Procedure for updating a vehicle's control unit

Abstract

Method for updating a control unit (200) of a vehicle, in particular an airbag control unit, wherein the control unit may contain information about internal and external faults, comprising the following steps: Receiving (101) an identification (201) of new software for the control unit, via an interface; Receiving (103) a set (203) of predetermined states of the control unit via an interface, wherein the set of predetermined states includes at least one internal fault of the control unit; Performing (105) a comparison between the set of predetermined states and a set of actual states of the control unit and providing a first comparison result or a second comparison result depending on the comparison; Performing (107) the update upon provision of the first comparison result and Preventing the update from being executed when the second comparison result is provided, where the first comparison result is provided when the set (203) of predetermined states contains information about internal faults that are assigned to the control unit and can occur in the control unit, when an update is possible.

Description

State of the art

[0001] The present invention relates to a method according to claim 1, a control unit according to claim 11 and a computer program product according to claim 12.

[0002] Several airbag control units offer the option of being updated in the field with a software update (SW update). This process is referred to below as flashing.

[0003] Under certain conditions, the application of a software update is prevented. For example, the airbag control unit distinguishes between internal and external faults. Internal faults affect components within the control unit. These faults cannot be cleared by the original equipment manufacturer (OEM) via diagnostics. External faults affect components outside the control unit and can be cleared by the OEM via diagnostics.

[0004] With current concepts, a software update is only possible if the control unit has not detected or stored any internal errors.

[0005] EP 1 701 262 B1 describes a method and a device for rewriting a sector in a sector-erasable, non-volatile semiconductor memory. Bootloader software is used.

[0006] From the document DE 10 2007 040 093 A1 a method for installing a software module in a control unit of a vehicle depending on the fulfillment of an installation condition is known.

[0007] A system for using a mobile device in a motor vehicle is known from the publication WO 2006 063 601 A1. In this system, the mobile device is used to query the version number of software used in a control unit via a communication link and to compare it with available updates. If newer versions of the control sequences present in the control unit are detected, these are first downloaded to the mobile device and then installed in the respective control unit. Disclosure of the invention

[0008] Against this background, the present invention presents a method for updating a vehicle control unit, a control unit that uses this method, and finally a corresponding computer program product according to the independent claims. Advantageous embodiments are described in the respective dependent claims and the following description.

[0009] The present invention presents a novel concept that, under certain circumstances, allows the circumvention of the known mechanism that prevents updates in the event of internal errors in a control unit. This makes it possible, for example, to clear internal errors and / or flash new software onto the control unit.

[0010] The present invention provides a method for updating a vehicle control unit, wherein information about internal and external errors can be stored in the control unit, comprising the following steps: Receiving an identification of new software for the control unit via an interface; Receiving a set of predetermined states of the control unit via an interface, wherein the set of predetermined states comprises at least one internal error of the control unit; Performing a comparison between the set of predetermined states and a set of actual states of the control unit and providing a first comparison result or a second comparison result depending on the comparison; Perform the update based on the first comparison result. The control unit may be an airbag control unit. The update may involve a change, addition, or replacement of data or information stored, for example, in a memory assigned to the control unit. Internal errors can relate to malfunctions of internal components of the control unit. Error entries relating to internal errors cannot currently be deleted by the original equipment manufacturer via diagnostics. External errors can relate to components located outside the control unit, which can also currently be deleted by the original equipment manufacturer via diagnostics. The errors can be hardware errors or software errors. A hardware error can be caused by a defect in a hardware component, for example a circuit or an electrical connection.A software error can be caused by a fault in a program running on the control unit or by a disruption in the program's execution process. Information about errors can be obtained, for example, through a self-test of the control unit and saved for evaluation or further processing. An update of the control unit can be initiated by an update request. The new software can be a program intended to run on the control unit. The new software can replace or supplement existing software. The new software can be identified by a version number. The interface can be an interface of the control unit. The set of predefined states can comprise a list of states or conditions that are assigned to the control unit and can occur within it.The set of predetermined states can, for example, define one or more possible error states. This set of predetermined states can be tailored to the control unit and / or the new software and, for example, provided to the control unit along with the new software or its identification. Conditions under which an update of the control unit is permitted or, alternatively, prohibited can be defined via the set of predetermined states. In particular, the set of predetermined states can define that an update can also be performed if one or more internal errors have been detected and / or stored. In this case, the set of predetermined states can contain information about those internal errors that should trigger an update.The set of actual states of the control unit can include information about detected and / or stored errors of the control unit. To compare the set of actual states with the set of predetermined states, known comparison operations can be performed. Depending on the comparison, the update can be performed or prevented.

[0011] According to one embodiment, the first comparison result can be provided if the set of predetermined states includes the set of actual states. Thus, the set of predetermined states can include those states for which the update should be possible.

[0012] The update can include saving the identification of the new software as a memory value. This allows for a later comparison between software versions.

[0013] The update process can also include saving an identification of existing software in the control unit as a memory value. Depending on the update mechanism used, this can, for example, prevent the installation of new software.

[0014] The method according to the invention can include a step of receiving the new software via an interface, and the update can include loading the new software as the current software into the control unit. In this way, the control unit can be updated with the new software.

