Motor vehicle ota firmware update checking by

Abstract

The invention relates to a method for checking software and / or software installations of a motor vehicle (10), which method is carried out by the motor vehicle (10) and comprises the following steps: determining (S10) checking data which represents a checking of an adaptation and / or a new installation of software and / or software installations available in the motor vehicle (10); detecting (S20) software state data of software and / or software installations of the motor vehicle (10), which software state data represents at least one current state of software and / or software installations available in the motor vehicle (10); transmitting (S30) software state data and / or check data to a rear-end computer system external to the motor vehicle (10); receiving (S70) test data from the back-end computer system, the test data representing test results determined from the previously transmitted software state data and / or inspection data.

Description

Technical Field

[0001] The invention relates to a method for checking software and / or software installation in a motor vehicle, a correspondingly configured motor vehicle, a correspondingly configured backend computer system and a correspondingly configured system. Background Art

[0002] It is desirable to improve the inspection of software and / or software installations in motor vehicles. Summary of the invention

[0003] The object of the present invention is to further improve the checking of software and / or software installations in motor vehicles.

[0004] This object is achieved according to the teaching of the independent claim. Different embodiments and refinements of the invention are the subject of the dependent claims.

[0005] According to one specific embodiment of the invention, a method for checking software and / or a software installation of a motor vehicle is provided, the method being carried out in particular by the motor vehicle.

[0006] In one embodiment, the method comprises determining check data. In one embodiment, the check data represent or describe a check of an adaptation and / or a new installation of software and / or a software installation available in the motor vehicle. In one embodiment, the check is based on a predetermined request for the software and / or the software installation together with responses of the software and / or the software installation, wherein a correct software installation and / or correctly functioning software is generally present when all responses of the software and / or the software installation correspond to expected responses.

[0007] In one embodiment, the method comprises detecting software status data of software and / or software installations of the motor vehicle. In one embodiment, the software status data describe or represent at least one state, in particular a current state, of software and / or software installations available in the motor vehicle. In one embodiment, the software status data are detected by or in at least one controller of the motor vehicle, in particular software status data of at least one, in particular software-operated or software-controlled, component of the motor vehicle.

[0008] In one embodiment, detecting software status data comprises determining or calculating software status data, in particular software status data of at least one, in particular software-operated or software-controlled, component of the motor vehicle. In one embodiment, the software status data describe at least one level (Stand) or version of the motor vehicle software or at least one level or version of the software and / or software installation available in the motor vehicle, in particular at least one level or version of the software and / or software installation of the at least one, in particular software-operated or software-controlled component of the motor vehicle or the at least one, in particular software-operated or software-controlled element.

[0009] In one embodiment, the method includes transmitting software status data and / or test data to a backend computer system external to the motor vehicle. In one embodiment, "transmitting" can refer to sending, especially actively sending or providing data, especially providing data based on a request from the backend computer system.

[0010] In one embodiment, the method includes receiving test data from a back-end computer system. In one embodiment, the test data represents or describes test results determined based on previously transmitted software state data and / or inspection data. In one embodiment, the test data is determined by the back-end computer system.

[0011] The term "motor vehicle" as used herein is preferably to be understood as a means of transport, in particular a car, a van, a truck, a motorcycle, an air vehicle and / or a water vehicle or the like.

[0012] The terms "backend" or "backend computer system" as used herein are preferably to be understood as a base unit ("Unterbau", "Backend") which is located outside the motor vehicle, in particular is constructed separately from the motor vehicle, and furthermore, in particular in one embodiment, has at least one server or at least one server or the like which is at least configured to execute or implement the method steps described herein and configured for the backend or is used or can be used for this purpose.

[0013] As used herein, the term "detection" is preferably understood as "self-detection or determination" or "obtained from an external source." In one embodiment, "detection" may include both "self-detection or determination" and "obtained from an external source."

[0014] The term “check” as used herein is preferably to be understood as one-time and / or repeatable over time, in particular in the sense of “monitoring”.

