Method for wirelessly updating software in a motor vehicle and update system

Abstract

The invention relates to a method for wirelessly updating software in a motor vehicle, in which a communication connection with an external server is established by means of a first detection device in order to detect software updates, and in which software updates received by means of a processing device are installed in the motor vehicle, wherein operating states of the motor vehicle are checked by means of a control logic before a software update is carried out. wherein semantic information about the software updates is processed by means of a local language model device and evaluated according to predefined / specified rules, in particular security and policy rules, and adaptive planning and prioritization of the updates is carried out by means of the processing device depending on vehicle states and / or operational conditions. The invention further relates to an update system (10).

Description

[0001] The invention relates to a method for wirelessly updating software in a motor vehicle according to the preamble of claim 1. Furthermore, the invention relates to an update system for wirelessly updating software in a motor vehicle.

[0002] Such methods are used in vehicle manufacturing to regularly update control units, function modules, and in-vehicle software components. A data transfer is initiated via a communication link with an external server to wirelessly transmit software updates to the vehicle. These systems are used particularly in connected vehicles to provide functional improvements, safety-related updates, and comfort enhancements wirelessly.

[0003] From WO 2007 / 027546 A2 a method for wirelessly transferring software to a vehicle is known, in which an external server interacts with a vehicle control unit via a communication link in order to transfer and install software updates.

[0004] The object of the invention is to provide a method that enables reliable and context-sensitive execution of software updates in a motor vehicle in order to avoid faulty or unsuitable update processes.

[0005] This problem is solved by means of a method with the features of claim 1 and by means of an update system. Advantageous embodiments of the method according to the invention are to be regarded as advantageous embodiments of the update system according to the invention, wherein the means of the system can be used to carry out the respective method steps. Furthermore, advantageous developments of the invention are described by the dependent claims, the following description, and the figures.

[0006] One aspect of the invention relates to a method for wirelessly updating software in a motor vehicle, particularly a passenger car, in which a communication connection is established with an external server by means of a detection device to receive software updates, and software updates received are installed in the motor vehicle by means of a processing device. Before a software update is carried out, a control logic checks whether the operating conditions of the motor vehicle permit the installation. This control logic takes into account, for example, whether the motor vehicle is in park mode, whether the battery has sufficient charge, whether an internet connection exists, and whether the intended time window is observed.The acquisition device, the processing device and the control logic are logically related in that the acquisition device initiates the data communication, the processing device performs the installation and the control logic controls a release depending on status data and / or system parameters.

[0007] In order to solve the problem of the invention and thus create an adaptive and semantically evaluated update, it is provided according to the invention that semantic information about the software updates is processed by means of a local language model device and predefined rules, in particular safety and policy rules, are evaluated, and that adaptive planning and prioritization of the updates is carried out by means of the processing device depending on vehicle states and / or operational conditions.

[0008] The language model facility analyzes the software updates semantically and interprets their safety-relevant or functional content, for example to determine whether an update affects a safety-critical control component.

[0009] Furthermore, the language model setup can describe security-relevant updates in natural language, thus enabling a transparent and comprehensible presentation of the update content.

[0010] The processing unit performs situation-dependent planning, taking into account loading times, schedules, and usage intervals. Linking these units ensures that updates are only executed when operationally and security-wise appropriate.

[0011] In contrast to known methods in which the execution of software updates is based exclusively on predefined installation times and server-side control commands, the present invention enables a particularly vehicle-side local, context-dependent and semantically controlled execution of the update process.

[0012] While the prior art, for example, does not provide for content-related evaluation or situation-dependent planning of updates, the invention provides for an analysis of the update data by a local language modeling device, which allows safety-relevant, functional, and, for example, optional updates to be distinguished from one another. In this way, for the first time, a semantic classification and prioritization of the available software packages within the vehicle is made possible without requiring a permanent connection to an external server.

[0013] By integrating the language modeling unit into the vehicle's internal control architecture, all processing operations are performed locally, ensuring data processing is compliant with data protection regulations and independent of external cloud services. This leads to increased system security and prevents unauthorized interference with the update process. Furthermore, the adaptive scheduling of the processing unit enables situation-appropriate execution of updates, particularly during periods when the vehicle is not in operation, thus avoiding operational interruptions.

[0014] Overall, the invention is characterized by providing a dynamic, semantically evaluated, and context-adaptive control of software update processes, in which safety and compatibility rules are automatically taken into account. This improves the technical availability of the vehicle, increases system integrity, and enables a traceable and user-transparent execution of the update process.

