NB_APP_Code/src/AppTaskUart.c

/****************************************************************************
 *
 * Copy right:   Qx.
 * File name:    UartTask.c
 * Description:  串口任务
 * History:      2021-03-05
 *
 * 2021-04-11:可以通过Ota线路升级Bms保护板
 ****************************************************************************/

#include "AppTaskUart.h"

extern ARM_DRIVER_USART Driver_USART1;
static ARM_DRIVER_USART *USARTdrv = &Driver_USART1;
volatile BOOL isRecvTimeout = false;
volatile BOOL isRecvComplete = false;
static StaticTask_t             gProcess_Uart_Task_t;
static UINT8                  gProcess_Uart_TaskStack[PROC_UART_TASK_STACK_SIZE];
static osThreadId_t           UartTaskId = NULL;
static process_Uart             gProcess_Uart_Task = PROCESS_UART_STATE_IDLE;
#define PROC_UART_STATE_SWITCH(a)  (gProcess_Uart_Task = a)

static UINT8 Uart_WriteCmd_func(UartWriteData_S UartWriteData);
void USART_callback(uint32_t event);
static UINT16 crc_chk(UINT8* data, UINT8 length);
UINT8 Uart_Encrypt_Send(void);
void Uart_Cmd_Control(QueueHandle_t UartWriteCmdHandle,UartWriteData_S UartWriteData,UartAnswerData_S UartAnswerData);
static UINT8 Uart_DataRecv_func(UartQueryType Uart_Read_Msg_Fun,UINT8* Uart_Recv_Buffer_Fun);
static void UartTask(void* arg)
{