[0015] As used herein, the term "controller" is preferably understood to be a device of a motor vehicle for controlling at least one component of the motor vehicle, and in particular the term "controller" can be understood to be a combination of multiple controllers, which are connected in information technology, in particular via a bus system or its own lines. In one embodiment, the controller comprises an information interface (in particular a bus, a proprietary data connection), a data memory (for example a flash memory, in particular a RAM) and / or an evaluation unit, which can be configured as a programmable processor, a microcontroller or the like, for example. In one embodiment, the controller, in particular the evaluation unit, is configured to receive, transmit or send and / or test data records. In other words, in one embodiment, the controller is configured to (at least) check the coding / programming of itself and / or at least one other component of the motor vehicle. In one embodiment, the controller, in particular the evaluation unit, is also configured to adapt the coding or software of the second controller. In one embodiment, this means a (real) Flash process / coding or update / upgrade of the motor vehicle software. In one embodiment, the evaluation unit is configured to send a request to the second controller by means of the information interface to check whether the function of the second controller is normal. In one embodiment, the predefined query can lead to obtaining a response to the request if the second controller is functional and in one embodiment, in particular, a check is performed according to a predefined reference in the data memory. In one embodiment, the predefined reference can in particular be obtained together with the data recording / programming task (in particular from the backend or backend server). In one embodiment, in particular, a controller or a combination of controllers as described herein is configured to participate in the method described herein or to perform at least a part, in particular a part assigned to the controller.

[0016] In one embodiment, in particular in the case of known security vulnerabilities, recalls can be advantageously avoided by SW (software) updates, in particular by monitoring and / or checking the motor vehicle, and further in particular the software of the motor vehicle. During the service life of the vehicle, the motor vehicle can be kept up-to-date in all aspects (including safety-related / ASIL-related areas) and in particular the update can be monitored and / or checked. In one embodiment, it is advantageous to introduce new functions (especially safety / ASIL-related or can be safety / ASIL-related) into existing vehicles, especially by means of customer wishes / orders, and especially to check and / or monitor their correct installation or function. In one embodiment, it is advantageous that a monitored environment is not required, especially no longer required, for this purpose, especially compared with changes in wired connections on the motor vehicle, especially on its software. In addition, in one embodiment, it is advantageous that there is no ASIL distribution in the vehicle. This means that the electronic / electrical infrastructure in the vehicle does not need to use better (more complete) hardware and more complex software, which will increase costs. In one embodiment, the software to be programmed / flash (including "checker software" for checking and / or monitoring) only needs to meet the necessary ASIL level. The software can be transmitted to the back end as a "safety package". In one embodiment, it is advantageous to prevent the wrong decision of the motor vehicle, especially the motor vehicle software, from leading to the cancellation of, for example, driving locks (Fahrsperre), motor locks or similar locks, which protect or can protect the motor vehicle from the influence of wrong or wrongly installed software. In one embodiment, this can advantageously be monitored and / or checked independently by an entity, in particular external or separate from the motor vehicle, such as in particular a backend computer system, and thereby in particular make changes to the motor vehicle, in particular its software, (more) secure. Advantageously, in one embodiment, changes to the motor vehicle, in particular its software and / or its software installation can be checked in two stages and / or independently.

[0017] In one specific embodiment, the method comprises, chronologically before the detection of the software status data, receiving a data record from the motor vehicle and / or adapting and / or newly installing software available in the motor vehicle, in particular based on the received data record.

[0018] However, in one specific embodiment, the method can advantageously be used to check whether the data record (received from the motor vehicle) was processed correctly and / or whether the adaptation and / or new installation of software available in the motor vehicle was successful, error-free and / or correct.

[0019] In one embodiment, the method includes determining the availability of a backend computer system, in particular for exchanging data with the motor vehicle. In one embodiment, the transmission of software status data and / or test data, in particular by the motor vehicle to the backend computer system, is based on the determined availability of the backend computer system.

