Robust Over-the-Air Reprogramming

Abstract

Exemplary operations include one or more of downloading updates to non-volatile electrically erasable memory storage in the vehicle, determining whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory, selecting a programming protocol based on the arrangement of the memory storage, and writing to the memory storage based on the selected programming protocol.

Description

[Background technology]

[0001] Generally, vehicles or transportation vehicles, such as automobiles, motorcycles, trucks, airplanes, trains, etc., serve transportation needs for passengers and / or goods in a variety of ways, and functionality associated with the transportation vehicle can be identified and utilized by various computing devices, such as smartphones or computers, located on and / or away from the transportation vehicle. Summary of the Invention

[0002] One exemplary embodiment provides a method that includes one or more of downloading updates to non-volatile electrically erasable memory storage in a vehicle, determining whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory, selecting a programming protocol based on the arrangement of the memory storage, and writing to the memory storage based on the selected programming protocol.

[0003] Another exemplary embodiment provides a system including a memory communicatively connected to a processor, the processor performing one or more of: downloading updates for non-volatile electrically erasable memory storage in a vehicle; determining whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory; selecting a programming protocol based on the arrangement of the memory storage; and writing to the memory storage based on the selected programming protocol.

[0004] A further exemplary embodiment provides a non-transitory computer-readable medium comprising instructions that, when read by a processor, cause the processor to one or more of: download an update for non-volatile electrically erasable memory storage in the vehicle; determine whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory; select a programming protocol based on the arrangement of the memory storage; and write to the memory storage based on the selected programming protocol. [Brief explanation of the drawings]

[0005] [Figure 1A] FIG. 1 illustrates an exemplary system layout, according to an exemplary embodiment. [Figure 1B] FIG. 10 illustrates a further example of a method for downloading programming data, according to an exemplary embodiment. [Figure 2A] FIG. 1 illustrates a transportation network diagram according to an exemplary embodiment. [Figure 2B] FIG. 10 illustrates another transportation network diagram according to an exemplary embodiment. [Figure 2C] FIG. 10 illustrates yet another transportation network diagram according to an illustrative embodiment. [Figure 2D] FIG. 10 illustrates a further transportation network diagram according to an exemplary embodiment. [Figure 2E] FIG. 10 illustrates an additional transportation network diagram according to an exemplary embodiment. [Figure 2F] FIG. 1 illustrates a diagram depicting powering of one or more elements according to an exemplary embodiment. [Figure 2G] FIG. 1 illustrates a diagram depicting interconnections between different elements according to an exemplary embodiment. [Figure 2H] FIG. 10 illustrates a further diagram depicting interconnections between different elements according to an exemplary embodiment. [Figure 2I]FIG. 10 illustrates yet another diagram depicting interconnections between elements according to an exemplary embodiment. [Figure 2J] 10A-10C illustrate additional views depicting a keyless entry system according to an exemplary embodiment. [Figure 2K] FIG. 10 illustrates an additional view depicting a CAN within a vehicle in accordance with an exemplary embodiment. [Figure 2L] FIG. 10 illustrates yet another diagram depicting an end-to-end communication channel according to an exemplary embodiment. [Figure 2M] FIG. 10 shows yet an additional diagram depicting an example vehicle using security certificates for secure V2V communication, according to an exemplary embodiment. [Figure 2N] 10A-10C show further diagrams depicting example vehicles interacting with security processors and wireless devices according to exemplary embodiments. [Figure 3A] FIG. 1 illustrates a flow diagram according to an exemplary embodiment. [Figure 3B] FIG. 10 illustrates another flow diagram according to an exemplary embodiment. [Figure 3C] FIG. 10 illustrates yet another flow diagram according to an exemplary embodiment. [Figure 4] FIG. 1 is a diagram illustrating a machine learning vehicle network diagram according to an exemplary embodiment. [Figure 5A] FIG. 1 illustrates an exemplary vehicle configuration for managing database transactions associated with a vehicle, according to an exemplary embodiment. [Figure 5B] FIG. 1 illustrates another exemplary vehicle configuration for managing database transactions between various vehicles, according to an exemplary embodiment. [Figure 6A] FIG. 1 illustrates a blockchain architecture configuration, according to an exemplary embodiment. [Figure 6B] FIG. 1 illustrates another blockchain configuration, according to an exemplary embodiment. [Figure 6C]FIG. 1 illustrates a blockchain configuration for storing blockchain transaction data, according to an exemplary embodiment. [Figure 6D] FIG. 2 illustrates an exemplary data block according to an exemplary embodiment. [Figure 7] FIG. 1 illustrates an exemplary system that supports one or more of the exemplary embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0006] It will be readily understood that the components, as generally described and illustrated in the figures herein, could be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of at least one embodiment of a method, apparatus, non-transitory computer-readable storage medium, and system, as illustrated in the accompanying figures, is not intended to limit the scope of the present application as claimed, but rather represents selected embodiments.

[0007] Communications between a vehicle and particular entities, such as remote servers, other vehicles, and local computing devices (e.g., smartphones, personal computers, computers integrated into the vehicle, etc.), may be sent and / or received and processed by one or more “components,” which may be hardware, firmware, software, or a combination thereof. A component may be part of any of these entities or computing devices, or of certain other computing devices. In one example, consensus decisions related to blockchain transactions may be made by one or more computing devices or components associated with the vehicle (which may be any of the elements described and / or depicted herein) and by one or more components located outside or remote from the vehicle.

[0008] The features, structures, or characteristics described throughout this specification may be combined in any suitable manner in one or more embodiments. For example, the use of the phrase "exemplary embodiment," "some embodiments," or other similar terminology throughout this specification indicates that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment. Thus, the appearances of the phrases "exemplary embodiment," "in some embodiments," "in other embodiments," or other similar terminology throughout this specification do not necessarily all refer to the same group of embodiments, and the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the figures, any connections between elements may enable one-way and / or two-way communication, even if the depicted connections are represented by one-way or two-way arrows. In the present solution, the transportation means may include one or more of a car, a truck, a pedestrian area battery electric vehicle (BEV), an e-Palette, a fuel cell bus, a motorcycle, a scooter, a bicycle, a boat, a recreational vehicle, an airplane, and any object that can be used to transport people and / or goods from one place to another.

[0009] Additionally, although the term "message" may be used in describing the embodiments, other types of network data may also be used, such as packets, frames, datagrams, etc. Furthermore, although particular types of messages and signaling may be depicted in preferred embodiments, they are not limited to particular types of messages and signaling.

[0010] Exemplary embodiments provide methods, systems, components, non-transitory computer-readable media, devices, and / or networks for providing at least one of a vehicle (also referred to herein as a car or passenger vehicle), a data collection system, a data monitoring system, a verification system, an authentication system, and a vehicle data distribution system. Vehicle status status data received in the form of communication messages, such as wireless data network communications and / or wired communication messages, can be processed to identify vehicle / vehicle status conditions and provide feedback regarding vehicle status and / or changes. In one example, a user profile can be applied to a particular vehicle / vehicle to authorize a current vehicle event, a service stop at a service station, authorize subsequent car rental services, and enable vehicle-to-vehicle communication.

[0011] Within a communications infrastructure, a distributed database is a distributed storage system that includes multiple nodes communicating with each other. A blockchain is an example of a distributed database and includes an append-only, immutable data structure (i.e., a distributed ledger) that allows records to be maintained among untrusted parties. The untrusted parties are referred to herein as peers, nodes, or peer nodes. Each peer maintains a copy of the database records, and no peer can modify the database records unless consensus is reached among the distributed peers. For example, peers may execute a consensus protocol to validate blockchain storage entries, organize the storage entries into blocks, and build a hash chain through the blocks. This process forms a ledger by ordering the storage entries as necessary for consistency. In a public or permissionless blockchain, anyone can participate without specific identity. Public blockchains can be involved in cryptocurrencies and can use consensus based on various protocols, such as proof-of-work (PoW). Conversely, a permissioned blockchain database can secure interactions between groups of entities that share a common goal but do not or cannot fully trust each other, such as entities exchanging funds, goods, information, and the like. The solution can function in permissioned and / or permissionless blockchain settings.

[0012] Smart contracts are trusted decentralized applications that leverage the tamper-resistant properties of a shared or distributed ledger (which may be in the form of a blockchain) and an underlying agreement between member nodes called an endorsement or endorsement policy. Generally, blockchain entries are "approved" before being committed to the blockchain, while unapproved entries are ignored. A typical endorsement policy allows the smart contract executable code to specify an endorser for the entry in the form of a set of peer nodes required for endorsement. When a client sends an entry to a peer specified in the endorsement policy, the entry is executed to validate the entry. After validation, the entry enters an ordering phase, in which a consensus protocol is used to generate an ordered sequence of endorsed entries organized into blocks.

[0013] A node is a communicating entity in a blockchain system. A "node" may perform a logical function, in the sense that multiple nodes of different types can run on the same physical server. Nodes are grouped together within a trust domain and associated with logical entities that control the node in various ways. Nodes may include different types, such as client or submitting client nodes, which submit entry calls to endorsers (e.g., peers) and broadcast entry proposals to an ordering service (e.g., ordering node). Another type of node is a peer node, which can receive client-submitted entries, commit the entries, and maintain a ledger state and copy of the blockchain entries. A peer may also have the role of an endorser. An ordering service node, or orderer, is a node that performs communication services for all nodes and provides delivery guarantees, such as broadcasting to each of the peer nodes in the system, when committing entries and modifying the blockchain's world state. The world state may constitute the initial blockchain entry, which typically includes control and configuration information.

[0014] A ledger is an ordered, tamper-resistant record of all state transitions of a blockchain. State transitions can result from invocations (i.e., entries) of smart contract executable code submitted by participating parties (e.g., client nodes, ordering nodes, endorser nodes, peer nodes, etc.). An entry can result in a set of key-value pairs of assets being committed to the ledger as one or more operands, such as creation, update, deletion, and the like. A ledger contains a blockchain (also called a chain) that is used to store immutably ordered records in blocks. A ledger also contains a state database that maintains the current state of the blockchain. There is typically one ledger per channel. Each peer node maintains a copy of the ledger for each channel in which it is a member.

