Method for providing updates for a motor vehicle

Abstract

The invention relates to a method for providing an update for a motor vehicle (1) and a system (3) for carrying out the method. The method comprises: providing (S1) equipment data (10) for an external computing device (2), the equipment data describing which control devices (4) the motor vehicle (1) is equipped with and which software version the corresponding control device (4) is currently operated; selecting (S2), by means of the external computing device (2), all update units (12) associated with the motor vehicle (1), taking into account the provided equipment data (10), from a total software list (11) in which a currently set software version is recorded for each control device (4) potentially comprised by the motor vehicle (1); determining (S3), by means of the external computing device (2), update sequence data (14) describing an installation sequence of the selected update units (12) in the motor vehicle (1) by applying a sequence determination criterion (13) to the selected update units (12); and providing (S4) the selected update unit (12) and the determined update sequence data (14) for the motor vehicle (1).

Description

Technical Field

[0001] The invention relates to a method for updating a motor vehicle and to a system for carrying out such a method. Background Art

[0002] A motor vehicle may have a plurality of control devices, each of which is operated with software. For each software, there may be a plurality of software versions. The respective control device of the motor vehicle is operated with exactly one software version, which may be referred to as the current software version of the control device. Now it may be the case that for at least one of the control devices there is a new software version which differs from the current software version of the control device, so that it makes sense to update the software of the control device. The update is usually provided to the motor vehicle by an external computing device in that the update is transmitted to the motor vehicle. The update may have a plurality of update units, each of which includes the update software for one of the control devices of the motor vehicle, so that the software of a plurality of control devices can be changed with a single update.

[0003] DE 10 2019 212 664 A1 shows a device for providing updates for a vehicle having multiple control devices. The vehicle's control circuit is configured to set the update order of the control devices based on a preset priority and the size of the update data.

[0004] DE 11 2017 006 978 T5 shows a control device, which is designed to control the update of a control program of an onboard vehicle control device. A control unit of the control device can perform a determination process to determine whether to perform the update of multiple control programs according to an update order.

[0005] WO 2019 / 021064 A1 shows the generation of a software Delta file for a vehicle controller. The properties of the software update are compared with the properties of the current software stored in the vehicle controller, and a software Delta file is generated based on the differences between these properties. Summary of the invention

[0006] The object of the present invention is to provide a solution by means of which a reliably available update for a motor vehicle can be provided.

[0007] This object is achieved by the subject-matter of the independent claims.

[0008] A first aspect of the invention relates to a method for providing updates for a motor vehicle. The method is based at least in part on the knowledge that in motor vehicles, a separate control device is usually provided for each individual device, that is, for example, a brake system, a lighting device and / or a comfort function (such as, for example, a seat heating device, an air conditioning system and / or a multimedia device). For a plurality of the control devices, a common interface can be provided, via which a connection to a central communication interface of the motor vehicle can be realized. By means of the central communication interface, for example, an Internet access can be provided for the motor vehicle.

[0009] In addition, it is possible to pre-determine verification documents for software newly provided for a motor vehicle, in order, for example, to be able to determine tampering with the software at an early stage. For this reason, for example, a software master list is provided, in which the currently set software version is recorded for each control device potentially included in the motor vehicle. The software master list can be provided by the vehicle manufacturer. In the list, different versions of the control devices themselves can be distinguished, which differ in hardware technology. The motor vehicle does not necessarily have to have all the control devices in the master list, but, for example, has a selection of control devices in the software master list depending on the equipment of the motor vehicle. The software master list can be called a baseline. The software master list thus describes a complete package of possible control devices for a motor vehicle.

[0010] Since a motor vehicle usually has only a selection of control devices, in the context of providing an update, update units corresponding to all control devices of the software master list should not be transmitted, but only vehicle-related update units should be transmitted, which relate to the software of the control devices actually arranged in the motor vehicle. This method is particularly resource- and time-saving, since the updates provided to the motor vehicle are tailored to the motor vehicle.