[0020] In one specific embodiment, the software and / or the software installation can thus advantageously be checked (in particular at the latest) when a connection establishment, in particular for data exchange, between the motor vehicle and a backend computer system is available or possible.

[0021] In one specific embodiment, the method includes controlling or configuring at least one component, in particular at least one function, of the motor vehicle based on the received test data.

[0022] In one embodiment, the motor vehicle can be advantageously influenced thereby, in particular when the motor vehicle has made a decision which cannot be confirmed by the backend computer system or which was determined to be incorrect when the backend computer system checked the decision, for example (incorrectly) releasing the driving lock, in particular the engine lock, even though the update was not performed correctly, for example. In one embodiment, in particular, the owner of the motor vehicle can be prevented from continuing to drive or being able to drive with incorrect software and / or an incorrect software installation.

[0023] According to one specific embodiment of the invention, a motor vehicle is provided. In one specific embodiment, the motor vehicle is configured to carry out the method described herein, in particular configured for a motor vehicle.

[0024] In one specific embodiment, the motor vehicle comprises means for determining test data, means for detecting software status data, means for transmitting software status data and / or test data and / or means for receiving test data from a backend computer system.

[0025] According to one embodiment of the invention, a method for checking software and / or software installation of a motor vehicle is provided, the method being implemented in particular by a backend computer system. In one embodiment, the method comprises receiving software status data of a motor vehicle, in particular as described herein. In one embodiment, the software status data describes or represents at least one current state of software and / or software installation available in the motor vehicle. In one embodiment, the method additionally or alternatively comprises receiving inspection data of the motor vehicle. In one embodiment, the inspection data describes or represents a check of an adaptation and / or a new installation of software available in the motor vehicle.

[0026] In one embodiment, the method comprises determining test data, in particular by means of a backend computer system. In one embodiment, the test data describes or represents differences between received software state data and reference data and / or between check data and (corresponding) reference data. In one embodiment, the test data describes an overall test result, which in one embodiment is or at least includes the result of a Boolean AND query of the corresponding test results of the software state data and the check data; and / or in one embodiment, the overall test result is based on a weighting of the test results of the software state data and the check data or at least has a corresponding weighting.

[0027] In one embodiment, the method comprises outputting the test data, in particular to a test entity. In one embodiment, the output comprises an auditory, tactile and / or visual output. In one embodiment, the output comprises sending an (acoustic, tactile, visual and / or digital) notification to a specialist department, a tester or the like, in particular for checking the data, in particular the software and / or the software installation. In one embodiment, the test data additionally or alternatively describe a diagnosis, at least one processing option or the like and / or at least one (code) position, in which at least one difference with reference data is determined during the check, in particular in the software state data and / or the check data.

[0028] In one embodiment, a further analysis can thus advantageously be performed, so that based on this analysis it can be additionally or alternatively determined whether the motor vehicle must be driven to a repair station. In one embodiment, it can thus advantageously be checked or verified first whether there is a deviation in the software available in the motor vehicle or in the software and / or software installation when adapting and / or installing the software available in the motor vehicle, in particular whether there is a deviation between the actual state of the software and / or the software installation of the motor vehicle and the corresponding target state. Accordingly, in one embodiment, the test entity can determine, in particular automatically, whether there is a hazard or danger to the motor vehicle or its user, in particular due to this deviation. Accordingly, in one embodiment, the method can include sending a command to the motor vehicle, in particular to the software of the motor vehicle, in order to stop the vehicle and / or to restrict the functional range of the vehicle or vice versa, in particular if the deviation leads to potential hazard or danger.

[0029] In one embodiment, outputting the test data comprises outputting the test data to a motor vehicle, in particular the motor vehicle described herein, further in particular to a motor vehicle from which software status data and / or check data are received (by a backend computer system). In one embodiment, outputting the test data comprises - in particular based on the determined test data - outputting control data to the motor vehicle, further in particular for controlling at least one component of the motor vehicle. In one embodiment, the test data comprises control data. Alternatively or additionally, outputting the test data comprises outputting data records, in particular for adapting and / or newly installing software available in a motor vehicle, further in particular based on the determined test data. In one embodiment, the test data in particular additionally comprises data records.