    UINT16  Uart_Uds_LEN;
    UINT16  Reg_Num = 0;
    UINT16  Uart_Recv_LEN;
    UINT8   UartRecvFlagCounter = 0;
    UartQueryType Uart_Read_Msg;//发送结构体初始化
    memset(&(Uart_Read_Msg),0x00,sizeof(Uart_Read_Msg));
    UartAnswerData_S UartAnswerData;//应答数据初始化
	memset(&(UartAnswerData),0x00,sizeof(UartAnswerData_S));
	UartWriteData_S  UartWriteData;
	memset(&(UartWriteData),0x00,sizeof(UartWriteData_S));//Uart控制命令初始化
    PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_INTI);
	UINT8 ret = 0x00;
	if(UartWriteCmdHandle == NULL)//Uart控制命令传输指针
	{
		UartWriteCmdHandle = osMessageQueueNew(1,sizeof(UartWriteData_S), NULL);
	}
    while (1)
    {
        switch (gProcess_Uart_Task)
        {
			case PROCESS_UART_STATE_INTI:
			{
				USARTdrv->Initialize(USART_callback);
				USARTdrv->PowerControl(ARM_POWER_FULL);
				USARTdrv->Control(ARM_USART_MODE_ASYNCHRONOUS |
								ARM_USART_DATA_BITS_8 |
								ARM_USART_PARITY_NONE |
								ARM_USART_STOP_BITS_1 |
								ARM_USART_FLOW_CONTROL_NONE, 9600);
				PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_ENCRYPT);
				break;
			}
            case PROCESS_UART_STATE_ENCRYPT:
            {
                UINT8 EncryptFlag=0x00;
				UINT8 EncryptCount=0;
				while(EncryptFlag!=0x01&&EncryptCount<=3)
				{
					EncryptFlag = Uart_Encrypt_Send();
					EncryptCount++;
				}
                PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_IDLE);
                break;
            }
            case PROCESS_UART_STATE_IDLE:
            {
                osDelay(100);
				Uart_Cmd_Control(UartWriteCmdHandle,UartWriteData,UartAnswerData);//电池锁定，继电器锁定，加热控制
                if(TimeCounter%10==0 && gProcess_app==WORK)
                {
					#ifdef USING_PRINTF1
						printf("Uart work begin:%02x\n",PadInterrupt);
					#endif
                    if(osMessageQueueGet(UartWriteCmdHandle,&UartWriteData,0,0)==osOK&&UartRecvFlag==1)
                    {
                        PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_WRITE);
                        break;
                    }
                    else
                    {
                        PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_READ);
                        break;
                    }
                }
                else if (gProcess_app==LISTEN)
                {
                    PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_SLEEP);
                    break;
                }
				if(BMS_Fota_update_flag)
				{
					if(BattWorkStateDelay==0x00)
					{
						PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_UPDATE);
						break;
					}
				}
                break;
            }
            case PROCESS_UART_STATE_READ:
            {
                UINT16 CRC_chk_buffer;
                Reg_Num = 0x21 + AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP ;//按照协议里面的0x21+X+N的结束地址
                Uart_Read_Msg.Bms_Address = BMS_ADDRESS_CODE;
                Uart_Read_Msg.Bms_Funcode = UART_READ_CODE;
                Uart_Read_Msg.Reg_Begin_H = 0x00;
                Uart_Read_Msg.Reg_Begin_L = 0x00;
                Uart_Read_Msg.Reg_Num_H   = Reg_Num>>8;
                Uart_Read_Msg.Reg_Num_L   = Reg_Num;
                Uart_Uds_LEN = Reg_Num*2;
                memset(UartAnswerData.Header,0x00,Uart_Uds_LEN);
				CRC_chk_buffer = crc_chk((UINT8 *)&Uart_Read_Msg,6);
				Uart_Read_Msg.CRC_L = CRC_chk_buffer;
				Uart_Read_Msg.CRC_H = CRC_chk_buffer>>8;
				Uart_Recv_LEN = Uart_DataRecv_func(Uart_Read_Msg,(UINT8*)(UartAnswerData.Header));
                #ifdef USING_PRINTF1
					printf("[%d]Uart_Recv_buffer-%d: ",__LINE__,Uart_Recv_LEN);
                #endif
				#ifdef USING_PRINTF1
					printf("[%d]Uart_Recv_buffer-%d: ",__LINE__,Uart_Recv_LEN);
					for(int i=0;i<Uart_Recv_LEN-5;i++)
					{
						printf("%2x - %x ",i,*((UINT8 *)&UartAnswerData.data+i));
					}
					printf("\n");
				#endif
                if(Uart_Recv_LEN>5)
                {
                    UartRecvFlag = 1;
                    UartAnswerData.len = Uart_Recv_LEN;
                    uartBattInfoDecode(UartAnswerData.data);
					PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_IDLE);
					break;
                }
                else if(Uart_Recv_LEN==1)//接收的数据校验不过
                {
					osDelay(100);
                    UartRecvFlagCounter++;
                }
				else//没有接收到数据
				{
					osDelay(100);
                    UartRecvFlagCounter++;
				}
				if(UartRecvFlagCounter>=3)
				{
					UartRecvFlag = 0;
					UartRecvFlagCounter = 0;
					PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_INTI);
					break;
				}
                break;
            }
            case PROCESS_UART_STATE_WRITE:
            {
                UartCmdRecvFlag = Uart_WriteCmd_func(UartWriteData);
				osDelay(500);
                PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_READ);
                break;
            }
            case PROCESS_UART_STATE_UPDATE:
            {
                UartRecvFlag =  0;
				#if  BMS_MANUFACTURE==1
				{
					SP_BMS_Update_Service();
				}		
				#elif BMS_MANUFACTURE==2
					MS_BMS_Update_Service();
				#endif
				PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_IDLE);
				BMS_Fota_update_flag = FALSE;
                break;
            }
            case PROCESS_UART_STATE_SLEEP:
            {
                #ifdef USING_PRINTF
                    printf("Uart silence begin\n");
                #endif
                UartRecvFlag = 0;
				USARTdrv->PowerControl(ARM_POWER_LOW);
                while (true)
                {
                    osDelay(100);
					if(gProcess_app==WORK)
					{
						 PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_INTI);
						 break;
					}	
                }
                break;
            }
            default:
            {
                PROC_UART_STATE_SWITCH(PROCESS_UART_STATE_IDLE);
                break;
            }
        }
    }
}
//Uart写命令函数
static UINT8 Uart_WriteCmd_func(UartWriteData_S UartWriteData)
{
    UartWriteMsgType Uart_Write_Msg;
    UINT16 RegAddress = 0x0000;
    UINT16 CRC_chk_buffer;
    UINT8 timeout = 0x00;
    UINT8 Uart_Recv_Buffer[8];
    switch (UartWriteData.WriteCmd)
    {
        case 0x01://是否锁定
        {   
            RegAddress = 0x1B + AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP;
            Uart_Write_Msg.Bms_Address = BMS_ADDRESS_CODE;
            Uart_Write_Msg.Bms_Funcode = UART_WRITE_CODE;
            Uart_Write_Msg.Reg_Begin_H = RegAddress>>8;
            Uart_Write_Msg.Reg_Begin_L = RegAddress;
            Uart_Write_Msg.Reg_Num_H = 0x00;
            Uart_Write_Msg.Reg_Num_L = 0x01;
            Uart_Write_Msg.Data_Count = 0x02;//要写入的字节数
            memcpy(Uart_Write_Msg.Data,UartWriteData.Data,2);
            CRC_chk_buffer = crc_chk((UINT8 *)&Uart_Write_Msg,sizeof(Uart_Write_Msg)-2);
            Uart_Write_Msg.CRC_L = CRC_chk_buffer;
            Uart_Write_Msg.CRC_H = CRC_chk_buffer>>8;
            break;
        }
		case 0x02://是否加热
		{
			RegAddress = 0x1C + AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP;
            Uart_Write_Msg.Bms_Address = BMS_ADDRESS_CODE;
            Uart_Write_Msg.Bms_Funcode = UART_WRITE_CODE;
            Uart_Write_Msg.Reg_Begin_H = RegAddress>>8;
            Uart_Write_Msg.Reg_Begin_L = RegAddress;
            Uart_Write_Msg.Reg_Num_H = 0x00;
            Uart_Write_Msg.Reg_Num_L = 0x01;
            Uart_Write_Msg.Data_Count = 0x02;//要写入的字节数
            memcpy(Uart_Write_Msg.Data,UartWriteData.Data,2);
            CRC_chk_buffer = crc_chk((UINT8 *)&Uart_Write_Msg,sizeof(Uart_Write_Msg)-2);
            Uart_Write_Msg.CRC_L = CRC_chk_buffer;
            Uart_Write_Msg.CRC_H = CRC_chk_buffer>>8;
            break;
		}
		case 0x04://是否继电器控制
		{
			RegAddress = 0x1B + AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP;
            Uart_Write_Msg.Bms_Address = BMS_ADDRESS_CODE;
            Uart_Write_Msg.Bms_Funcode = UART_WRITE_CODE;
            Uart_Write_Msg.Reg_Begin_H = RegAddress>>8;
            Uart_Write_Msg.Reg_Begin_L = RegAddress;
            Uart_Write_Msg.Reg_Num_H = 0x00;
            Uart_Write_Msg.Reg_Num_L = 0x01;
            Uart_Write_Msg.Data_Count = 0x02;//要写入的字节数
            memcpy(Uart_Write_Msg.Data,UartWriteData.Data,2);
            CRC_chk_buffer = crc_chk((UINT8 *)&Uart_Write_Msg,sizeof(Uart_Write_Msg)-2);
            Uart_Write_Msg.CRC_L = CRC_chk_buffer;
            Uart_Write_Msg.CRC_H = CRC_chk_buffer>>8;
            break;
		}
        default:
        {
            UartWriteData.WriteCmd = 0x00;
            return 0;
            break;
        }
    }
    USARTdrv->Send((UINT8 *)&Uart_Write_Msg,sizeof(Uart_Write_Msg));
    #ifdef USING_PRINTF1
        printf("Uart_Send_buffer:  ");
        for(int i=0;i<sizeof(Uart_Write_Msg);i++)
        {
            printf("%x ",*((UINT8 *)&Uart_Write_Msg+i));
        }
        printf("\n");
    #endif
    USARTdrv->Receive(Uart_Recv_Buffer,8);
    while((isRecvTimeout == false) && (isRecvComplete == false))
    {
        timeout++;
        osDelay(100);
        if (timeout>=10)
        {
            timeout =0;
            isRecvTimeout = true;
            break;
        }
    }
    if (isRecvComplete == true)
    {
        #ifdef USING_PRINTF1
            printf("Uart_Rece_buffer: ");
            for(int i=0;i<8;i++)
            {
            printf("%x ",Uart_Recv_Buffer[i]);
            }
            printf("\n");
        #endif
        isRecvComplete = false;
        if(Uart_Recv_Buffer[1]==0x10)
        {
            return UartWriteData.WriteCmd;
        }
        else
        {
            return 0x00;
        }
    }
    else
    {
        isRecvTimeout = false;
        return 0x00;
    }
}
void Uart_Cmd_Control(QueueHandle_t UartWriteCmdHandle,UartWriteData_S UartWriteData,UartAnswerData_S UartAnswerData)
{
	UINT8 HeatSwitch = 0;
	if(TimeCounter%10==0 && BattHeaterSwitch(&HeatSwitch,10,5,10)==TRUE)
	{
		UartWriteData.WriteCmd = 0x02;
		UartWriteData.Data[0] = 0x00;
		UartWriteData.Data[1] = HeatSwitch&0xFF;
		osMessageQueuePut(UartWriteCmdHandle,&UartWriteData,0,0);
	}
	if(battWorkState ==0x00 && AppDataInfo.BattLock==TRUE && ((UartAnswerData.data[(0x1B+AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2+1])&0x01)!=0x00)//try to lock lock the discharge 
	{
		UartWriteData.WriteCmd = 0x01;
		UartWriteData.Data[0] = 0x00|(UartAnswerData.data[(0x1B+AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2]);
		UartWriteData.Data[1] = 0x02;
		osMessageQueuePut(UartWriteCmdHandle,&UartWriteData,0,0);
	}
	else if (battWorkState ==0x00 && AppDataInfo.BattLock==FALSE && ((UartAnswerData.data[(0x1B+AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2+1])&0x01)!=0x01 ) // try to unlock
	{
		UartWriteData.WriteCmd = 0x01;
		UartWriteData.Data[0] = 0x00|(UartAnswerData.data[(0x1B+AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2]);
		UartWriteData.Data[1] = 0x03;
		osMessageQueuePut(UartWriteCmdHandle,&UartWriteData,0,0);
	}
	if(AppDataInfo.RelayControl==TRUE && getbit((UartAnswerData.data[(0x09+AppNVMData.BattCellCount+AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2+1]),0)==0x00)//继电器断开
	{
		UartWriteData.WriteCmd = 0x04;
		UartWriteData.Data[0] = 0x80;
		UartWriteData.Data[1] = 0x00|(UartAnswerData.data[(0x1B+AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2+1]);
		osMessageQueuePut(UartWriteCmdHandle,&UartWriteData,0,0);
	}
	else if(AppDataInfo.RelayControl==FALSE && getbit((UartAnswerData.data[(0x09+AppNVMData.BattCellCount+AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2+1]),0)==0x01)//继电器闭合
	{
		UartWriteData.WriteCmd = 0x04;
		UartWriteData.Data[0] = 0x00;
		UartWriteData.Data[1] = 0x00|(UartAnswerData.data[(0x1B+AppNVMData.BattCellCount + AppNVMData.BattTempCount + BMS_OTHER_TEMP)*2+1]);
		osMessageQueuePut(UartWriteCmdHandle,&UartWriteData,0,0);
	}
}
//Uart发送接收函数
static UINT8 Uart_DataRecv_func(UartQueryType Uart_Read_Msg_Fun,UINT8* Uart_Recv_Buffer_Fun)
{
    UINT16 CRC_Rece_buffer = 0x00;
    UINT16 CRC_chk_buffer = 0xff;
    UINT16 Data_Len = 0 ;
    UINT8 timeout = 0x00;
	UINT8 pSendCmd[8];
	memcpy(pSendCmd,(UINT8*)(&Uart_Read_Msg_Fun),8);
	Data_Len  = ((Uart_Read_Msg_Fun.Reg_Num_H<<8)|(Uart_Read_Msg_Fun.Reg_Num_L))*2+5;
	USARTdrv->Send(pSendCmd,8);
    USARTdrv->Receive(Uart_Recv_Buffer_Fun,Data_Len);
	while(true)
    {
        timeout++;
        if((isRecvTimeout == true) || (isRecvComplete == true))
        {
            break;
        }
        else
        {
            osDelay(100);
            if (timeout>=10)
            {
                timeout =0;
                isRecvTimeout = true;
            }
        } 
    }
    if (isRecvComplete == true)
    {
        isRecvComplete = false;
        CRC_Rece_buffer =*(Uart_Recv_Buffer_Fun+Data_Len-1)<<8|*(Uart_Recv_Buffer_Fun+Data_Len-2);
        CRC_chk_buffer = crc_chk(Uart_Recv_Buffer_Fun,Data_Len-2);
	    #ifdef USING_PRINTF1
	         printf("Uart_Rece_buffer after Crc: ");
	         for(int i=0;i<Data_Len;i++)
	         {
	         	printf("%x ",*(Uart_Recv_Buffer_Fun+i));
	   	     }
	         printf("\tcrcchk:%x,%x\n ",CRC_chk_buffer,CRC_Rece_buffer);
	    #endif
        if (CRC_Rece_buffer == CRC_chk_buffer)//满足校验
        {
            return Data_Len;
        }
        else //接收数据的校验不过
        {
            memset(Uart_Recv_Buffer_Fun,0x00,Data_Len);
            return 1;
        }
    }
    else
    {
        memset(Uart_Recv_Buffer_Fun,0x00,Data_Len);
        isRecvTimeout = false;
        return 2;
    }
	return 0;
}
UINT8 Uart_Encrypt_Send()
{
	UINT8 SeedNumberArrray[4]={0x38,0x56,0xfe,0xac};
	UINT16 EncodeNumberArray[4];
	UINT8 UartEncryptBuffer[17];
	UINT8 UartDecryptBuffer[5];
	UINT16 CRC_chk_buffer;
	UINT8 timeCount = 0;
	UartEncryptBuffer[0] = BMS_ADDRESS_CODE;
	UartEncryptBuffer[1] = UART_ENCRYPT_CODE;
	UartEncryptBuffer[2] = 0x0c;
	for(int i=0;i<4;i++)
	{
		SeedNumberArrray[i]=rand();
		EncodeNumberArray[i] = encryptionAlgorithm(SeedNumberArrray[i]);
		UartEncryptBuffer[i+3] = SeedNumberArrray[i];
		UartEncryptBuffer[i*2+7] = EncodeNumberArray[i]>>8;
		UartEncryptBuffer[i*2+8] = EncodeNumberArray[i];
	}
	CRC_chk_buffer = crc_chk(UartEncryptBuffer,17-2);
	UartEncryptBuffer[15] = CRC_chk_buffer;
	UartEncryptBuffer[16] = CRC_chk_buffer>>8;
	USARTdrv->Send(UartEncryptBuffer,17);
	USARTdrv->Receive(UartDecryptBuffer,5); 
	while((isRecvTimeout == false) && (isRecvComplete == false))
	{
		timeCount++;
		osDelay(100);
		if (timeCount>=10)
		{
			timeCount =0;
			isRecvTimeout = true;
			break;
		}
	}
	#ifdef USING_PRINTF1
		printf("[%d]Uart_Encrypt_Recv: ",__LINE__);
		for(int i=0;i<5;i++)
		{
		printf("%x ",UartDecryptBuffer[i]);
		}
    #endif	
	if (isRecvComplete == true)
	{
		isRecvComplete = false;
		return UartDecryptBuffer[2];
	}
	else
	{
		isRecvTimeout = false;
		return 0x03;
	}
}
void USART_callback(uint32_t event)
{
    if(event & ARM_USART_EVENT_RX_TIMEOUT)
    {
        isRecvTimeout = true;
    }
    if(event & ARM_USART_EVENT_RECEIVE_COMPLETE)
    {
        isRecvComplete = true;
    }
}
static UINT16 crc_chk(UINT8* data, UINT8 length)
{  
    UINT8 j;
    UINT16 reg_crc=0xFFFF;
    while(length--)
    { 
        reg_crc ^= *data++;
        for(j=0;j<8;j++)
        { 
            if(reg_crc & 0x01)
            {
                reg_crc=(reg_crc>>1) ^ 0xA001;
            }
            else
            {
                reg_crc=reg_crc >>1;
            }
        }
    }
    return reg_crc;
}
void AppTaskUartInit(void *arg)
{
    osThreadAttr_t task_attr;
    memset(&task_attr,0,sizeof(task_attr));
    memset(gProcess_Uart_TaskStack, 0xA5, PROC_UART_TASK_STACK_SIZE);
    task_attr.name = "Uart_Task";
    task_attr.stack_mem = gProcess_Uart_TaskStack;
    task_attr.stack_size = PROC_UART_TASK_STACK_SIZE;
    task_attr.priority = osPriorityBelowNormal7;
    task_attr.cb_mem = &gProcess_Uart_Task_t;
    task_attr.cb_size = sizeof(StaticTask_t);
    UartTaskId = osThreadNew(UartTask, NULL, &task_attr);
}
void AppTaskUartDeInit(void *arg)
{
    osThreadTerminate(UartTaskId);
    UartTaskId = NULL;
}