[0015] A chain is an entry log constructed as hash-linked blocks, where each block contains a sequence of N entries, where N is 1 or greater. The block header contains a hash of the block's entries and a hash of the previous block's header. In this way, all entries in the ledger can be ordered and cryptographically linked. Therefore, it is impossible to tamper with the ledger data without breaking the hash links. The hash of the most recently added blockchain block represents all entries on the chain that came before it, ensuring that all peer nodes are in a consistent and trusted state. The chain can be stored on the peer node file system (i.e., local, attached storage, cloud, etc.) to efficiently support the append-only nature of blockchain workloads.

[0016] The current state of the immutable ledger represents the most recent values ​​for all keys contained in the chain's entry log. The current state is sometimes referred to as the world state, as it represents the most recent key values ​​known on the channel. Invocations of smart contract executables execute entries against the ledger's current state data. To make these smart contract executables' interactions efficient, the most recent values ​​of keys may be stored in a state database. The state database may simply be an indexed view onto the chain's entry log, and therefore may be regenerated from the chain at any time. The state database may be automatically restored (or generated if necessary) upon peer node startup and before entries are accepted.

[0017] Blockchains differ from traditional databases in that they are not centralized storage, but rather distributed, immutable, and secure storage, and nodes must share changes to records in storage. Some properties inherent in blockchains and that help enable them include, but are not limited to, immutable ledgers, smart contracts, security, privacy, decentralization, consensus, endorsement, accessibility, and the like.

[0018] Exemplary embodiments provide services for a particular vehicle and / or a user profile applied to the vehicle. For example, a user may be the owner of the vehicle or an operator of a vehicle owned by another party. The vehicle may require service at specific intervals, and requests for service may require approval before service is permitted. A service center may also provide service to vehicles in a nearby area based on the vehicle's current route plan and the relative level of service requirement (e.g., urgent, critical, moderate, minor, etc.). Vehicle requests may be monitored via one or more vehicle and / or roadway sensors or cameras that report sensed data to a central controller computing device within the vehicle and / or remote from the vehicle. This data is forwarded to a management server for review and action. Sensors may be located on one or more of the interior of the vehicle, the exterior of the vehicle, on fixed objects remote from the vehicle, and on another vehicle near the vehicle. Sensors may also be associated with vehicle speed, vehicle braking, vehicle acceleration, fuel level, requests for service, vehicle gear shifts, vehicle maneuvering, and the like. Sensors as described herein may also be devices, such as wireless devices, within and / or near the vehicle. Sensor information may also be used to identify whether the vehicle is operating safely and whether the occupant has engaged in any unexpected vehicle conditions, such as during vehicle access and / or usage. Vehicle information collected before, during, and / or after vehicle operation may be identified and stored in transactions on a shared / distributed ledger, which may be created and committed to an immutable ledger as determined in a "decentralized" manner by a permission-granting consortium, such as a blockchain membership group.

[0019] Each interested party (i.e., owner, user, company, agency, etc.) may want to limit the exposure of private information, and therefore, blockchain and its immutability can be used to manage permissions for each specific user-car profile. Smart contracts can be used to provide compensation, quantify user profile scores / ratings / reviews, apply car event permissions, determine when services are needed, identify collision events and / or degradation events, identify events that pose safety concerns, identify event participants, and distribute such car event data to registered entities seeking access. Results can also be identified, and necessary information can be shared among registered companies and / or individuals based on a consensus method associated with the blockchain. Such methods could not be realized with traditional centralized databases.

[0020] To create maps of terrain and roads that the vehicle can use for navigation and other purposes, the various driving systems of the present solution may utilize software, sensor arrays, and machine learning capabilities, light detection and ranging (LIDAR) projectors, radar, ultrasonic sensors, etc. In some embodiments, instead of LIDAR, GPS, maps, cameras, sensors, and the like may also be used in the autonomous vehicle.

[0021] In certain embodiments, the solution includes authorizing a vehicle for service via an automated, rapid authentication scheme. For example, driving to a charging station or fuel pump can be performed by the vehicle operator or autonomous vehicle, and authorization to charge or receive fuel can occur without any delay once authorization is received by the service and / or charging station. The vehicle can provide a communication signal providing the vehicle's identity, with the identity having a currently active profile linked to an account authorized to receive service that can later be modified with compensation. Additional measures can be used to provide further authentication, for example, another identifier can be wirelessly transmitted from the user's device to the service center to replace or add an additional authorization step to the first authorization step between the vehicle and the service center.

[0022] The shared and received data may be stored in a database, which generally maintains the data in a specific location within a single database (e.g., a database server). This location is often a central computer, such as a desktop central processing unit (CPU), a server CPU, or a mainframe computer. Information stored in a centralized database is typically accessible from multiple different points. Centralized databases are easier to manage, maintain, and control, and are particularly useful for security purposes because they are in a single location. In a centralized database, having all data in a single storage location also means that a given data set has only one primary record, thereby minimizing data redundancy. Blockchains can be used to store data and transactions related to transportation means.

[0023] Any of the operations described herein may be performed by one or more processors (e.g., microprocessors, sensors, electronic control units (ECUs), head units, and the like) that may be located onboard or offboard a vehicle. One or more processors may communicate with other processors onboard or offboard other vehicles to utilize data being transmitted by the vehicle. One or more processors and other processors may transmit data, receive data, and utilize this data to perform one or more of the operations described or depicted herein.

[0024] A robust over-the-air (OTA) update for a vehicle's multimedia system is provided. The OTA update relates to non-volatile, electrically erasable memory formed either of blocks of bytes of memory, called NAND flash memory, or individual bytes of memory, called NOR flash memory. NAND flash memory is often used for data storage, while NOR flash memory is often used for processor programming memory.

[0025] An over-the-air (OTA) update is the wireless delivery of software, firmware, and / or data to a vehicle. Vehicle manufacturers often use over-the-air updates to update firmware and vehicle configuration over Wi-Fi or cellular networks. Updates are delivered remotely to the vehicle from a cloud-based server through a Wi-Fi or cellular connection. Vehicle manufacturers regularly update software, firmware, or data to fix bugs, improve vehicle performance, add features, or protect against vulnerabilities that may allow hackers to access the vehicle's software and control systems, allowing vehicle performance to be continually improved. The two main types of OTA updates for vehicles are multimedia and driving controls. Multimedia updates refresh map information, upgrade audio, add interfaces, application updates, and the like.

[0026] Generally, OTA updates include updating applications, verifying the authenticity of the update, verifying hardware and update compatibility, verifying data integrity, and decrypting encrypted data. Generally, OTA updates are packaged in blocks of bytes of memory, e.g., NAND flash, and are agnostic to the type of memory being updated.

[0027] A download failure in NAND flash memory has a different effect than in NOR flash memory: in NAND flash memory, which comprises a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory, which comprises individual bytes of memory, a failure during download requires a re-download starting at the failed byte.

[0028] The solution enables updates to the vehicle's multimedia (MM) system and includes software powering the MM, such as startup, navigation, voice assistant, over-the-air (OTA) updates, and the like. Other functions may also include software powering Bluetooth, CAN communication, Wi-Fi, and the like. In one embodiment, side A to side B reprogramming is established, where multiple copies of software and firmware exist, and updated and original copies of firmware and / or firmware are preserved in the event of a failure during download. The OTA reprogramming logic may reside onboard or offboard the vehicle, or on a device associated with the vehicle. The OTA reprogramming logic may execute fully or partially on one or more of a processor on the vehicle, a processor on a server that may be onboard or offboard the vehicle, a device associated with the vehicle (e.g., a mobile device), or any other processor associated with the vehicle. Memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The vehicle's processor may be the vehicle's electronic control module (ECM) or another processor, such as an ECU, a processor in a head unit (HU), or another processor in the vehicle.

[0029] Any of the operations described herein may be performed by one or more processors (e.g., microprocessors, electronic control units (ECUs), head units, and the like) that may be located onboard or offboard a vehicle. One or more processors may communicate with other processors onboard or offboard other vehicles to utilize data being transmitted by the vehicle. One or more processors and other processors may transmit data, receive data, and utilize this data to perform one or more of the operations described or depicted herein.

[0030] In general, the implementation of reprogramming limits the ability to reliably use side A versus side B in a particular flash technology. For example, when using NOR flash technology versus NAND flash technology, a detected download failure makes a difference in how reprogramming resume is implemented.

[0031] Generally, reprogramming protocols only consider NAND Flash, which limits the reliability of updating software and / or firmware for NOR Flash memory. Current reprogramming steps impose logical limitations on reprogramming. For example, when writing to NOR Flash, the first block of memory is overwritten to indicate whether side A or side B of the memory should be booted. If the first block is overwritten as the first step, any power outage or problem encountered during the reprogramming process can result in an endless loop of failures where the device boots and runs from a faulty download.

[0032] For example, the following depicts the current flow: a. The system installs version 1.0 on Side A. b. At boot time, the system checks the first block and boots Side A. c. The system receives version 1.1 for side B. d. Before successfully reprogramming and booting Side B, the system updates the first block to Side B, which can cause problems if Side B has a reprogramming failure. For example, overwriting the current firmware with new firmware before completing verification of the new firmware can result in security and reliability issues.

