Method for updating a control device of a vehicle

Abstract

The invention relates to a method for updating a control device of a vehicle, in which software for updating the control device is loaded into a run environment of the control device; as well as to a control device for a vehicle.

Description

[0001] Method for updating a control unit of a vehicle

[0002] DESCRIPTION:

[0003] The invention relates to a method for updating a control unit of a vehicle, in which software updating the control unit is loaded into an execution environment of the control unit. Furthermore, the invention relates to a control unit for a vehicle.

[0004] Methods of the type mentioned above, in various embodiments, are part of the state of the art and serve to bring a vehicle control unit into a new state using new software. The new software is loaded into an execution environment of the control unit and updates the control unit. The execution environment comprises a memory area and a processor of the control unit assigned to the memory area, or a core of a processor of the control unit assigned to the memory area.

[0005] For example, DE 10 2012 21 1 591 A1 discloses an update method for a vehicle control unit, in which an engine control unit of the vehicle is updated. Updating the engine control unit comprises enabling or activating the engine control unit for a different engine performance, wherein the enabling or activation comprises loading a new control unit code or loading new application data into a special memory area of ​​the control unit. The engine control unit is updated by a manufacturer of the control unit or by a software developer different from the manufacturer of the control unit. For example, the company "BDperformance" offers an update method called ECUflash® for a motorcycle control unit, in which the control unit is updated by saving an optimized configuration file in the control unit using a flash tool.Switching between an original configuration file and the optimized configuration file is possible at any time (see https: / / ecuflash.de).

[0006] Of course, a vehicle ECU provided by a vehicle manufacturer can also be updated by replacing it with a replacement ECU provided by a third-party manufacturer. An example replacement ECU is provided by the rusEFI group as part of an open-source project (see https: / / rusefi.com).

[0007] EP 3 333 748 A1 discloses an update method for a vehicle control unit, in which the control unit is booted in a neutral operating state to set one of two configured operating states. A subsequent boot of the control unit in a first configured operating state allows a one-time switch to the second configured operating state. A subsequent boot of the control unit in a second configured operating state does not allow a switch to the first configured operating state.

[0008] If the control unit provides several functions, in particular functions of different safety levels (ASIL), for the vehicle, it must be ensured that a first function is not impaired by a fault in a second function.

[0009] DE 10 2014 201 682 A1 discloses such an operating method for a vehicle control unit. In this method, each core of a processor of the control unit is assigned its own separate memory area with software installed therein. Each core of the processor executes exclusively the software installed in the assigned memory area. Updating software in one memory area or a runtime error in the software in the memory area does not affect the execution of software in other memory areas.

[0010] DE 10 2019 200 812 A1 also discloses an operating method for a vehicle control unit, in which a first software module implementing a main function of the control unit and a second software module implementing a secondary function of the control unit are executed in different, separate hardware partitions. A failure of the secondary function does not affect the main function.

[0011] Updating an ECU is typically reserved for the original equipment manufacturer (OEM). This minimizes the risk that a ECU's function may be compromised by faulty or incompatible software. However, this approach excludes various software developers from updating the ECU.

[0012] Software provided by such a software developer is hereinafter referred to as free software, while software provided by the manufacturer of the control unit is referred to as OEM software.

[0013] It is therefore an object of the invention to propose a method for updating a vehicle control unit that enables the loading of free software into the control unit and ensures a legally prescribed minimum functionality of the control unit. A further object of the invention is to provide a control unit for a vehicle.

[0014] The invention relates to a method for updating a control unit of a vehicle, in which software updating the control unit is loaded into an execution environment of the control unit. In the updating method, the control unit is transferred to an updated, i.e., new, state by loading new software. The new software can be loaded into the control unit in any known manner. The vehicle can, in particular, be embodied as a passenger car.

[0015] According to the invention, a control unit configuration is converted from a closed configuration to an open configuration, and free software, as the software updating the control unit, is loaded into a free execution environment of the open configuration. The update process changes the control unit configuration. The closed configuration corresponds to the delivery state of the control unit. It allows only a control unit manufacturer (original equipment manufacturer, OEM) to update the control unit using OEM software provided by the manufacturer.

[0016] Typically, the control unit maintains the closed configuration during a warranty period of the control unit or the vehicle.

[0017] The open configuration, on the other hand, allows free software to be loaded into the ECU, specifically into a free execution environment of the ECU's open configuration. The closed configuration may already include the free execution environment.

[0018] It should be noted that converting from the closed configuration to the open configuration may require a corresponding request from the vehicle owner. If the control unit manufacturer approves the request, successful authentication of the owner in a conventional manner, for example, using an identity card and / or vehicle registration document, may also be required.

