Method for updating a control device of a vehicle

Abstract

The invention relates to a method for updating a control device (1) of a vehicle, wherein software for updating the control device (1) is loaded into an execution environment of the control device (1), and also to a control device for a vehicle.

Description

Technical Field

[0001] The present invention relates to a method for updating a control device of a vehicle, wherein software for updating the control device is loaded into an execution environment of the control device. The present invention also relates to a control device for a vehicle. Background Art

[0002] Various embodiments of methods of the type mentioned at the outset are part of the prior art and serve to bring a control device of a vehicle into a new state using new software. The new software is loaded into an execution environment of the control device and updates the control device. The execution environment comprises a memory area and a processor of the control device assigned to the memory area or a processor core of the control device assigned to the memory area.

[0003] For example, DE 10 2012 211 591 A1 discloses a method for updating a control device of a vehicle, wherein an engine control device of the vehicle is updated. Updating the engine control device includes starting or activating the engine control device for a different engine power, wherein starting or activating includes loading a new control device code or new application data into a special storage area of ​​the control device. The power plant control device is updated by the manufacturer of the control device or by a software developer different from the manufacturer of the control device.

[0004] For example, the company "BDperformance" offers a product called An update method is provided in which the control device is updated by saving an optimized configuration file in the control device using a flash tool. Switching between the original configuration file and the optimized configuration file can be achieved at any time (see https: / / ecuflash.de).

[0005] Of course, the vehicle controls provided by the vehicle manufacturer can also be updated by replacing them with replacement controls provided by third-party manufacturers. The rusEFI team provides an example replacement control as part of an open source project (see https: / / rusefi.com).

[0006] EP 3 333 748 A1 discloses a method for updating a control device of a vehicle, wherein the control device is started in a neutral operating state in order to set one of two configured operating states. A subsequent start of the control device in the first configured operating state allows a one-time change to the second configured operating state. A subsequent start of the control device in the second configured operating state does not allow a change to the first configured operating state.

[0007] If a control device provides multiple functions for a vehicle, in particular functions with different safety levels (ASIL), it must be ensured that the first function is not affected by a failure of the second function.

[0008] DE 10 2014 201 682 A1 discloses an operating method for a control device of a vehicle. In the method, each core of a processor of the control device is assigned a separate storage area in which software is installed. Each core of the processor only runs the software installed in the assigned storage area. An update of the software in the storage area or an operating failure of the software in the storage area will not affect the operation of the software in other storage areas.

[0009] DE 10 2019 200 812 A1 also discloses an operating method for a vehicle control device, wherein a first software module implementing a primary function of the control device and a second software module implementing a secondary function of the control device are implemented in separate hardware partitions that are different from each other. A failure of the secondary function will not affect the primary function.

[0010] Typically, the updating of control devices is left to the manufacturer of the control device (original equipment manufacturer, OEM). In this way, the risk that the function of the control device is affected by faulty or incompatible software is minimized. However, in this way, software developers other than the manufacturer of the control device cannot update the control device.

[0011] Software provided by such software developers is hereinafter referred to as free software, while software provided by manufacturers who control manufacturing is referred to as OEM software. Summary of the invention

[0012] Therefore, the object of the present invention is to propose a method for updating a control device of a vehicle which enables free software to be loaded into the control production and ensures the legally prescribed minimum functionality of the control device. Another object of the present invention is to provide a control device for a vehicle.

[0013] A subject of the invention is a method for updating a control device of a vehicle, wherein software for updating the control device is loaded into an execution environment of the control device. During the updating process, the control device is converted into an updated, i.e. new, state by loading the new software. The new software can be loaded into the control device in any known manner. The vehicle can be designed in particular as a passenger car (Pkw).

[0014] According to the invention, the configuration of the control device is converted from a closed configuration into an open configuration and free software is loaded into the free execution environment of the open configuration as software for updating the control device. The updating process changes the configuration of the control device. The closed configuration corresponds to the delivery state of the control device. The closed configuration only allows the manufacturer of the control device (original equipment manufacturer, OEM) to update the control device using the OEM software provided by the manufacturer.

[0015] Typically, the control remains in a closed configuration during the control or vehicle warranty period.

[0016] In contrast, an open configuration enables free software to be loaded into the control device, in particular into a free execution environment of the open configuration of the control device.A closed configuration may already contain a free execution environment.

[0017] It should be noted that the switch from the closed configuration to the open configuration may be preceded by a corresponding application by the vehicle owner. If the manufacturer of the control device agrees to the application, the subsequent prerequisite may be a successful verification of the owner's identity in a manner known per se (e.g., via an identity card and / or vehicle registration document).