[0030] In one embodiment, the motor vehicle, in particular its software and / or software installation, can thereby be modified advantageously, in particular automatically, after checking the software and / or software installation of the motor vehicle. In one embodiment, the safety for the motor vehicle user can thereby be improved in OTA applications, in particular OTA applications for adapting and / or newly installing software available in a motor vehicle.

[0031] In one embodiment, the control data are designed to activate or reset a driving lock, in particular a motor lock, of the motor vehicle, in particular based on the determined test data, in order in particular to stop or (re)activate the motor vehicle. In one embodiment, the control data are designed to activate or deactivate or reset measures for, in particular to ensure, preventing the motor vehicle from moving.

[0032] In one embodiment, the data transmission includes a verification step and / or an encryption step, by which the motor vehicle authenticates itself at the backend computer system and / or the backend computer system authenticates itself at the motor vehicle and / or encrypts the data to be transmitted.

[0033] In one embodiment, the transmission includes a check of the integrity and / or correctness of the sent data, in particular by means of known methods, such as by means of a checksum (“hash”) or the like.

[0034] It lies within the scope of the invention here to carry out the above-mentioned method steps in a different sequence and / or to combine method steps and / or to integrate one method step into another method step, as far as this is technically possible and / or expedient.

[0035] According to one embodiment of the present invention, a backend computer system is provided. In one embodiment, the backend computer system is configured to implement the method described herein, and the method is particularly configured to be used in a backend computer system.

[0036] In one embodiment, the back-end computer system comprises means for receiving software status data and / or for receiving test data. In one embodiment, the back-end computer system comprises means for determining test data. In one embodiment, the back-end computer system comprises means for outputting test data. In one embodiment, the back-end computer system comprises means for outputting control data and / or data records, in particular to a motor vehicle.

[0037] According to one embodiment of the present invention, a system is provided, comprising at least one motor vehicle as described herein and at least one backend computer system as described herein.

[0038] In one specific embodiment, a check of the software and / or software installation of the motor vehicle can thereby advantageously be carried out (more) simply, in particular a (more) secure adaptation and / or new installation of software available in the motor vehicle.

[0039] The terms "include", "comprising", "containing", or "having" or any other variations thereof as used herein, as necessary, are intended to encompass a non-exclusive relationship. For example, a method or device comprising or having a list of elements is not necessarily limited to these elements, but may include other elements not explicitly listed or inherent to these methods or devices.

[0040] In addition, unless expressly stated to the contrary, "or" refers to an inclusive rather than an exclusive "or". For example, condition A or B is satisfied by one of the following conditions: A is true (or exists) and B is false (or does not exist), A is false (or does not exist) and B is true (or exists), and both A and B are true (or exist).

[0041] As used herein, the terms "a" and "an" are defined in the sense of "one or more." The terms "another" and "an additional" and any other variations thereof should be construed in the sense of "at least one additional."

[0042] The term "configuration" or "setting" for fulfilling a specific function (and its corresponding variants) (as used herein where necessary) is to be understood as meaning that the corresponding device or its components are already in a design or setting that can perform this function, or are at least configurable, i.e. configurable, so that the device can perform this function after being set accordingly. The configuration can be carried out here, for example, by correspondingly setting process parameters or switches or similar elements for activating or deactivating functions or settings. In particular, the device can have a plurality of predefined configurations or operating modes, so that the configuration can be carried out by selecting one of these configurations or operating modes.