/*-----------------------------------------------------------------------------*/
void SP_BMS_Update_Service() //超力源BMS升级服务
{
	
	UINT8 errorCount = 0;
	UINT8 resetCount = 0;	
	UINT16 currentPackage = 0;	
	UINT32 updateDataTotalByteLen = 0;
	UpdateStep updateStep = UPDATE_STEP_CHECK_VERSION;	
	
	UINT8 i,j,ret=0;
	UINT8 dataLen = 0;
		
	UINT8 pUpdateMsgSend[80];
	UINT32 updateMsgSendLen = 0;	
	UINT32 currentPackageStartAddr = 0;
	BMS_Update_Recv_Msg_Type pUpdateMsgRecv;
	UINT8 bmsUpdateFlag = 1;
	//BMS_Update_Recv_Msg_Type bmsMsg;
	//static UpdateStep step = UPDATE_STEP_CHECK_VERSION;
	UINT8 Cycle_conut = 0;
	while(bmsUpdateFlag && Cycle_conut<2)
	{
		switch (updateStep)
		{
			case UPDATE_STEP_CHECK_VERSION:

				dataLen = 0;
				updateMsgSendLen = 7;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x01; //read
				pUpdateMsgSend[3] = 0x03;	//data len
				pUpdateMsgSend[4] = 0x90;	//cmd
				pUpdateMsgSend[5] = 0x93;	//checksum
				pUpdateMsgSend[6] = 0xF5;	//end flag		
				//printf("updateMsgSendLen0 = %x\n",updateMsgSendLen);
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv),sizeof(BMS_Update_Recv_Msg_Type), 500);
				//printf("updateMsgSendLen1 = %x\n",updateMsgSendLen);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x90)
						{
							if(pUpdateMsgRecv.data != 0xFF)
							{
								updateStep = UPDATE_STEP_REQUEST_UPDATE;
								errorCount = 0;
							}
							else
							{
								updateStep = UPDATE_STEP_SET_BAUD_RATE;
								errorCount = 0;
							}
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}
				#ifdef USING_PRINTF1
							//printf("update step:%d\n",updateStep);
							printf("query:");
							
