Method, computer program code and apparatus for updating device software

Abstract

This invention relates to a method, computer program code, and apparatus for updating device software. The invention further relates to motor vehicles and electronic devices using this method or apparatus. In a first step, a software update for the device is received (S1). Furthermore, an environmental state is determined (S2). Based at least on the architecture of the processing device running the software to be updated, a dynamic update implementation method can be determined (S3). Based at least on this environmental state, a dynamic update of the software is triggered (S4).

Description

[0001] This invention relates to a method, computer program code, and apparatus for updating device software. The invention further relates to motor vehicles and electronic devices using this method or apparatus.

[0002] Today's motor vehicles are equipped with an increasing number of electronic components that require software. Typical examples are electronic control units (ECUs) and advanced driver assistance systems (ADAS). High-performance computers are also being used more and more frequently. Therefore, software updates will become more common in an increasingly software-driven automotive industry. While some updates are designed to provide additional functionality, others may require updates to address safety or security issues. Such updates may also be time-sensitive, designed to protect vehicle users. Regardless of the reason for the update, users expect it not only to be effective but also efficient.

[0003] To reduce the costs associated with physical on-site repairs and expedite critical repairs (i.e., time-critical safety and security updates), software updates preferably utilize data transmitted over the air (i.e., data transmitted via wireless communication networks).

[0004] In this regard, US 9,086,941 B1 discloses a method for providing predictive software upgrades. The method includes querying a virtual vehicle application simulating a real vehicle to determine a period of time during which the vehicle will be off, long enough to allow for software updates without altering the vehicle's operating state. A push notification is then sent to a user's portable interactive communication device, providing the determined time period to the user for selection of at least one time period. The method further includes receiving at least one selected time period for the software upgrade and sending a confirmation request for the first time period to the user's portable interactive communication device during a predefined time period preceding the first time period. If the user confirms the first time period, the vehicle is commanded to upgrade its vehicle control module during the first time period.

[0005] US Patent 10,834,207 B2 discloses a method for updating software in a vehicle. A server sends the updated software to electronic devices in the vehicle. The server can receive information about the capabilities of the electronic devices in the vehicle, such as memory, computing power, and security capabilities, and tailor the delivery of the software update based on these capabilities. For example, the partitioning of the software update, the memory portion from which the increment is determined, the compression scheme, and / or specific functionalities may depend on the capabilities of the electronic devices in the vehicle.

[0006] Unfortunately, the existing solution requires a software or system reboot. This means that updates can only be performed when the vehicle is not in use.

[0007] One object of the present invention is to provide an improved solution for updating device software.

[0008] This objective is achieved by the method according to claim 1, the computer program code for implementing the method according to claim 12, and the apparatus according to claim 13. This objective is further achieved by the motor vehicle according to claim 14 and the electronic device according to claim 15. The dependent claims include advantageous further developments and modifications of the inventive principles described below.

[0009] According to the first aspect, a method for updating device software includes the following steps:

[0010] - Receive software updates for this device;

[0011] - Determine the environmental conditions; and

[0012] - At least based on the environmental state, a dynamic update to the software should be triggered.

[0013] Accordingly, a computer program code includes instructions that, when executed by at least one processor, cause the at least one processor to perform the following steps to update the software of the device:

[0014] - Receive software updates for this device;

[0015] - Determine the environmental conditions; and

[0016] - At least based on the environmental state, a dynamic update to the software should be triggered.

[0017] The term "computer" must be understood in a broad sense. In particular, it also includes mobile devices, embedded devices, electronic control units, and other processor-based data processing devices.

[0018] For example, computer program code can be used for electronic retrieval or stored on computer-readable storage media.

[0019] According to another aspect, an apparatus for updating device software includes:

[0020] - The communication module is configured to receive software updates for the device;

[0021] - An environment perception module, configured to determine the environmental state; and

[0022] - The dynamic update manager is configured to trigger dynamic updates to the software based at least on the state of the environment.

[0023] To address the aforementioned issues, according to the present invention, a dynamic update manager provides the possibility of injecting code into a running process (i.e., performing hot patching). This can be used to fix known security issues or critical bugs. The dynamic update manager is responsible for performing updates in a system state that does not violate security requirements. To this end, the environmental state is assessed. The advantage of this solution is that software updates can be performed without a reboot. The updated software remains running. Therefore, the system does not experience downtime during the update process.