[0019] Preferably, the conversion comprises generating the free execution environment and / or maintaining an OEM execution environment of the closed configuration and / or a security execution environment (11) of the closed configuration. In other words, the control unit only includes the free execution environment after converting the closed configuration to the open configuration. In this way, the memory space available in the closed configuration of the control unit is not restricted by the free execution environment.

[0020] In contrast, the OEM execution environment and / or the security execution environment belong to both the closed configuration and the open configuration. Maintaining may include changing the OEM execution environment and / or the security execution environment, for example, a size of the respective execution environment and / or software stored in the respective execution environment.

[0021] Advantageously, the free execution environment is created in a hardware partition of the ECU that includes the OEM execution environment. In short, the free execution environment and the OEM execution environment belong to the same hardware partition. Both execution environments share the same microprocessor or microcontroller. This allows software modules from both execution environments to interact particularly easily.

[0022] Ideally, the transfer involves loading OEM software with legally required minimum functionality into the OEM execution environment and / or moving OEM software with legally required minimum functionality from the OEM execution environment to the safety execution environment. When transferring from the closed configuration to the open configuration, the OEM software is loaded into the OEM execution environment of the open configuration. Alternatively or additionally, the OEM software stored in the OEM execution environment of the closed configuration is moved, in particular partially, to the safety execution environment during the transfer. The OEM software ensures compliant minimum functionality of the control unit, regardless of any free software loaded into the free execution environment.Without the free software, the control unit may have limited, i.e. reduced, functionality after being converted to the open configuration compared to the closed configuration.

[0023] In one embodiment, the OEM execution environment protects the loaded OEM software from unauthorized modification, or the security execution environment protects the moved OEM software from unauthorized modification. Protecting the OEM execution environment or the security execution environment can comprise any known means suitable for preventing unauthorized modification of the OEM software. Known means include, for example, keys and certificates. Thanks to this protection, a software developer different from the manufacturer of the control unit cannot modify the OEM software. As a result, the legally prescribed minimum functionality of the control unit is guaranteed. Protecting the OEM execution environment or the security execution environment particularly protects safety-relevant functions of the vehicle.

[0024] The loaded OEM software can provide an interface for the free software loaded into the free execution environment. The interface allows the free software to interact with the OEM software in a read-only manner. For example, the free software can query and use a vehicle mileage record managed by the OEM software via the interface. However, the free software cannot manipulate the mileage record. This ensures the authenticity of the vehicle's mileage record. A specification, i.e., definition, of the interface is published by the ECU manufacturer. The same can also apply to the ECU's firmware.

[0025] In one embodiment, the security execution environment provides at least one key and / or one certificate for accessing the OEM execution environment or the free execution environment. The security execution environment (Hardware Security Execution Environment, HSEE) can be implemented, for example, as a Hardware Security Module (HSM) or a Trusted Execution Environment (TEE). The security execution environment issues the keys and / or certificates required for access.

[0026] A bootloader loaded into the free execution environment can load the free software. The bootloader loads the free software when the ECU is rebooted, making it easier to update the ECU.

[0027] The configuration transfer is ideally logged in an OEM database external to the vehicle. Logging can be automated and includes, for example, saving the time of the transfer and a list of free software loaded into the free execution environment. This allows the OEM database to be queried at any time to determine the current configuration of the ECU.

[0028] It is understood that the proposed method can be applied simultaneously to a plurality of control units of the vehicle, in particular to a network of interacting control units of the vehicle.

[0029] Another subject of the invention is a control unit for a vehicle having a closed configuration. The closed configuration of the control unit corresponds to a delivery state of the control unit.

[0030] According to the invention, the control unit is designed to be updated by executing a method according to one embodiment of the invention. The update method changes the configuration of the control unit and converts the originally closed configuration into an open configuration. The open configuration enables free software to be loaded into the control unit. OEM software also loaded into the control unit during the conversion can ensure a legally prescribed minimum functionality of the control unit.

[0031] A key advantage of the method according to the invention is that a vehicle control unit can be updated using free software while simultaneously ensuring legally required functionality. This makes the control unit programmable for software developers who are different from the control unit manufacturer.

[0032] The invention is schematically illustrated in the drawings using an embodiment and will be further described with reference to the drawings. It shows:

[0033] Figure 1 shows a block diagram of a control device according to an embodiment of the invention for a vehicle in a closed configuration;

[0034] Figure 2 shows a block diagram of the control unit shown in Fig. 1 in an open configuration.

[0035] Figure 1 shows a block diagram of a control unit 1 according to an embodiment of the invention for a vehicle (not shown) in a closed configuration 2. The control unit 1 comprises a hardware partition 10 with an OEM execution environment 31 and a security execution environment 11. The security execution environment 11 is designed to provide at least one key 110 and / or one certificate 111, in particular a plurality of keys 110 and / or certificates 111.

