Method and device for performing a software update in a vehicle

Abstract

The invention relates to a method for operating a software update for vehicle functions in a control system of a vehicle, wherein the vehicle functions comprise a regular access function and an emergency access function of a redundant emergency access system, comprising the following steps: - Retrieving update software from a central unit remote from the vehicle; - Activating the emergency access function and deactivating the regular access function accordingly; - Updating at least the regular access function without updating the emergency access function; - After successfully updating the regular access function, enabling the regular access function and disabling the emergency access function; - Update the disabled emergency access feature.

Description

[0001] The invention relates to vehicles with control systems that have one or more control units and are operated using software. The invention further relates to performing user-initiated updates of software of the control units of control systems outside of a workshop, wherein the updated software code for the software update is received and applied in the vehicle via a wireless communication connection.

[0002] While a few years ago a software update of a vehicle's control system was only possible in dealer workshops, where the update was carried out by trained specialists, modern vehicles now allow a software update to be initiated and carried out by the vehicle user.

[0003] This so-called remote software update enables the updating of part or all of the software in the vehicle's control system, allowing the implementation of new vehicle functions, feature enhancements, security updates, or quality improvements. Installation requires transferring the updated software and copying the program memory, where the software for the vehicle functions is stored.

[0004] As a rule, the installation of new software functions cannot be canceled; however, the vehicle, and in particular the vehicle functions being updated, cannot be used during the installation. This means that most of the vehicle's control system functions are unavailable during the update. A user who initiates an update is informed of this and / or is aware of it and does not plan to use the vehicle or its functions during the update. However, the control system functions also include functions of the central locking or locking system, so access to the vehicle may be restricted.

[0005] While previously it was possible to use mechanically integrated keys for emergency access to a vehicle's locking system in an emergency, the provision of mechanical keys is increasingly being dispensed with, and access is enabled solely through the electronic locking functions in the control system. This can result in access to the vehicle being denied during a control system software update because the vehicle's access function is being updated. This can lead to objects or people inside the vehicle being inaccessible and / or even people inside the vehicle being unable to leave.

[0006] It is therefore an object of the present invention to provide a method for updating a control system of a vehicle which enables an update of the vehicle access function and still leaves the user the possibility of opening a vehicle door or hatch at any time in order to access an interior of the vehicle.

[0007] This object is achieved by the method for operating an update of software for vehicle functions in a control system of a vehicle according to claim 1 and by the device and the vehicle according to the independent claims.

[0008] Further embodiments are specified in the dependent claims.

[0009] According to a first aspect, a method is provided for operating a software update for vehicle functions in a control system of a vehicle, wherein the vehicle functions comprise a regular access function and an emergency access function of a redundant emergency access system, comprising the following steps: - Providing update software, in particular retrieving update software from a central unit remote from the vehicle; - Activating the emergency access function and deactivating the regular access function accordingly; - Updating at least the regular access function without updating the emergency access function; - After successfully updating the regular access function, activating the regular access function and deactivating the emergency access function; and - Update the disabled emergency access feature.

[0010] It may be provided that when updating at least the regular access function, other vehicle functions besides the emergency access function are also updated.

[0011] Furthermore, the activation of the emergency access function can be retained if it is determined that the update of the regular access function has failed.

[0012] According to a further aspect, a device, in particular an update controller, is provided which is designed to carry out all steps of the above method.

[0013] According to a further aspect, a vehicle is provided with one or more control units of a control system, with a control unit for an emergency access function, with a locking device and with the above device, wherein an activated regular access function and an activated emergency access function are designed to carry out authentication of a user and to control closing and opening by means of the locking device.

[0014] With the elimination of the mechanical key, the problem already arose that access to a vehicle was no longer possible, for example if the battery was empty or the control system was defective.

[0015] One solution to date has been to integrate an emergency access system into a vehicle door. This system is part of the control system and is designed to be redundant to the regular access system in order to provide access to the vehicle in the event of a failure of the regular access function, for example in the event of a failure of the control unit or a control unit network in which the regular access function is implemented, or in the event of a defective or discharged battery.

[0016] The emergency access system comprises a separate control unit and other components that enable controlled vehicle access independent of other vehicle systems. While a separate control unit may form a common unit with other control units, it is electronically and functionally separate from the other control units, except for a communication link for its activation and deactivation.

[0017] When updating the control system software, it is now stipulated that the regular access function and the emergency access function may not be updated at the same time and that one of the two functions remains active or is activated while the other is being updated and is therefore not functional.

[0018] During an update, the control system functions are usually updated sequentially, for example, by successively overwriting a program memory with the updated software. This makes it possible to specify the scheduling of the update of individual vehicle functions.

[0019] It is therefore intended that the regular access function and the emergency access function are not executed at the same time and that the vehicle function that is not being updated remains active or is activated while the other of the functions is being updated.

[0020] When the update process, i.e., the remote software update, is started, an update controller implemented in the control system informs all subsystems of the global status of the update. This may include activating the emergency access function. Alternatively, the emergency access function can also be activated by a corresponding notification immediately before the start of the regular access function update.

[0021] Similarly, the update controller can disable the emergency access function when the control system software update is complete. Alternatively, after the access function update is successfully completed, the update controller can disable the emergency access function and enable the regular access function.

[0022] This means that after the emergency access function has been activated once, it remains active until the control system's regular access function has been successfully updated. If an error occurs, the deactivation of the emergency access function is not signaled, and it remains active, allowing continued vehicle access.

[0023] Embodiments are explained in more detail below with reference to the attached drawings. They show: Fig. 1 is a schematic representation of a control system for a vehicle with a plurality of functions, including a regular access function and an emergency access function; and Fig. 2 is a flowchart illustrating a method for operating a software update in a control system of a vehicle.