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");
							printf("next update step:%d\n",updateStep);
				#endif
				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				osDelay(50);
				break;
			
			case UPDATE_STEP_REQUEST_UPDATE:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x80;	//cmd
				pUpdateMsgSend[5] = 0x22;	//data
				pUpdateMsgSend[6] = 0xA6;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x80)
						{
							if(pUpdateMsgRecv.data == 0x33)
							{
								updateStep = UPDATE_STEP_START_UPDATE;
								errorCount = 0;
							}
							else
							{
								errorCount++;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				
				#ifdef USING_PRINTF1
							printf("update step:%d\n",updateStep);
							printf("query:");
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");
							printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;

			case UPDATE_STEP_START_UPDATE:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x80;	//cmd
				pUpdateMsgSend[5] = 0x55;	//data
				pUpdateMsgSend[6] = 0xD9;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), 0, 500);
				//updateStep = UPDATE_STEP_SET_BAUD_RATE;
				updateStep = UPDATE_STEP_CHECK_VERSION_AGAIN;//2021-04-09跳过波特率设置
				#ifdef USING_PRINTF1
							
							printf("query:");
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							
							printf("\n");		
							printf("next update step:%d\n",updateStep);
				#endif
				break;
			case UPDATE_STEP_CHECK_VERSION_AGAIN:
				dataLen = 0;
				updateMsgSendLen = 7;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x01; //read
				pUpdateMsgSend[3] = 0x03;	//data len
				pUpdateMsgSend[4] = 0x90;	//cmd
				pUpdateMsgSend[5] = 0x93;	//checksum
				pUpdateMsgSend[6] = 0xF5;	//end flag		
				//printf("updateMsgSendLen0 = %x\n",updateMsgSendLen);
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv),sizeof(BMS_Update_Recv_Msg_Type), 100);
				//printf("updateMsgSendLen1 = %x\n",updateMsgSendLen);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x90)
						{
							if(pUpdateMsgRecv.data != 0xFF)
							{
								updateStep = UPDATE_STEP_RESET;
								errorCount = 0;
							}
							else
							{
								updateStep = UPDATE_STEP_SET_BAUD_RATE;
								errorCount = 0;
							}
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}
				#ifdef USING_PRINTF1
							//printf("update step:%d\n",updateStep);
							printf("query:");
							
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");
							printf("next update step:%d\n",updateStep);
				#endif
				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				osDelay(50);
				break;
			case UPDATE_STEP_SET_BAUD_RATE:
				printf("start step %d\n",updateStep);
				dataLen = 4;
				updateMsgSendLen = 12;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x08;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0x33;	//data
				pUpdateMsgSend[6] = 0x00;	//baud rate:9600
				pUpdateMsgSend[7] = 0x00;
				pUpdateMsgSend[8] = 0x25;
				pUpdateMsgSend[9] = 0x80;
				pUpdateMsgSend[10] = 0x61;	//check
				pUpdateMsgSend[11] = 0xF5;	//end flag
				#ifdef USING_PRINTF1
				printf("query:");
				for(j=0;j<updateMsgSendLen;j++)
				{
					printf("%x ",pUpdateMsgSend[j]);
				}
				printf("\n");
				#endif
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
				printf("ret = %d\n",ret);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x81)
						{
							if(pUpdateMsgRecv.data == 0x11)
							{
								updateStep = UPDATE_STEP_PREPARE_SEND_DATA_LEN;
								errorCount = 0;
							}
							else
							{
								errorCount++;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				
				#ifdef USING_PRINTF1
					//printf("update step:%d\n",updateStep);
					printf("query:");
					for(j=0;j<updateMsgSendLen;j++)
					{
						printf("%x ",pUpdateMsgSend[j]);
					}
					printf("\nanswer:");
					for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
					{
						printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
					}
					printf("\n");
					printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;
			
			
			case UPDATE_STEP_PREPARE_SEND_DATA_LEN:
				printf("start step %d\n",updateStep);
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0x44;	//data
				pUpdateMsgSend[6] = 0xC9;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x81)
						{
							if(pUpdateMsgRecv.data == 0x11)
							{
								updateStep = UPDATE_STEP_SEND_DATA_LEN;
								errorCount = 0;
							}
							else
							{
								errorCount++;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				
				#ifdef USING_PRINTF1
					//printf("update step:%d\n",updateStep);
					printf("query:");
					for(j=0;j<updateMsgSendLen;j++)
					{
						printf("%x ",pUpdateMsgSend[j]);
					}
					printf("\nanswer:");
					for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
					{
						printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
					}
					printf("\n");	
					printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;		
			case UPDATE_STEP_SEND_DATA_LEN:
				
				dataLen = 4;
				BSP_QSPI_Read_Safe(&updateDataTotalByteLen,FLASH_BMS_FOTA_START_ADDR,4);
				updateDataTotalByteLen = (((updateDataTotalByteLen)&0xFF)<<24)|(((updateDataTotalByteLen>>8)&0xFF)<<16)|(((updateDataTotalByteLen>>16)&0xFF)<<8)|(((updateDataTotalByteLen>>24)&0xFF));
				updateMsgSendLen = 11;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x07;	//data len
				pUpdateMsgSend[4] = 0x82;	//cmd
				pUpdateMsgSend[5] = (updateDataTotalByteLen>>24)&0xFF;	//data: package byte len
				pUpdateMsgSend[6] = (updateDataTotalByteLen>>16)&0xFF;	
				pUpdateMsgSend[7] = (updateDataTotalByteLen>>8)&0xFF;	
				pUpdateMsgSend[8] = (updateDataTotalByteLen)&0xFF;
				pUpdateMsgSend[9] = SP_BMS_Update_CheckSUM(&pUpdateMsgSend[3], dataLen+2);	//check sum
				pUpdateMsgSend[10] = 0xF5;	//end flag
				
				memset((UINT8*)(&pUpdateMsgRecv),0,sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x81)
						{
							if(pUpdateMsgRecv.data == 0x11)
							{
								updateStep = UPDATE_STEP_PREPARE_SEND_UPDATE_DATA;
								errorCount = 0;
							}
							else
							{
								errorCount++;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				
				#ifdef USING_PRINTF1
							//printf("update step:%d\n",updateStep);
							printf("query:");
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");
							printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;	
				
			case UPDATE_STEP_PREPARE_SEND_UPDATE_DATA:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0x55;	//data
				pUpdateMsgSend[6] = 0xDA;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen,(UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x81)
						{
							if(pUpdateMsgRecv.data == 0x11)
							{
								updateStep = UPDATE_STEP_SEND_UPDATE_DATA;
								errorCount = 0;
							}
							else
							{
								errorCount++;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				
				#ifdef USING_PRINTF1
					//printf("update step:%d\n",updateStep);
					printf("query:");
					for(j=0;j<updateMsgSendLen;j++)
					{
						printf("%x ",pUpdateMsgSend[j]);
					}
					printf("\nanswer:");
					for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
					{
						printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
					}
					printf("\n");	
					printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;
			case UPDATE_STEP_SEND_UPDATE_DATA:
				dataLen = 64;
				updateMsgSendLen = 75;
							
				for(currentPackage=0;currentPackage<updateDataTotalByteLen/64;currentPackage++)
				{
					currentPackageStartAddr = currentPackage*64;
				
					pUpdateMsgSend[0] = 0xEB; //start flag
					pUpdateMsgSend[1] = 0x01;	//add flag
					pUpdateMsgSend[2] = 0x00; //write
					pUpdateMsgSend[3] = 0x47;	//data len			
					pUpdateMsgSend[4] = 0x82;	//cmd
					pUpdateMsgSend[5] = (currentPackageStartAddr>>24)&0xFF;
					pUpdateMsgSend[6] = (currentPackageStartAddr>>16)&0xFF;
					pUpdateMsgSend[7] = (currentPackageStartAddr>>8)&0xFF;
					pUpdateMsgSend[8] = currentPackageStartAddr&0xFF;
					BSP_QSPI_Read_Safe(&pUpdateMsgSend[9], FLASH_BMS_FOTA_START_ADDR+4+currentPackage*dataLen, dataLen);  //data			
					pUpdateMsgSend[8+dataLen+1] = SP_BMS_Update_CheckSUM(&pUpdateMsgSend[3], dataLen+6);  //check sum
					pUpdateMsgSend[8+dataLen+2] = 0xF5;	//end flag
					memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
					ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
					if(ret!=0)
					{
						if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
						{
							if(pUpdateMsgRecv.cmd == 0x81)
							{
								if(pUpdateMsgRecv.data == 0x11)
								{
									if(currentPackage+1 == updateDataTotalByteLen/64)
									{
										updateStep = UPDATE_STEP_SEND_DATA_END;
									}
									errorCount = 0;
								}
								else
								{
									errorCount++;
								}						
							}
							else
							{
								errorCount++;
							}
						}
						else
						{
							errorCount++;
						}
					}			
					else
					{
						errorCount++;
					}

					if(errorCount>10)
					{					
						updateStep = UPDATE_STEP_RESET;
						errorCount = 0;
						break;
					}
				#ifdef USING_PRINTF1
							//printf("update step:%d\n",updateStep);
							printf("query:");
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");
							printf("next update step:%d\n",updateStep);
				#endif
				}
				osDelay(50);
				break;

			case UPDATE_STEP_SEND_DATA_END:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0x66;	//data
				pUpdateMsgSend[6] = 0xEB;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				ret = SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), sizeof(BMS_Update_Recv_Msg_Type), 500);
				if(ret!=0)
				{
					if(pUpdateMsgRecv.startFlag == 0xEB && pUpdateMsgRecv.endFlag == 0xF5)
					{
						if(pUpdateMsgRecv.cmd == 0x81)
						{
							if(pUpdateMsgRecv.data == 0x11)
							{
								updateStep = UPDATE_STEP_START_INSTALL;
								errorCount = 0;
							}
							else
							{
								errorCount++;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = UPDATE_STEP_RESET;
					errorCount = 0;
				}
				
