VEHICLE OTA FIRMWARE UPGRADE VERIFICATION USING AN OFF-BOARD SYSTEM

Abstract

A method for verifying software and / or software installation of a motor vehicle (10), wherein the method is performed by the motor vehicle (10) and comprises: acquiring (S10) verification data, wherein the verification data represents a verification of an adaptation and / or a new installation of software and / or software installation available in the motor vehicle (10); acquiring (S20) software state data of the software and / or software installation of the motor vehicle (10), wherein the software state data represents at least one current state of software and / or software installation available in the motor vehicle (10); transmitting (S30) the software state data and / or the verification data to a backend computer system external to the motor vehicle (10);Receiving (S70) test data from the backend computer system, representing a test result determined based on previously transmitted software status data and / or verification data.

Description

The present invention relates to a method for checking software and / or software installation of a motor vehicle, to a correspondingly configured motor vehicle, to a correspondingly configured backend computer system, and to a correspondingly configured system.It is an object of the invention to further improve checking of software and / or software installation of a motor vehicle.The solution of this object is achieved according to the teaching of the independent claims. Various embodiments and developments of the invention are the subject matter of the dependent claims.According to one embodiment of the present invention, a method for checking software and / or software installation of a motor vehicle is provided, wherein the method is carried out in particular by the motor vehicle.In one embodiment, the method comprises ascertaining checking data. In one embodiment, the checking data represent or describe a checking of an adaptation and / or a new installation of a software and / or software installation available in the motor vehicle. In one embodiment, checking is based on predetermined requests to the software and / or software installation with responses of the software and / or software installation, wherein a correct software installation and / or correctly functioning software usually exists when all responses of the software and / or software installation correspond to an expected response.In one embodiment, the method comprises acquiring software state data of the software and / or software installation of the motor vehicle. In one embodiment, the software state data describe or represent at least one, in particular current, state of software and / or software installation available in a motor vehicle. In one embodiment, the software state data are recorded by or in at least one control device of the motor vehicle, in particular software state data are recorded by at least one, in particular software-operated or software-controlled, component of the motor vehicle. In one embodiment, the acquisition of software state data comprises a determination or calculation of software state data, in particular of at least one, in particular software-operated or software-controlled, element of the motor vehicle. In one embodiment, software state data describe at least one state or version of software of the motor vehicle or of software and / or software installation available in the motor vehicle, in particular of the at least one, in particular software-operated or software-controlled, component or of the at least one, in particular software-operated or software-controlled, element of the motor vehicle.In one embodiment, the method comprises transmitting the software state data and / or the checking data to a backend computer system external with respect to the motor vehicle. In one embodiment, "transmitting" can refer to sending, in particular actively, or to providing, in particular on request by the backend computer system, the data.In one embodiment, the method includes receiving test data from the backend computer system. In one embodiment, the test data represent or describe a test result determined as a function of the previously transmitted software state data and / or test data. In one embodiment, the test data is determined by the backend computer system.The term "motor vehicle" as used herein is preferably to be understood as a means of transport, in particular a car, transporter, truck, motorcycle, aircraft and / or watercraft, or the like.The term "backend" or "backend computer system" as used herein is preferably to be understood as a substructure ("backend"), which is located outside the motor vehicle, in particular is formed separately from the motor vehicle, further in particular, in one embodiment, has at least one server or is at least one server or the like, which is or can be used at least for carrying out or carrying out the method steps described herein and provided for the backend.The term "sensing" as used herein is preferably intended to be "self-detecting" or "obtained from an external source.". In one embodiment, "sensing" may include both "self-detecting" and "obtained from an external source.".The term "checking" as used herein is preferably to be understood as being repeatable once and / or over time, in particular in the sense of "monitoring".The term "control device" as used herein is preferably to be understood as a means of the motor vehicle for controlling at