[0011] The method according to the present invention includes: providing equipment data of a motor vehicle to an external computing device. The equipment data describes which control devices the motor vehicle is equipped with and which software versions each control device is currently running with. The software version therefore relates to the software stored in the control device and currently used to run the control device. In other words, the software version is the version of the software installed in the control device. The equipment data can be summarized into a list, which lists all the control devices of the motor vehicle together with their respective current software versions. The equipment data therefore describes the installation status of the motor vehicle in terms of hardware and software. For example, a central control device can be set in the motor vehicle itself, which summarizes the equipment data and transmits the equipment data, for example, to a communication interface of the motor vehicle, which then transmits the equipment data to an external computing device via a communication link and thus provides the equipment data to the external computing device. The communication link is preferably configured to be cable-free, especially wireless. The communication link can be configured, for example, via a wireless local area network (Wireless Local Area Network, abbreviated WLAN), a Bluetooth connection and / or a mobile data network, for example, based on mobile communication standards such as long-term evolution (LTE), long-term evolution enhanced version (LTE-A), five generations (5G) or six generations (6G). Alternatively or additionally thereto, the communication link can be at least partially designed as a cable connection, in particular as a wired one. Such a communication link can be realized via a vehicle diagnostic system interface of the motor vehicle. An additional external computing device can be provided, which is at least wired to the vehicle diagnostic system interface and is designed to establish or maintain a communication connection with the external computing device.

[0012] The external computing device is, for example, a server, a cloud server or a backend. With the aid of the external computing device, all update units relevant to the motor vehicle are selected from the software master list. In the software master list, the currently set software version is recorded for each control device potentially included in the motor vehicle. Preferably, the software master list has exactly one software version for each control device. The relevant software unit is selected taking into account the provided equipment data. In other words, it can be checked for each individual control device of the motor vehicle whether the software version set for the control device according to the software master list is different from the software version obtained from the equipment list for the control device. For each control device whose software version of the equipment data of the motor vehicle is inconsistent with the software version of the software master list, an update unit is selected, that is, the software of the corresponding new software version is selected. The update unit is a component of the entire update here and can alternatively be referred to as a single update for one of the motor vehicle control devices.

[0013] Update sequence data are now determined by means of an external computing device by applying a sequence determination criterion to the selected update units. The update sequence data describe the order in which the selected update units are to be installed in the motor vehicle. The sequence determination criterion is an algorithm and / or rule by means of which the external computing device determines which of the selected update units should be installed in the motor vehicle when compared to other update units. In a simple example, a ranking number is assigned to each update unit, for example, so that when the individual update units are installed in the motor vehicle according to the update sequence data, the individual update units are installed one after the other, that is to say sequentially / serially, for example according to the ranking numbers arranged in ascending order. The sequence determination criterion is executed by the external computing device, wherein the update sequence data are present as a result of the execution. In other words, the update sequence is determined by determining the time sequence of the individual update units.

[0014] Furthermore, the method comprises providing the motor vehicle with the selected update units and the determined update sequence data. For this purpose, the selected update units and the determined update sequence data are transmitted from an external computing device to the motor vehicle via a communication link. The selected update units and the determined update sequence data can be transmitted, for example, in a manner that they are aggregated into an update package or an update folder. An update unit is to be understood here as an update unit having the corresponding software for the corresponding update of the respective control device. In other words, the update unit respectively comprises the software code for the respective control device for which the new software version is provided.

[0015] With the aid of the method according to the invention, it is possible to provide a reliable update for a motor vehicle, which only includes the update units that are actually to be installed in the motor vehicle, and also to predetermine how the installation sequence of the update units should be carried out particularly expediently and reliably. Thus, for example, the dependency of the installation of an update unit on the installation of another update unit can be taken into account if such information is taken into account by the sequence determination criterion. Overall, by appropriately designing the sequence determination criterion, a plurality of possible prerequisites for the update sequence can be taken into account.

[0016] The invention includes embodiments that produce additional advantages.