[0015] In a particularly advantageous embodiment of the invention, a multimodal interaction with the user is provided via an interaction device using speech and touch, through which update information is displayed, explained, and / or confirmed. This allows the user to direct queries to the speech model, for example, regarding the content of an update ("What's new?") or to postpone an installation ("Install later?"). The interaction device is preferably coupled with the speech model device, thereby enabling the generation of explanations and recommendations in natural language.

[0016] In a further advantageous embodiment of the invention, the language modeling device is used to execute a locally operated, generative language model that functions without a connection to an external cloud. This allows all user data and vehicle information to be processed locally within the vehicle, enabling the handling of sensitive information in compliance with data protection regulations. This embodiment is particularly advantageous for vehicles that do not have a permanent cloud connection due to limited network coverage or data protection regulations.

[0017] In a further advantageous embodiment of the invention, the language modeling system is used to semantically analyze safety-relevant software updates and evaluate their feasibility based on predefined safety and compatibility rules. This prevents updates from being performed while driving or when the battery charge is insufficient.

[0018] In a further advantageous embodiment of the invention, a prioritization logic is used to rank available software updates according to criticality, vehicle condition, and availability. This prioritization logic can, for example, place safety-critical software packages ahead of functional or optional updates, thereby creating an update sequence appropriate to the situation.

[0019] In a further advantageous embodiment of the invention, the processing unit is used to perform adaptive update planning, taking into account charging times, schedules, and the user's calendar data. This allows updates to be performed preferably during idle periods, parking phases, or charging cycles.

[0020] In a further advantageous embodiment of the invention, it is provided that all processing operations are carried out locally in the vehicle using the language modeling device in order to ensure data protection-compliant processing of sensitive user and vehicle data. This reduces the dependence on external networks.

[0021] In a further advantageous embodiment of the invention, the control logic provides that the software update is only released after a security, availability, and / or compatibility check has been performed. This prevents, for example, unwanted installation processes in unsuitable vehicle states.

[0022] Another aspect of the invention relates to an update system for wirelessly updating software in a motor vehicle, comprising a detection unit, a processing unit, and control logic. The detection unit is configured to establish a communication link with an external server to receive software updates. The processing unit is configured to install received software updates, while the control logic monitors the operating states of the motor vehicle and coordinates the release of the update process.

[0023] The update system is characterized by a local language modeling unit that processes semantic information about the software updates and evaluates security and policy rules. This processing unit performs adaptive planning and prioritization of updates based on vehicle states and operational conditions. The language modeling unit interacts with in-vehicle modules, including a sensor and vehicle data module, an internet check module, a battery monitoring module, and a planning data module, thereby providing situational and user-related contextual information.

[0024] The combination of these components leads to situation-dependent, user-adaptive and safety-oriented control of the entire update process.

[0025] In other words, the procedure and / or update system is intended to not only provide a conventional wireless update, but to include an intelligent, locally controlled and context-sensitive update architecture, in which a language model, as a central evaluation element, controls the technical, temporal and security-related execution of the updates.

[0026] The aforementioned devices and / or components can interact in various technical configurations. For example, the acquisition device, the processing device, the control logic, and the language modeling device can be designed as separate modules and coupled together, or integrated together in a higher-level electronic computing unit. It is also possible for individual functions to be provided jointly by several modules or implemented in software running on central control hardware. The physical arrangement of the modules can be distributed, adjacent, or fully integrated without altering the technical relationship of the system architecture according to the invention. This allows for flexible adaptation of the implementation to different vehicle architectures, performance requirements, and safety concepts.

[0027] This comprehensive design essentially leads to improved functional reliability, user transparency and system autonomy compared to the known state of the art.

[0028] In other words, the described over-the-air update system is intended to be extended by a locally operated, vehicle-based generative language model that orchestrates semantic understanding, safety-critical verification mechanisms, and multimodal user interfaces. This language model can, for example, be a quantized large language model, such as one based on an LLaMA-3 architecture or a comparable generative model structure, within a modular vehicle architecture. The system architecture follows a modular design with asynchronous communication via an event-based messaging system, such as DDS or MQTT, within an AUTOSAR Adaptive or POSIX-compliant vehicle computer system. The language model forms a semantic processing and decision layer between the internal OTA management component, the policy rules, and the user dialogs.