[0033] An exemplary method includes downloading updates to non-volatile electrically erasable memory storage in a vehicle. The vehicle's multimedia (MM) system updates and includes software that powers the MM, such as startup, navigation, voice assistant, and over-the-air (OTA) updates for Bluetooth, CAN communication, Wi-Fi, and the like. The method determines whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory. OTA updates involve non-volatile electrically erasable memory formed in one of blocks of bytes of memory, known as NAND flash memory, and individual bytes of memory, known as NOR flash memory. The method selects a programming protocol based on the memory storage arrangement and writes to the memory storage based on the selected programming protocol. The memory storage arrangement may comprise individual bytes of memory that are NOR memory or individual blocks of memory that are NAND memory. The OTA reprogramming logic may execute, in whole or in part, on one or more of a processor in the vehicle, a processor in a server that may reside onboard or offboard the vehicle, a device (e.g., a mobile device) associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0034] The method may include generating an abort flag when a download is interrupted, determining a memory storage location of the interrupted download that matches the abort flag, and resuming the download based on the memory storage location. The abort flag indicates a failure during the download of the update. The type of memory block in which the update failed determines how the update is resumed. In NAND flash memory comprising blocks of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage location and writes to the memory storage based on the selected programming protocol. One memory storage location may be in the form of individual bytes for NOR-type memory, and another storage location may be in the form of blocks of bytes for NAND-type memory. A failure in reprogramming NOR-type memory is resumed at the failed byte, and a failure in reprogramming NAND-type memory is resumed at the failed memory block. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. Memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The processor in the vehicle may be the ECM of the vehicle or another processor, such as a processor in the ECU, HU, or another processor in the vehicle.

[0035] The method may also include determining whether the download is complete, issuing an abort flag if the download is incomplete, generating a magic number if the abort flag is detected, the magic number being randomly generated, writing the magic number to memory storage at the memory location where the download ended, and resuming the download at the memory location where the download ended. The abort flag indicates a failure during the download of the update, and how to resume the update depends on the type of memory block where the update failed. The location of the download failure may be indicated by the magic number, which is a number indicating the location of the last good download. The magic number serves as protection against software attacks during the download because only the delivery vehicle and the server know what the magic number is. In NAND flash memory comprising a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage layout and writes to the memory storage based on the selected programming protocol. One memory storage arrangement may be in the form of individual bytes of NOR type memory, and another storage arrangement may be in the form of blocks of bytes of NAND type memory. A failure in reprogramming NOR type memory restarts at the failed byte, and a failure in reprogramming NAND type memory restarts at the failed memory block. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle.The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0036] The method may include writing the download to temporary storage, verifying the download, and copying the verified download from the temporary storage to permanent memory storage. The temporary storage may be memory storage where data is not permanently stored, such as random access memory (RAM), or, in another example, a temporary storage area in flash memory, NOR data (individual bytes of memory) in a NOR temporary storage area, and NAND data (individual blocks of memory) in a NAND temporary storage area. The location of the RAM, NOR temporary storage area, or NAND temporary storage area of ​​the temporary storage may be in the vehicle's ECM, such as an ECU, a processor in the HU, or another processor in the vehicle, including a mobile device that communicates with the vehicle. The temporary storage area serves as intermediate storage to collect the download to be verified before copying it to permanent storage for use. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0037] The method may also include generating an abort flag if the download is aborted, booting from the memory storage if the abort flag is not generated, and booting from the previous memory storage if the abort flag is generated. This prevents the system from booting from a failed download. The abort flag indicates a failure during the download of the update, and the type of memory block where the update failed determines how the update is resumed. In NAND flash memory comprising a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage location and writes to the memory storage based on the selected programming protocol. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0038] FIG. 1A shows a system 110 depicting OTA reprogramming data flow from an external server 118 to a vehicle. The OTA reprogramming data flow may be executed, in whole or in part, on one or more processors in the vehicle, on a processor in a server that may be onboard or offboard the vehicle, on a device associated with the vehicle (such as a mobile device associated with a vehicle occupant), or on any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The OTA reprogramming data may be communicated directly or indirectly with electronic control modules (ECMs) via a bus, such as a controller area network bus (CAN bus) 112. ECMs are often connected to one another through a central vehicle network, which may be referred to as a controller area network (CAN). The vehicle's CAN bus 112 is connected to electronic control unit ECU i 113 for communicating vehicle OTA reprogramming data to ECU n 114 to receive and store the reprogramming data. A head unit (HU) 115 may distribute the reprogramming data to the ECMs 113, 114 and may also be connected to the CAN bus 112. A data communication module (DCM) 116 may also be connected to the CAN bus 112 to receive and communicate the OTA reprogramming data received from the ECMs. The DCM is an on-board communication device that may periodically transmit CAN information connected to various on-board ECUs to another computer, such as a cloud server. An on-board processor, such as an ECU, collects the OTA reprogramming data and sends a data signal to the on-board DCM through a CAN central gateway (CGW) on the vehicle. In this example, the OTA reprogramming data is solved inside the vehicle and communicated to the ECUs for local storage. The OTA reprogramming data may be routed through the vehicle's HU and the data may be sent to the ECUs on the fly or collected in temporary storage by the head unit.The location of the temporary storage RAM, NOR temporary storage area, or NAND temporary storage area may be in a processor in the vehicle's ECM, e.g., the ECU, the HU, or another processor in the vehicle, including a mobile device that communicates with the vehicle. The OTA reprogramming data is transmitted wirelessly from an external server 118 to the vehicle by the CGW over a network 117, such as a cellular network. The results of the OTA reprogramming download are transmitted from the vehicle to the external server 118 by the CGW over the network 117, such as a cellular network, to confirm receipt of completion or to request a secondary download starting at the location of the failure.

[0039] FIG. 1B shows a system 120 depicting data signal flow from various sources of OTA reprogramming data. The OTA reprogramming data can be transmitted directly to a vehicle 125 from a server 118 over a network 117, such as a cellular network. As shown in FIG. 1A, the OTA reprogramming data can be communicated directly to an electronic control module (ECM) or indirectly to an ECM via a bus, such as the controller area network bus (CAN bus) 112 of FIG. 1A. ECMs are often connected to one another through a central vehicle network, which may be referred to as a controller area network (CAN). The vehicle's CAN bus 112 of FIG. 1A is connected to electronic control unit ECU i 113 of FIG. 1A for communicating the vehicle's OTA reprogramming data to ECU n 114 of FIG. 1A to receive and store the reprogramming data. OTA reprogramming logic can also be transmitted from another vehicle 126 using vehicle-to-vehicle communication. The OTA reprogramming logic may also be received by a cell phone 127 or computer 128 and communicated to the vehicle 126 via cellular radio or Wi-Fi. The OTA reprogramming data flow may be executed, in whole or in part, on one or more processors in the vehicle, on a processor in a server that may be onboard or offboard the vehicle, on a device associated with the vehicle (such as a mobile device associated with a vehicle occupant), or on any other processor associated with the vehicle. Memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle.

[0040] The present solution seeks to overcome these limitations. In one embodiment, the OTA reprogramming steps are modified to reprogram based on the updated flash technology. For example, NOR-type memory is subject to a first set of OTA reprogramming steps, and NAND-type memory is subject to a second set of OTA reprogramming steps. In one embodiment, multiple flags are used when performing the OTA reprogramming process. For example, the flags may include indicators for the current boot side and the version of the current boot side, indicating the location used by the system for boot and the version number of that boot, and a flag indicating the next boot side, indicating the location of the OTA reprogramming logic and the version number of the OTA reprogramming logic. The flags indicate the location of the successful reprogram side and the version of the successful reprogram side. The flags indicate whether a fallback boot is allowed if the OTA reprogramming fails, and a flag for a magic number that marks the location of the download where the download failed. The flags may include indications for successful writes and successful boots. The flags include an indication for the number of failed boot attempts, and indicate the minimum and maximum firmware versions allowed.

[0041] The updated image is written to temporary storage for verification. Below is an example OTA reprogramming flow: i. The system has version 1.0 on Side A 1. "Current launch side" == A 2. "Current Launch Version" == 1.0 3. "Minimum allowed firmware version" == 1.0 4. "Maximum allowed firmware version" == 1.0 ii. At boot time, the system checks the flag and decides to boot from side A iii. The system downloads version 1.1 for Side B. iv. The system determines the type of flash technology to be reprogrammed and determines the OTA reprogramming steps for that flash technology type based on the flash technology type, NOR and / or NAND. v. The system writes version 1.1 to "temporary storage" 1. In case of failure and / or interruption: Use the value stored in the "magic number" and write that value to the point in the download where the restart will begin. The system may randomly generate the magic number for a static value. b. System update indicates "successful write" == No c. During the next boot sequence, the system checks the values ​​stored in "Successful Write", "Magic Number", and "Current Boot Side" i. The system will restart the OTA reprogramming process 2. If successful: a.Continue vi. The system completes the verification of version 1.1 1. The system updates to "Next Boot Side" == B 2. Update the system to "Next Launch Version" == 1.1 3. The system updates to "Fallback Boot Allowed" == Yes 4. Update the system to "Maximum Allowed Firmware Version" = 1.1 5. The system randomly generates and updates a "magic number" vii. At boot time, the system checks a flag to determine if it should attempt to boot from side B. 1. In case of failure: a. The system checks the flag and attempts to boot from side A b. The system creates and shares notifications about failed launch attempts c. The system updates to "Boot Successful" == No d. The system updates to "Failed Boot Attempts" += 1 e. In the situation where the number of failures exceeds the "retry" threshold, the system updates a flag so that the system does not attempt to boot from side B. 1. The system updates "Fallback Boot Allowed" == No 2. The system updates to "Next Boot Side" == A 3. Update the system to "Next Launch Version" == 1.0 4. Update the system to "Maximum Allowed Firmware Version" = 1.0 2. If successful: a. The system updates "normal reprogram side" == B b. The system is updated to "Normal Reprogram Side Version" == 1.1 c. The system updates "Current Boot Side" == B d. Update the system to "Current Launch Version" == 1.1 e. The system updates "next boot side" == B f. The system will update to "Next Launch Version" == 1.1 g. System should be updated to "Minimum Allowed Firmware Version" = 1.1 h. The system is updated to "Maximum Allowed Firmware Version" = 1.1 i. The system updates "Fallback Boot Allowed" == No

[0042] FIG. 2A illustrates a vehicle network diagram 200 according to an exemplary embodiment. The network includes elements including a vehicle 202 including a processor 204 and a vehicle 202' including a processor 204'. The vehicles 202, 202' communicate with each other via the processors 204, 204' and other elements (not shown) including transceivers, transmitters, receivers, storage, sensors, and other elements capable of providing communication. Communication between the vehicles 202, 202' may occur directly, via private and / or public networks (not shown), or via other vehicles and elements comprising one or more processors, memory, and software. While depicted as a single vehicle and processor, multiple vehicles and processors may be present. One or more of the applications, functions, steps, solutions, etc. described and / or depicted herein may be utilized and / or provided by the present elements.

