Procedure for performing an update of a control unit in a vehicle

Abstract

The invention relates to a method for performing an update of a control unit (110) in a vehicle, comprising the steps of: checking by a verification unit (120) in the vehicle whether a predetermined update criterion is met, which indicates that an update of the control unit (110) should be performed; transmitting an update request from the verification unit (120) to an update management unit (130) in the vehicle if the predetermined update criterion is met; deciding by the update management unit, upon receipt of the update request, whether the update of the control unit (110) should be performed; performing the update of the control unit (110) by the update management unit (130) if the update management unit (130) decides that the update of the control unit (110) should be performed.

Description

The present invention relates to a method for carrying out an update of a control unit in a vehicle, and to a computing unit and a computer program for carrying out the latter.BACKGROUND OF THE INVENTIONIn the vehicle sector, in the course of what is known as an over-the-air (OTA) update, a software update for software executed by a control device of a (motor) vehicle can be obtained via a wireless connection, for example via the Internet, from a remote source external to the vehicle, for example from a server or a computing unit system in the sense of what is known as cloud computing. Updates of this type can be provided, for example, in the form of individual update units or update packets on a cloud-centric platform (OEM cloud platform, service provider platform, or the like), the back end. An OTA management unit in the vehicle (e.g. a so-called orchestrator) can download corresponding update units therefrom, buffer them and distribute them to the respective control units to be updated. After distribution and a potential integrity check, the control units affected by an update can be updated to the new software state. An update unit can comprise, for example, new or supplementary software for a control device and / or configuration data for an existing software state.Disclosure of the InventionAccording to the invention, a method for carrying out an update of a control unit in a vehicle and a computing unit and a computer program for carrying it out having the features of the independent patent claims are proposed. Advantageous embodiments are the subject matter of the dependent claims and of the following description.In the course of the method, a checking unit in the vehicle checks whether a predefined update criterion is fulfilled, which indicates that an update of the control unit is to be carried out. This checking unit is implemented in particular as a hardware and / or software unit in the vehicle. For example, the checking unit can check whether a faulty or old software level is present in the control device, which could be improved or updated by a corresponding update. Furthermore, the checking unit can check, for example, whether operating or environmental conditions of the vehicle have changed, so that the control device can be adapted to the changed conditions by a corresponding update.If the predefined update criterion is fulfilled, the checking unit transmits an update request to an update management unit in the vehicle. This update management unit can also be implemented in the vehicle in particular as a hardware and / or software unit. For example, this update management unit can be designed as an orchestrator.Upon receiving the update request, the update management unit decides whether the update of the control unit should be carried out. For example, the update management unit can check for this purpose whether a faulty or legacy software state is actually present or whether changed operating or environmental conditions of the vehicle are actually present. In particular, the update management unit can check whether a corresponding update is available for the control device.When the update management unit decides that the update of the control device is to be performed, the update management unit performs the update of the control device. For example, the update management unit can come into contact for this purpose with a non-vehicle or off-vehicle computing unit, e.g. a server or a so-called "cloud", for example in order to download update data required for the update. For implementation or safety reasons, the contact can also be made via an update relay unit in the vehicle, which forwards requests, feedback and update information.The present invention thus provides a possibility that a vehicle itself can recognize and decide whether and when an update, in particular an "over-the-air update", of its control units is carried out. In-vehicle computing units or components of the vehicle, in particular the relevant control device itself, can therefore identify by themselves that they require an update. The components can furthermore decide, autonomously and independently of computing units external to the vehicle, when a corresponding software update is to be carried out. The in-vehicle components can initiate the corresponding software update independently.In a conventional manner, it is usually decided in a respective back end, usually in a computing unit external to the vehicle, such as a server or a cloud, whether an OTA update is to be carried out. For example, a software update is then initiated by an OEM or supplier on the basis of provided data. An entity outside the vehicle then thus decides whether and when a software update of components within the vehicle is to be carried out, for example on the basis of bugfixing, diagnosis, feature expansion, feature release etc. In contrast, within the scope of the present invention, the update and installation process is triggered from the point of view of the updateable vehicle or its components themselves.According to one specific embodiment, checking by the checking unit whether the predefined update criterion is fulfilled includes carrying out an error check as to whether an error of the control unit is present. Alternatively or additionally, it can be checked, e.g. by an artificial intelligence, whether an update contributes to the improvement. In particular, the correct functionality of the relevant control unit is thus checked. For example, the control unit can perform a self-diagnosis for this purpose and / or a plausibility check can be carried out by a further control unit. The fault checking can be carried out, for example, in the context of the component start (boot check), during operation (run-time monitoring) or in the context of the component shutdown (run-time diagnosis).According to one specific embodiment, the predefined update criterion is fulfilled