[0017] One embodiment provides that the provided update units are installed in the motor vehicle in a sequence according to the provided update sequence data. Preferably, not only the information required in principle to be able to carry out the update in the motor vehicle, that is to say the selected update data and the determined update sequence data, is provided, but also the provided update is actually installed in the motor vehicle. For this purpose, for example in the motor vehicle itself, the individual update units can be assigned to their respective control devices, so that the installation of the respective update units according to the update sequence data is carried out, for example, by a central control device or by the respective individual control devices themselves. In other words, the control devices can be refreshed or updated according to the sequence based on the provided update units. Ultimately, as a result of the method, it can be achieved that the control devices of the motor vehicle are all placed in a software state according to the software master list.

[0018] A further embodiment provides that the update sequence data specifies whether a plurality of the provided update units are to be installed and, if so, which of the update units are to be installed in parallel. It is therefore not necessary to install the individual update units sequentially, but it can be determined by means of a sequence determination criterion: which of the update units can be installed simultaneously in the motor vehicle, for example because the corresponding control devices offer processes and / or services that are not dependent on one another. As a result, the installation time for installing the update units can be reduced, since, if feasible, a plurality of update units are always installed simultaneously according to the update sequence data. This results in a particularly time-saving updating of the control devices.

[0019] Furthermore, one embodiment provides that the sequence determination criterion is based on a mathematical model. The mathematical model takes into account at least one of the following information for each of the selected update units: correlation with the installation of at least one other update unit; installation time; installation energy consumption; general safety requirements; functional safety requirements; and / or legal safety requirements. Thus, the sequence determination criterion contains, for example, information about the installation of the individual update units themselves, that is, the mutual dependencies / correlations of the individual update units, the required time and / or the required energy. The installation time can alternatively be referred to as the update time. The installation energy consumption can be understood as the energy value used to install the individual update units. In order to determine the installation energy consumption, for example, the maximum current load in the motor vehicle can be measured when testing the installation of the update unit and the installation energy consumption can be calculated therefrom. The installation time can also be determined during the test installation. Ultimately, the installation time and the installation energy consumption are performance indicators for installing the corresponding update unit.

[0020] The dependencies of the individual control devices on one another are preferably functional dependencies, which include, for example, whether the individual control devices are in data exchange. For example, it can be provided that an update unit is not installed in a control device while another control device is continuously waiting for data from the control device, since in this case a malfunction of the control device waiting for data could be triggered. In this case, it is therefore sensible to update the control devices that are dependent on one another synchronously, that is to say in parallel. Alternatively or additionally, preventive measures can be taken for this purpose, for example, so that no malfunction is triggered in the control device waiting for data.

[0021] The general safety requirements may include, for example, requirements for the communication interface itself and thus the provisions for the communication interface itself and its possible updates. The safety requirements may alternatively be referred to as safety-related requirements. If the software update is, for example, an update of an interface for receiving and / or processing data from an external computing device and / or another external data source, then there are special requirements for the execution of the corresponding update unit, since the safety of the entire system of the motor vehicle is involved. Therefore, such safety requirements can be taken into account with the help of the general safety requirements.

[0022] Functional safety requirements relate, for example, to a plurality of redundantly designed control devices, which, for example, should not be updated simultaneously. Functional safety requirements may, for example, stipulate that when updating a control device for a door locking device of a motor vehicle door, it is not possible to install all, for example, four, doors of the motor vehicle's control units simultaneously. For example, there must always be at least one control device for one of the doors of the motor vehicle that does not have an update unit installed, so that, for example, four control devices of four doors can only be updated one after the other, that is to say serially, and not simultaneously.

[0023] Legal requirements relate, for example, to legally prescribed prohibitions and / or regulations for update processes, so that, for example, stamps and / or signatures must be specified and maintained. Such legal security requirements may have been determined, for example, by international or national institutions, such as regulations for automotive cybersecurity from the United Nations Economic Commission for Europe (UNECE).

[0024] Ultimately, a large amount of information is incorporated into the sequence determination criterion, with the aid of which the update sequence data can be determined. The sequence determination criterion is therefore present as a mathematical model that is based on at least one of the items of information and preferably on a plurality of the items of information. This allows a particularly sensible update sequence to be determined.