[0029] The central language model acts as an interpreting layer, processing structured update information packages, such as JSON or Protobuf data, which are delivered via the vehicle's internal OTA control components. The OTA update engine provides metadata for each available update, including information on affected software modules, the update category (e.g., safety-critical, functional, or comfort feature), the change log, and compatibility rules. The language model processes this information within predefined semantic prompt templates that check for safety-relevant keywords such as ABS, ESP, or airbag module and their effects. The generated output is passed to the user interface and contains a natural-language, technically understandable explanation of the respective update.An example of this is the message generated by the language model: "The update affects the electronic brake control system and corrects a configuration deviation that could lead to longer braking distances during strong acceleration."

[0030] Furthermore, the language model performs rule-based security validation by retrieving current vehicle status data from a policy service, such as speed, charge level, or movement status, and comparing it with predefined context-dependent policies. These policies might, for example, stipulate that a safety-critical update may only be performed when the vehicle is stationary and the battery charge level is above a certain threshold. The language model handles the policy evaluation in combination with logical comparison modules and prevents automatic installations if the required conditions are not met.

[0031] To prioritize software updates, an evaluation logic is provided that classifies available update packages based on weighting criteria such as security relevance, urgency, or user preference. The language model receives these weightings as structured input and generates a sorted list of updates with a suggested installation sequence, which is presented to the user for approval. In addition, a dedicated scheduling module is provided that contextually analyzes system load, internet availability via mobile network or Wi-Fi, the vehicle's charging schedule, and synchronized calendar data of the user.The suggestions resulting from these parameters are translated into natural language by the language model, for example, the following message: "The installation of the navigation map update is recommended for 4:00 a.m., as the vehicle will be charging at this time and a stable network connection will be available." The generated schedule can be adjusted by the user via voice command or touch input, with the language model validating the changes and reporting them back to the queuing module.

[0032] The update system supports multimodal interaction via voice and touch, simultaneously displaying content generated by the voice model both verbally and visually. The voice channel enables interactive communication via the infotainment system or a mobile companion device, recognizing commands such as "Install only security updates" or "Explain the update for the driver assistance system" and implementing them contextually. Voice control is primarily local within the vehicle, but can optionally access cloud resources in cases of insufficient model coverage; this function is configurable via a data privacy profile. Simultaneously, the graphical user interface provides a visual representation of the content generated by the voice model, for example, in the form of a priority list or explanatory text sections.The user can select an update via touch input, retrieve detailed information, start the installation immediately or postpone the time, and define personal preferences, such as that automatic installations should only take place when a Wi-Fi connection is available and during the night.

[0033] Multimodality is controlled by an integration layer that coordinates event handling between the user interface and the language model, providing synchronized response structures that include both textual feedback and graphical instructions. Furthermore, integrating the language model into the vehicle's internal system allows for local processing of all data, thus enabling the data protection-compliant handling of sensitive vehicle and user data.

[0034] The Large Language Model used, for example, a quantized LLaMA-3 instance with approximately eight billion parameters on edge hardware, offers several technical advantages. It enables a semantic understanding of complex software structures, allowing technical changes, security impacts, and functional dependencies to be described in natural language. Furthermore, it allows language-based interaction with the underlying policy rules, enabling security-relevant specifications to be explained, adjusted, or justified in dialogue with the user. This capability increases transparency and trust in the automated update process. By running locally on modern vehicle system-on-chips, such as platforms like Nvidia Orin or Qualcomm Ride, the language model can operate entirely without a cloud connection.This ensures data privacy, reduces latency, and guarantees system availability even in offline situations.

[0035] Furthermore, the language model possesses the capability for dialog-based feedback. It can generate suggestions, interpret user queries, learn preferences, and adaptively adjust future update recommendations based on this information. This results in a self-learning, context-sensitive system that elevates safety, convenience, and user understanding in the software update process for vehicles to a new level. The interaction of the described modules—acquisition unit, processing unit, control logic, prioritization and scheduling components, and the language model layers—leads to a technically coherent, locally controlled, and intelligent update architecture that significantly advances the current state of the art.

[0036] Further advantages, features, and details of the invention will become apparent from the following description of a preferred embodiment and from the drawings. The features and combinations of features mentioned above in the description, as well as those mentioned below in the figure description and / or shown in the figures alone, can be used not only in the combinations specified, but also in other combinations or individually, without departing from the scope of the invention.

[0037] This shows: Fig. 1. A flowchart of a procedure for wirelessly updating software in a motor vehicle, supported by a language modeling device; and Fig. 2 a flowchart of an update system with a local language modeling facility and vehicle-internal modules for situation-dependent control and execution of the update process.