[0043] FIG. 2B shows another vehicle network diagram 210 according to an exemplary embodiment. The network comprises elements including a vehicle 202 including a processor 204 and a vehicle 202' including a processor 204'. The vehicles 202, 202' communicate with each other via the processors 204, 204' and other elements (not shown) including transceivers, transmitters, receivers, storage, sensors, and other elements capable of providing communication. Communication between the vehicles 202, 202' may occur directly, via private and / or public networks (not shown), or via other vehicles and elements comprising one or more of a processor, memory, and software. The processors 204, 204' may further communicate with one or more elements 230 including a sensor 212, a wired device 214, a wireless device 216, a database 218, a mobile phone 220, a vehicle 222, a computer 224, an I / O device 226, and a voice application 228. The processor 204, 204' may further be in communication with elements comprising one or more of a processor, memory, and software.

[0044] Although depicted as a single vehicle, processor, and element, there may be multiple vehicles, processors, and elements. Information or communication may originate to and / or from any of processors 204, 204′ and element 230. For example, mobile phone 220 may provide information to processor 204, which may cause vehicle 202 to initiate an action, may further provide information or additional information to processor 204′, which may cause vehicle 202′ to initiate an action, may further provide information or additional information to mobile phone 220, vehicle 222, and / or computer 224. One or more of the applications, functions, steps, solutions, etc. described and / or depicted herein may be utilized and / or provided by the present elements.

[0045] 2C illustrates yet another vehicle network diagram 240, according to an exemplary embodiment. The network comprises elements including a vehicle 202, which includes a processor 204 and a non-transitory computer-readable medium 242C. The processor 204 is communicatively coupled to the computer-readable medium 242C and to element 230 (depicted in FIG. 2B). The vehicle 202 may be a vehicle, a server, or any device including a processor and memory.

[0046] The processor 204 performs one or more of downloading 244C updates to non-volatile electrically erasable memory storage in the vehicle, determining 246C whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory, selecting 248C a programming protocol based on the arrangement of the memory storage, and writing 250C to the memory storage based on the selected programming protocol.

[0047] An exemplary method includes downloading updates to non-volatile electrically erasable memory storage in a vehicle. The vehicle's multimedia (MM) system updates and includes software that powers the MM, such as startup, navigation, voice assistant, and over-the-air (OTA) updates for Bluetooth, CAN communication, Wi-Fi, and the like. The method determines whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory. OTA updates involve non-volatile electrically erasable memory formed in one of blocks of bytes of memory, known as NAND flash memory, and individual bytes of memory, known as NOR flash memory. The method selects a programming protocol based on the memory storage arrangement and writes to the memory storage based on the selected programming protocol. The memory storage arrangement may comprise individual bytes of memory that are NOR memory or individual blocks of memory that are NAND memory. The OTA reprogramming logic may execute, in whole or in part, on one or more of a processor in the vehicle, a processor in a server that may reside onboard or offboard the vehicle, a device (e.g., a mobile device) associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0048] 2D shows a further vehicle network diagram 250 according to an exemplary embodiment. The network comprises elements including a vehicle 202 including a processor 204 and a non-transitory computer-readable medium 242D. The processor 204 is communicatively coupled to the computer-readable medium 242D and to element 230 (depicted in FIG. 2B). The vehicle 202 may be a vehicle, a server, or any device including a processor and memory.

[0049] The processor 204 performs one or more of generating an interrupted flag if the download is interrupted (244D), determining a memory storage location of the interrupted download that matches the interrupted flag (246D), and resuming the download based on the memory storage location (248D). The method may include determining whether the download is complete (250D), issuing an interrupted flag if the download is incomplete (252D), generating a magic number if the interrupted flag is detected, the magic number being randomly generated (254D), writing the magic number to memory storage at the memory location where the download finished (256D), and resuming the download at the memory location where the download finished (258D). The method may include writing the download to temporary storage (260D), verifying the download (262D), and copying the verified download from temporary storage to memory storage (264D). Temporary storage is memory storage where data is not permanently stored, such as random access memory (RAM), or as another example, a temporary storage area in flash memory, NOR data (individual bytes of memory) in a NOR temporary storage area, and NAND data (individual blocks of memory) in a NAND temporary storage area. The location of the RAM, NOR temporary storage area, or NAND temporary storage area of ​​temporary storage may be in the vehicle's ECM, e.g., the ECU, a processor in the HU, or another processor in the vehicle. The method may further include generating an interrupt flag if the download is interrupted 266D, booting from memory storage if the interrupt flag was not generated 268D, and booting from previous memory storage if the interrupt flag was generated 270D.

[0050] The method may include generating an abort flag when a download is interrupted, determining a memory storage location of the interrupted download that matches the abort flag, and resuming the download based on the memory storage location. The abort flag indicates a failure during the download of the update. The type of memory block in which the update failed determines how the update is resumed. In NAND flash memory comprising blocks of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage location and writes to the memory storage based on the selected programming protocol. One memory storage location may be in the form of individual bytes for NOR-type memory, and another storage location may be in the form of blocks of bytes for NAND-type memory. A failure in reprogramming NOR-type memory is resumed at the failed byte, and a failure in reprogramming NAND-type memory is resumed at the failed memory block. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. Memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The processor in the vehicle may be the ECM of the vehicle or another processor, such as a processor in the ECU, HU, or another processor in the vehicle.

[0051] The method may also include determining whether the download is complete, issuing an abort flag if the download is incomplete, generating a magic number if the abort flag is detected, the magic number being randomly generated, writing the magic number to memory storage at the memory location where the download ended, and resuming the download at the memory location where the download ended. The abort flag indicates a failure during the download of the update, and how to resume the update depends on the type of memory block where the update failed. The location of the download failure may be indicated by the magic number, which is a number indicating the location of the last good download. The magic number serves as protection against software attacks during the download because only the delivery vehicle and the server know what the magic number is. In NAND flash memory comprising a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage layout and writes to the memory storage based on the selected programming protocol. One memory storage arrangement may be in the form of individual bytes of NOR type memory, and another storage arrangement may be in the form of blocks of bytes of NAND type memory. A failure in reprogramming NOR type memory restarts at the failed byte, and a failure in reprogramming NAND type memory restarts at the failed memory block. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle.The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0052] The method may include writing the download to temporary storage, verifying the download, and copying the verified download from the temporary storage to permanent memory storage. The temporary storage may be memory storage where data is not permanently stored, such as random access memory (RAM), or, in another example, a temporary storage area in flash memory, NOR data (individual bytes of memory) in a NOR temporary storage area, and NAND data (individual blocks of memory) in a NAND temporary storage area. The location of the RAM, NOR temporary storage area, or NAND temporary storage area of ​​the temporary storage may be in the vehicle's ECM, such as an ECU, a processor in the HU, or another processor in the vehicle, including a mobile device that communicates with the vehicle. The temporary storage area serves as intermediate storage to collect the download to be verified before copying it to permanent storage for use. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0053] The method may also include generating an abort flag if the download is aborted, booting from the memory storage if the abort flag is not generated, and booting from the previous memory storage if the abort flag is generated. This prevents the system from booting from a failed download. The abort flag indicates a failure during the download of the update, and the type of memory block where the update failed determines how the update is resumed. In NAND flash memory comprising a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage location and writes to the memory storage based on the selected programming protocol. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0054] 2E illustrates yet another vehicle network diagram 260 according to an example embodiment. Referring to FIG. 2E, network diagram 260 includes a vehicle 202 connected to other vehicles 202′ and an update server node 203 via a blockchain network 206. Vehicles 202 and 202′ may represent vehicles / vehicles. Blockchain network 206 may have a ledger 208 that stores software update verification data and sources of verification 207 for future use (e.g., in audits).

[0055] While only one vehicle 202 is described in detail in this example, multiple such nodes may be connected to the blockchain 206. It should be understood that the vehicle 202 may include additional components, and that some of the components described herein may be removed and / or modified without departing from the scope of the present application. The vehicle 202 may have a computing device or server computer, or the like, and may include a processor 204, which may be a semiconductor-based microprocessor, a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), and / or another hardware device. While a single processor 204 is depicted, it should be understood that the vehicle 202 may include multiple processors, multiple cores, or the like without departing from the scope of the present application. The vehicle 202 may be a vehicle, a server, or any device including a processor and memory.

[0056] The processor 204 performs one or more of determining whether the mobile device is located within the vehicle 244E, receiving a portion of the software update via at least one of Bluetooth® and near field communication by the mobile device located within the vehicle 246E, determining whether a nearby vehicle is within communication range of the vehicle 248E, and receiving a portion of the software update via the nearby vehicle 250E.

[0057] The processor and / or computer-readable medium 242E may reside, completely or partially, inside or outside the vehicle. The steps or functions stored in the computer-readable medium 242E may be performed, completely or partially, in any order by any of the processors and / or elements. Furthermore, one or more steps or functions may be added, omitted, combined, performed later, etc.