[0025] Furthermore, one embodiment provides that the sequence determination criterion takes into account empirical data. The empirical data describe at least one experience that has been gained during the individual assurance of individual control devices of the motor vehicle and / or the joint assurance of control devices. Alternatively or additionally, the experience is provided as feedback to past updates. In other words, empirical values ​​from the past can be used and the mathematical model of the sequence determination criterion can be optimized and adapted with the aid of these empirical values.

[0026] The guarantee for each control device is determined, for example, within the scope of a cyclic test, which is required to allow the control device to be installed in a motor vehicle. Within this scope, the requirements for updates can be checked, such as determining the installation time and installation energy consumption. This guarantee can also be determined for the entire association, that is, for example, for all control devices mentioned in the software master list. This is a joint guarantee. For example, the maximum value of the installation time and / or installation energy consumption of the update unit for all control devices in the software master list can be determined by the joint guarantee. Ultimately, information from the research and development of the vehicle manufacturer (which is generated within the scope of cyclic tests in the development and / or production of the control device) can be provided to the sequence determination standard, which can then take into account the information. Within the scope of individual guarantees or joint guarantees, the test installation mentioned above as an example can be performed.

[0027] For example, feedback on previous or past updates can be provided by workshops and / or other test installations. The feedback is thus, for example, empirical values ​​from previous update activities. Feedback is preferably given by the individual motor vehicles, which are transmitted, for example, by the respective motor vehicles to an external computing device. This can provide information, for example, on which dependencies between the individual control devices are taken into account and / or the installation duration and / or installation energy consumption determined in the corresponding guarantees can be checked, in particular confirmed. This can further refine the sequence determination criteria.

[0028] In conjunction with the experience data, in one embodiment, it may be provided that the experience data is provided periodically. For example, a fixed time period may be set during which the experience data is provided. This ensures that the information provided in the form of the experience data is always up to date.

[0029] According to another embodiment, the update sequence data has installation total duration information, which describes the estimated total duration of the installation of the selected update unit. The total duration data included in the update sequence data can be used to describe the installation total duration information. Now check whether the installation total duration information, i.e. the estimated total duration of the update installation, is less than the preset duration limit. If the estimated total duration of the update installation is less than the duration limit, especially only in this case, the selected update unit and the determined update sequence data are provided, and / or the installation of the selected update unit is allowed. In particular, the check is performed before the selected update unit and the determined update sequence data are provided. Finally, it can be stipulated that the update is provided or the installation of the update is realized only when the total duration of the installation of the updated update unit does not exceed the preset duration limit. It is thus ensured that the update does not require more time than the preset time due to the simultaneous operation of the motor vehicle. For example, the situation may be that the installation of the update unit should be carried out during the waiting pause before the traffic light device and then during the driving of the motor vehicle. Because this waiting pause is typically only a few seconds or minutes long, a correspondingly short duration limit can be preset. This prevents the motor vehicle from being immobilized for a longer period than expected due to the update, for example. If the total installation duration information is greater than or equal to a preset duration limit, it is possible to still provide the determined update sequence data and the selected update unit, but to output a message in the motor vehicle that the duration limit is expected to be exceeded when installing the update. The user can then, for example, allow the installation of the update at any time despite the duration limit being exceeded. This ultimately provides a particularly user-friendly update for the motor vehicle.

[0030] In addition, another embodiment may provide that the update sequence data has total energy consumption information describing the estimated total installation energy consumption of the installation of the selected update unit. The total energy consumption information may be in the form of total energy consumption data that can be included in the update sequence data. Then check whether the estimated total installation energy consumption according to the total energy consumption information is less than the preset energy consumption limit. If the estimated total installation energy consumption is less than the preset energy consumption limit, in particular only in this case, the selected update unit and the determined update sequence data are provided and / or the installation of the update unit is allowed. In particular, the check is performed before the selected update unit and the determined update sequence data are provided to the motor vehicle. Here, if the check is unsuccessful, that is, if the total energy consumption information is greater than or equal to the energy consumption limit, a prompt about the estimated exceeding of the energy consumption limit can be output in the motor vehicle. It can be ensured that, for example, the update does not require more energy than the energy set for this purpose, and that, for example, the 12-volt battery of the motor vehicle that provides energy for the installation of the update will not be drained during the installation of the update. This ensures by means of an additional check that the determined update sequence is appropriate for the selected update unit, since it provides for the update of the motor vehicle in such a way that the observed installation energy consumption for the entire update does not exceed a predefined limit value.