[0024] In an advantageous embodiment, the dynamic update implementation method is determined at least based on the architecture of the processing device running the software to be updated. Different architectures may require or are best suited to different dynamic update implementation methods. Therefore, it is advantageous to select an appropriate dynamic update implementation method for a given architecture of the processing device before updating the software.

[0025] In an advantageous embodiment, the environmental state is at least one of suitable, unsuitable, and uncertain. When the environmental state is suitable, the update can be easily performed. However, if the environmental state is unsuitable, the update cannot be performed. Therefore, the update needs to be postponed. When the environmental state is uncertain, the dynamic update manager can decide to trigger updates only that do not affect any security-related functions of the device; that is, to perform the update only if update failure is acceptable.

[0026] In an advantageous embodiment, the environmental state is determined based on data obtained from at least one of the device's sensors, the device's data bus, and an external device. The external device can be, for example, an onboard unit, a roadside unit, or an IoT (Internet of Things) device. Based on this data, it can be determined which functions are likely to be needed in the near future and therefore should not be updated, and which functions are not needed in the foreseeable future and therefore can be updated.

[0027] In an advantageous embodiment, data fusion is performed on data obtained from different sources. By fusing available data, a more comprehensive assessment of the current environmental state is achieved. This improves the reliability of the state assessment.

[0028] In an advantageous embodiment, the environmental state is determined using a trained AI (artificial intelligence) model. For example, supervised learning based on labeled training data can be used to provide the trained AI model. If a large amount of data is available for state evaluation, it is advantageous to use an AI algorithm to evaluate that data.

[0029] In an advantageous embodiment, software updates are received using wireless communication. For example, software updates can be received from a cloud server. This has the advantage of allowing updates to be received during device operation. No physical on-site repairs are required.

[0030] In an advantageous embodiment, the device is a motor vehicle. As mentioned above, motor vehicles are equipped with an increasing amount of software. The advantage of using the solution according to the invention for motor vehicles is that necessary, time-sensitive security and safety updates can be installed without waiting for the motor vehicle to be idle.

[0031] In an advantageous embodiment, the device's sensors are environmental sensors. Especially if the device is a motor vehicle, many functions implemented as software operate based on data from environmental sensors (e.g., ultrasonic sensors, laser scanners, lidar sensors, radar sensors, or cameras). Therefore, evaluating data from environmental sensors allows for determining whether specific functions may be needed in the near future.

[0032] In an advantageous embodiment, the device's operating mode is considered when a dynamic update to the software is triggered. For example, an electronic control unit (ECU) of a motor vehicle may have different operating modes. During normal operation, the ECU operates in a safe mode, in which only properly signed software can be installed and started. However, during development, the ECU may operate in an unsafe mode, in which the software may be installed by a debugger.

[0033] Advantageously, the motor vehicle or electronic device includes the means according to the invention or is configured to perform the method for updating software according to the invention. For example, the motor vehicle may be an automobile. For example, the electronic device may be a smartphone, tablet, computer, or any other IoT device.

[0034] Further features of the invention will become apparent from the following description and appended claims, taken in conjunction with the accompanying drawings. Attached Figure Description

[0035] Figure 1 The method for updating device software is illustrated schematically;

[0036] Figure 2 A first embodiment of a device for updating device software is illustrated schematically;

[0037] Figure 3 A second embodiment of a device for updating device software is illustrated schematically;

[0038] Figure 4 A motor vehicle implementing the solution according to the present invention is illustrated schematically;

[0039] Figure 5 An electronic device implementing the solution according to the present invention is illustrated schematically;

[0040] Figure 6The system architecture diagram of the system configured to perform dynamic updates is shown;

[0041] Figure 7 The diagram illustrates the functional modules involved in dynamic software updates; and

[0042] Figure 8 An exemplary analysis process performed by the environment perception module is described. Detailed Implementation

[0043] This specification illustrates the principles of this disclosure. Therefore, it will be understood that those skilled in the art will be able to design various arrangements that, although not explicitly described or shown herein, embody the principles of this disclosure.

[0044] All examples and conditional language listed herein are intended for educational purposes to help readers understand the principles of this disclosure and the concepts that the inventors have contributed to advancing the field, and should be interpreted as not being limited to these specifically listed examples and conditions.

[0045] Furthermore, all statements herein describing the principles, aspects, and embodiments and specific examples thereof are intended to include their structural and functional equivalents. Additionally, such equivalents are intended to include both currently known equivalents and those developed in the future, i.e., any element developed to perform the same function, regardless of its structure.

[0046] Therefore, for example, those skilled in the art will understand that the figures presented herein represent conceptual diagrams of illustrative circuit systems that embody the principles of this disclosure.