[0058] 2F shows a diagram 265 depicting the powering of one or more elements. In one embodiment, a vehicle 266 may provide power stored in its batteries to one or more elements, including other vehicles 268, charging stations 270, and a power grid 272. The power grid 272 may be connected to one or more of the charging stations 270, which may be connected to one or more of the vehicles 268. This configuration allows for the distribution of electricity / power received from the vehicle 266. The vehicle 266 may also communicate with the other vehicles 268 via vehicle-to-vehicle (V2V) technology, cellular communications, Wi-Fi, and the like. The vehicle 266 may also communicate with the other vehicles 268, charging stations 270, and / or the power grid 272 wirelessly and / or via wired methods. In one embodiment, vehicle 266 is routed (or routes itself) to power grid 272, charging stations 270, or other vehicles 268 in a safe and efficient manner. Using one or more embodiments of the present solution, vehicle 266 may provide energy to one or more of the elements depicted herein in various advantageous ways as described and / or depicted herein. Additionally, vehicle safety and efficiency may be enhanced, and environmental impacts may be positively impacted as described and / or depicted herein.

[0059] The term "energy" may be used to refer to any form of energy received, stored, used, shared, and / or lost by a vehicle. Energy may be referenced along with a voltage source and / or current supply for charging provided from an entity to a vehicle during a charging / use operation. Energy may also be in the form of fossil fuels (e.g., for use in hybrid vehicles) or from alternative power sources, including, but not limited to, lithium-based, nickel-based, hydrogen fuel cells, atomic / nuclear energy, fusion-based energy sources, and energy generated in situ during energy sharing and / or use operations to increase or decrease the energy level of one or more vehicles at a given time.

[0060] In one embodiment, charging station 270 manages the amount of energy transferred from vehicle 266 so that vehicle 266 has enough charge remaining to reach its destination. In one embodiment, wireless connectivity is used to wirelessly direct the amount of energy transferred between vehicles 268 that may be traveling together. In one embodiment, an idle vehicle, such as car 266 (which may be autonomous), provides an amount of energy to charging station 270 and is instructed to return to its original location (e.g., its original location or a different destination). In one embodiment, a mobile energy storage unit (not shown) is used to collect excess energy from at least one other vehicle 268 and transfer the stored excess energy to charging station 270. In one embodiment, the amount of energy transferred to charging station 270 is determined by factors such as distance, time, and traffic conditions, road conditions, environmental / weather conditions, vehicle condition (e.g., weight), the schedule of the occupant using the vehicle, and the expected schedule of the occupant waiting for the vehicle. In one embodiment, vehicle 268 , charging station 270 , and / or power grid 272 may provide energy to vehicle 266 .

[0061] In one embodiment, a location, such as a building, residence, or the like (not depicted), is communicatively connected to one or more of an electrical grid 272, a vehicle 266, and / or a charging station 270. The rate at which electricity flows to the location, vehicle 266, and / or one or more of other vehicles 268 is modified in response to external conditions, such as weather. For example, if the external temperature is very hot or very cold, increasing the likelihood of a power outage, the flow of electricity to connected vehicles 266 / 268 is slowed to help minimize the likelihood of a power outage.

[0062] In one embodiment, the solutions described and depicted herein may be utilized to determine load impacts on a vehicle and / or system, provide energy to a vehicle and / or system based on future needs and / or priorities, provide information between a device including a module and a vehicle, and enable a processor in the device to wirelessly communicate with a vehicle regarding the amount of energy stored in the vehicle's battery. In one embodiment, the solutions may also be utilized to provide charging from a vehicle to a location based on factors such as the temperature of the location, the cost of energy, and the power level of the location. In one embodiment, the solutions may also be utilized to manage the amount of energy remaining in a vehicle after a portion of the charge has been transferred to a charging station. In one embodiment, the solutions may also be utilized to notify the vehicle to provide the amount of energy in the vehicle's battery, the amount of energy to transfer being based on the vehicle's distance to the energy-receiving module.

[0063] In one embodiment, the solution may also be utilized to use a mobile energy storage unit to travel using the determined route to a vehicle that has excess energy and deposits the stored energy into the grid. In one embodiment, the solution may also be utilized to determine the priority of a vehicle's decision regarding its need to provide energy to the grid and the priority of the vehicle's current needs, such as passengers or future passengers or current or future cargo. In one embodiment, the solution may also be utilized to determine, when a vehicle is not being utilized, a decision to maneuver to a location to discharge excess energy into the energy grid and then return to the previous location. In one embodiment, the solution may also be utilized to determine the amount of energy a vehicle needs to provide needed energy to another vehicle through an energy transfer between vehicles based on one or more conditions, such as weather, traffic, road conditions, vehicle status, and occupants and / or goods within the other vehicle, and to instruct the vehicle to route and provide energy to the other vehicle. In one embodiment, the solution may also be utilized to transfer energy from one moving vehicle to another moving vehicle. In one embodiment, the solution may also be used to extract energy by a vehicle based on the vehicle's energy consumption to reach and provide service at a meeting point with another vehicle and its estimated energy consumption to return to its original location. In one embodiment, the solution may also be used to provide a remaining distance needed to a charging station that determines the amount of energy to be extracted from the vehicle, and the remaining charge is based on the remaining distance. In one embodiment, the solution may also be used to manage a vehicle being charged at multiple points simultaneously, such as by both a charging station via a wired connection and another vehicle via a wireless connection.In one embodiment, the solution may also be utilized to apply priorities to the distribution of energy to vehicles, with priority being given to vehicles that provide a portion of their stored vehicle charge to another entity, such as the grid, homes, and the like. Additionally, the solution as described and depicted with respect to Figure 2F may be utilized in this and other networks and / or systems.

[0064] FIG. 2G is a diagram 275 illustrating the interconnections between different elements. The solution may be stored and / or executed, in whole or in part, on and / or by one or more computing devices 278′, 279′, 281′, 282′, 283′, 284′, 276′, 285′, 287′, and 277′ associated with various entities, all communicatively connected and in communication with a network 286. A database 287 is communicatively connected to the network and allows for the storage and retrieval of data. In one embodiment, the database is an immutable ledger. One or more of the various entities may be a vehicle 276, one or more service providers 279, one or more public buildings 281, one or more transportation infrastructure 282, one or more residential buildings 283, a power grid / charging station 284, a microphone 285, and / or another vehicle 277. Other entities and / or devices, such as one or more private users using a smartphone 278, a laptop 280, an augmented reality (AR) device, a virtual reality (VR) device, and / or any wearable device, may also be integrated with the solution. The smartphone 278, the laptop 280, the microphone 285, and other devices may be connected to one or more of the connected computing devices 278′, 279′, 281′, 282′, 283′, 284′, 276′, 285′, 287′, and 277′. One or more public buildings 281 may include various institutions. One or more public buildings 281 may utilize computing devices 281′. One or more service providers 279 may include dealerships, tow truck services, collision centers, or other repair shops. One or more service providers 279 may utilize computing devices 279′. These various computing devices may be directly and / or communicatively connected to one another via wired networks, wireless networks, blockchain networks, the like, etc. In one embodiment, microphone 285 may be utilized as a virtual assistant.In one embodiment, the one or more traffic infrastructures 282 may include one or more traffic signals, one or more sensors including one or more cameras, vehicle speed sensors or traffic sensors, and / or other traffic infrastructure. The one or more traffic infrastructures 282 may utilize a computing device 282'.

[0065] In one embodiment, vehicles 277 / 276 can transport people, objects, permanently or temporarily attached equipment, and the like. In one embodiment, vehicles 277 may communicate with vehicles 276 via V2V communications through computers 276′ and 277′ associated with each vehicle and may be referred to as vehicles, cars, automobiles, and the like. Vehicles 276 / 277 may be self-propelled, wheeled vehicles such as cars, sport utility vehicles, trucks, buses, vans, or other motor- or battery-powered or fuel-cell-powered vehicles. For example, vehicles 276 / 277 may be electric vehicles, hybrid vehicles, hydrogen fuel cell vehicles, plug-in hybrid vehicles, or any other type of vehicle with a fuel cell stack, motor, and / or generator. Other examples of vehicles include bicycles, scooters, trains, airplanes, or boats, and any other form of vehicle capable of transportation. Vehicles 276 / 277 may be semi-autonomous or autonomous. For example, vehicle 276 / 277 may be self-piloted and operated without human input. An autonomous vehicle may have and use one or more sensors and / or navigation units to navigate autonomously.

[0066] In one embodiment, the solution described and depicted herein may be utilized to determine access to a vehicle via blockchain consensus. In one embodiment, the solution may also be utilized to perform profile verification before allowing a vehicle occupant to use the vehicle. In one embodiment, the solution may also be utilized to have the vehicle indicate (visually, but in another embodiment, verbally, etc.) on or from the vehicle actions (which may be pre-recorded) that the user must take and confirm as correct. In one embodiment, the solution may also be utilized to bifurcate data and provide the vehicle with the ability to decide, based on the risk level associated with the data and the driving environment, how to distribute a portion of the bifurcation data to the occupant with a lower risk level in a safe driving environment and later distribute the remaining portion of the bifurcation data with a higher risk level to the occupant after the occupant has left the vehicle. In one embodiment, the solution may also be utilized to address vehicle movement across (country / state / etc.) borders and apply the rules of the new area to the vehicle using blockchain and / or smart contracts.

[0067] In one embodiment, the solution may also be utilized to allow a vehicle to continue operating outside of a boundary if a consensus is reached by the vehicle based on the vehicle's operation and vehicle occupant characteristics. In one embodiment, the solution may also be utilized to analyze the vehicle's available data upload / download rate, file size, and the speed / direction the vehicle is traveling to determine the distance required to complete the data upload / download and assign a secure area boundary for the data upload / download to be performed. In one embodiment, the solution may also be utilized to instruct the subject vehicle and other nearby vehicles to safely perform a normally dangerous maneuver to allow the subject vehicle to exit in a safe manner, such as when the system determines that an exit is imminent or when the vehicle does not appear ready to exit (e.g., is in the wrong lane or traveling at an inappropriate speed for the next exit). In one embodiment, the solution may also be utilized to verify the diagnosis of other vehicles using one or more vehicles while both the one or more vehicles and the other vehicles are traveling.