[0031] In addition, according to one embodiment, it can be proposed to determine the state of charge data. The state of charge data describes the state of charge of the battery of the motor vehicle. The battery of the motor vehicle is typically a 12-volt battery of the motor vehicle. Therefore, the battery is not, for example, a high-voltage battery that is constructed to supply power to the motor vehicle's motor and thus to the electric drive. The energy consumption limit value is specified based on the determined state of charge data. If, for example, it is determined that the battery of the motor vehicle is almost exhausted, this may have an impact on the installation of the selected update unit and the determined update sequence data and / or the update unit for the motor vehicle, so that only when the battery of the motor vehicle actually allows the installation of the update, for example, the update is fully provided and / or installed. The state of charge data is determined in the motor vehicle for this purpose and is transmitted to an external computing device, for example, via a communication link. The transmission to the external computing device can be performed automatically, that is, for example, continuously and / or in response to the query of the external computing device. Reliable protection can thus be provided to prevent the update from having an adverse effect on the energy supply of the motor vehicle.

[0032] For applications or use cases which may arise in the method and are not explicitly described here, provision may be made for outputting an error message and / or a request for inputting user feedback and / or for setting standard settings and / or a predetermined initial state according to the method.

[0033] Another aspect of the invention relates to a system. The system includes a motor vehicle and an external computing device. The system is configured to perform the above method. The system may alternatively be referred to as an arrangement including a motor vehicle and an external computing device. In this case, the arrangement is configured to implement the above method.

[0034] The invention also includes improvements of the system according to the invention, which have the features already described in conjunction with the improvements of the method according to the invention. For this reason, the corresponding improvements will not be described in detail here.

[0035] The motor vehicle is preferably designed as a car, in particular a passenger car or a truck, or as a passenger bus or a motorcycle.

[0036] The present invention also includes a control device and an external computing device for a motor vehicle. The corresponding control device can have a data processing device or a processor device, which is configured to implement an embodiment of the method according to the present invention. For this purpose, the processor device can have at least one microprocessor and / or at least one microcontroller and / or at least one FPGA (Field Programmable Gate Array) and / or at least one DSP (Digital Signal Processor). In addition, the processor device can have a program code, which is configured to implement an embodiment of the method according to the present invention when executed by the processor device. The program code can be stored in a data memory of the processor device.

[0037] As another solution, the present invention also includes a computer-readable storage medium, which includes instructions, which when executed by a computer or a computer complex, cause the computer or computer complex to implement an embodiment of the method according to the present invention. For example, the storage medium can be at least partially configured as a non-volatile data storage (e.g., flash memory and / or SSD-solid state drive) and / or at least partially configured as a volatile data storage (e.g., RAM-random access memory). A processor circuit with at least one microprocessor can be provided by the computer or computer complex. The instructions can be provided as binary code or source code in an assembly language and / or a programming language (e.g., C language).

[0038] The present invention also includes combinations of features of the described embodiments. Therefore, the present invention also includes implementations that each have a combination of features of a plurality of the described embodiments, as long as these embodiments are not described as mutually exclusive. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Embodiments of the present invention are described below. To this end, it is shown that:

[0040] Figure 1 shows a schematic diagram of a system including a motor vehicle and an external computing device; and

[0041] Figure 2 A schematic diagram of a signal flow diagram of a method for providing updates to a motor vehicle is shown. DETAILED DESCRIPTION

[0042] The embodiments described below are preferred embodiments of the present invention. In the embodiments, the various parts described in the embodiments are the features of the present invention that can be considered independently of each other, and these features also improve the present invention independently of each other. Therefore, the present disclosure should also include the combination of the features of the embodiments except the combination shown. In addition, the embodiments can also be supplemented by other features in the features already described in the present invention.

[0043] In the figures, the same reference numerals respectively denote elements with the same function.