[0036] The control unit 1 has the closed configuration 2 and is configured to be updated by executing a method described below according to one embodiment of the invention. In the method for updating the control unit 1 of the vehicle, software that updates the control unit 1 is loaded into an execution environment of the control unit 1. In this process, the closed configuration 2 of the control unit 1 is converted into an open configuration 3 of the control unit 1.

[0037] Figure 2 shows a block diagram of the control unit 1 shown in Fig. 1 in the open configuration 3. The transfer advantageously comprises generating a free execution environment 30 and / or maintaining an OEM execution environment 31 of the closed configuration (2) and / or a safety execution environment (11) of the closed configuration 2. After the transfer, the open configuration 3 comprises the safety execution environment 11, the OEM execution environment 31 and the free execution environment 30.

[0038] The OEM execution environment 31 may include a coordination module 310. The free execution environment 30 is preferably created in the hardware partition 10 of the control unit 1 that includes the OEM execution environment 31.

[0039] Free software 5 is loaded into the free execution environment 30 of the open configuration 3 as the software that updates the control unit 1. A bootloader 300 loaded into the free execution environment 30 conveniently loads the free software 5.

[0040] The transfer comprises, in particular, loading an OEM software 6 with a legally prescribed minimum functionality into the OEM execution environment 31 and / or moving an OEM software 6 with a legally prescribed minimum functionality from the OEM execution environment 30 to the security execution environment 11. The loaded OEM software 6 advantageously provides an interface 60 for the free software 5 loaded into the free execution environment 30. The OEM execution environment 31 can protect the loaded OEM software 6 from unauthorized modification. The security execution environment can protect the moved OEM software 6 from unauthorized modification.The security execution environment 11 belonging to the closed configuration 2 and the open configuration 3 can each provide at least one key 110 and / or one certificate 111 for accessing the OEM execution environment 31 or the free execution environment 30. A release 112 for the free execution environment is shown, i.e., a subset of keys 110 and / or certificates 111 that the open execution environment 30 can access. It is understood that the number and distribution of the keys 110 and certificates 111 shown are merely exemplary and not restrictive. The transfer can be logged in an OEM database 4 external to the vehicle.

[0041] LIST OF REFERENCE SYMBOLS:

[0042] 1 control unit

[0043] 10 Hardware partition 11 Security execution environment

[0044] 110 keys

[0045] 11 1 Certificate

[0046] 112 Release for the free execution environment

[0047] 2 closed configuration 3 open configuration

[0048] 30 free execution environments

[0049] 300 bootloaders

[0050] 31 OEM execution environment

[0051] 310 Coordination Module 4 OEM Database

[0052] 5 free software

[0053] 6 OEM software

[0054] 60 interface

Claims

PATENT CLAIMS:

1. Method for updating a control unit (1) of a vehicle, in which software updating the control unit (1) is loaded into an execution environment of the control unit (1), wherein a closed configuration (2) of the control unit (1) is converted into an open configuration (3) of the control unit (1) and free software (5) as the software updating the control unit (1) is loaded into a free execution environment (30) of the open configuration (3).

2. The method according to claim 1, wherein the transfer comprises generating the free execution environment (30) and / or maintaining an O-EM execution environment (31) of the closed configuration (2) and / or a security execution environment (11) of the closed configuration (2).

3. The method according to claim 2, wherein the free execution environment (30) is generated in a hardware partition (10) of the control unit (1) comprising the OEM execution environment (31).

4. The method according to claim 3, wherein the transfer comprises loading an OEM software (6) with a legally prescribed minimum functionality into the OEM execution environment (31) and / or moving an OEM software (6) with a legally prescribed minimum functionality from the OEM execution environment (30) into the security execution environment (11).

5. The method of claim 4, wherein the OEM execution environment (31 ) protects the loaded OEM software (6) from unauthorized modification or the security execution environment (11 ) protects the moved OEM software (6) from unauthorized modification.

6. The method according to claim 4 or 5, wherein the loaded OEM software (6) provides an interface (60) for the free software (5) loaded into the free execution environment (30).

7. The method according to any one of claims 2 to 6, wherein the security execution environment (11) provides at least one key (110) and / or one certificate (111) for accessing the OEM execution environment (31) or the free execution environment (30).

8. Method according to one of claims 1 to 7, wherein a bootloader (300) loaded into the free execution environment (30) loads the free software (5).

9. Method according to one of claims 1 to 8, wherein the transfer is logged in an OEM database (4) external to the vehicle.

10. Control unit (1) for a vehicle having a closed configuration (2) and configured to be updated by executing a method according to one of claims 1 to 9.

Images