[0018] Preferably, the conversion includes: generating a free execution environment and / or maintaining an OEM execution environment of a closed configuration and / or maintaining a secure execution environment of a closed configuration (11). In other words, the control device has a free execution environment only after the closed configuration has been converted to an open configuration. In this way, the storage space available to the control device in the closed configuration is not limited by the free execution environment.

[0019] On the other hand, the OEM execution environment and / or the secure execution environment are both closed and open configurations. Maintaining may include changing the OEM execution environment and / or changing the secure execution environment, such as changing the size of the corresponding execution environment and / or changing the size of the software stored in the corresponding execution environment.

[0020] Advantageously, the free execution environment is generated in a hardware partition of the control device that includes the OEM execution environment. In short, the free execution environment and the OEM execution environment belong to the same hardware partition. The two execution environments share the same microprocessor or microcontroller. In this way, the software modules of the two execution environments can interact particularly easily.

[0021] Ideally, the conversion includes: loading OEM software with the minimum functionality required by law into the OEM execution environment and / or transferring OEM software with the minimum functionality required by law from the OEM execution environment to the secure execution environment. When converting a closed configuration to an open configuration, the OEM software is loaded into the OEM execution environment of the open configuration. Alternatively or additionally, during the conversion, the OEM software stored in the OEM execution environment of the closed configuration is, in particular, partially transferred to the secure execution environment.

[0022] The OEM software ensures the legally required minimum functionality of the control device, independently of the free software loaded into the free execution environment. Without free software, the control device can have restricted, ie reduced, functionality compared to the closed configuration after conversion to the open configuration.

[0023] In one embodiment, the OEM execution environment protects the loaded OEM software from unauthorized modifications, or the secure execution environment protects the transferred OEM software from unauthorized modifications. The protection of the OEM execution environment or the secure execution environment may include any known means suitable for preventing unauthorized modifications of the OEM software. Known means include, for example, keys and certificates. Due to this protection, software developers other than the manufacturer of the control device cannot modify the OEM software. The legally required minimum functionality of the control device is thus guaranteed. The protection of the OEM execution environment or the secure execution environment in particular protects safety-related vehicle functions.

[0024] The loaded OEM software can provide an interface for the free software loaded into the free execution environment. The interface allows the free software to interact with the OEM software in read-only mode. For example, the free software can query and use the mileage, i.e., kilometer reading, managed by the vehicle's OEM software through the interface. However, the free software cannot tamper with the mileage. This ensures the authenticity of the vehicle's mileage. The specification, i.e., definition, of the interface is published by the manufacturer of the control unit. The same applies to the firmware of the control unit.

[0025] In one embodiment, the secure execution environment provides at least one key and / or certificate for accessing the OEM execution environment or the free execution environment, respectively. The secure execution environment (hardware secure execution environment, HSEE) can be designed as, for example, a hardware security module (HSM) or a trusted execution environment (TEE). The secure execution environment issues the keys and / or certificates required for access.

[0026] A bootloader loaded into the free execution environment can load free software. The bootloader loads free software when the control device is restarted, making it easy to update the control device.

[0027] The change of configuration can advantageously be recorded in an OEM database external to the vehicle. The recording can be done automatically and include, for example, the storage of the changeover time, the list of free software loaded into the free execution environment. In this way, the OEM database can be queried at any time to determine the current configuration of the control device.

[0028] It will be appreciated that the proposed method can be applied simultaneously to a plurality of control devices of a vehicle, in particular to a network of interacting control devices of a vehicle.

[0029] Another subject matter of the invention is a control device for a vehicle having a closed configuration. The closed configuration of the control device corresponds to a delivery state of the control device.

[0030] According to the present invention, the control device is designed to be updated by executing the method according to an embodiment of the present invention. The updating process changes the configuration of the control device and converts the original closed configuration into an open configuration. The open configuration allows free software to be loaded into the control device. The OEM software that is also loaded into the control device during the conversion process can ensure that the control device has the minimum functionality required by law.

[0031] The significant advantage of the method according to the invention is that the control device of the vehicle can be updated using free software and at the same time the legally required functions are ensured. In this way, the control device is programmable for software developers other than the control device manufacturer. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The invention is schematically illustrated in the drawings according to embodiments and is further described with reference to the drawings. The drawings show:

[0033] Figure 1 A block diagram showing a control device for a vehicle according to an embodiment of the present invention in a closed configuration.

[0034] Figure 2 Show Figure 1 Block diagram of the control device shown in the open configuration. DETAILED DESCRIPTION

[0035] Figure 1 A block diagram of a control device 1 for a vehicle (not shown) according to one embodiment of the present invention is shown in a closed configuration 2. The control device 1 comprises a hardware partition 10 having an OEM execution environment 31 and a secure execution environment. The secure execution environment 11 is designed to provide at least one key 110 and / or certificate 111, in particular a plurality of keys 110 and / or certificates 111.