[0068] In one embodiment, the solution may also be used to detect lane usage at a certain location and time and notify or instruct the vehicle occupant to recommend or not recommend a lane change. In one embodiment, the solution may also be used to eliminate the need to send information via email and the need for the driver / occupant to respond by making payments via email or in person. In one embodiment, the solution may also be used to provide services to the vehicle occupant, where the services provided are subscription-based and permissions are obtained from other vehicles connected to the occupant's profile. In one embodiment, the solution may also be used to record changes in the state of a rented object. In one embodiment, the solution may also be used to seek blockchain consensus from other vehicles near the damaged vehicle. In one embodiment, the solution may also be used to receive media from a server, such as an insurance entity server, or from a vehicle computer that may be related to the accident. The server accesses one or more media files to access the damage to the vehicle and stores the damage assessment on the blockchain. In one embodiment, the solution may also be utilized to obtain consensus to determine the severity of an event from multiple devices at various times prior to the vehicle-related event.

[0069] In one embodiment, the solution may also be utilized to solve the problem of a lack of video evidence for vehicle-related accidents. The solution details inquiries by vehicles involved in an accident regarding media related to the accident from other vehicles that may have been in the vicinity of the accident. In one embodiment, the solution may also be utilized to record specific portions of the damaged vehicle using vehicles and other devices (e.g., pedestrian cell phones, streetlight cameras, etc.).

[0070] In one embodiment, the solution may also be utilized to alert occupants if the vehicle is maneuvering toward a dangerous area and / or event, allowing the vehicle to notify the occupants or a central controller of potentially dangerous areas on or near the current vehicle path. In one embodiment, the solution may also be utilized to detect when at least one other vehicle is being used to assist in slowing the vehicle in a manner that minimizes impact to traffic if the vehicle is traveling at a high speed. In one embodiment, the solution may also be utilized to identify a dangerous driving situation, where media is captured by a vehicle involved in the dangerous driving situation. A geofence is established based on the distance of the dangerous driving situation, and additional media is captured by at least one other vehicle within the established geofence. In one embodiment, the solution may also be utilized to send a notification to one or more occupants of a vehicle that the vehicle is approaching a traffic control sign on a road, and then receive an indication of poor driving from other nearby vehicles if the vehicle passes the sign. In one embodiment, the solution may also be utilized to partially disable a vehicle by (in certain embodiments) limiting speed, limiting the ability to approach another vehicle, limiting speed to a maximum, and only allowing a given number of miles (approximately 1.609 km) per period.

[0071] In one embodiment, the solution may also be utilized to correct problems with a vehicle when it is not operating correctly, overcoming the need to rely on software updates. Through observations of other vehicles along the route, a server receives data from multiple other vehicles that may be observing the vehicle's unsafe or erroneous operation. Through analysis, the observations may result in notification to the vehicle if the data suggests unsafe or erroneous operation. In one embodiment, the solution may also be utilized to provide notification between a vehicle and a potentially dangerous situation involving persons unrelated to the vehicle. In one embodiment, the solution may also be utilized to transmit data to a server by either a device associated with a vehicle incident or a device near the incident. Based on the severity of the accident or the severity of the nearby accident, the server notifies the sender of the data. In one embodiment, the solution may also be utilized to provide recommendations for vehicle operation to either the driver or passengers of the vehicle based on analysis of the data. In one embodiment, the solution may also be utilized to establish geofences associated with physical structures to determine payment liability for the vehicle. In one embodiment, the solution may also be utilized to coordinate the availability of a vehicle drop-off at a location using both the current state and proposed future state of the location and using navigation destinations of other vehicles. In one embodiment, the solution may also be utilized to coordinate the ability to automatically arrange vehicle drop-off at locations such as transportation rental entities.

[0072] In one embodiment, the solution may also be used to move a vehicle to a different location based on a user event. More specifically, the system tracks the user's device and modifies the vehicle to be moved closer to the user based on the results of the original event or the modified event. In one embodiment, the solution may also be used to enable verification of available locations within an area through vehicles present in the area. The approximate time when a location may become available is also determined based on verification from the vehicles present. In one embodiment, the solution may also be used to move a vehicle to a closer parking space if a parking space becomes available and the elapsed time since initial parking is less than the average time of the event. Furthermore, the solution may move a vehicle to a final parking space if the event is completed or depending on the location of a device associated with at least one occupant of the vehicle. In one embodiment, the solution may also be used to plan parking ahead of upcoming congestion. The system may interact with vehicles to offer services below full price and / or guide vehicles to alternative parking locations based on vehicle priority, thereby improving pre-arrival parking optimization.

[0073] In one embodiment, the solution may also be used to sell fractional ownership of a vehicle or determine pricing and availability for ride-sharing applications. In one embodiment, the solution may also be used to provide accurate and timely reporting of dealership sales activities, far superior to what is currently available. In one embodiment, the solution may also be used to enable dealerships to request assets via the blockchain. By using the blockchain, consensus is obtained before any asset is moved. Furthermore, the process may be automated and payments may be initiated via the blockchain. In one embodiment, the solution may also be used to arrange for agreements to be made with multiple entities (such as service centers), consensus is obtained, and actions (such as diagnostics) are taken. In one embodiment, the solution may also be used to associate digital keys with multiple users. A first user may be the operator of the vehicle, and a second user is the party responsible for the vehicle. The key is authorized by a server, and the proximity of the key is verified against the location of the service provider. In one embodiment, the solution may also be used to determine services needed at the vehicle's destination. One or more service locations capable of providing the required service are located within an area on the route to the destination and available for performance of the service, navigation of the vehicle is updated with the determined service locations, a smart contract including a compensation value for the service is identified, and a blockchain transaction is stored on a distributed ledger for transactions.

[0074] In one embodiment, the solution may also be used to link a service provider's vehicle with a vehicle occupant's profile to determine services and goods that may be of interest to the occupant in the vehicle. The services and goods are determined by the occupant's history and / or preferences. The vehicle then receives offers from the service provider's vehicle and, in another embodiment, meets with the vehicle to provide the service / goods. In one embodiment, the solution may also be used to detect vehicles within a certain range and send service offers (such as maintenance offers, product offers, or the like) to the vehicle. An agreement is reached between the system and the vehicle, and a service provider is selected by the system to provide the agreement. In one embodiment, the solution may also be used to assign one or more vehicles as road managers, who assist in regulating traffic. Road managers may generate road indicators (such as signal lights, displays, sounds, etc.) to assist traffic flow. In one embodiment, the solution may also be used to alert the vehicle driver via a device, which may be a traffic light or near an intersection. An alert is sent in the event that a traffic light turns green and the vehicle ahead of it in the list of vehicles does not move.

[0075] FIG. 2H is another block diagram 290 illustrating the interconnections between different elements in one example. A vehicle 276 is depicted, including ECUs 295, 296 and a head unit (otherwise known as an infotainment system) 297. An electronic control unit (ECU) is a system embedded within automotive electronics that controls one or more of the electrical systems or subsystems within the vehicle. ECUs may include, but are not limited to, managing the vehicle's engine, braking system, transmission system, door locks, dashboard, airbag system, infotainment system, electronic differential, and active suspension. The ECU is connected to the vehicle's controller area network (CAN) bus 294. The ECU may also communicate with a vehicle computer 298 via the CAN bus 294. The vehicle's processor / sensors 298 (e.g., vehicle computer) may communicate with external elements, such as a server 293, via a network 292 (e.g., the Internet). Each ECU 295, 296 and head unit 297 may contain its own security policy. The security policy defines the allowable processes that can be executed in the appropriate context. In one embodiment, the security policy may be provided partially or entirely within the vehicle computer 298.

[0076] ECUs 295, 296 and head unit 297 may each include custom security function elements 299 that define approved processes and the contexts in which those processes are allowed to operate. Context-based authorization, which determines whether a process can be executed, allows the ECU to maintain secure operation and prevent unauthorized access from elements such as the vehicle's controller area network (CAN bus). If the ECU encounters an unauthorized process, the ECU may prevent the process from operating. Automotive ECUs may use various contexts to determine whether a process is operating within its authorized boundaries, such as proximity contexts such as nearby objects, distance to approaching objects, speed, and trajectory relative to other moving objects; operational contexts such as an indication of whether the vehicle is moving or parked, the vehicle's current speed, and transmission status; user-related contexts such as devices connected to the vehicle via wireless protocols, infotainment usage, cruise control, parking assistance, driving assistance, location-based contexts, and / or other contexts.

[0077] In one embodiment, the solution described and depicted herein may be utilized to partially disable a vehicle by (in certain embodiments) limiting speed, limiting the ability to approach another vehicle, limiting speed to a maximum, and only allowing a given number of miles per time period. In one embodiment, the solution may also be utilized to facilitate the exchange of vehicle ownership using blockchain, where data is transmitted to a server by either a device associated with a vehicle accident or a device near the accident. Based on the severity of the accident or the severity of the nearby accident, the server notifies the sender of the data. In one embodiment, the solution may also be utilized to help a vehicle avoid an accident, such as if the vehicle is involved in an accident, by the server querying other vehicles near the accident. The server attempts to obtain data from other vehicles, allowing the server to understand the nature of the accident from multiple perspectives. In one embodiment, the solution may also be utilized to determine that a sound from a vehicle is abnormal and transmit data related to the sound and the location of the possible source to a server, which may determine the possible cause and avoid a potentially dangerous situation. In one embodiment, the solution may also be utilized to establish a location boundary through the system when a vehicle is involved in an accident. This boundary is based on the decibels associated with the accident. Multimedia content for devices within the boundary is captured to assist in further understanding the unfolding of the accident. In one embodiment, the solution may also be utilized to associate a vehicle with the accident and then capture media captured by devices near the location of the accident. The captured media is saved as media segments. The media segments are transmitted to another computing device that creates a sound profile of the accident. This sound profile will assist in understanding further details surrounding the accident.