				#ifdef USING_PRINTF1
							//printf("update step:%d\n",updateStep);
							printf("query:");
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");
							printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;			

			case UPDATE_STEP_START_INSTALL:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0x99;	//data
				pUpdateMsgSend[6] = 0x1E;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), 0, 500);
				
				updateStep = UPDATE_STEP_END;
				
				#ifdef USING_PRINTF1
							//printf("update step:%d\n",updateStep);
							printf("query:");
							for(j=0;j<updateMsgSendLen;j++)
							{
								printf("%x ",pUpdateMsgSend[j]);
							}
							printf("\nanswer:");
							for(j=0;j<sizeof(BMS_Update_Recv_Msg_Type);j++)
							{
								printf("%x ",*(((UINT8*)&pUpdateMsgRecv)+j));
							}
							printf("\n");	
							printf("next update step:%d\n",updateStep);
				#endif
				osDelay(50);
				break;
			case UPDATE_STEP_END:
				updateStep = UPDATE_STEP_CHECK_VERSION;
				printf("update end\n");
				bmsUpdateFlag = 0;
				break;
			case UPDATE_STEP_RESET:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0xAA;	//data
				pUpdateMsgSend[6] = 0x2F;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), 0, 500);
				osDelay(50);
				
				resetCount++;
				if(resetCount>=2)
				{
					updateStep = UPDATE_STEP_DOWNLOAD_BREAK_OFF;
					resetCount = 0;
				}
				else
				{
					updateStep = UPDATE_STEP_PREPARE_SEND_DATA_LEN;
				}
			#ifdef USING_PRINTF
				printf("update error!!\n rest and start send data lenth again!!\n continue update!\n");
			#endif
				break;
			case UPDATE_STEP_DOWNLOAD_BREAK_OFF:
				dataLen = 1;
				updateMsgSendLen = 8;
				pUpdateMsgSend[0] = 0xEB; //start flag
				pUpdateMsgSend[1] = 0x01;	//add flag
				pUpdateMsgSend[2] = 0x00; //write
				pUpdateMsgSend[3] = 0x04;	//data len
				pUpdateMsgSend[4] = 0x81;	//cmd
				pUpdateMsgSend[5] = 0xBB;	//data
				pUpdateMsgSend[6] = 0x40;	//check
				pUpdateMsgSend[7] = 0xF5;	//end flag
				memset((UINT8*)(&pUpdateMsgRecv) , 0, sizeof(BMS_Update_Recv_Msg_Type));
				SP_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(&pUpdateMsgRecv), 0, 500);
				osDelay(50);
				updateStep = UPDATE_STEP_CHECK_VERSION;
				Cycle_conut++;
				break;
			case UPDATE_STEP_ERROR:
				updateStep = UPDATE_STEP_CHECK_VERSION;
				printf("update error end\n");
				bmsUpdateFlag = 0;
			break;

			default:
				updateStep = UPDATE_STEP_CHECK_VERSION;
				printf("update default end\n");
				bmsUpdateFlag = 0;
			break;
		}
	}
}

UINT8 SP_BMS_Update_Query(UINT8* pSend,UINT32 sendLen, UINT8* pRead, UINT32 readLen, UINT32 timeout)
{

	UINT8 timeCount = 0;
	UINT8 j=0;
	USARTdrv->Send(pSend,sendLen);
	#ifdef USING_PRINTF1
		printf("query in:");
		for(j=0;j<sendLen;j++)
		{
			printf("%x ",*(pSend+j));
		}
		printf("\n");	
	#endif
	if(readLen>0)
	{
		USARTdrv->Receive(pRead,readLen);         
		while((isRecvTimeout == false) && (isRecvComplete == false))
		{
			timeCount++;
			osDelay(100);
			if (timeCount>=timeout/100)
			{
				timeCount =0;
				isRecvTimeout = true;
				break;
			}
		}
		#ifdef USING_PRINTF1
			printf("\nanswer in:");
			for(j=0;j<readLen;j++)
			{
				printf("%x ",*(pRead+j));
			}
			printf("\n");
		#endif	
		if (isRecvComplete == true)
		{
			isRecvComplete = false;
			if(*(pRead+0)!=0xEB)
			{
				USARTdrv->Uninitialize();
				osDelay(100);
				USARTdrv->Initialize(USART_callback);
				USARTdrv->PowerControl(ARM_POWER_FULL);
				USARTdrv->Control(ARM_USART_MODE_ASYNCHRONOUS |
						ARM_USART_DATA_BITS_8 |
						ARM_USART_PARITY_NONE |
						ARM_USART_STOP_BITS_1 |
						ARM_USART_FLOW_CONTROL_NONE, 9600);
				#ifdef USING_PRINTF
					printf("\nuart reset in \n");	
				#endif
				return  0;
			}
			return readLen;
		}
		else
		{
			memset(pRead,0x00,readLen);
			isRecvTimeout = false;
			return 0;
		}
	}
	else
	{
			return 1;
	}
}
UINT8 SP_BMS_Update_CheckSUM(UINT8* pSendData,UINT8 len)
{
	UINT8 ret = 0;
	UINT8 i=0;
	for(i=0;i<len;i++)
	{
			ret +=*(pSendData+i);
	}
	return ret&0xFF;
}
//________________________________________________________________________________
updateBMSStatus MS_BMS_Update_Service() //美顺BMS升级服务
{
	#ifdef USING_PRINTF
		UINT8 ii = 0;
	#endif
	
	UINT8 errorCount = 0;	
	UINT16 currentPackage = 0;	
	UINT32 updateDataTotalByteLen = 0;
	UINT16 updateDataPackageCount = 0;
	UINT8  ReadNVMTemp[64];
	UpdateStep_MS_BMS updateStep = MS_UPDATE_STEP_SEND_FIRMWARE_UPDATE_REQUEST_AND_JUMP_TO_BOOTLOADER;	
	
	
	UINT16 i,j=0;
	UINT8 dataLen = 0;
	UINT8 ret0 = 0;
	updateBMSStatus ret = updateFailed;
		
	UINT8 pUpdateMsgSend[80];
	UINT32 updateMsgSendLen = 0;
	UINT32 updateMsgReadLen = 0;
	
	BOOL bmsUpdateFlag = TRUE;
	UINT8 bmsAnswerMsg[8];
	
	//static UpdateStep step = UPDATE_STEP_CHECK_VERSION;
	UINT8 Cycle_conut = 0;
	UINT16 CRCtemp = 0;
	UINT8 headerLen = 5;

	UINT8 checkSum = 0x00;
	UINT8 checkSumCal = 0x00;
	UINT8 tempLen = 0x00;	