least one component of the motor vehicle; in particular, the term "control device" can be understood as a combination of a plurality of control devices, which are linked in particular via a bus system or its own lines in terms of information technology. In one embodiment, the control device comprises an information interface (in particular a bus, a proprietary data connection), a data memory (for example a flash memory, in particular a RAM) and / or an evaluation unit, which can be configured, for example, as a programmable processor, microcontroller or the like. In one embodiment, the control device, in particular the evaluation unit, is configured to receive, transmit or transmit and / or test a data set. In other words, the control device, in one embodiment, is (at least) configured to check the coding / programming of its own and / or at least one other component of the motor vehicle. In one embodiment, the control device, in particular the evaluation unit, is additionally configured to adapt a coding or the software of a second control device. In one embodiment, this represents a (actual) flash process / the coding or an update / upgrade of the software of the motor vehicle. By means of the information interface, the evaluation unit is configured in one embodiment to output a request to the second control device in order to check the proper functioning of the second control device. In one embodiment, predefined queries can entail, when the second control device is functioning properly, obtaining a response to the request and can be checked, in particular, on the basis of references predefined in the data memory, in one embodiment. In one embodiment, the predefined reference can be obtained, in particular together with a data record / programming instruction (in particular from a backend or backend server). In particular, the control device, as described herein, or the combination of control devices, is configured, in one embodiment, to participate in a method described herein or to execute at least one part, in particular the part assigned to the control device.Advantageously, in one embodiment, call-backs, in particular in the case of known safety gaps, can be avoided by SW (software) updates, in particular by monitoring and / or checking the motor vehicle, further in particular the software of the motor vehicle. Motor vehicles can be kept up-to-date in all areas (including safety-relevant / ASIL-relevant ranges) via the vehicle age and, in particular, this up-to-dateness can be monitored and / or checked. Advantageously, in one embodiment, this allows new functionalities, which are or can be security / ASILrelevant in particular, to be brought into the existing vehicle by a customer request / order and in particular the correct installation or function thereof to be checked and / or monitored, in particular with the aid of the backend. Advantageously, in one embodiment, environments controlled for this purpose are no longer necessary, in particular no longer necessary, in particular compared to changes on the motor vehicle, in particular its software, which are wired. Additionally, in one embodiment, there is advantageously no ASIL distribution in the vehicle. This means that the in-vehicle I / O infrastructure does not need to be capable of better (integer) hardware and more complex software, which would increase costs. In one embodiment, it is sufficient that the software that is to be programmed / flashed (including the "checker software" for checking and / or monitoring) corresponds to the necessary ASIL level. This software can be transferred to the backend as a "secured packet". Advantageously, in one embodiment, this makes it possible to prevent an incorrect decision of the motor vehicle, in particular of the software of the motor vehicle, from causing, for example, the vehicle lock, an engine lock or the like, which can protect or protect the motor vehicle from incorrect or incorrectly installed software, to be canceled. In one embodiment, this can be monitored and / or checked independently of an entity, in particular an external entity or entity detached from the motor vehicle, such as in particular the backend computer system, and thereby make changes to the motor vehicle, in particular its software, safe(s), in particular. Advantageously, in one embodiment, changes to the motor vehicle, in particular its software and / or its software installation, can be checked in two stages and / or independently.In one embodiment, the method includes, prior to the acquisition of software state data, receiving a data record by the motor vehicle and / or adapting and / or reinstallating software available in the motor vehicle, in particular based on the received data record.Advantageously, however, in one embodiment, the method can check whether or not the data record (received from the motor vehicle) has been correctly processed and / or that the adaptation and / or the reinstallation of a software or software available in the motor vehicle has been successful, error-free and / or correct.In one embodiment, the method includes ascertaining an availability of the backend computer system, in particular for data exchange with the motor vehicle. In one embodiment, the transmission of the software state data and / or the checking data, in particular by the motor vehicle, to the backend computer system is based on the determined availability of the backend computer system.Advantageously, in one embodiment, this allows