if one or more of the following criteria are fulfilled: presence of a fault in software of the control unit; presence of a storage fault in a storage unit of the control unit, which has in particular led to a loss of control commands, data, etc.; presence of a fault entry in a fault storage; presence of hardware aging, for example at sensors or components of the control unit; presence of an unscheduled reset of the control unit or a function or functionality of the control unit; and / or presence of a fault in an algorithm executed by the control unit. Furthermore, the predefined update criterion is fulfilled in particular if a requested function cannot be implemented directly by the control unit itself, for example if a necessary driving profile adjustment cannot be implemented directly in the control unit via a characteristic curve or a parameter change. Functions can also be requested by other control units or by the driver himself (e.g. via voice control). Such criteria can expediently be recognized in the course of the fault checking of the control unit, for example by a self-diagnosis of the control unit or by a plausibility check by a further control unit.According to one specific embodiment, checking by the checking unit whether the predefined update criterion is fulfilled includes checking whether a change in a vehicle configuration and / or a change in an environmental condition of the vehicle is present. Such a change in the vehicle configuration relates in particular to a change in equipment or hardware configuration of the vehicle, for example by adding or replacing individual hardware elements such as sensors and actuators. A change in the environmental condition of the vehicle relates in particular to a change in the geographical environment or the geographical area of use in which the vehicle is currently being operated in comparison to the environment in which the vehicle has been operated up to now. During the production of the vehicle, a specific software level is usually embedded in the individual control units of the vehicle, which is adapted specifically for the specific vehicle configuration and the planned geographical area of use or the planned geographical environment. For example, this originally embedded software level can be adapted to the original equipment of the vehicle and can further comprise, for example, a regional variant of road sign recognition. If the vehicle configuration is changed or the vehicle is brought into another geographical area of use over a longer period of time, an update is necessary in particular in order to update the previous software level accordingly.Conventionally, the installation of a new software stand on account of a change in the configuration of the vehicle can represent a potential fault source and additional workshop outlay. Furthermore, updates due to changed environmental conditions, for example in order to install a geographically specific software version, can conventionally be associated with high outlay, since the vehicle owner usually has to bring the vehicle to a contract shop of the manufacturer for this purpose. In contrast, the present method enables improved and easier execution of such software updates, since the relevant control device itself can recognize internal or introspective system changes, e.g. the installation of new sensor systems or actuator systems, or external environmental changes and can request a new software level. Furthermore, advantages in terms of datahood and data protection can be achieved in this way, since the vehicle driver can optionally himself decide whether modifications or spatial changes are made known to the vehicle manufacturer.According to one specific embodiment, the predefined update criterion is fulfilled if a change (installation / uninstallation) of sensor system and / or actuator system is detected. For example, the predefined update criterion can be fulfilled if a new, previously unrecognized sensor and / or a new, previously unrecognized actuator is recognized in the vehicle, i.e., a sensor or actuator that has not yet been installed in the vehicle. Furthermore, a new actuator or sensor can replace existing sensor(s) or actuator(s). Such a new sensor or actuator and possibly uninstallation of existing hardware indicate in particular a changed vehicle configuration, in the course of which a new vehicle function is to be implemented. In this case, an update of the respective control device software is required in particular in order to be able to use the new sensor or actuator and in order to be able to implement the new vehicle function. The recognition can take place automatically or be triggered by a request from the users for re-recognition, e.g. by selection in a human-machine interface.According to one specific embodiment, the predefined update criterion is fulfilled if a new object that has not been recognized up to now is recognized in the surroundings of the vehicle. These can be done, for example. The traffic signs may be animals, road users (vehicles, etc.) or surroundings. For example, if a traffic sign that has not been recognized up to now and / or a new, not recognized writing and / or a new, not recognized speech is recognized up to now. Furthermore, the update criterion can be fulfilled if the entry of the vehicle into a geographical area is detected, which requires other software scopes or parameterization. For example, such detections can be made by means of a camera of the vehicle and / or by means of a V2X communication, i.e. a communication between the vehicle and the infrastructure. A new traffic sign that has not been recognized up to now is to be understood as meaning, for example, a new or modified type of traffic sign that has not yet been detected since the vehicle was put into operation for the first time. A previously unrecognized letter and / or language can be recognized, for example, on traffic signs, vehicle license plates, on buildings, etc., and has not yet been recognized, in particular, since the first startup of the vehicle. Such fulfilled criteria indicate in particular that the geographic area of use of the vehicle has changed or that a changed traffic situation exists which the system has not yet managed. In this case, a software update is required in particular in order to be able to continue to correctly execute vehicle functions such as a navigation system. Expediently, the update criterion is not fulfilled after a first recognition of a respective new road sign or a respective new letter or language, but only after a predefined multiple recognition.According to one specific embodiment, transmitting the update request from the checking unit to the update management unit also includes transferring the control unit into a safe or update-safe