[0047] The functionality of the various elements shown in the figure can be provided using dedicated hardware and hardware capable of executing software in association with appropriate software. When provided by a processor, these functions can be provided by a single dedicated processor, a single shared processor, or multiple independent processors, some of which may be shared. Furthermore, the explicit use of the terms "processor" or "controller" should not be construed as referring specifically to hardware capable of executing software, and may implicitly include, but is not limited to, digital signal processor (DSP) hardware, system-on-a-chip, microcontroller, read-only memory (ROM), random access memory (RAM), and non-volatile memory for storing software.

[0048] Other conventional and / or custom hardware may also be included. Similarly, any switches shown in the figure are conceptual only. The functionality of these switches can be performed through the operation of program logic, through dedicated logic, through the interaction of program control and dedicated logic, or even manually, with the specific technology to be chosen by the implementer, as can be understood more specifically from the context.

[0049] In the claims herein, any element expressed as a means for performing a particular function is intended to cover any manner in which that function is performed, including, for example, a combination of circuit elements performing that function or any form of software, thus including firmware, microcode, etc., in combination with a suitable circuit system for performing that software to perform that function. The disclosure defined by such claims lies in the fact that the functions provided by the various mentioned means are combined and arranged together in the manner claimed in the claims. Therefore, any means that can provide those functions is considered equivalent to those means shown herein.

[0050] Figure 1 A method for updating software in a device (e.g., a motor vehicle or electronic device) according to the present invention is illustrated schematically. In a first step, a software update for the device is received S1. Furthermore, an environmental state S2 is determined, for example using a trained AI model. Preferably, this environmental state is at least one of suitable, unsuitable, and uncertain. This environmental state S2 can be determined based on data obtained from at least one of the device's sensors, the device's data bus, and external devices. For this purpose, data fusion can be performed on data obtained from different sources. Preferably, the sensor is an environmental sensor. A dynamic update implementation S3 can be determined based at least on the architecture of the processing device running the software to be updated. A dynamic update of the software S4 is triggered based at least on this environmental state. When triggering the dynamic update S4, the device's operating mode can be considered. Advantageously, the software update is received using wireless communication. For example, the software update can be received from a cloud server.

[0051] Figure 2A block diagram of a first embodiment of an apparatus 10 for updating software of a device (e.g., a motor vehicle or electronic device) according to the present invention is shown schematically from a module perspective. The apparatus 10 has an input terminal 11 through which a communication module 12 receives software updates SU and environmental data ED. Advantageously, the software updates SU are received wirelessly. For example, the software updates can be received from a cloud server. An environmental awareness module 13 is configured to determine an environmental state (e.g., using a trained AI model) based on the environmental data ED. Preferably, the environmental state is at least one of suitable, unsuitable, and uncertain. The environmental awareness module 13 can determine the environmental state based on data ED obtained from at least one of the device's sensors, the device's data bus, and external devices. For this purpose, data fusion can be performed on data obtained from different sources. Preferably, the sensor is an environmental sensor. A patch strategy module 14 can be provided to determine a dynamic update implementation method based at least on the architecture of the processing device running the software to be updated. A dynamic update manager 15 is configured to trigger a dynamic update of the software based at least on the environmental state. The dynamic update manager 15 can take into account the device's operating mode when triggering a dynamic update. The dynamic update can then be performed by a dynamic update module 16. For this purpose, the dynamic update module 16 can provide corresponding instructions via the output terminal 19 of the device 10. The output terminal 19 can be combined with the input terminal 11 to form a single interface. A local storage unit 18 is provided for storing data during processing. Of course, the dynamic update module 16 can also be arranged separately from the device 10. In this case, the dynamic update manager 15 sends the necessary instructions to the dynamic update module 16 via the output terminal 19.

[0052] Each component 12 to 16 can be controlled by the control module 17. A user interface 20 can be provided to allow a user to modify the settings of components 12 to 17. Components 12 to 17 can be implemented as dedicated hardware units. Of course, these components can also be combined entirely or partially into a single unit or implemented as software running on a processor (e.g., CPU or GPU).