	BSP_QSPI_Read_Safe(&checkSum,FLASH_BMS_FOTA_START_ADDR,1);

	memset(ReadNVMTemp, 0, 64);
	BSP_QSPI_Read_Safe(ReadNVMTemp, FLASH_BMS_FOTA_START_ADDR+1, 4);  //data

	updateDataTotalByteLen = ((ReadNVMTemp[0]<<24)&0xFF000000) | ((ReadNVMTemp[1]<<16)&0xFF0000) | ((ReadNVMTemp[2]<<8)&0xFF00) | (ReadNVMTemp[3]&0xFF) ;
	updateDataPackageCount = (updateDataTotalByteLen+(64-1))/64;  //进一法 e = (a+(b-1))/b	

	for(i=0; i<((updateDataTotalByteLen+4)+(64-1))/64;i++)
	{
		memset(ReadNVMTemp, 0, 64);
		if((i+1)*64 < (updateDataTotalByteLen+4))
		{	
			tempLen = 64;
			BSP_QSPI_Read_Safe(ReadNVMTemp,FLASH_BMS_FOTA_START_ADDR+1+i*64,64);
		}
		else
		{
			tempLen = (updateDataTotalByteLen+4) - i*64;
			BSP_QSPI_Read_Safe(ReadNVMTemp,FLASH_BMS_FOTA_START_ADDR+1+i*64,tempLen);
		}
		
		for(j = 0; j< tempLen; j++)
		{
			checkSumCal = (checkSumCal + ReadNVMTemp[j]) & 0xFF;
		}
		//osDelay(10);
	}
	if(checkSum != checkSumCal)
	{
		#ifdef USING_PRINTF
			printf("checksum error: checksum = %x, checksumCal = %x\n",checkSum,checkSumCal);
		#endif
		ret = updateErrorCheckSumError;	
		return ret;
	}
	else
	{
		#ifdef USING_PRINTF
			printf("checksum OK: checksum = %x, checksumCal = %x\n",checkSum,checkSumCal);
		#endif
	}

	#ifdef USING_PRINTF
		printf(" bmsUpdateFlag = %x, Cycle_conut = %x\n",bmsUpdateFlag,Cycle_conut);
	#endif
	while(bmsUpdateFlag && Cycle_conut<2)
	{
		#ifdef USING_PRINTF
			printf("update ms bms step %d\n:",updateStep);				
		#endif
		switch (updateStep)
		{
			
			case MS_UPDATE_STEP_SEND_FIRMWARE_UPDATE_REQUEST_AND_JUMP_TO_BOOTLOADER:  //0x01				
				dataLen = 0x00;
				updateMsgSendLen = 6+dataLen;
				updateMsgReadLen = 8;
				
				pUpdateMsgSend[0] = 0x01; //node byte
				pUpdateMsgSend[1] = 0x40;	//func byte
				pUpdateMsgSend[2] = updateStep; //cmd byte
				pUpdateMsgSend[3] = dataLen;	//data len
											//no data type
				CRCtemp = MS_BMS_Update_CRC16(pUpdateMsgSend, 4);
				pUpdateMsgSend[4] = (CRCtemp>>8)&0xFF; // CRC High
				pUpdateMsgSend[5] = CRCtemp&0xFF;		//CRC Low
				
				memset((UINT8*)(bmsAnswerMsg) , 0, 8);
				ret0 = MS_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(bmsAnswerMsg), updateMsgReadLen, 500);
				#ifdef USING_PRINTF
				printf("update step 1 answer,updateMsgReadLen = %x:\n",updateMsgReadLen);
				
				 for(ii=0;ii<updateMsgReadLen;ii++)
					printf("%x ",bmsAnswerMsg[ii]);

					printf("\nret0 = %d",ret0);
					printf("\n");
				#endif
				if(ret0!=0)
				{
					if(bmsAnswerMsg[0] == 0x01 && bmsAnswerMsg[1] == 0x40)  // node and func byte
					{
						if(bmsAnswerMsg[2] == MS_UPDATE_STEP_FIRMWARE_UPDATE_REQUEST_ANSWER && bmsAnswerMsg[3] == 0x02)	//answer cmd byte:0x02, answer data len:0x02
						{
							if(bmsAnswerMsg[4] == 0x00)	//answer data byte1
							{
								if(bmsAnswerMsg[5] == 0x00)	//answer data byte2
								{
									updateStep = MS_UPDATE_STEP_SEND_FIRMWARE_INFO;
									errorCount = 0;
								}
							}
							else if(bmsAnswerMsg[4] == 0x01) //不允许升级
							{
								if(bmsAnswerMsg[5] == 0x01)//电量过低
								{
									updateStep = MS_UPDATE_STEP_ERROR;
									ret = updateErrorBMSPowerLow;
								}
								else if(bmsAnswerMsg[5] == 0x02)//电池存在保护状态不允许升级
								{
									updateStep = MS_UPDATE_STEP_ERROR;
									ret = updateErrorBMSWarningProtect;
								}
								else if(bmsAnswerMsg[5] == 0x03) //不支持升级
								{
									updateStep = MS_UPDATE_STEP_ERROR;
									ret = updateErrorBMSNotSurport;
								}
								else if(bmsAnswerMsg[5] == 0x04) //当前电池处于充放电状态
								{
									updateStep = MS_UPDATE_STEP_ERROR;
									ret = updateErrorBMSWorkState;
								}
								else
								{
									errorCount++;
								}
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = MS_UPDATE_STEP_ERROR;
					errorCount = 0;
				}								
				osDelay(50);
				printf(" step 1 ret = %d\n",ret);
				break;
			case MS_UPDATE_STEP_SEND_FIRMWARE_INFO:  //0x03
				dataLen = 52;
				updateMsgSendLen = 6+dataLen;
				updateMsgReadLen = 7;
				pUpdateMsgSend[0] = 0x01; //node byte
				pUpdateMsgSend[1] = 0x40;	//func byte
				pUpdateMsgSend[2] = updateStep; //cmd byte
				pUpdateMsgSend[3] = dataLen;	//data len

				memset(ReadNVMTemp, 0, 64);
				BSP_QSPI_Read_Safe(ReadNVMTemp, FLASH_BMS_FOTA_START_ADDR+headerLen, 16);	//data
				MEMCPY(&pUpdateMsgSend[4], ReadNVMTemp, 16);  //厂家信息，未开启校验
				MEMCPY(&pUpdateMsgSend[4+16], ReadNVMTemp, 16);	//保护板硬件序列号，未开启校验
				pUpdateMsgSend[4+16*2 + 0] = (updateDataTotalByteLen>>24)&0xFF;	//固件包大小
				pUpdateMsgSend[4+16*2 + 1] = (updateDataTotalByteLen>>16)&0xFF;
				pUpdateMsgSend[4+16*2 + 2] = (updateDataTotalByteLen>>8)&0xFF;
				pUpdateMsgSend[4+16*2 + 3] = (updateDataTotalByteLen)&0xFF;				
				MEMCPY(&pUpdateMsgSend[4+16*2+4], ReadNVMTemp, 16); // 固件包头信息，未开启校验
				
				CRCtemp = MS_BMS_Update_CRC16(pUpdateMsgSend, 4+dataLen);
				
				pUpdateMsgSend[4+dataLen] = (CRCtemp>>8)&0xFF; // CRC High
				pUpdateMsgSend[5+dataLen] = CRCtemp&0xFF;		//CRC Low
				
				memset((UINT8*)(bmsAnswerMsg) , 0, 8);
				ret0 = MS_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(bmsAnswerMsg), updateMsgReadLen, 500);
				#ifdef USING_PRINTF1
				printf("update step 3 answer:\n");
				 for(ii=0;ii<updateMsgReadLen;ii++)
					printf("%x ",bmsAnswerMsg[ii]);