state. This (update) safe state of the control unit is in particular a state in which the update can be carried out safely without further influencing functions or functionalities of the control unit and without a risk of the operation of the vehicle possibly occurring.According to one specific embodiment, the execution of the update of the control unit by the update management unit includes a reception of update data or update data packets from a non-vehicle arithmetic unit. The update management unit can thus download the data required for the update to be carried out, for example, via the Internet, for example from a server or a cloud. Alternatively or additionally, the update management unit can also read update data from a memory unit of the vehicle, e.g. from an intermediate or buffer memory. If, for example, corresponding update data have already been downloaded, e.g. for a previously carried out update of another control unit, and are still located in the buffer memory, these data which are already located in the vehicle are expediently used back. If all update data required for the update are already stored in the memory unit, communication with the non-vehicle arithmetic unit can be dispensed with completely, in particular.According to one specific embodiment, the execution of the update of the control unit by the update management unit furthermore includes checking whether the vehicle is in a safe or update-safe state, or a transfer of the vehicle into such a safe state. For example, such an (update) safe state can comprise a standstill of the vehicle. If the vehicle is in the safe state, the update of the control unit is carried out or initiated by the update management unit as a function of the update data received and / or read in. The respective new or modified software version is then embedded in the control device. After the update has been successfully carried out, the control device can expediently be transferred again from its safe state into a normal operating state.According to one specific embodiment, the update management unit decides, on the basis of predefined decision criteria, whether the update of the control unit is to be carried out. These decision criteria can comprise, for example, whether a corresponding update is present for the respective control device and whether all data required for the update are already present in the vehicle, e.g. in the respective buffer memory, or still have to be downloaded from the non-vehicle arithmetic unit.According to one specific embodiment, the checking unit is implemented in the control unit itself, in particular as software executed by the control unit. In this case, the control device itself can identify whether it needs an update for its software or installation is possible. For example, the control device with the integrated checking unit can perform a self-diagnosis for this purpose in order to be able to identify faults which indicate that an update is to be carried out. Furthermore, the control device can check, in particular, itself with the integrated checking unit whether changes are present in the vehicle configuration and / or in the environmental conditions of the vehicle for which an update of the respective control device software is required.Alternatively or additionally, the checking unit is implemented in a further computing unit of the vehicle according to one specific embodiment. For example, the checking unit can be implemented in a further control device as executed software. This further control unit can then, for example, carry out a plausibility check of the relevant control unit in order to check whether the relevant update criterion is fulfilled for the relevant control unit. For example, the checking unit and the update management unit can be implemented together in a common computing unit, e.g. each as executable software. For example, the checking unit and the update management unit can be implemented jointly in the relevant control device, so that the control device can independently identify and initiate updates required for its control device software. For example, the checking unit and the update management unit can also be implemented jointly in a central, superordinate control device which can then identify, initiate and manage required OTA updates of a plurality of control devices of the vehicle.A computing unit according to the invention, e.g. a control device of a motor vehicle, is configured, in particular by programming, to carry out a method according to the invention.The implementation of a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous since this causes particularly low costs, in particular if an executing control device is also used for further tasks and is therefore present in any case. Finally, a machine-readable storage medium is provided with a computer program stored thereon, as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, among others. Download of a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be effected in a wired or wired or wireless manner (e.g. via a WLAN network, a 3G, 4G, 5G or 6G connection, etc.).Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.The invention is schematically illustrated in the drawing on the basis of exemplary embodiments and is described below with reference to the drawing.Brief Description of the DrawingsFIG. 1 schematically shows a combination of units of a vehicle which is configured to carry out an embodiment of a method according to the invention. FIG. 2 schematically shows an embodiment of a method according to the invention as a block diagram.Embodiment(s) of the InventionIn FIG. 1, a combination of units or elements of a vehicle is schematically illustrated and denoted by 100.This group 100 has a control device 110, e.g. a vehicle computer, a control device for carrying out driving assistance functions, etc. It is understood that the vehicle can also have a plurality of further control devices.The group 100 further comprises a checking unit 120 and an update management unit 130. The checking unit 120 and the update management unit 130 may each be implemented as executable software in the vehicle, for example. For example, the checking unit 120 and the update management unit 130 can be executed jointly by a computing unit 150, e.g. by a superordinate management unit, e.g. a superordinate control device.The cluster 100 further comprises a storage unit 140, e.g. a buffer or buffer memory. For example, this storage unit 140 may be provided in the upper-level management unit 150 that executes the checking unit 120 and the update management unit 130.It is also conceivable for the checking unit 120 and the update management unit 130 to be executed by different separate computing or control units in the vehicle. Furthermore, it