[0043] The system and / or the device in the sense of the present invention can be constructed in hardware technology and / or software technology, in particular, with at least one, in particular digital, processing unit, in particular a microprocessor unit (CPU), a graphics card (GPU) or the like, and / or one or more programs or program modules, preferably connected to a memory and / or a bus system data or signal. The processing unit can be designed to process instructions implemented as a program stored in a storage system, detect input signals from a data bus and / or output output signals to a data bus. The storage system can have one or more, in particular different storage media, in particular optical, magnetic, solid-state and / or other non-volatile media. The program can be provided in such a way that it embodies or can implement the method described herein, so that the processing unit can implement the steps of this method and can therefore in particular monitor the software and / or software installation of the motor vehicle.

[0044] In one embodiment, the computer program product may include a storage medium that is particularly computer-readable and / or non-volatile, for storing a program or instruction or having a program stored thereon or an instruction stored thereon. In one embodiment, the program or instruction is executed by a system or control device, particularly a computer or a plurality of computer arrangements, so that the system or control device, particularly one or more computers implement the method described herein or one or more steps thereof, or the program or instruction is arranged for this. In another embodiment, the computer program and / or computer program product may exist as a file on a data processing unit, particularly a server, and may be downloaded via a data connection such as the Internet or a proprietary data connection, such as a proprietary network or a local area network. In addition, the computer program may have a plurality of interacting individual program modules. These modules may be configured in particular or may be used in any case so that they are implemented on different devices (computers or processor units) in the sense of distributed computing, which are geographically spaced apart from each other and interconnected via a data network. The system, in particular the back-end computer system and / or the motor vehicle can accordingly have a program memory in which the computer program is stored. Alternatively, the system can also be configured to access an external computer program, for example available on one or more servers or other data processing units, via a communication connection, in particular in order to exchange data with the computer program, which data are used during the operation of the method or the computer program or form the output of the computer program.

[0045] In one specific embodiment, one or more, in particular all, steps of the method are carried out completely or partially automatically, in particular by a control device or its means.

[0046] The embodiments described here can be combined as desired with one another and with other described embodiments of the solution, as long as this is not expressly excluded or technically not feasible. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Other advantages, features and application possibilities of the present invention are apparent from the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are as follows:

[0048] Figure 1 schematically shows a flow chart for explaining an embodiment of the method according to the present invention; and

[0049] Figure 2 A system with a motor vehicle and a backend computer system is shown schematically. DETAILED DESCRIPTION

[0050] The elements shown in the drawings are not necessarily drawn to scale. Rather, the various elements shown in the drawings are drawn in such a way that the function and general use thereof are understandable to a skilled person. Unless expressly stated otherwise, the connections and couplings between the functional units and elements shown in the drawings may also be implemented as indirect connections or indirect couplings. The functional units may in particular be implemented as hardware, software or a combination of hardware and software.

[0051] Figure 1 A flow chart of the method is schematically shown. The method steps performed by the motor vehicle 10 are shown above and the method steps performed by the back-end computer system 20 are shown below. The method comprises determining check data S10, detecting software status data S20 and transmitting software status data and / or check data S30. In one embodiment, the transmission S30 is performed, in particular only when the back-end computer system 20 is available for sending or receiving data or is accessible by the motor vehicle 10 or an apparatus of the motor vehicle 10 provided for this purpose. The back-end computer system 20 receives S40 the software status data and / or check data transmitted by the motor vehicle 10 and determines S50 test data regarding the software status data and / or check data, in particular based on corresponding reference data. In addition, in Figure 1 Schematically shown in FIG. 1 is an output S60 of test data by the backend computer system 20 . In one embodiment, the schematically shown method includes receiving S70 test data, in particular determined by the backend computer system 20 , by the motor vehicle or a device for receiving test data.

[0052] Figure 2 A motor vehicle 10 and a backend computer system 20 are shown, which are in data exchange, in particular, to implement the method described herein or as described in the example of FIG. Figure 1 Method shown by way of example. In one embodiment, communication takes place, in particular wirelessly, by means of a suitable transmitter in order to transmit or receive the corresponding data. The motor vehicle 10 has a suitable device, shown schematically as a box, which is connected to the transmitter of the motor vehicle, in particular for data communication. The back-end computer system 20 is shown by way of example as a server with a transmission tower and as being arranged outside the motor vehicle 10. In one embodiment, the communication between the motor vehicle 10 and the back-end computer system takes place as required, in particular by software triggers and / or continuously, in particular when there is availability for data transmission.