checking of the software and / or software installation, in particular at the latest, to be carried out when a connection set-up, in particular for data exchange, between the motor vehicle and the backend computer system is available or possible.In one embodiment, the method comprises controlling or configuring, in particular at least one functionality, at least one component of the motor vehicle on the basis of the received test data.In one embodiment, this advantageously makes it possible to influence the motor vehicle, in particular when the motor vehicle has made a decision that cannot be confirmed by the backend computer system or was determined during the checking thereof by the backend computer system that this decision was not correct, for example the (incorrect) enabling of a vehicle lock, in particular engine lock, although, for example, the update was not carried out correctly. In particular, in one embodiment, this makes it possible to prevent the owner of the motor vehicle from continuing or continuing to drive with faulty software and / or faulty software installation.According to one embodiment of the present invention, a motor vehicle is provided. In one embodiment, the motor vehicle is configured to carry out a method described herein, in particular provided for the motor vehicle.In one embodiment, the motor vehicle means for ascertaining checking data has means for capturing software for inventory data, means for transmitting the software state data and / or the checking data, and / or means for receiving checking data from a backend computer system.According to one embodiment of the present invention, a method is provided which checks software and / or software installation of a motor vehicle, wherein the method is carried out in particular by a backend computer system. In one embodiment, the method comprises receiving software state data of a motor vehicle, in particular of the motor vehicle described herein. In one embodiment, the software state data describes or represents at least one current state of a software and / or software installation available in the motor vehicle. In one embodiment, the method additionally or alternatively comprises receiving checking data of the motor vehicle. In one embodiment, the checking data describe or represent a checking of an adaptation and / or reinstallation of software available in the motor vehicle.In one embodiment, the method comprises ascertaining test data, in particular with the aid of the backend computer system. In one embodiment, the test data describe or represent a difference between the received software state data and reference data and / or between test data and (corresponding) reference data. In one embodiment, the test data describes an overall test result, wherein the overall test result in one embodiment is or at least has a result of a Boolean AND query on the respective results of the testing of the software state data and the test data; and / or in one embodiment is or at least has a corresponding weight based on the results of the testing of the software state data and the test data.In one embodiment, the method comprises outputting the test data, in particular to a test instance. In one embodiment, the outputting comprises an acoustic, haptic and / or visual outputting. In one embodiment, the outputting comprises sending a (acoustic, haptic, visual and / or digital) message to a compartment, a human inspector or the like, in particular for checking the data, in particular the software and / or software installation. In one embodiment, the test data additionally or alternatively describe a diagnosis, at least one option for action or the like and / or at least one (code) location in which at least one difference from reference data was ascertained during the test, in particular in the case of the software state data and / or the test data.Advantageously, in one embodiment, a further analysis can be carried out as a result, so that it can additionally or alternatively be determined on the basis of this analysis whether a motor vehicle has to drive into the workshop or not. Advantageously, in one embodiment, it can thereby be checked or verified first that there is a deviation in the software available in the motor vehicle or during the adaptation and / or reinstallation of the software and / or software installation available in the motor vehicle, in particular an actual state of the software and / or software installation of the motor vehicle, and a corresponding desired state. Accordingly, in an embodiment, in particular automatically, the test entity can make a decision as to whether, in particular due to this deviation, there is a risk or risk for the motor vehicle or its user. Accordingly, in one embodiment, the method can include sending a command to the motor vehicle, in particular to the software of the motor vehicle, in order in particular to shut down the vehicle in the event of a potential risk or risk due to the deviation and / or to restrict its scope of function or vice versa.In one embodiment, the outputting of the test data comprises outputting the test data to the motor vehicle, in particular to the motor vehicle described herein, further in particular to the motor vehicle from which the software state data and / or test data were received (by the backend computer system). In one embodiment, the outputting of the test data comprises outputting control data to the motor vehicle, in particular based on the determined test