					printf("\nret0 = %d",ret0);
					printf("\n");
				#endif
				if(ret0!=0)
				{
					if(bmsAnswerMsg[0] == 0x01 && bmsAnswerMsg[1] == 0x40)  // node and func byte
					{
						if(bmsAnswerMsg[2] == MS_UPDATE_STEP_FIRMWARE_INFO_CHECK_AND_UPDATE_REQEST_ANSWER && bmsAnswerMsg[3] == 0x01)	//answer cmd byte:0x04, answer data len:0x01
						{
							if(bmsAnswerMsg[4] == 0x00)	//answer data byte1
							{								
								updateStep = MS_UPDATE_STEP_EREASE_APP_FLASH_REQUEST;
								errorCount = 0;
							}
							else if(bmsAnswerMsg[4] == 0x01) //厂家信息错误
							{
								errorCount++;
								ret = updateErrorFirmwareInfoError;
							}		
							else if(bmsAnswerMsg[4] == 0x02) //硬件序列号不匹配
							{
								errorCount++;
								ret = updateErrorFirmwareInfoError;
							}
							else if(bmsAnswerMsg[4] == 0x03) //固件大小超出范围
							{
								errorCount++;
								ret = updateErrorFirmwareSizeError;
							}
							else if(bmsAnswerMsg[4] == 0x04) //固件包头信息错误
							{
								errorCount++;
								ret = updateErrorFirmwareInfoError;
							}
							else
							{
								errorCount++;
							}
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = MS_UPDATE_STEP_ERROR;
					errorCount = 0;
				}		
				printf(" step 3 ret = %d\n",ret);
				osDelay(50);
				break;
			case MS_UPDATE_STEP_EREASE_APP_FLASH_REQUEST:  //0x05
				dataLen = 0;
				updateMsgSendLen = 6+dataLen;
				updateMsgReadLen = 8;
				pUpdateMsgSend[0] = 0x01; //node byte
				pUpdateMsgSend[1] = 0x40;	//func byte
				pUpdateMsgSend[2] = updateStep; //cmd byte
				pUpdateMsgSend[3] = dataLen;	//data len				
				
				CRCtemp = MS_BMS_Update_CRC16(pUpdateMsgSend, 4+dataLen);
				
				pUpdateMsgSend[4+dataLen] = (CRCtemp>>8)&0xFF; // CRC High
				pUpdateMsgSend[5+dataLen] = CRCtemp&0xFF;		//CRC Low
				
				memset((UINT8*)(bmsAnswerMsg) , 0, 8);
				ret0 = MS_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(bmsAnswerMsg), updateMsgReadLen, 500);
				#ifdef USING_PRINTF1
				printf("update step 5 answer:\n");
				 for(ii=0;ii<updateMsgReadLen;ii++)
					printf("%x ",bmsAnswerMsg[ii]);

					printf("\nret0 = %d",ret0);
					printf("\n");
				#endif
				if(ret0!=0)
				{
					if(bmsAnswerMsg[0] == 0x01 && bmsAnswerMsg[1] == 0x40)  // node and func byte
					{
						if(bmsAnswerMsg[2] == MS_UPDATE_STEP_EREASE_FLASH_ANSWER && bmsAnswerMsg[3] == 0x02)	//answer cmd byte:0x06, answer data len:0x02
						{
							if(bmsAnswerMsg[4] == 0x00)	//answer data byte1, erease successed
							{								
								updateStep = MS_UPDATE_STEP_SEND_UPDATE_DATA; //0x07
								errorCount = 0;
							}
							else if(bmsAnswerMsg[4] == 0x01) //擦除失败
							{
								errorCount++;
								ret = updateErrorAppErease;
							}							
							else
							{
								errorCount++;
							}
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>10)
				{
					updateStep = MS_UPDATE_STEP_ERROR;
					errorCount = 0;
				}								
				osDelay(50);
				break;
			case MS_UPDATE_STEP_SEND_UPDATE_DATA:  //0x07
				
				updateMsgReadLen = 7;
				pUpdateMsgSend[0] = 0x01; //node byte
				pUpdateMsgSend[1] = 0x40;	//func byte
				pUpdateMsgSend[2] = updateStep; //cmd byte
				
				for(i = 0; i < updateDataPackageCount ; i++ )	
				{					
					

					memset(ReadNVMTemp, 0, 64);
					
					if((i+1)*64 < (updateDataTotalByteLen))
					{	
						tempLen = 64;
						BSP_QSPI_Read_Safe(ReadNVMTemp,FLASH_BMS_FOTA_START_ADDR+headerLen+i*64,64);
					}
					else
					{
						tempLen = (updateDataTotalByteLen) - i*64;
						BSP_QSPI_Read_Safe(ReadNVMTemp,FLASH_BMS_FOTA_START_ADDR+headerLen+i*64,tempLen);
					}

					CRCtemp = MS_BMS_Update_CRC16(ReadNVMTemp, tempLen);

					dataLen = tempLen+6;  //data len =count(2+2 byte) + crc(2byte) +  update data len
					updateMsgSendLen = 6+dataLen; // updateMsgSendLen = data len + header len(6byte)

					pUpdateMsgSend[3] = dataLen;	//data len
					
					pUpdateMsgSend[4] = ((i+1)>>8)&0xFF;  //当前包序号，大端模式
					pUpdateMsgSend[5] = (i+1)&0xFF;

					pUpdateMsgSend[6] = (updateDataPackageCount>>8)&0xFF;
					pUpdateMsgSend[7] = updateDataPackageCount&0xFF;
					pUpdateMsgSend[8] = (CRCtemp>>8)&0xFF; // data CRC High
					pUpdateMsgSend[9] = CRCtemp&0xFF;		//data CRC Low					
					
					MEMCPY(&pUpdateMsgSend[4+6], ReadNVMTemp, 64);  //升级数据，64字节
					
					
					CRCtemp = MS_BMS_Update_CRC16(pUpdateMsgSend, 4+dataLen);
					
					pUpdateMsgSend[4+dataLen] = (CRCtemp>>8)&0xFF; // CRC High
					pUpdateMsgSend[5+dataLen] = CRCtemp&0xFF;		//CRC Low
					
					memset((UINT8*)(bmsAnswerMsg) , 0, 8);
					ret0 = MS_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(bmsAnswerMsg), updateMsgReadLen, 500);
					#ifdef USING_PRINTF1
						printf("update step 7 answer:\n");
					 for(ii=0;ii<updateMsgReadLen;ii++)
						printf("%x ",bmsAnswerMsg[ii]);

						printf("\nret0 = %d",ret0);
						printf("\n");
					#endif
					if(ret0!=0)
					{
						if(bmsAnswerMsg[0] == 0x01 && bmsAnswerMsg[1] == 0x40)  // node and func byte
						{
							if(bmsAnswerMsg[2] == MS_UPDATE_STEP_UPDATE_DATA_WRITE_ANSWER && bmsAnswerMsg[3] == 0x01)	//answer cmd byte:0x04, answer data len:0x01
							{
								if(bmsAnswerMsg[4] == 0x00)	//answer data byte1,接收并操作成功
								{								
									updateStep = MS_UPDATE_STEP_EREASE_APP_FLASH_REQUEST;
									errorCount = 0;
								}
								else if(bmsAnswerMsg[4] == 0x01) //固件块校验失败
								{
									errorCount=10;
									ret = updateErrorPackageCRC;
								}		
								else if(bmsAnswerMsg[4] == 0x02) //烧写失败
								{
									errorCount=10;
									ret = updateErrorPackageWrite;
								}
								else if(bmsAnswerMsg[4] == 0x03) //固件块编号异常
								{
									errorCount=10;
									ret = updateErrorPackageNo;
								}								
								else
								{
									errorCount=10;
								}
							}
							else
							{
								errorCount=10;
							}
						}
						else
						{
							errorCount=10;
						}
					}			
					else
					{
						errorCount=10;
					}

					if(errorCount>=10)
					{
						updateStep = MS_UPDATE_STEP_ERROR;
						errorCount = 0;
						i--;
						break;
					}								
					osDelay(50);
				}
				if(i == updateDataPackageCount)
				{
					updateStep = MS_UPDATE_STEP_SEND_UPDATE_DATA_END_AND_JUMP_TO_APP;
				}
				break;
			case MS_UPDATE_STEP_SEND_UPDATE_DATA_END_AND_JUMP_TO_APP:  //0x09
				dataLen = 0x00;
				updateMsgSendLen = 6+dataLen;
				updateMsgReadLen = 7;
				
				pUpdateMsgSend[0] = 0x01; //node byte
				pUpdateMsgSend[1] = 0x40;	//func byte
				pUpdateMsgSend[2] = updateStep; //cmd byte
				pUpdateMsgSend[3] = dataLen;	//data len
											//no data type
				CRCtemp = MS_BMS_Update_CRC16(pUpdateMsgSend, 4);
				pUpdateMsgSend[4] = (CRCtemp>>8)&0xFF; // CRC High
				pUpdateMsgSend[5] = CRCtemp&0xFF;		//CRC Low
				