[0015] When an update is performed, a comparison can be made between the identification of the current software and the memory value. This allows verification that the correct software has been installed.

[0016] Furthermore, the update can include saving information about the set of predetermined states and / or information about the set of actual states. This facilitates documentation of the update process.

[0017] According to one embodiment, the update can include at least partially disabling information about the actual state of the control unit. In this way, for example, information stored in the control unit about an internal error can be deleted or at least hidden for the duration of the new software loading process.

[0018] According to one embodiment, receiving the set of predetermined states can include a step of reading the set of predetermined states from a memory of the control unit. In this way, the method according to the invention can be made more robust against misuse.

[0019] The number of actual states can also be read from the control unit's memory. In this way, past and documented events can be used as a basis for decisions regarding updates.

[0020] Furthermore, at least one of the received pieces of information can be secured using a security procedure, and a verification of the received information can be performed upon receipt. A known encryption or signing method can be used as the security procedure.

[0021] The present invention further provides a control unit configured to perform or implement the steps of the method according to the invention. This embodiment of the invention in the form of a control unit also allows the problem underlying the invention to be solved quickly and efficiently.

[0022] In this context, a control unit can be understood as an electrical device that processes sensor signals and outputs control signals accordingly. The control unit can have an interface, which can be implemented in hardware and / or software. In the case of a hardware-based interface, the interfaces can, for example, be part of a so-called system ASIC, which incorporates various functions of the control unit. However, it is also possible that the interfaces are separate integrated circuits or at least partially comprised of discrete components. In the case of a software-based interface, the interfaces can be software modules, which, for example, are located on a microcontroller alongside other software modules.

[0023] A computer program product with program code stored on a machine-readable medium such as semiconductor memory, hard disk memory or optical memory, and used to carry out the method according to one of the embodiments described above, is also advantageous if the program is executed on a control unit.

[0024] The invention is explained in more detail below with reference to the accompanying drawings. These show: Fig. 1 a flowchart of a method according to an embodiment of the present invention; and Fig. 2 a control unit according to an embodiment of the present invention.

[0025] In the following description of preferred embodiments of the present invention, the same or similar reference numerals are used for the elements shown in the various figures and having a similar effect, without repeating these elements.

[0026] Fig. 1 shows a method for updating a control unit of a vehicle according to an exemplary embodiment of the present invention. In order to carry out the update of the control unit, an identification of new software to be loaded for the control unit and a set of predefined or predetermined states of the control unit can be provided. In a step 101, the identification of the new software can be received, for example, via an interface of the control unit. In a step 103, the set of predetermined states can be received, for example, via the interface of the control unit. The set of predetermined states can be provided, for example, in the form of a list. In this case, the set of predetermined states can in particular comprise at least one definition of an internal error of the control unit. The actual states can, for example, be read from an internal memory of the control unit.The individual data points can also be received in a different order than described, or simultaneously.

[0027] In a step 105, the predetermined states can be compared with the actual states. The states can be compared together or, for example, individually in sequence until a decision-relevant match or mismatch is found. Depending on the comparison, a first comparison result or a second comparison result can be provided. If the first comparison result is provided, the control unit is subsequently updated in a step 107. If the second comparison result is provided, execution of step 107 and thus execution of the update is prevented.

[0028] According to this exemplary embodiment, the first comparison result can be provided if the set of predetermined states includes the set of actual states. Thus, the update can be performed when all events that have occurred and are relevant for the decision are included in the set of predetermined states. If the set of predetermined states also contains information about a specific internal error of the control unit, the update can be performed even if the specific error has actually occurred in the control unit.

[0029] Thus, the method according to the invention comprises an extended concept for providing the control unit with new software (flash concept), which uses various mechanisms that enable targeted control of the software update or enforce certain processes.

[0030] For this purpose, a new diagnostic service or an adaptation of an existing diagnostic service is used. Upon request, the service contains at least one piece of information about the condition that must be present in the control unit for the procedure to be permitted, and at least one piece of information about the identification of the new software. The condition that must be present in the control unit can, for example, include a list of internal errors that may be present in the control unit. The identification of the new software can, for example, include a software version and can be used to enforce the application of the new software in a subsequent step of the concept.

[0031] Once the request is received by the control unit software, the software checks whether the required condition for the update procedure is met. This check might, for example, require that the control unit's fault memory only contains internal errors that are present in the request's list of internal errors, i.e., in the set of predefined states.

[0032] If this is not the case, the request is rejected. If this is the case, the request can be documented. This can include saving, for example, the list of internal errors, the currently existing errors, the system time, the number of switch-on processes already carried out and / or the workshop identification. In any case, the identification of the new, mandatory software can be saved. After successful documentation, the internal errors can be deleted and the control unit prepared for the software update and any other memory, such as EEPROM. The preparation can be done, for example, by resetting the bootloader. The updates can then be carried out and the control unit returned to its normal operating state, e.g. by resetting.

[0033] Each time the system returns to normal operating mode, the additionally stored software identification can be compared with the software identification of the current software. If the two match, the stored software identification can be reset to a default value. This makes it possible to install further software updates using the established procedure.