data, further in particular for controlling at least one component of the motor vehicle. In one embodiment, the test data comprises the control data. Alternatively or additionally, the outputting of the test data comprises outputting a data set, in particular for adapting and / or reinstallating the software available in the motor vehicle, further in particular based on the determined test data. In one embodiment, the test data comprise, in particular additionally, the data record.In an embodiment, advantageously, in particular automatically, after checking the software and / or software installation of the motor vehicle, a correction can thereby be carried out on the motor vehicle, in particular on the software and / or software installation thereof. In one embodiment, this can improve the safety for the user of the motor vehicle in OTA applications, in particular for adapting and / or reinstalling software available in the motor vehicle.In one embodiment, the control data are designed to activate or reset a vehicle lock, in particular an engine lock, of the motor vehicle, in particular based on the ascertained test data, in particular to shut down or (re)mated the motor vehicle. In one embodiment, the control data is designed to activate or deactivate or reset a measure for, in particular guaranteed, preventing a journey of the motor vehicle.In one embodiment, the transmission of data has an authentication step and / or an encryption step, with which the motor vehicle authenticates itself to the backend computer system and / or the backend computer system authenticates itself to the motor vehicle and / or encrypts the data to be transmitted.In one embodiment, the transmission comprises checking the transmitted data for completeness and / or correctness, in particular with the aid of known methods, such as, for example, with the aid of a checksum ("hash") or the like.It is within the scope of the invention that the method steps described above are carried out in a different sequence and / or method steps are combined and / or a method step is integrated into a different method step, where technically possible and / or meaningful.According to one embodiment of the present invention, a backend computer system is provided. In one embodiment, the backend computer system is configured to carry out a method described herein, which is provided in particular for the backend computer system.In one embodiment, the backend computer system has means for receiving software state data and or for receiving verification data. In one embodiment, the backend computer system has means for ascertaining test data. In one embodiment, the backend computer system has means for outputting the test data. In one embodiment, the backend computer system has means for outputting control data and or a data record, in particular to a or the motor vehicle.According to one embodiment of the present invention, a system comprising at least one motor vehicle as described herein and at least one backend computer system as described herein is provided.Advantageously, in an embodiment, this allows a checking of software and / or software installation of a motor vehicle to be carried out in a simple manner(s), in particular an adaptation and / or reinstallation of software available in the motor vehicle to be carried out reliably(s).The terms "comprises," "includes," "includes," "has," "has," "with," or any other variant thereof, as used herein, are intended to cover a non-exclusive inclusion. For example, a method or apparatus comprising or having a list of elements is not necessarily limited to those elements, but may include other elements not expressly listed or inherent to such a method or apparatus.Further, unless expressly stated to the contrary, "or" refers to an inclusive or not an exclusive "or.". For example, a condition A or B is satisfied by one of the following conditions: A is true (or present) and B is false (or absent), A is false (or absent) and B is true (or present), and both A and B are true (or present).The terms "a" or "an" as used herein are defined in the sense of "one / one or more.". The terms "another" and "a further" and any other variant thereof are to be understood in the sense of "at least one further".The term "configured" or "configured" to fulfil a specific function (and respective modifications thereof), as is optionally used here, is to be understood that a device or component thereof in this respect is already present in a configuration or setting in which it can execute the function or it is at least adjustable, i.e. configurable, in such a way that it can execute the function after appropriate setting. The configuration can be effected, for example, by means of a corresponding setting of parameters of a process sequence or of switches or the like for activating or deactivating functionalities or settings. In particular, the device can have a plurality of predetermined configurations or operating modes, such that the configuration can be effected by means of a selection of one of these configurations or operating modes.A system and / or a means in the sense of the present invention can be designed using hardware and / or software, in particular can have at least one, in particular digital, processing, in particular microprocessor unit (CPU), graphics card (GPU) or the like, preferably data- or signal-connected to a memory and / or bus system, and / or one or more programs or program modules. The processing unit can be designed