[0053] Figure 3A block diagram of a second embodiment of an apparatus 30 for updating software of a device according to the present invention is shown from a hardware perspective. The apparatus 30 includes a processing device 32 and a memory device 31. For example, the apparatus 30 may be a computer, an electronic control unit, or an embedded system. The memory device 31 stores instructions that, when executed by the processing device 32, cause the apparatus 30 to perform steps according to one of the methods described herein. Thus, the instructions stored in the memory device 31 tangibly embody an instruction program that can be executed by the processing device 32 to perform the program steps as described herein according to the principles of the present invention. The apparatus 30 has an input terminal 33 for receiving data. Data generated by the processing device 32 can become available via an output terminal 34. Additionally, such data can be stored in the memory device 31. The input terminal 33 and the output terminal 34 can be combined into a single bidirectional interface.

[0054] The processing device 32 used herein may include one or more processing units, such as a microprocessor, a digital signal processor, or a combination thereof.

[0055] Local storage unit 18 and storage device 31 may include volatile and / or non-volatile memory regions and storage devices (e.g., hard disk drives, optical drives, and / or solid-state drives).

[0056] Figure 4 A motor vehicle 40 in which the solution according to the invention is implemented is schematically shown. In this example, the motor vehicle 40 is an automobile. The automobile has multiple environmental sensors 41, such as ultrasonic sensors, laser scanners, lidar sensors, radar sensors, or cameras. A high-performance computer 42 is provided for controlling various functions of the motor vehicle 40. In this example, other components of the motor vehicle 40 are an infotainment system 43, a navigation system 44, and at least one driver assistance system 45. Since many components of the motor vehicle 40 are running software, a device 10 for updating software according to the invention is provided. In this example, the device 10 is a self-contained unit. Of course, for example, the device 10 can also be integrated into the high-performance computer 42. A connection to a cloud server 60 can be established by means of a data transmission unit 46, for example, for receiving software updates. A memory 47 can be used to store data. Data exchange between different components of the motor vehicle 40 is carried out via a network 48.

[0057] Figure 5 An electronic device 50 in which the solution according to the invention is implemented is illustrated schematically. In this example, the electronic device 50 is a smartphone. The smartphone has a processor 51 for running applications and controlling the operation of the smartphone. In order to update the software used by the processor 51, a device 10 according to the invention is provided. The necessary software updates can be retrieved from a cloud server 60.

[0058] In the following sections, some further details of the solution according to the invention will be given in the example of software updates for motor vehicle components.

[0059] Figure 6 A system architecture diagram of a system configured to perform dynamic updates is shown. The system includes a high-performance computer 42 configured to receive updates from a cloud server and provide dynamic update implementation methods. The high-performance computer 42 communicates with various communication interfaces (e.g., Wi-Fi interface 70, Ethernet interface 71, CAN interface 72, etc.). Communication interfaces 70, 71 can be configured to communicate with cloud servers, IoT devices, or other high-performance computers. Sensors, such as a camera 73, radar 74, or other sensors 75, are provided, enabling the system to detect and monitor dynamic update scenarios and conditions.

[0060] Figure 7 A functional block diagram of the various modules involved in dynamic software updates is shown. Communication module 12 receives software update SU from cloud server 60. Environment awareness module 13 provides environment state ES (e.g., at least suitable, unsuitable, or uncertain) to patch strategy module 14. Patch strategy module 14 can provide a decision regarding the dynamic update implementation DUI, for example, based on environment state ES and the architecture of the processing device (e.g., system-on-a-chip or central processing unit) running the software to be updated. If environment state ES indicates that the state is suitable for updating, patch strategy module 14 outputs a "GO" decision based on the architecture of the processing device. Dynamic update manager 15 then triggers the dynamic update implementation DUI, for example, based on the vehicle's operating mode, such as normal mode, safe mode, and unsafe mode. The software update can then be performed by dynamic update module 16. Dynamic update manager 15 can further manage dynamic update thresholds. When dynamic updates or hot patches are injected into a running process, they exist only in random access memory and are not persistent. They are no longer present after a reset or restart. The number of dynamic updates should not exceed a predefined limit. Once this limit is reached, it is recommended to replace dynamic updates with standard static software updates. The dynamic update threshold ensures that this dynamic update limit is met.

[0061] Figure 8An exemplary analysis process performed by the environmental perception module is described. In the first step, environmental data is acquired (S10). Environmental data may include messages from onboard units, roadside units, or IoT devices, data from environmental sensors (e.g., cameras or radar sensors), and inter-vehicle system messages (e.g., messages transmitted via Ethernet, CAN, or LIN (Local Area Network)). The data is copied to a temporary buffer for data fusion processing (S11). During data fusion processing (S11), the acquired data is fused as needed. The subsequent state assessment (S12) can use a trained AI model to calculate the environmental state based on the fused data.