[0034] In a known method, the software identification and the EEPROM identification are compared. This ensures that both identifications match. The method according to the invention introduces the following additional steps. First, the expected software version after flashing is stored. Second, the software identification is tested after flashing. Third, the expected version is reset as soon as the two versions match. This ensures that the correct software version has been flashed. The comparison between the software and the EEPROM is still included.

[0035] If the software identifications do not match, an error can be identified and, for example, a warning light may be activated. The control unit (ECU) will only function correctly once the correct software version has been installed.

[0036] According to one embodiment, it may not be desirable to install new software. In this case, the old software identification, i.e., the identification of the software contained in the control unit before the update request, can be specified as the new software identification. Thus, the software identification check is only correct if no new software is installed.

[0037] According to a further embodiment, the inventive concept can be applied to internal errors. In this case, deleting the internal errors is not mandatory. Alternatively, deleting the internal errors can be hidden for the duration of the flashing process, thus allowing the flashing process. However, the method for checking the error memory against the list of internal errors from the request remains intact.

[0038] To make the method more robust against misuse, according to a further embodiment, a list of conditions, e.g., internal errors, for which this method is generally applicable can be stored in the control unit software. The method can only be executed if the list of conditions, e.g., internal errors, from the request only contains those conditions that are also contained in the list stored in the control unit.

[0039] According to a further embodiment, the information in the request can be signed and / or encrypted, for example, by the manufacturer of the control unit. The signature and / or encryption can be verified by the control unit after receipt of the request, and the request can only be further processed if the signature and / or decryption was successful.

[0040] Fig.2 shows a schematic representation of a control unit 200 according to an exemplary embodiment of the present invention. The control unit 200 can be an airbag control unit that can be used in a vehicle. The control unit 200 can be configured to execute software. The software and / or other data stored in the control unit 200 can be updated in an update process according to the inventive method for updating the control unit 200. During the update process, the control unit 200 can be configured to receive, via one or a plurality of interfaces, an identification 201 of new software, a set 203 of predetermined states, and the new software 204. Furthermore, the control unit can be configured to read a set of actual states from a memory 210.According to one embodiment, the set of 203 predetermined states can also be stored in the memory 210 and read out from it.

[0041] During the update process, information such as the identification 201 or the quantity of actual states present at the time of the update can be stored in memory 210.

[0042] The exemplary embodiments described and shown in the figures are selected only as examples. Different exemplary embodiments can be combined with each other in their entirety or with regard to individual features. Furthermore, one exemplary embodiment can be supplemented by features of another exemplary embodiment.

[0043] Furthermore, method steps according to the invention can be repeated and carried out in a different order than that described.

[0044] If an embodiment comprises an “and / or” link between a first feature and a second feature, this can be read such that the embodiment according to one embodiment has both the first feature and the second feature and according to another embodiment has either only the first feature or only the second feature.

Claims

[1] Method for updating a control unit (200) of a vehicle, in particular an airbag control unit, wherein information about internal and external errors can be stored in the control unit, comprising the following steps: Receiving (101) an identification (201) of new software for the control unit via an interface; Receiving (103) a set (203) of predetermined states of the control unit via an interface, wherein the set of predetermined states comprises at least one internal error of the control unit; Performing (105) a comparison between the set of predetermined states and a set of actual states of the control unit and providing a first comparison result or a second comparison result depending on the comparison; Carrying out (107) the update when the first comparison result is provided and Preventing the update from being executed when the second comparison result is provided, wherein the first comparison result is provided when the set (203) of predetermined states comprises information about internal errors that are associated with the control unit and can occur in the control unit, upon the occurrence of which the update is possible. [2] Method according to claim 1, wherein the updating (107) comprises storing the identification (201) of the new software as a memory value. [3] Method according to one of the preceding claims, wherein the updating (107) comprises storing an identification of an existing software of the control unit (200) as a memory value. [4] Method according to one of the preceding claims, comprising a step of receiving the new software (204) via an interface and wherein the updating comprises loading the new software as current software into the control unit. [5] Method according to one of claims 2 or 3, wherein in response to the update (107) a comparison is made between an identification of the current software and the memory value. [6] Method according to one of the preceding claims, wherein the updating (107) comprises storing information about the set of predetermined states and / or information about the set of actual states. [7] Method according to one of the preceding claims, in which the update (107) deletes information stored in the control unit about an internal error that has occurred or at least hides it for the period of loading the new software. [8] Method according to one of the preceding claims, wherein receiving (103) the set of predetermined states comprises a step of reading the set of predetermined states from a memory (210) of the control unit (200). [9] Method according to one of the preceding claims, in which the set of actual states is read from a memory (210) of the control unit (200). [10] Method according to one of the preceding claims, wherein at least one of the received information is secured by means of a security method and in response to the step of receiving, a check of the at least one received information is carried out. [11] Control device (200) configured to perform the steps of a method according to one of claims 1 to 10. [12] Computer program product with program code stored on a machine-readable carrier for carrying out the method according to one of claims 1 to 10 when the program is executed on a control device.

Images