to process commands implemented as a program stored in a memory system, to acquire input signals from a data bus and / or to deliver output signals to a data bus. A storage system may include one or more, in particular different, storage media, in particular optical, magnetic, solid-state and / or other non-volatile media. The program can be designed such that it embodies or is capable of executing the methods described here, so that the processing unit can execute the steps of such methods and thus can monitor, in particular, software and / or software installation of the motor vehicle.In one embodiment, a computer program product may include, in particular be, a storage medium, in particular a computer-readable and / or nonvolatile storage medium, for storing a program or instructions or having a program stored thereon or having instructions stored thereon. In one embodiment, execution of this program or of these instructions by a system or a controller, in particular a computer or an arrangement of a plurality of computers, causes the system or the controller, in particular the computer or computers, to execute a method described here or one or more of its steps, or the program or the instructions are configured for this purpose. In another implementation, the computer program and / or the computer program product can be present as a file on a data processing unit, in particular on a server, and can be downloadable via a data connection, for example the Internet or a dedicated data connection, such as a proprietary or local area network. In addition, the computer program can have a plurality of interacting individual program modules. The modules can be configured in particular for this purpose or at least be usable in such a way that they are executed in the sense of distributed computing (distributed computing on different devices (computers or processor units which are geographically spaced apart from one another and are connected to one another via a data network. The system, in particular the backend computer system and / or the motor vehicle, can accordingly have a program memory in which the computer program is stored. Alternatively, the system can also be configured to access a computer program available externally, for example on one or more servers or other data processing units, via a communication connection, in particular to exchange with this data which are used during the course of the method or computer program or represent outputs of the computer program.In one embodiment, one or more, in particular all, steps of the method are carried out completely or partially automatically, in particular by the controller or its(s) means.Embodiments described herein can be combined with one another as desired and with the further described embodiments of the present solution, unless this is explicitly excluded or technically impossible.Further advantages, features and possible applications of the present invention are evident from the following detailed description in conjunction with the figures.This shows FIG. 1 schematically shows a flow chart for illustrating an embodiment of the method according to the invention; and FIG. 2 schematically shows a system with a motor vehicle and a jaw computer system.Elements shown in the figures are not necessarily drawn to scale. Rather, the various elements illustrated in the figures are reproduced in such a way that their function and general purpose will be understood by the person skilled in the art. Connections and couplings between functional units and elements shown in the figures can also be implemented as an indirect connection or coupling, unless expressly stated otherwise. Functional units can be implemented in particular as hardware, software or a combination of hardware and software.FIG. 1 schematically shows a flow chart of the method. In this case, method steps which are carried out by the motor vehicle 10 are shown above and method steps which are carried out by the backend computer system 20 are shown below. In this case, the method comprises ascertaining checking data S 10, acquiring software state data S 20 and transmitting the software state data and / or the checking data S 30. In one embodiment, the transmission S 30 takes place, in particular only if the backend computer system 20 is available or accessible for transmitting or receiving data by the motor vehicle 10 or the means of the motor vehicle 10 configured for this purpose. The backend computer system 20 receives S 40 the software state data and / or checking data transmitted by the motor vehicle 10 and determines S 50 checking data relating to the software state data and / or checking data, in particular based on corresponding reference data. Furthermore, FIG. 1 schematically illustrates the outputting S 60 of the test data by the backend computer system 20. In one embodiment, the schematically illustrated method comprises receiving S 70 test data, in particular determined by the backend computer system 20, the motor vehicle or the means for receiving the test data.FIG. 2 shows a motor vehicle 10 and a backend computer system 20 which are in data exchange, in particular carry out a method as described herein or as illustrated by way of example in FIG. 1. In one embodiment, the communication takes place, in particular wirelessly, with the aid of suitable transmitting devices for transmitting or receiving the respective data. The motor vehicle 10 has means suitable for this purpose, which are