[0053] While at least one exemplary embodiment has been described above, it should be noted that there are numerous variations thereto. It should also be noted that the exemplary embodiments described are merely non-limiting examples and are not intended to limit the scope, applicability, or configuration of the apparatus and methods described herein. More specifically, the foregoing description provides guidance to the skilled person for implementing at least one exemplary embodiment, and it goes without saying that various changes may be made to the operating principles and arrangements of the elements described in the exemplary embodiments without departing from the technical solutions and their legal equivalents respectively set forth in the appended claims.

[0054] List of reference numerals:

[0055] 10 Motor Vehicles

[0056] 20 Back-end computer system

[0057] S10 Confirm inspection data

[0058] S20 detection software status data

[0059] S30 Transmit software status data and / or check data

[0060] S40 Receive software status data and / or check data

[0061] S50 Determine test data

[0062] S60 output test data

[0063] S70 receives test data

Claims

1. A method for checking software and / or software installation of a motor vehicle (10), the method being carried out by the motor vehicle (10) and comprising: - determining (S10) check data representing a check of an adaptation and / or a new installation of software and / or software installation available in the motor vehicle (10); - detecting (S20) software status data of software and / or software installation of the motor vehicle (10), said software status data representing at least one current status of software and / or software installation available in the motor vehicle (10); - transmitting (S30) software status data and / or test data to a back-end computer system external to the motor vehicle (10); - Receiving (S70) test data from the backend computer system, said test data representing test results determined based on previously transmitted software status data and / or inspection data.

2. The method according to the preceding claim, characterized in that The method comprises, before detecting the software status data, the following steps: - receiving the data record by the motor vehicle (10); and / or - In particular, adapting and / or reinstalling software available in the motor vehicle (10) based on the received data records.

3. The method according to any one of the preceding claims, characterized in that The method comprises: - determining the availability of a backend computer system for exchanging data with the motor vehicle (10) and transmitting software status data and / or test data based on the determined availability.

4. The method according to any one of the preceding claims, characterized in that The method comprises: - controlling or configuring at least one function of at least one component of the motor vehicle (10) based on the received test data.

5. Motor vehicle (10), wherein: The motor vehicle (10) is configured to carry out a method according to any one of the preceding claims.

6. A method for checking software and / or software installation of a motor vehicle (10), the method being implemented by a back-end computer system (20), the method comprising: - receiving (S40) software status data of the motor vehicle (10), the software status data representing at least one current status of software available in the motor vehicle (10) and / or software installation; and / or receiving inspection data of the motor vehicle (10), the inspection data representing an inspection of an adaptation and / or a new installation of software available in the motor vehicle (10); - determining (S50) test data by means of the backend computer system, the test data describing differences between the received software state data and / or check data and reference data; and - Outputting (S60) the test data, in particular to a test entity.

7. The method according to the preceding claim, characterized in that - outputting (S60) the test data comprises outputting the test data to a motor vehicle (10), in particular to a motor vehicle (10) according to claim 5; and - outputting control data to the motor vehicle (10) based on the determined test data for controlling at least one component of the motor vehicle (10); and / or - exporting the data record, in particular for adapting and / or newly installing software available in the motor vehicle (10).

8. The method according to the preceding claim, characterized in that The control data are designed to activate or reset a driving lock, in particular a motor lock, of the motor vehicle (10), in particular based on the determined test data.

9. Back-end computer system, where: The backend computer system (20) is configured to implement the method according to any one of the preceding claims 6 to 8.

10. System, including: - at least one motor vehicle (10) according to claim 5; - At least one backend computer system (20) according to claim 9.

Images