[0024] Fig. Figure 1 schematically shows a vehicle 1 with a control system 2, which may include one or a plurality of control units. The control units 3 comprise microcontrollers or microprocessors operated using software functions. The software functions may be capable of performing a variety of different functions in the vehicle 1.

[0025] An update control can be implemented in a control unit 3, which controls the software update process.

[0026] A regular access function is implemented in at least one of the control units 3 and is executed there during regular operation. The regular access function controls a locking device 4 in a vehicle door 5 according to a signal indicating an opening or closing request. The regular access function includes all known functions of a central locking or locking system of a vehicle and can be operated via a user signal to open or close a vehicle door.

[0027] Furthermore, the control system 2 is connected to a communication unit 9, via which authentication data is received using a wireless communication connection. Thus, a transponder or mobile device approaching the vehicle can receive an authentication signal that identifies the owner of the transponder or mobile device as authorized access. An opening or closing command can be transmitted to the locking device 4 through suitable signaling, such as operation of the transponder or mobile device or an operating device on the locking device.

[0028] The control system 2 may further be connected to a user interface 8, which may be implemented, for example, as a touchscreen input / output unit or comparable input / output unit, and enables interaction with a user.

[0029] Furthermore, an emergency access system can be implemented, which has a redundant control unit 6, e.g. in the vehicle door 5 and, if necessary, a redundant battery or emergency power supply 7 for the electrical supply of the emergency access system.

[0030] An emergency access function can be implemented in the control unit 6 of the emergency access system, which makes it possible to enable access to the vehicle 1 in a defined manner when the emergency access function is activated, regardless of the operation of the control system 2.

[0031] The emergency access function can have its own local radio interface 10, which is in communication with the redundant control unit 6 and can be implemented, for example, in the vehicle door 5, so that the emergency access function can be used with a radio key to open or close the vehicle 1. The local radio interface 10 can, for example, be an NFC interface, so that the user can be authenticated by approaching a mobile device.

[0032] The emergency access function can also be equipped with a unit for capturing biometric features, such as a fingerprint sensor or a camera for facial recognition, to verify a user's authorization and receive instructions for opening or closing. A control button or control surface can also be connected to the emergency access control unit.

[0033] Since, according to the emergency access function, access to the vehicle must be completely autonomous, the emergency access system must provide a way to gain access to the vehicle 1 even if the control system 2 or the other control units 3 of the control system 2 have failed.

[0034] In Fig. 2 is a flowchart illustrating a method for updating software of the control system 2.

[0035] In step S1, the user is first asked whether he or she wants to start a software update. This can be done by inputting a command via the user interface 8. If a software update is to be performed (alternative: yes), the process continues with step S2; otherwise (alternative: no), the process returns to step S1.

[0036] In step S2, the user is informed via an output on the user interface 8 that only an emergency access function is temporarily active for access to the vehicle. This explains how access to the vehicle 1 can be obtained while the emergency access function is active.

[0037] In step S3, the software update data is retrieved from a central unit remote from the vehicle via the communication interface. This corresponds to the updated program code for the software functions. Alternatively, the software update data may already be present in the vehicle before the software update is offered. This means that the software update data is loaded into the vehicle in advance in the background.

[0038] In step S4, the emergency access function is signaled to activate.

[0039] In step S5, after the software update data has been transmitted, the update of control system 2 is initiated by the update controller. A sequence of updates for the individual vehicle functions is taken into account, whereby, in particular, the update of the access function and the emergency access function must not occur simultaneously. The vehicle functions, including the regular access function, are now updated, with the emergency access function being excluded.

[0040] In step S6, a check is made to determine whether the software update has been completed successfully. If it is determined that the vehicle functions have been updated successfully and correctly (alternative: Yes), including the regular access functions, the regular access function is started in step S7, and the emergency access function is subsequently deactivated in step S8. Otherwise (alternative: No), an update error is signaled in step S12.

[0041] In a subsequent step S9, the emergency access function is updated.

[0042] In step S10, a check is performed to determine whether the emergency access function update has been successfully completed. If it is determined that the emergency access functions have been updated successfully and correctly (alternative: Yes), a signal is signaled in step S11 that the update is complete. Otherwise (alternative: No), an update error is signaled in step S12. The update is then completed. List of reference symbols 1 vehicle 2 Tax system 3 Control unit 4 locking device 5 vehicle door 6 Emergency access system control unit 7 Battery or emergency power supply of the emergency access system 8 User interface 9 Communication unit 10 local radio interface

Claims

[1] Method for performing an update of software for vehicle functions in a control system (2) of a vehicle (1), wherein the vehicle functions comprise a regular access function and an emergency access function of a redundant emergency access system, comprising the following steps: - Provide (S3) update software that updates the regular access function; - Activating (S4) the emergency access function and correspondingly deactivating the regular access function; - Update (S5) at least the regular access function, without updating the emergency access function; - After successfully updating the regular access function, activate (S7) the regular access function and deactivate (S8) the emergency access function; - Update (S9) the deactivated emergency access function. [2] Method according to claim 1, wherein providing the update software comprises retrieving software update data from a remote central unit or reading from a memory in the vehicle (1). [3] Method according to claim 1 or 2, wherein updating at least the regular access function also updates other vehicle functions other than the emergency access function. [4] Method according to any one of claims 1 to 3, wherein the activation of the emergency access function is retained when it is determined that the update of the regular access function has failed. [5] Device, in particular an update controller configured to perform all steps of one of the methods according to any one of claims 1 to 4. [6] Vehicle (1) with one or more control units (3) of a control system (2), with a control unit (6) for an emergency access function, with a locking device (4) and a device according to claim 5, wherein an activated regular access function and an activated emergency access function are configured to perform user authentication and to control closing and opening using the locking device (4).

Images