schematically shown as a box, which is connected to the transmitting device of the motor vehicle, in particular in data communication. The backend computer system 20 is shown by way of example as a server with a transmitter mast and as being arranged externally to the motor vehicle 10. In one embodiment, the communication between motor vehicle 10 and backend computer system takes place as required, in particular by software triggers, and / or continuously, in particular when there is availability for transmitting data.While at least one exemplary embodiment has been described above, it should be appreciated that a wide variety of variations exist. It should also be appreciated that the described example embodiments are merely non-limiting examples, and are not intended to limit the scope, applicability, or configuration of the apparatuses and methods described herein. Rather, the foregoing description will provide guidance to those skilled in the art to implement at least one exemplary embodiment, it being understood that various changes may be made in the operation and arrangement of elements described in an exemplary embodiment without departing from the subject matter set forth in the appended claims, as well as the legal equivalents thereof.LIST OF REFERENCE CHARACTERS10 Motor vehicle 20 backend computer system S 10 ascertaining checking data S 20 acquiring software state data S 30 transmitting the software state data and / or the checking data S 40 receiving software state data and / or checking data S 50 ascertaining checking data S 60 outputting the checking data S 70 receiving checking data

Claims

Method for checking a software and / or software installation of a motor vehicle (10), wherein the method is executed by the motor vehicle (10) and comprises: - determining (S10) checking data, wherein the checking data represent a check of an adaptation and / or a new installation of a software and / or software installation available in the motor vehicle (10); - acquiring (S20) software state data of the software and / or software installation of the motor vehicle (10), wherein the software state data represent at least a current state of a software and / or software installation available in the motor vehicle (10); - transmitting (S30) the software state data and / or the checking data to a backend computer system external with respect to the motor vehicle (10); receiving (S70) from the backend computer system test data representing a test result determined as a function of the previously transmitted software state data and / or test data.Method according to the preceding claim, characterized in that the method has, prior to the acquisition of software state data,: - reception of a data record by the motor vehicle (10); and / or - adaptation and / or reinstallation of software available in the motor vehicle (10), in particular based on the received data record.Method according to one of the preceding claims, characterized in that the method comprises: - determining an availability of the backend computer system for data exchange with the motor vehicle (10), wherein the software state data and / or checking data are transmitted on the basis of the determined availability.Method according to one of the preceding claims, characterized in that the method comprises: - controlling or configuring at least one functionality of at least one component of the motor vehicle (10) on the basis of the received test data.Motor vehicle (10), wherein the motor vehicle (10) is configured to carry out a method according to one of the preceding claims.Method for checking a software and / or software installation of a motor vehicle (10), wherein the method is carried out by a backend computer system (20), comprising: - receiving (S40) software state data of the motor vehicle (10), wherein the software state data represent at least one current state of a software and / or software installation available in the motor vehicle (10); and / or receiving checking data of the motor vehicle (10), wherein the checking data represent a check of an adaptation and / or a re-installation of a software available in the motor vehicle (10); - determining (S50) checking data using the backend computer system, wherein the checking data describe a difference between the received software state data and / or checking data and reference data; and - outputting (S60) the checking data, in particular to a checking entity.Method according to the preceding claim, characterized in that the outputting (S60) of the test data comprises outputting the test data to the motor vehicle (10), in particular to the motor vehicle (10) according to claim 5; and - outputting control data to the motor vehicle (10), based on the determined test data, for controlling at least one component of the motor vehicle (10); and / or - outputting a data record, in particular for adapting and / or reinstallating the software available in the motor vehicle (10).Method according to the preceding claim, characterized in that the control data are designed for activating or resetting a vehicle lock, in particular an engine lock, of the motor vehicle (10), in particular based on the ascertained test data.A backend computer system, wherein the backend computer system (20) is configured to perform a method according to any one of the preceding claims 6 to 8.A system comprising: - at least one motor vehicle (10) according to claim 5; - at least one backend computer system (20) according to claim 9.

Images