[0078] In one embodiment, the solution may also be utilized to record areas where a potential event occurred, such as when a vehicle comes into or may come into contact with another vehicle (whether in motion or parked), utilizing sensors to record audio, video, motion, etc., and the system captures data from sensors that may be present on one or more of the vehicles and / or on fixed or moving objects. In one embodiment, the solution may also be utilized to determine that a vehicle has been damaged by using sensor data to identify the new condition of the vehicle during a vehicle event and comparing that condition to the vehicle's condition profile, thereby enabling the safe and secure capture of critical data from a vehicle that is about to be involved in an adverse event.

[0079] In one embodiment, the solution may also be used to alert a vehicle occupant if the vehicle determines via one or more sensors that the vehicle is approaching a one-way street in the wrong direction or traveling the wrong way. The vehicle has sensors / cameras / maps that interact with the solution's system. The system knows the geographic location of one-way streets. The system may audibly notify the occupant, for example, "approaching a one-way street." In one embodiment, the solution may also be used to enable vehicles to earn rewards, allowing autonomous vehicle owners to monetize the data collected and stored by their vehicle's sensors, creating incentives for vehicle owners to share their data and provide additional data to entities that can improve future vehicle performance, provide services to vehicle owners, etc.

[0080] In one embodiment, the solution may also be utilized to increase or decrease vehicle functionality depending on the vehicle's operation over a period of time. In one embodiment, the solution may also be utilized to assign fractional ownership to a vehicle. Sensor data associated with one or more vehicles and devices proximate to the vehicle is used to determine the vehicle's status. Fractional ownership of the vehicle is determined based on the status, and new responsibility for the vehicle is established. In one embodiment, the solution may also be utilized to provide data to a replacement / upfitting part, the data attempting to destroy the replacement / upfit part's authorized functionality and, in response to the authorized functionality not being destroyed, allowing the part to use the replacement / upfit part's authorized functionality.

[0081] In one embodiment, the solution may also be utilized to allow an individual to assure themselves that they are in the vehicle and should reach a specific destination. Furthermore, the system ensures that the driver (in the case of a non-autonomous vehicle) and / or other vehicle occupants are authorized to interact with the vehicle. Pickup, drop-off, and location are also mentioned. All of the above are immutably stored on the blockchain. In one embodiment, the solution may also be utilized to determine driver characteristics through analysis of driving style and other factors to take action if the driver is not driving as usual, such as if the driver has previously driven in certain conditions, e.g., during the day, at night, in rain, in snow, etc. Furthermore, vehicle attributes are also considered. Attributes may include weather, whether headlights are on, whether navigation is in use, whether a HUD is in use, whether media is playing at a certain volume, etc. In one embodiment, the solution may also be utilized to notify vehicle occupants of a dangerous situation if items in the vehicle indicate that the occupants may not be aware of the dangerous situation.

[0082] In one embodiment, the solution may also be utilized to attach calibration devices to fixed equipment on the vehicle, allowing various sensors on the vehicle to automatically self-calibrate based on what should be detected by the calibration devices compared to what is actually detected. In one embodiment, the solution may also be utilized to enable remote diagnostic capabilities, requiring consensus from multiple service centers using blockchain when a vehicle requiring service transmits malfunction information, where consensus is required from other service centers regarding severity thresholds for the data. Once consensus is received, the service center may transmit the malfunction's security level to the blockchain where it is stored. In one embodiment, the solution may also be utilized to determine differences between sensor data external to the vehicle and the vehicle's own sensor data. The vehicle requests software from a server to correct the problem. In one embodiment, the solution may also be utilized to enable messaging for vehicles near or within an area when an event (e.g., a collision) occurs.

[0083] Referring to FIG. 21, a connected vehicle operating environment 290A is shown, according to some embodiments. As depicted, vehicle 276 includes a controller area network (CAN) bus 291A connecting vehicle elements 292A-299A. Other elements may be connected to the CAN bus but are not depicted herein. Depicted elements connected to the CAN bus include a sensor set 292A, an electronic control unit 293A, an autonomous function or advanced driver assistance system (ADAS) 294A, and a navigation system 295A. In some embodiments, vehicle 276 includes a processor 296A, memory 297A, a communication unit 298A, and an electronic display 299A.

[0084] Processor 296A may include an arithmetic logic unit, microprocessor, general purpose controller, and / or similar processor array to perform calculations and provide electronic display signals to display unit 299A. Processor 296A processes data signals and may include a variety of computing architectures, including complex instruction set computer (CISC) architecture, reduced instruction set computer (RISC) architecture, or architectures implementing a combination of instruction sets. Vehicle 276 may include one or more processors 296A. Other processors, operating systems, sensors, displays, and physical configurations (not depicted) communicatively coupled to each other may be used in the present solution.

[0085] Memory 297A is non-transitory memory that stores instructions or data that can be accessed and executed by processor 296A. The instructions and / or data may include code for performing the techniques described herein. Memory 297A may be a dynamic random access memory (DRAM) device, a static random access memory (SRAM) device, flash memory, or some other memory device. In some embodiments, memory 297A may also include non-volatile memory or similar permanent storage devices and media, which may include a hard disk drive, a floppy disk drive, a CD-ROM device, a DVD-ROM device, a DVD-RAM device, a DVD-RW device, a flash memory device, or some other mass storage device for permanently storing information. A portion of memory 297A may be reserved for use as a buffer or virtual random access memory (virtual RAM). Vehicle 276 may include one or more memories 297A without departing from the present solution.

[0086] The memory 297A of the vehicle 276 may store one or more of the following types of data: navigation route data 295A and autonomous function data 294A. In some embodiments, the memory 297A stores data that may be necessary for the navigation application 295A to provide functionality.

[0087] Navigation system 295A may represent at least one navigation route including a start point and an end point. In some embodiments, navigation system 295A of vehicle 276 receives a request from a user for a navigation route, the request including a start point and an end point. Navigation system 295A may query a real-time data server 293 (via network 292), such as a server that provides driving instructions, for navigation route data corresponding to the navigation route including the start point and the end point. Real-time data server 293 transmits the navigation route data to vehicle 276 via wireless network 292, and communication system 298A stores navigation data 295A in memory 297A of vehicle 276.

[0088] ECU 293A controls the operation of multiple systems of vehicle 276, including ADAS system 294A. ECU 293A may disable any unsafe and / or unselected autonomous functions during a journey controlled by ADAS system 294A in response to instructions received from navigation system 295A. In this manner, navigation system 295A may control whether ADAS system 294A is activated or enabled so that ADAS system 294A can operate on a given navigation route.

[0089] Sensor set 292A may include any sensor in vehicle 276 that generates sensor data. For example, sensor set 292A may include short-range and long-range sensors. In some embodiments, sensor set 292A of vehicle 276 may include one or more of the following vehicle sensors: a camera, a LIDAR sensor, an ultrasonic sensor, an automobile engine sensor, a radar sensor, a laser altimeter, a manifold absolute pressure sensor, an infrared detector, a motion detector, a thermostat, an audio detector, a carbon monoxide sensor, a carbon dioxide sensor, an oxygen sensor, a mass airflow sensor, an engine coolant temperature sensor, a throttle position sensor, a crankshaft position sensor, a valve timer, an air-fuel ratio meter, a blind spot meter, a curb feeler, a fault detector, a Hall effect sensor, a parking sensor, a speed gun, a speedometer, a speed sensor, a tire pressure monitoring sensor, a torque sensor, a transmission fluid temperature sensor, a turbine speed sensor (TSS), a variable reluctance sensor, a vehicle speed sensor (VSS), a moisture sensor, a wheel speed sensor, a GPS sensor, a mapping function, and any other type of automotive sensor. The navigation system 295A may store the sensor data in memory 297A.

[0090] Communications unit 298A transmits and receives data to and from network 292 or to another communications channel. In some embodiments, communications unit 298A may include a DSRC transceiver, a DSRC receiver, and other hardware or software necessary to make vehicle 276 a DSRC-equipped device.

[0091] Vehicle 276 may communicate with other vehicles 277 via V2V technology. In one embodiment, V2V communication includes detecting radar information corresponding to a relative distance to an external object, receiving GPS information of the vehicle, setting an area as an area where other vehicles 277 are located based on the detected radar information, calculating a probability that the GPS information of a target vehicle is located in the set area, and identifying the vehicle and / or object corresponding to the radar information and GPS information of the target vehicle based on the calculated probability.

[0092] In one embodiment, the solution described and depicted herein may be utilized to manage emergency deployment and vehicle functionality when it is determined that the vehicle has entered an area without network access. In one embodiment, the solution may also be utilized to manage and provide functionality (such as audio, video, navigation, etc.) in a vehicle without network connectivity. In one embodiment, the solution may also be utilized to determine when a profile of a person near the vehicle matches profile attributes of a profile of at least one occupant within the vehicle. A notification is sent from the vehicle to establish communication.

[0093] In one embodiment, the solution may also be utilized to analyze the availability of occupants in each vehicle where voice communication is available based on the time remaining in the vehicle and the context of the communication taking place. In one embodiment, the solution may also be utilized to determine two threat levels of obstacles in the roadway and receive gestures that may indicate that the obstacle does not reach a threshold warning and proceed along the roadway by the vehicle. In one embodiment, the solution may also be utilized to delete sensitive data from the vehicle if it is damaged in a way that renders it unusable.

[0094] In one embodiment, the solution may also be utilized to verify that customer data to be removed is truly removed from all necessary locations within a company demonstrating GDPR compliance. In one embodiment, the solution may also be utilized to provide compensation from one vehicle to another vehicle in exchange for safety-related data, important notifications, etc., to enhance the autonomous capabilities of lower-level autonomous vehicles. In one embodiment, the solution may also be utilized to provide the vehicle with the ability to receive data based on a first biometric associated with the occupant. The vehicle then decrypts the encrypted data based on verification of a second biometric, the second biometric being a continuation of the first biometric. The vehicle provides the decrypted data to the occupant only if the occupant is able to receive it, deletes the sensitive portion of the decrypted data when the sensitive portion is provided, and deletes the non-sensitive portion after a time period associated with the biometric has expired. In one embodiment, the solution may also be utilized to enable the vehicle to verify an individual based on weight and grip pressure applied to the vehicle's steering wheel. In one embodiment, the solution may also be utilized to provide existing but not currently enabled features to a passenger vehicle, presenting features to vehicle occupants that reflect their characteristics.