[0038] In the figures, identical or functionally equivalent elements are provided with the same reference symbols.

[0039] Fig. Figure 1 shows a flowchart illustrating a procedure for wirelessly updating software in a motor vehicle using a corresponding update system 10.

[0040] In this process, a communication connection is established with an external server using a data acquisition device to capture software updates, and software updates received are installed in the vehicle using a processing device, whereby the operating states of the vehicle are checked by means of a control logic before a software update is carried out.

[0041] The method is characterized by the use of a local language modeling unit to process semantic information about software updates and evaluate predefined rules, particularly security and policy rules. Furthermore, the processing unit enables adaptive planning and prioritization of updates based on vehicle states and / or operational conditions. The language model is implemented as a large generative language model (LLM), allowing for dialog-based interaction with the user and serving as the semantic evaluation tool for software updates. This enables adaptive and context-dependent control of the update process.

[0042] In the first process step S1, the motor vehicle is in a resting state, thus representing the start of the process.

[0043] In a second process step S2, the acquisition device activates an OTA check, i.e. a check of the availability of wirelessly transmitted software updates, whereby a communication connection with an external server is established.

[0044] In a third process step S3, a control logic checks whether the necessary conditions for carrying out an OTA update are met, for example whether the vehicle is in park mode, has a sufficient battery charge, has an internet connection and the intended time window is adhered to.

[0045] If the prerequisites are met, in a fourth process step S4 the availability of OTA packages, i.e. update files that can be transmitted wirelessly, is checked by the acquisition device.

[0046] In a fifth process step S5, the software updates found are classified by the processing unit, for example into critical, functional or optional updates.

[0047] In a sixth process step S6, the language model setup initiates a dialogue with the user, for example by issuing a message such as "X new updates found", whereby semantic information about the updates is analyzed and interpreted.

[0048] In a seventh process step S7, the user can ask follow-up questions, such as "What's new?", whereupon the language model setup evaluates the content of the updates according to predefined security and policy rules.

[0049] Subsequently, in an eighth process step S8, the language model facility generates an explanation of the available updates as well as corresponding recommendations, whereby safety-relevant updates can be described semantically, for example: "This update fixes a vulnerability in the brake control module and increases safety during emergency braking."

[0050] In a ninth process step S9, the user can provide further instructions, such as "Install later?" or "Update map only", with the processing unit taking this information into account for adaptive planning and prioritization of updates.

[0051] In a tenth process step S10, the language model adapts the proposal according to the user input and passes the updated prioritization to the processing facility.

[0052] After confirmation by the user in an eleventh process step S11, the processing unit, i.e., an update control unit for the software installation process, starts the OTA process, i.e., the wireless transmission and installation process, in a twelfth process step S12.

[0053] In a thirteenth process step, S13, the update is installed and successful completion is confirmed.

[0054] If, in the third process step S3, it is determined that the prerequisites for carrying out an OTA update are not met, the process is aborted or postponed by the control logic in a fourteenth process step S14.

[0055] The procedure finally ends in a fifteenth procedural step S15.

[0056] Fig. Figure 2 shows a schematic representation of the system architecture of a vehicle OTA update system 10 supported by a local language model device, with a user interaction 12 and a vehicle system 14 comprising a collection device, a processing device, and control logic. The collection device is configured to establish a communication link with an external server to collect software updates, while the processing device installs the received software updates. Before performing an update, the control logic checks the vehicle's operating states and coordinates the release of the update process.

[0057] In a first process step S1, user interaction 12 takes place via an infotainment system, i.e. an information and entertainment system in the motor vehicle, or via a companion app, i.e. an accompanying mobile application on an external device, through which the user can communicate with the update system.

[0058] In a second process step S2, the local language model setup is activated. This is a generative language model installed in the vehicle that operates without a connection to an external cloud and processes semantic information about the software updates, evaluates security and policy rules, and prepares adaptive prioritization.

[0059] In a third process step S3, communication takes place between the language model device and the vehicle's internal system components, summarized under the vehicle system 14.

[0060] In a fourth process step S4, the language model setup accesses a situational availability logic. This is a logic module designed to determine suitable times and operating states for performing software updates and to check the prerequisites for an OTA update.

[0061] In a fifth process step S5, this situational availability logic communicates with several vehicle-internal modules, including a sensor and vehicle data module 16, which is intended for the acquisition and evaluation of vehicle status data, an internet check module 18, which checks mobile and WLAN connections, a battery monitoring module 20, which monitors the state of charge and energy availability of the vehicle battery, and a planning data module 22, which evaluates appointment data and time preferences of the user.

