital broadcast processing apparatus and boot loader upgrade method thereof |
| CN110096300A (zh) * | 2019-04-08 | 2019-08-06 | 上海赛治信息技术有限公司 | 一种fpga程序文件备份管理系统、运行方法及升级方法 |
| CN110134415A (zh) * | 2019-04-12 | 2019-08-16 | 深圳市致宸信息科技有限公司 | 一种控制器及其软件升级方法和装置 |
| CN112506535A (zh) * | 2020-05-22 | 2021-03-16 | 上海擎度汽车科技有限公司 | 一种汽车ECU控制器更新升级Bootloader软件的方法 |
| CN114064095A (zh) * | 2020-08-10 | 2022-02-18 | 威马智慧出行科技（上海）有限公司 | 车载软件的升级方法、车载控制器、车辆及存储介质 |
| CN115061713A (zh) * | 2021-03-08 | 2022-09-16 | 华为技术有限公司 | 升级电子设备的方法及装置 |
| CN113918200A (zh) * | 2021-09-30 | 2022-01-11 | 深圳市戴升智能科技有限公司 | 高效可靠的嵌入式设备应用程序无线升级方法 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10735260B2 (en) | Gateway device, firmware update method, and recording medium | |
| US20210167988A1 (en) | Vehicle master device, update data distribution control method, computer program product and data structure of specification data | |
| US11671498B2 (en) | Vehicle master device, update data verification method and computer program product | |
| US11068255B2 (en) | Processing system, related integrated circuit, device and method | |
| US11947953B2 (en) | Vehicle electronic control system, progress screen display control method and computer program product | |
| US11999360B2 (en) | Vehicle master device, control method for executing rollback, computer program product for executing rollback and data structure of specification data | |
| US11467821B2 (en) | Vehicle master device, installation instruction determination method and computer program product | |
| WO2010017775A1 (zh) | 基于can总线的汽车电子控制器代码刷新的控制方法 | |
| US11604637B2 (en) | Electronic control unit, vehicle electronic control system, difference data consistency determination method and computer program product | |
| US20210157492A1 (en) | Vehicle electronic control system, file transfer control method, computer program product and data structure of specification data | |
| US20060218340A1 (en) | Data validity determining method for flash EEPROM and electronic control system | |
| US11926270B2 (en) | Display control device, rewrite progress display control method and computer program product | |
| CN112181455B (zh) | 微控制器的在线升级方法、微控制器及存储介质 | |
| CN113031974A (zh) | 一种变速器控制单元软件刷写方法 | |
| CN112540778A (zh) | 车辆数据的刷写方法、诊断设备及刷写系统 | |
| WO2022160816A1 (zh) | 一种数据处理方法以及相关设备 | |
| US20220107798A1 (en) | Server, software update system, distribution method, and non-transitory storage medium | |
| US11876898B2 (en) | Vehicle master device, security access key management method, security access key management program and data structure of specification data | |
| US11656771B2 (en) | Electronic control unit, vehicle electronic control system, activation execution control method and computer program product | |
| WO2024108456A1 (zh) | 一种控制器升级方法以及装置 | |
| KR20130022804A (ko) | 리프로그래밍 제어모듈 및 이를 이용한 리프로그래밍 시스템 및 방법 | |
| US20230254374A1 (en) | Vehicle master device, update data verification method and computer program product | |
| US11995437B2 (en) | Center, distribution control method, and non-transitory storage medium | |
| CN116431186A (zh) | 一种车载ecu的升级方法、装置及介质 | |
| US20220317994A1 (en) | Ota master, update control method, and non-transitory storage medium |