is also conceivable for the checking unit 120 and / or the update management unit 130 to be implemented in each case in the control unit 110 itself, for example as software executed by the control unit 110. Furthermore, the storage unit 140 can also be provided in the control device 110 itself.The group 100 further comprises a radio or air interface 160 via which the vehicle can be connected by means of a wireless connection 180, e.g. the Internet, to a remote computing unit 190 external to the vehicle, e.g. a computing unit system in the sense of so-called cloud computing.Within the scope of one specific embodiment of the present invention, the vehicle or components of the vehicle itself decide whether and when an update of the software executed by control unit 110 is carried out. For this purpose, the group 100, in particular the superordinate management unit 150, is configured, in particular by programming, to carry out an embodiment of a method according to the invention, as will be explained below with reference to FIG. 2.FIG. 2 schematically shows such an embodiment of the method according to the invention as a block diagram.In a step 210, the checking unit 120 checks whether a predefined update criterion is fulfilled, which indicates that an update of the control unit 110 is to be carried out. The checking unit 120 can perform this checking regularly, e.g. at regular time intervals and / or upon the occurrence of a predefined event.For example, the checking unit 120 carries out an error check for this purpose to determine whether an error of the control unit 110 is present or whether the functionality of the control unit 110 is executed correctly. If the checking unit 120 is not executed by the control unit 110, a plausibility check of the control unit 110 can be carried out, for example. When the inspection unit 120 is implemented in the controller 110, the controller 110 may perform, for example, a self-diagnosis. For example, the fault check can be carried out during the starting of the control unit 110 (boot check), during the operation of the control unit 110 (run-time monitoring) or during the shutdown of the control unit 110 (run-on diagnosis).If, during the fault check, for example, a fault in the software of the control unit 110, a storage fault in a storage unit of the control unit 110, a fault entry in a fault memory of the control unit 110, an unscheduled reset of the control unit 110 and / or a fault in an algorithm executed by the control unit 110 is detected, the update criterion is fulfilled. Furthermore, the update criterion is fulfilled, for example, if a requested function is not directly implemented by the control unit 110 itself, for example if a necessary driving profile adjustment is not directly implementable in the control unit 110 via a characteristic curve or parameter change.Furthermore, the checking unit 120 checks in step 210 whether there is a change in a vehicle configuration. For example, the checking unit 120 checks whether changes are present in the vehicle interior. For example, a sensor that has not been recognized up to now and / or an actuator that has not been recognized up to now is present in the vehicle. If such a new sensor and / or actuator, which has not been recognized up to now, is recognized, this indicates a newly installed sensor system or actuator system in the course of a changed vehicle configuration or vehicle equipment, so that an update is required in order to actuate the new sensor or actuator. The update criterion is also fulfilled in this case.Furthermore, the checking unit 120 checks in step 210 whether there is a change in a surrounding condition of the vehicle. For example, the checking unit 120 checks for this purpose whether objects not previously recognized, for example traffic signs, a writing not previously recognized and / or a speech not previously recognized can be recognized in the environment of the vehicle. If this is the case, this indicates that the geographic area of use of the vehicle has changed or that a changed traffic situation exists which the system has not yet managed. In this case, a software update is required in particular in order to be able to continue to execute vehicle functions correctly. The update criterion is also fulfilled in such a case.If the predefined update criterion is fulfilled, the checking unit transmits an update request to the update management unit 130 in a step 220. Furthermore, the update management unit 130 can decide on the basis of the criticality whether the vehicle is to be transferred into a safe state.Upon receiving the update request, the update management unit 130 decides in a step 230 whether the update of the control unit 110 is to be carried out. For example, the update management unit 130 checks for this purpose whether a respective update is available. If a respective update is available, the update management unit 130 furthermore checks whether the update data required for carrying out the update are already stored in the intermediate storage 140, for example because the respective update has already been carried out for another control device, or whether the required update data must first be downloaded from the cloud 190.If the update management unit 130 decides that the update of the control unit 110 should not be carried out, e.g. because no corresponding update is available, the update management unit 130 can decide on the basis of the criticality to transfer the control unit 110 back into its normal operating state in a step 240.If the update management unit 130 decides that the update of the control unit 110 is to be carried out, the update management unit 130 carries out the update of the control unit 110 in a step 250.Depending on whether individual or all update data required for the update are already stored in the buffer storage 140, the update management unit 130 reads in the respective already stored update data from the buffer storage 140 in a step 251 and, if necessary, downloads the not yet stored update data from the cloud 190 into the buffer storage 140.In a step 252, the update management unit 130 checks whether the vehicle is in a safe or update-safe state, e.g. at standstill. Alternatively, the update management unit 130 can also transition the vehicle into a safe state.If the vehicle is in the safe state, the update management unit 130 carries out the update of the control unit 110 depending on the update data received from the cloud 190 or depending on the update data read in from the buffer storage 140 in a step 253. In the course of this, the respective new or revised software version is embedded in the control device 110.In a step 260, the control device is transferred back into its normal operating state after the successfully carried out update.