[0062] In a sixth process step S6, starting from the local language model setup according to process step S2, the semantic evaluations, vehicle states, and interaction data determined by the language model, together with the context information provided by the situational availability logic, are forwarded to an OTA prioritization logic. This OTA prioritization logic is part of the processing setup and evaluates available software updates according to their importance, criticality, and the respective vehicle context, thereby enabling adaptive planning and prioritization.

[0063] The OTA prioritization logic thus evaluates the relevance, criticality and priority of available software updates depending on the respective operating conditions and the rules stored in the system.

[0064] In a seventh process step, S7, the OTA prioritization logic controls an onboard ECU, i.e., an electronic control unit in the vehicle, which is equipped with an OTA module as a processing unit. This unit executes the previously evaluated and prioritized software updates.

[0065] In an eighth process step S8, the OTA module initiates the actual wireless transmission and installation process via an update engine, i.e., an update control unit for the software installation process.

[0066] In a ninth process step S9, the respective vehicle modules, such as navigation maps, driver assistance systems or comfort functions, are finally updated with the new software versions according to the prioritization created by the processing unit.

[0067] This describes Fig. 2 the interaction between the acquisition device, the processing device, the control logic and the local language model device for situation-dependent, adaptive and context-sensitive control of the OTA update process in the motor vehicle.

[0068] The in the Fig. 1 and Fig. The two illustrated embodiments are merely exemplary implementations of the method and system according to the invention. They serve to improve understanding of the invention and are not to be understood as exhaustive or limiting. Rather, individual features of the illustrated embodiments can be combined, modified, or replaced by technically equivalent elements without leaving the scope of protection of the invention.

[0069] In summary, the invention proposes an adaptive, privacy-compliant OTA update system with a local generative language model, integrated security check, multimodal user interaction (speech + touch) and intelligent update queuing and scheduling.

[0070] This significantly improves the security, efficiency and user-friendliness of the OTA process, optimizes vehicle availability and strengthens user confidence in the automated update process. Reference symbol list 10 Update system 12 User Interaction 14 Vehicle system 16 Sensor and vehicle data module 18 Internet Check Module 20 Battery Monitoring Module 22 Planning Data Module QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] WO 2007 / 027546 A2

[0003]

Claims

[1] Method for wirelessly updating software in a motor vehicle, in which a communication link is established with an external server by means of a first detection device in order to detect software updates, and in which software updates received via a processing unit are installed in the motor vehicle, where, using control logic, the operating states of the motor vehicle are checked before a software update is carried out, characterized by , that - semantic information about the software updates is processed using a local language model facility and evaluated according to predefined / specified rules, especially security and policy rules, and - the processing unit is used to perform adaptive planning and prioritization of updates depending on vehicle conditions and / or operational conditions. [2] Method according to claim 1, characterized by , that a multimodal interaction with the user is provided via an interaction device using speech and touch, through which update information is displayed, explained and / or confirmed. [3] Method according to any one of the preceding claims, characterized by , that a locally operated, generative language model is executed via the language model setup, which preferably works without a connection to an external cloud. [4] Method according to any one of the preceding claims, characterized by , that security-relevant software updates are semantically analyzed using the language model setup and their executability is evaluated depending on predefined / specified security and compatibility rules. [5] Method according to any one of the preceding claims, characterized by, that available software updates are ranked according to criticality, vehicle condition and time availability using a prioritization logic. [6] Method according to any one of the preceding claims, characterized by , that the processing unit performs adaptive update planning, taking into account loading times, schedules and calendar data of the user. [7] Method according to any one of the preceding claims, characterized by , that all processing operations are carried out locally in the vehicle using the language model setup (in order to ensure data protection-compliant processing of sensitive user and vehicle data). [8] Method according to any one of the preceding claims, characterized by , that the control logic initiates the release of the software update only after a security, availability and / or compatibility check has been carried out. [9] Update system (10) for wirelessly updating software in a motor vehicle, comprising: - a data collection device that is trained to establish a communication link with an external server in order to collect software updates, - a processing unit trained to install received software updates in the motor vehicle, wherein a control logic is trained to check the operating states of the motor vehicle before performing a software update, characterized by , that a local language modeling facility is provided which is trained to process semantic information about the software updates and to evaluate predefined rules, in particular security and policy rules, and the processing facility is trained to perform adaptive planning and prioritization of updates depending on vehicle states and operational conditions.

Images