[0044] exist Figure 1 A motor vehicle 1 is depicted in FIG. 1 . Furthermore, an external computing device 2 is schematically depicted, which is designed, for example, as a server or backend. A system 3 comprises the motor vehicle 1 and the computing device 2 . The system 3 may alternatively be referred to as an arrangement.

[0045] The motor vehicle 1 has a plurality of control devices 4. Each control device 4 can be designed to control a drive device of the motor vehicle 1, that is, for example, a motor of the motor vehicle 1; provide comfort functions, such as controlling an air conditioning device and / or a multimedia device; and / or provide other functions or other services of the motor vehicle 1, such as controlling a lighting device, a remote door locking device, and / or an automatic window opening device. In other words, the motor vehicle 1 includes individual control devices 4 for different functions and / or services. The respective control device 4 can be a computing device, which, however, is an internal device of the motor vehicle 1, unlike the external computing device 2. In addition, a central control device 5 for the motor vehicle 1 is also briefly drawn, which can, for example, receive and collect information from the individual control devices 4. The data exchange with the external computing device 2 can be controlled by the control device 5, for example.

[0046] The motor vehicle 1 has a communication interface 6. In addition, the external computing device 2 has a communication interface 6. A cable-free, in particular wireless, communication link 7 can be established and / or maintained between the two communication interfaces 6. Alternatively or additionally, the communication link can be at least partially designed as a cable connection, in particular a wired one. For example, data can be transmitted, in particular exchanged, between the motor vehicle 1 and the external computing device 2 via the communication link 7.

[0047] The motor vehicle 1 also has a battery 8, for which state-of-charge data 9 are present. The state-of-charge data 9 describe the state of charge of the battery 8 of the motor vehicle 1. The state-of-charge data 9 relate here, for example, to a 12-volt battery as battery 8 and not to a high-voltage battery such as is required to operate an electric motor as a drive of the motor vehicle 1.

[0048] Figure 2 A method for providing an update for a motor vehicle 1 is shown. In step S1, equipment data 10 of the motor vehicle 1 are provided to an external computing device 2 via a communication link 7. The equipment data 10 describe which control devices 4 the motor vehicle 1 is equipped with and at which software version the respective control device 4 is currently running. Figure 1 , five control devices 4 are shown by way of example, so that, for example, the motor vehicle 1 provides the names of the five control devices 4 and their current software versions within the scope of the equipment data 10 . In other words, the equipment data 10 contain information about the current hardware and software of the motor vehicle 1 .

[0049] In step S2, all update units 12 relevant to the motor vehicle 1 are selected from the software master list 11 by means of the external computing device 2, taking into account the provided equipment data 10. In the software master list 11, the currently set software version is recorded for each control device 4 potentially included in the motor vehicle 1. Thus, a list of all software that may be installed in the motor vehicle 1 is obtained from the software master list 11, which list includes the current software described with the help of the corresponding software version for each possible hardware. The motor vehicle 1 does not necessarily have to include all the control devices 4 listed in the software master list 11, but for example only a selection of control devices. For example, the software master list 11 may list 80 control devices 4, and the motor vehicle 1 may actually include only five of these control devices 4 or any other number between 1 and 80.

[0050] An update unit 12 is only relevant to the respective control device 4 of the motor vehicle 1 if the control device 4 is operated according to the equipment data 10 with a software version that differs from the software version provided for the control device according to the software master list 11. Therefore, in the example shown here, two update units 12 are selected, because, for example, three of the five exemplary control devices 4 are in the software state provided according to the software master list 11, that is, have the software version provided according to the software master list 11, so that a respective update unit 12 is present only for two of the control devices 4. The update unit 12 contains the software code required for updating the respective control device 4.