[0036] The control device 1 has a closed configuration 2 and is configured to be updated by executing a method according to one embodiment of the present invention described below.

[0037] In a method for updating a control device 1 of a vehicle, software for updating the control device 1 is loaded into an execution environment of the control device 1 . In this case, a closed configuration 2 of the control device 1 is converted into an open configuration 3 of the control device 1 .

[0038] Figure 2 Show Figure 1 The block diagram of the control device 1 shown is in an open configuration 3. The conversion advantageously includes: generating a free execution environment 30, and / or maintaining an OEM execution environment 31 of the closed configuration (2) and / or maintaining a secure execution environment (11) of the closed configuration 2. The converted open configuration 3 includes the secure execution environment 11, the OEM execution environment 31 and the free execution environment 30.

[0039] The OEM execution environment 31 may include a coordination module 310. Preferably, the free execution environment 30 is generated in the hardware partition 10 of the control device 1 including the OEM execution environment 31.

[0040] The free software 5 is loaded into the free execution environment 30 of the open configuration 3 as software for updating the control device 1. The boot loader 300 loaded into the free execution environment 30 loads the free software 5 conveniently.

[0041] The conversion includes, in particular, loading the OEM software 6 with the minimum functionality required by law into the OEM execution environment 31, and / or transferring the OEM software 6a with the minimum functionality required by law from the OEM execution environment 30 to the secure execution environment 11. The loaded OEM software 6 advantageously provides an interface 60 for the free software 5 loaded into the free execution environment 30. The OEM execution environment 31 can protect the loaded OEM software 6 from unauthorized modifications. The secure execution environment can protect the transferred OEM software 6 from unauthorized modifications.

[0042] The secure execution environments 11 belonging to the closed configuration 2 and the open configuration 3 can provide at least one key 110 and / or certificate 111 for accessing the OEM execution environment 31 or the free execution environment 30, respectively. The figure shows the authorization 112 for the free execution environment, i.e., the subset of the keys 110 and / or certificates 111 that the open execution environment 30 can access. It should be understood that the number and distribution of the keys 110 and certificates 111 shown are merely exemplary and non-limiting.

[0043] This conversion may be recorded in an OEM database 4 external to the vehicle.

[0044] List of reference numerals:

[0045] 1 Control device

[0046] 10 Hardware Partitioning

[0047] 11 Secure Execution Environment

[0048] 110 Key

[0049] 111 Certificates

[0050] 112 Licensing of the Free Execution Environment

[0051] 2 Closed Configuration

[0052] 3 Open Configuration

[0053] 30 Free Execution Environment

[0054] 300 Bootloader

[0055] 31 OEM Execution Environment

[0056] 310 Coordination Module

[0057] 4 OEM Database

[0058] 5 Free Software

[0059] 6 OEM Software

[0060] 60 Interface

Claims

1. A method for updating a control device (1) of a vehicle, wherein: - loading the software for updating the control device (1) into the execution environment of the control device (1), - The closed configuration (2) of the control device (1) is converted into the open configuration (3) of the control device (1), and the free software (5) is loaded into the free execution environment (30) of the open configuration (3) as software for updating the control device.

2. The method according to claim 1, characterized in that The conversion includes: generating a free execution environment (30) and / or maintaining an OEM execution environment (31) of the closed configuration (2) and / or maintaining a secure execution environment (11) of the closed configuration (2).

3. The method according to claim 2, characterized in that A free execution environment (30) is generated in a hardware partition (10) of a control device (1) including an OEM execution environment (31).

4. The method according to claim 3, characterized in that The conversion includes: loading the OEM software (6) with the minimum functions required by law into the OEM execution environment (31), and / or transferring the OEM software (6) with the minimum functions required by law from the OEM execution environment (30) to the secure execution environment (11).

5. The method according to claim 4, characterized in that The OEM execution environment (31) protects the loaded OEM software (6) from unauthorized modification, or the secure execution environment (11) protects the transferred OEM software (6) from unauthorized modification.

6. The method according to claim 4 or 5, characterized in that: The loaded OEM software (6) provides an interface (60) for the free software (5) loaded into the free execution environment (30).

7. The method according to any one of claims 2 to 6, characterized in that The secure execution environment (11) provides at least one key (110) and / or certificate (111) for accessing the OEM execution environment (31) or the free execution environment (30), respectively.

8. The method according to any one of claims 1 to 7, characterized in that The boot loader (300) loaded into the free execution environment (30) loads the free software (5).

9. The method according to any one of claims 1 to 8, characterized in that The conversion is recorded in an OEM database (4) external to the vehicle.

10. A control device (1) for a vehicle, the control device having a closed configuration (2), the control device being configured to be updated by performing a method according to any one of claims 1 to 9.

Images