Claims

Method for carrying out an update of a control unit (110) in a vehicle, comprising the steps: checking (210), by a checking unit (120) in the vehicle, whether a predefined update criterion is fulfilled, which indicates that an update of the control unit (110) is to be carried out; transmitting (220), by the checking unit (120), an update request to an update management unit (130) in the vehicle if the predefined update criterion is fulfilled; deciding (230), by the update management unit, on receipt of the update request, whether the update of the control unit (110) is to be carried out; carrying out (250), by the update management unit (130), the update of the control unit (110) if the update management unit (130) decides that the update of the control unit (110) is to be carried out.The method according to claim 1, wherein checking (210), by the checking unit (120), whether the predefined update criterion is fulfilled comprises: carrying out an error check whether an error of the control unit (110) is present; and / or checking whether an update contributes to an improvement.Method according to Claim 2, wherein the predefined update criterion is fulfilled if one or more of the following criteria are fulfilled: presence of a fault in software of the control unit (110); presence of a storage fault in a storage unit of the control unit (110); presence of a fault entry in a fault memory of the control unit (110); presence of hardware aging; presence of an unscheduled reset of the control unit (110) or of a function of the control unit (110); presence of a fault in an algorithm executed by the control unit (110); determining that a requested function cannot be implemented directly by the control unit (110).Method according to one of the preceding claims, wherein the checking (210), by the checking unit (120), whether the predefined update criterion is fulfilled comprises at least one of: checking whether a change in a vehicle configuration is present; checking whether a change in an environmental condition of the vehicle is present.Method according to Claim 4, wherein the predefined update criterion is fulfilled if one or more of the following criteria are fulfilled: detection of a previously unrecognized sensor in the vehicle; detection of a previously unrecognized actuator in the vehicle; detection of changes to sensors and / or actuators; detection of the uninstallation of sensors and / or actuators; detection of previously unrecognized objects in the environment of the vehicle; detection of a previously unrecognized traffic sign in the environment of the vehicle; detection of a previously unrecognized text in the environment of the vehicle; detection of a previously unrecognized speech in the environment of the vehicle; detection of the entry into a geographical area which requires other software scopes or parameterization.Method according to one of the preceding claims, wherein the transmission (220) of the update request from the checking unit (120) to the update management unit (130) further comprises: transferring the control unit (110) into a safe state.Method according to one of the preceding claims, wherein the performance (250) of the update of the control unit (110) by the update management unit (130) comprises: receiving (251) update data from a computing unit (190) external to the vehicle and / or reading (251) update data from a storage unit (140) of the vehicle; checking (252) whether the vehicle is in a safe state or transferring (252) the vehicle to the safe state; performance (253) of the update of the control unit (110) by the update management unit (130) depending on the update data received and / or read in if the vehicle is in the safe state.Method according to one of the preceding claims, wherein the decision (230) by the update management unit (130) as to whether the update of the control unit (110) is to be carried out comprises: the update management unit (130) deciding, on the basis of predefined decision criteria, whether the update of the control unit (110) is to be carried out.Method according to one of the preceding claims, wherein the checking unit (120) is implemented in the control device (110) itself and / or in a further computing unit (150) of the vehicle.Arithmetic unit (150) which is configured to carry out all method steps of a method according to one of the preceding claims.Computer program which causes a computing unit (150) to carry out all method steps of a method according to one of Claims 1 to 9 when it is executed on the computing unit (150).A machine readable storage medium having stored thereon a computer program according to claim 11.

Images