[0051] In step S3, a sequence determination criterion 13 is applied to the selected update units 12 by means of the external computing device 2. Update sequence data 14 are determined here, which describe the installation sequence of the selected update units 12 in the motor vehicle 1. In this example, it is determined which of the two update units 12 should be installed in the motor vehicle 1 first and / or whether both can be installed, for example, in parallel and thus simultaneously. In this case, a detailed sequence can be determined in the case of multiple update units 12. The sequence determination criterion 13 is based on a mathematical model. The mathematical model takes into account at least one of the following information 15 for each of the selected update units 12: relevance to the installation of at least one other update unit 12, installation time, installation energy consumption, general safety requirements, functional safety requirements and / or legal safety requirements.

[0052] Alternatively or additionally, the sequence determination criterion 13 may take into account experience data 16 describing at least one experience which has been determined when ensuring the respective control device 4 of the motor vehicle 1 and / or when ensuring a plurality of control devices 4, that is to say, for example, all control devices 4 listed in the software master list 11, and / or which has been provided as feedback on past updates. For example, the experience data 16 may be provided cyclically, so that the sequence determination criterion 13 may be revised cyclically based on the experience data 16. The experience data 16 may at least partially relate to the previously mentioned information 15, that is to say, for example, the experience data may relate to the installation time for the update unit 12.

[0053] In step S4, the motor vehicle 1 is provided with the selected update units 12 and the determined update sequence data 14. For this purpose, these can be transmitted from the external computing device 2 to the motor vehicle 1 via the communication link 7. The selected update units 12 together with the determined update sequence data 14 can be referred to as an update package 17 or update. Thus, the motor vehicle 1 is provided with an update package 17, from which the required software updates for the individual control devices 4 (update units 12) and information about the order in which the individual software updates are to be installed (update sequence data 14) can be extracted.

[0054] In step S5, it is provided that the provided update units 12 are installed in the motor vehicle 1 in the order according to the provided update sequence data 14. This can be achieved, for example, by correspondingly controlling the individual control devices 4 by means of the central control device 5. As far as this is possible and sensible, the individual update units 12 are installed in parallel, otherwise they can be installed in series.

[0055] In step S6, it can be checked whether the estimated total duration according to the total installation duration information 18 is less than the preset duration limit 19. The update sequence data 14 here has the total installation duration information 18, which describes the estimated total duration for installing the selected update unit 12. Step S4 and / or step S5 can only be performed if or always if the estimated total duration is less than the duration limit. If step S5 is performed after the check is successfully completed, step S4 is also performed before step S6 is performed.

[0056] Alternatively or additionally, in step S7, it can be checked whether the estimated total installation energy consumption according to the total energy consumption information 20 is less than a preset energy consumption limit value 21. In this case, the update sequence data 14 have total energy consumption information 20, which describes the estimated total installation consumption for installing the selected update unit 12. If the check is successful, step S4 and / or step S5 can be performed. If step S7 and / or step S6 are unsuccessful, for example, step S2 can be repeated, that is, for example, fewer update units 12 can be selected and / or another update sequence and thus another update sequence data 14 can be determined when step S3 is repeated. When presetting the energy consumption limit value 21, the state of charge data 9 can be taken into account, so that, for example, the energy consumption limit value 21 can be related to the current state of charge according to the state of charge data 9. Steps S6 and S7 can be performed with the help of the external computing device 2 and / or with the help of the control device 5.

[0057] In summary, these examples show the model-based calculation of the update sequence (refresh sequence) when the motor vehicle 1 is jointly updated. The establishment of the update sequence, that is, the establishment of the update sequence data 14, is realized by a model-based method. Here, all the functional dependencies of the control devices 4 related to the update, the requirements related to safety assurance, the performance indicators (such as the update time), the maximum current load and energy value during the update, and the legal requirements are described in a mathematical model, which is used to automatically calculate the update sequence. The mathematical model exists in the form of a sequence determination criterion 13. For maintenance or updating, the empirical values ​​from the guarantee of the individual controllers, the empirical values ​​from the joint guarantee and / or the empirical values ​​from the feedback of the update activities are periodically incorporated into the data model from the field, that is, into the mathematical model. Therefore, the empirical data 16 are taken into account by the sequence determination criterion 13. The database is used as the input of the data model, in which it is mapped how the relevant products (single controller update, current value, energy value) are obtained from the upstream measurement and assurance process at the individual controller or joint inspection, that is, the information 15 used for the sequence determination criterion 13 is taken into account.