[0062] Figure Labels

[0063] 10 devices

[0064] 11 Input Terminal

[0065] 12 Communication Module

[0066] 13 Environmental Perception Module

[0067] 14. Patch Strategy Module

[0068] 15 Dynamic Update Manager

[0069] 16. Dynamic Update Module

[0070] 17 Control Module

[0071] 18 local storage units

[0072] 19 Output terminal

[0073] 20 User Interface

[0074] 30 devices

[0075] 31. Memory devices

[0076] 32 Processing equipment

[0077] 33 Input Terminal

[0078] 34 Output terminal

[0079] 40 Motor vehicles

[0080] 41 Environmental Sensors

[0081] 42 High-performance computers

[0082] 43. Infotainment System

[0083] 44 Navigation System

[0084] 45 Driver Assistance Systems

[0085] 46 Data transmission units

[0086] 47. Memory

[0087] 48 Network

[0088] 50 Electronic devices

[0089] 51 processor

[0090] 60 cloud servers

[0091] 70 WIFI ports

[0092] 71 Ethernet interfaces

[0093] 72 CAN interface

[0094] 73 cameras

[0095] 74 Radar

[0096] 75 Other Sensors

[0097] DUI Dynamic Update Implementation Method

[0098] ED Environmental Data

[0099] ES environment status

[0100] SU software update

[0101] S1 receives software updates

[0102] S2 Determine the environmental state

[0103] S3 Determine the implementation method for dynamic updates

[0104] S4 triggers dynamic updates

[0105] S10 Obtain Environmental Data

[0106] S11 Data Fusion Processing

[0107] S12 Status Assessment

Claims

1. A method for updating software in a device, the method comprising: - Receive software updates (SU) for this device; - Determine the environment state (ES); - Determine the number of software programs requiring dynamic updates based on the dynamic update threshold; and - When multiple software programs require dynamic updates and the number of such programs exceeds the update threshold, at least a portion of the software programs will be dynamically updated based on the environment state (ES); and a static software update will be triggered for another portion of the software programs. The environment state (ES) includes at least uncertainty. When the environment state (ES) is uncertain, dynamic updates that do not affect any security-related functions of the device are triggered only if update failure is acceptable.

2. The method of claim 1, further comprising determining the Dynamic Update Implementation (DUI) based at least on the architecture of the processing device running the software to be updated.

3. The method according to claim 1 or 2, wherein, The environmental state (ES) may also include at least one of unsuitable and suitable.

4. The method according to claim 1 or 2, wherein, The environmental state (ES) is determined based on data obtained from at least one of the device's sensors, the device's data bus, and external devices.

5. The method according to claim 4, wherein, Data fusion is performed on data obtained from different sources.

6. The method according to claim 1 or 2, wherein, The environment state (ES) is determined using a trained AI model.

7. The method according to claim 1 or 2, wherein, The software update (SU) is received wirelessly.

8. The method according to claim 7, wherein, The software update (SU) is received from the cloud server (60).

9. The method according to claim 4, wherein, This sensor is an environmental sensor.

10. The method according to claim 1 or 2, wherein, The device is a motor vehicle (40).

11. The method according to claim 1 or 2, wherein, The device's operating mode should be taken into account when triggering dynamic updates to the software.

12. A computer program code comprising instructions that, when executed by at least one processor, cause the at least one processor to perform a method for updating software for a device according to any one of claims 1 to 11.

13. An apparatus (10) for updating software of a device, the apparatus (10) comprising: - Communication module (12) is configured to receive software updates (SU) to the device; - The environment sensing module (13) is configured to determine the environment state (ES); as well as - The dynamic update manager (15) is configured to determine the number of software that needs to be dynamically updated based on a dynamic update threshold; if multiple software needs to be dynamically updated and the number of such multiple software exceeds the update threshold, trigger a dynamic update of at least some of the multiple software based on the environment state (ES); and trigger a static software update of another part of the multiple software. The environment state (ES) includes at least uncertainty. When the environment state (ES) is uncertain, dynamic updates that do not affect any security-related functions of the device are triggered only if update failure is acceptable.

14. A motor vehicle (40), characterized in that, The motor vehicle (40) includes the device (10) according to claim 13, or is configured to perform a method for updating the software of the motor vehicle (40) according to any one of claims 1 to 11.

15. An electronic device (50), characterized in that, The electronic device (50) includes the apparatus (10) according to claim 13, or is configured to perform the software for updating the electronic device (50) according to any one of claims 1 to 11.

Images