				memset((UINT8*)(bmsAnswerMsg) , 0, 8);
				ret0 = MS_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(bmsAnswerMsg), updateMsgReadLen, 500);
				#ifdef USING_PRINTF1
				printf("update step 9 answer:\n");
				 for(ii=0;ii<updateMsgReadLen;ii++)
					printf("%x ",bmsAnswerMsg[ii]);

					printf("\nret0 = %d",ret0);
					printf("\n");
				#endif
				if(ret0!=0)
				{
					if(bmsAnswerMsg[0] == 0x01 && bmsAnswerMsg[1] == 0x40)  // node and func byte
					{
						if(bmsAnswerMsg[2] == MS_UPDATE_STEP_JUMP_TO_APP_ANSWER && bmsAnswerMsg[3] == 0x01)	//answer cmd byte:0x0A, answer data len:0x01
						{
							if(bmsAnswerMsg[4] == 0x00)	//answer data byte1, update succeed
							{
								errorCount = 0;
								updateStep = MS_UPDATE_STEP_READ_CURRENT_RUNNING_MODE; //0x0B
							}
							else if(bmsAnswerMsg[4] == 0x01) //升级失败
							{
								errorCount = 10;
								ret = updateFailed;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>=10)
				{
					updateStep = MS_UPDATE_STEP_ERROR;
					errorCount = 0;
				}								
				osDelay(50);
				break;
			case MS_UPDATE_STEP_READ_CURRENT_RUNNING_MODE:  //0x0B
				dataLen = 0x00;
				updateMsgSendLen = 6+dataLen;
				updateMsgReadLen = 8;
				
				pUpdateMsgSend[0] = 0x01; //node byte
				pUpdateMsgSend[1] = 0x40;	//func byte
				pUpdateMsgSend[2] = updateStep; //cmd byte
				pUpdateMsgSend[3] = dataLen;	//data len
											//no data type
				CRCtemp = MS_BMS_Update_CRC16(pUpdateMsgSend, 4);
				pUpdateMsgSend[4] = (CRCtemp>>8)&0xFF; // CRC High
				pUpdateMsgSend[5] = CRCtemp&0xFF;		//CRC Low
				
				memset((UINT8*)(bmsAnswerMsg) , 0, 8);
				ret0 = MS_BMS_Update_Query(pUpdateMsgSend, updateMsgSendLen, (UINT8*)(bmsAnswerMsg), updateMsgReadLen, 500);
				#ifdef USING_PRINTF1
				printf("update step A answer:\n");
				 for(ii=0;ii<updateMsgReadLen;ii++)
					printf("%x ",bmsAnswerMsg[ii]);

					printf("\nret0 = %d",ret0);
					printf("\n");
				#endif
				if(ret0!=0)
				{
					if(bmsAnswerMsg[0] == 0x01 && bmsAnswerMsg[1] == 0x40)  // node and func byte
					{
						if(bmsAnswerMsg[2] == MS_UPDATE_STEP_CURRENT_RUNNING_MODE_ANSWER && bmsAnswerMsg[3] == 0x02)	//answer cmd byte:0x0C, answer data len:0x02
						{
							if(bmsAnswerMsg[4] == 0x01)	//answer data byte1, update succeed, app is running
							{
								errorCount = 0;
								updateStep = MS_UPDATE_STEP_END;
							}
							else if(bmsAnswerMsg[4] == 0x00) //update failed , boot is running，error
							{
								errorCount = 10;
							}						
						}
						else
						{
							errorCount++;
						}
					}
					else
					{
						errorCount++;
					}
				}			
				else
				{
					errorCount++;
				}

				if(errorCount>=3)
				{
					updateStep = MS_UPDATE_STEP_ERROR;
					errorCount = 0;
				}								
				osDelay(50);
				break;
			case MS_UPDATE_STEP_END: //0x0D
				errorCount = 0;
				bmsUpdateFlag = FALSE;
				ret = updateOK;
				break;
			case MS_UPDATE_STEP_ERROR:	//0x0E
				errorCount = 0;
				bmsUpdateFlag = true;
				Cycle_conut++;
				if(Cycle_conut>2)
				{
					ret = updateErrorTimeout;
					bmsUpdateFlag = FALSE;
				}
				break;
			default:
				bmsUpdateFlag = FALSE;
				break;
		}
	}
	#ifdef USING_PRINTF
		printf("last ret = %x\n",ret);
	#endif
	return ret;

}
UINT8 MS_BMS_Update_Query(UINT8* pSend,UINT32 sendLen, UINT8* pRead, UINT32 readLen, UINT32 timeout)
{

	UINT8 timeCount = 0;
	UINT8 j=0;
	USARTdrv->Send(pSend,sendLen);
	#ifdef USING_PRINTF1
		printf("query in:");
		for(j=0;j<sendLen;j++)
		{
			printf("%x ",*(pSend+j));
		}
		printf("\n");	
	#endif
	if(readLen>0)
	{
		USARTdrv->Receive(pRead,readLen);         
		while((isRecvTimeout == false) && (isRecvComplete == false))
		{
			timeCount++;
			osDelay(100);
			if (timeCount>=timeout/100)
			{
				timeCount =0;
				isRecvTimeout = true;
				break;
			}
		}
		#ifdef USING_PRINTF1
			printf("\nanswer in:");
			for(j=0;j<readLen;j++)
			{
				printf("%x ",*(pRead+j));
			}
			printf("\n");
		#endif	
		if (isRecvComplete == true)
		{
			isRecvComplete = false;
			if(*(pRead+0)!=0x01)
			{
				USARTdrv->Uninitialize();
				osDelay(100);
				USARTdrv->Initialize(USART_callback);
				USARTdrv->PowerControl(ARM_POWER_FULL);
				USARTdrv->Control(ARM_USART_MODE_ASYNCHRONOUS |
						ARM_USART_DATA_BITS_8 |
						ARM_USART_PARITY_NONE |
						ARM_USART_STOP_BITS_1 |
						ARM_USART_FLOW_CONTROL_NONE, 9600);
				#ifdef USING_PRINTF
					printf("\nuart reset in \n");	
				#endif
				return  0;
			}
			return readLen;
		}
		else
		{
			memset(pRead,0x00,readLen);
			isRecvTimeout = false;
			return 0;
		}
	}
	else
	{
			return 1;
	}
}



static void __invert_uint8(UINT8* dBuf, UINT8* srcBuf)
{
	 int i;
	 UINT8 tmp[4];
	 tmp[0] = 0;
	 for (i = 0;i < 8;i++)
	 {
		  if(srcBuf[0] & (1 << i))
		  {
		   	tmp[0] |= 1<<(7-i);
		  }
	 }
	 dBuf[0] = tmp[0];
}


static void __invert_uint16(UINT16* dBuf, UINT16* srcBuf)
{
	 int i;
	 UINT16 tmp[4];
	 tmp[0] = 0;
	 for (i = 0;i < 16;i++)
	 {
		  if(srcBuf[0] & (1 << i))
		  {
		   	tmp[0] |= 1 << (15 - i);
		  }
	 }
	 dBuf[0] = tmp[0];
}

UINT16 MS_BMS_Update_CRC16(UINT8* pSendData,UINT16 len)
{
	
	UINT16 wCRCin = 0xFFFF;
	UINT16 wCPoly = 0x8005;
	UINT8 wChar = 0;
	UINT16 crc_rslt = 0;
	int i;
	while (len--)
	{
		wChar = *(pSendData++);
		__invert_uint8(&wChar, &wChar);
		wCRCin ^= (wChar << 8);
		for (i = 0;i < 8;i++)
		{
			if(wCRCin & 0x8000)
			{
				wCRCin = (wCRCin << 1) ^ wCPoly;
			}
			else
			{
				wCRCin = wCRCin << 1;
			}
		}
	}
	__invert_uint16(&wCRCin, &wCRCin);
	crc_rslt = ((wCRCin << 8) & 0xFF00) | ((wCRCin >> 8) & 0x00FF);
	return (crc_rslt);
}