[0058] The technical implementation is based on an enterprise database, which is filled with empirical values ​​(empirical data 16) from measurements at the inspection site and from actual customer update processes, such as single controller refresh time, single controller energy value, current measurement, etc., in order to operate a mathematical data model. The data model maps the requirements, dependencies and / or relevant legal provisions when calculating the refresh sequence in the case of joint updates with the help of mathematical and logical relationships, that is, the update sequence data 14 can be determined with the help of sequence determination criteria 13. When establishing a new baseline, that is, a new software master list 11, the data calculation is started by the server (external computing device 2) and the results of the calculation performed with the help of the data model are called. These implemented and paralyzed update processes can be displayed in a way that is easy for the operator to read through suitable visualization. Similarly, the critical path, the expected total update time and the estimated required energy value can be calculated. Based on these values, it can be judged whether the performance indicators stipulated by law are complied with before the software master list 11 is released. This is achieved at least partially by checking steps S6 and S7, for example.

Claims

1. A method for providing an update to a motor vehicle (1), the method comprising: - providing (S1) equipment data (10) to an external computing device (2), the equipment data describing which control devices (4) the motor vehicle (1) is equipped with and the software version with which the respective control device (4) is currently running; - by means of the external computing device (2), taking into account the provided equipment data (10), selecting (S2) all update units (12) relevant to the motor vehicle (1) from a software master list (11), in which the currently set software version is recorded for each control unit (4) potentially included in the motor vehicle (1); - determining (S3) update sequence data (14) describing the installation sequence of the selected update units (12) in the motor vehicle (1) by applying a sequence determination criterion (13) to the selected update units (12) with the aid of an external computing device (2); and - providing (S4) the motor vehicle (1) with the selected update unit (12) and the determined update sequence data (14).

2. The method according to claim 1, characterized in that The provided update units (12) are installed (S5) in the motor vehicle (1) in an order according to the provided update sequence data (14).

3. The method according to claim 2, characterized in that The update sequence data (14) specifies whether a plurality of provided update units (12) are to be installed, and if so, which of the update units (12) are to be installed in parallel.

4. The method according to any one of the preceding claims, characterized in that The order determination criterion (13) is based on a mathematical model which takes into account at least one of the following information (15) for each of the selected update units (12): - dependency on the installation of at least one further updating unit (12); - Installation time; - Installation energy consumption; - General safety requirements; - functional safety requirements; and / or -Legal security requirements.

5. The method according to any one of the preceding claims, characterized in that The sequence determination criterion (13) takes into account empirical data (16) which describe at least one experience which has been determined when individually securing a corresponding control device (4) of the motor vehicle (1) and / or when jointly securing a plurality of control devices (4) and / or which has been provided as feedback to a past update.

6. The method according to claim 5, characterized in that Empirical data (16) is provided periodically.

7. The method according to any one of the preceding claims, characterized in that The update sequence data (14) has total installation duration information (18), which describes the expected total installation duration of the selected update unit (12). Checking (S6) whether the total installation duration information (18) is less than a preset duration limit (19) is performed, wherein if the total installation duration information is less than the preset duration limit, the selected update unit (12) and the determined update sequence data (14) are provided and / or the installation of the selected update unit is allowed.

8. The method according to any one of the preceding claims, characterized in that The update sequence data (14) has total energy consumption information (20) describing the estimated total installation energy consumption of the installation of the selected update unit (12), and checks (S7) whether the total energy consumption information (20) is less than a preset energy consumption limit value (21), wherein, if the total energy consumption information is less than the preset energy consumption limit value, the selected update unit (12) and the determined update sequence data (14) are provided and / or the installation of the selected update unit is allowed.

9. The method according to claim 8, characterized in that State of charge data (9) describing the state of charge of a battery (8) of a motor vehicle (1) are determined, and energy consumption limit values ​​(21) are defined based on the determined state of charge data (9).

10. A system (3) comprising a motor vehicle (1) and an external computing device (2), characterized in that The system (3) is designed to carry out the method according to any of the preceding claims.

Images