[0095] In one embodiment, the solution may also be utilized to enable the incorporation of modifications to the vehicle, particularly the interior of the vehicle and the exterior of the vehicle, to assist at least one occupant in one embodiment. In another embodiment, recreation of a occupant's work environment and / or home environment is disclosed. If the vehicle determines that the user is in "work mode" or "home mode," the system may attempt to "recreate" the user's work / home environment while the user is within the vehicle. All data related to the interior and exterior of the vehicle and the various occupants using the vehicle is stored on a blockchain and executed via smart contracts. In one embodiment, the solution may also be utilized to detect occupant gestures and assist in communication with nearby vehicles, so that the vehicle can be steered accordingly. In one embodiment, the solution may also be utilized to provide the vehicle with the ability to detect intended gestures using a gesture definition data store. In one embodiment, the solution may also be utilized to provide the vehicle with the ability to take various actions based on the user's cadence and gestures. In one embodiment, the solution may also be utilized to ensure that a vehicle driver currently engaged in various operations (e.g., driving while talking to a navigation system, etc.) does not exceed a number of dangerous operations before allowing a gesture.

[0096] In one embodiment, the solution may also be utilized to assign a status to each occupant in the vehicle and validate gestures from the occupants based on the occupant's status. In one embodiment, the solution may also be utilized to collect details of sounds associated with the collision (such as location, direction, whether they are getting louder or quieter, from which device, type, manufacturer, owner, and data associated with the device such as the number of sounds occurring simultaneously and the time the sounds were emitted) to provide to the system where analysis of the data assists in determining details about the collision. In one embodiment, the solution may also be utilized to provide a determination that operation of the vehicle is unsafe. A vehicle includes multiple components that interact to control the vehicle, each component associated with a separate component key. An encryption key is transmitted to the vehicle to reduce the functionality of the vehicle. In response to receiving the encryption key, the vehicle disables one or more of the component keys. Disabling one or more component keys results in one or more of restricting the vehicle from moving faster than a given speed, restricting the vehicle from moving closer than a certain distance to another vehicle, and restricting the vehicle from moving farther than a threshold distance.

[0097] In one embodiment, the solution may also be utilized to provide an indication from one specific vehicle (trying to vacate) to another specific vehicle (trying to occupy), with blockchain being used to perform authentication and reconciliation. In one embodiment, the solution may also be utilized to determine partial responsibility for a vehicle. In cases where multiple people own a single vehicle, the vehicle may be used in different periods of time and used by the system to update fractional ownership. Other embodiments are included in applications including minimum ownership of vehicles based on vehicle availability and vehicle driver determination, as well as other factors, rather than vehicle usage.

[0098] In one embodiment, the solution may also be utilized within a vehicle to allow a user to authorize their subscription with respect to a limited group of people, such as family or friends. For example, a user may want to share a membership, in which case the associated transaction is stored in a blockchain or traditional database. When subscription material is requested by a user who is not the primary subscriber, the blockchain node (i.e., the vehicle) may verify that the person requesting the service is an authorized person with whom the subscriber shared their profile. In one embodiment, the solution may also be utilized to allow a person to reach their intended destination using paratransit. Functional relationship values ​​(e.g., values ​​indicating various parameters and their importance in determining what type of alternative transportation to use) are used in determining the paratransit. In one embodiment, the solution may also be utilized to allow occupants involved in an accident to access other transportation to continue to their original destination.

[0099] In one embodiment, the solution may also be used to communicate software / firmware uploads to a first subset of vehicles. The first set of vehicles test the update, and if the test is successful, the update is communicated to additional sets of vehicles. In one embodiment, the solution may also be used to communicate software / firmware updates from a master vehicle to cars, with the update being communicated through a network of vehicles from the first subset, then a larger subset, and so on. A portion of the update may be sent first, and then the remaining portion may be sent from the same vehicle or another vehicle. In one embodiment, the solution may also be used to provide updates for the vehicle's computer to the vehicle and the vehicle operator's / occupant's devices. The update may be approved by all drivers and / or all occupants. The software update is provided to the vehicle and the device. The user does not need to do anything other than be near the vehicle; the functionality occurs automatically. A notification is sent to the device indicating the software update is complete. In one embodiment, the solution may also be utilized to verify that an OTA software update is being performed by an authorized technician and that the source of the verification code, the procedure for receiving the software update over the air, the information contained in the software update, and the status related to the results of the verification are generated by one or more vehicle components.

[0100] In one embodiment, the solution may also be utilized to provide the ability for a second component to parse software updates located in a first component, then identify a first portion of critical updates and a second portion of non-critical updates, assign the identified first portion to one process in the vehicle, run the identified first portion in the one process for a period of time, and, depending on a positive outcome based on the period, run the identified first portion in another process after the period of time. In one embodiment, the solution may also be utilized to provide a selection of services to a vehicle occupant, the services based on a profile of the vehicle occupant and a shared profile shared with the occupant's profile. In one embodiment, the solution may also be utilized to store user profile data on a blockchain and intelligently present offers and recommendations to a user based on the user's automatically collected purchase history and preferences obtained from the user profile on the blockchain.

[0101] To be sufficiently secure, a vehicle must be protected from unauthorized physical access and unauthorized remote access (e.g., cyber threats). In one embodiment, the vehicle is equipped with a secure access system, such as keyless entry, to prevent unauthorized physical access. Meanwhile, in one embodiment, security protocols are added to the vehicle's computers and computer networks to facilitate secure remote communications to and from the vehicle.

[0102] Electronic control units (ECUs) are nodes within a vehicle that control tasks ranging from windshield wiper operation to anti-lock braking systems. ECUs are often connected to one another through a central network in the vehicle, which may be referred to as a Controller Area Network (CAN). Cutting-edge features such as autonomous driving rely heavily on new and complex ECU implementations such as advanced driver assistance systems (ADAS), sensors, and the like. These new technologies are helping to improve vehicle safety and the driving experience, but they also increase the number of external communication units within the vehicle, making it more vulnerable to attacks. Below are some examples of securing vehicles from physical and remote intrusions:

[0103] FIG. 2J illustrates a keyless entry system 290B for preventing unauthorized physical access to a vehicle 291B, according to an exemplary embodiment. Referring to FIG. 2J, in one embodiment, a key fob 292B transmits commands to the vehicle 291B using radio frequency signals. In this example, the key fob 292B includes a transmitter 2921B having an antenna capable of transmitting short-range wireless signals. The vehicle 291B includes a receiver 2911B having an antenna capable of receiving the short-range wireless signals transmitted from the transmitter 2921B. The key fob 292B and the vehicle 291B also include CPUs 2922B and 2913B, respectively, that control the respective devices, including memory in (or accessible to) the CPUs 2922B and 2913B. In one embodiment, the key fob 292B and the vehicle 291B each include a power supply 2924B and 2915B that powers the respective devices.

[0104] When a user presses button 293B on key fob 292B (or otherwise activates the fob, etc.), CPU 2922B activates within key fob 292B and transmits a data stream to transmitter 2921B, which outputs the data stream via the antenna. In other embodiments, the user's intent is recognized in key fob 292B through other means, such as a microphone for receiving audio, a camera for capturing images and / or video, or other sensors commonly employed in the art for detecting intent from a user, including receiving gestures, motion, eye movements, and the like. The data stream can be a 64- to 128-bit long signal that includes one or more of a preamble, a command code, and a rolling code. The signal can be transmitted at a rate between 2 KHz and 20 KHz, although embodiments are not limited thereto. In response, receiver 2911B of vehicle 291B captures the signal from transmitter 2921B, demodulates the signal, and sends the data stream to CPU 2913B, which decodes the signal and sends a command (e.g., lock door, unlock door, etc.) to command module 2912B.

[0105] If the key fob 292B and the vehicle 291B use a fixed code between them, a replay attack can occur. In this case, if an attacker can capture / find the fixed code during short-range communication, they can replay this code and enter the vehicle 291B. To improve security, the key fob and the vehicle 291B may use a rolling code that changes after each use. Here, the key fob 292B and the vehicle 291B are synchronized with an initial seed 2923B (e.g., a random number, a pseudo-random number, etc.). This is called pairing. The key fob 292B and the vehicle 291B also contain a shared algorithm that modifies the initial seed 2914B each time the button 293B is pressed. The next key press takes the result of the previous key press as input and converts it into the next number in the sequence. In some cases, vehicle 291B may store multiple next codes (e.g., 255 next codes) in the event that a key press on key fob 292B is not detected by vehicle 291B. Thus, multiple key presses on key fob 292B that are not recognized by vehicle 291B do not prevent the vehicle from becoming unsynchronized.

[0106] In addition to rolling codes, key fob 292B and vehicle 291B may employ other methods to make attacks even more difficult. For example, various frequencies may be used to transmit the rolling codes. As another example, two-way communication between transmitter 2921B and receiver 2911B may be used to establish a secure session. As another example, the code may have a limited expiration or timeout. Furthermore, the solution as described and depicted with respect to FIG. 2J may be utilized in this and other networks and / or systems, including those described and depicted herein.

[0107] FIG. 2K illustrates a controller area network (CAN) 290C within a vehicle, according to an exemplary embodiment. Referring to FIG. 2K, CAN 290C includes a CAN bus 297C having high and low terminals and multiple electronic control units (ECUs) 291C, 292C, 293C, etc., connected to CAN bus 297C via wired connections. CAN bus 297C is designed to allow microcontrollers and devices in applications to communicate with each other without the use of a host computer. CAN bus 297C implements a message-based protocol (i.e., the ISO 11898 standard) that allows ECUs 291C-293C to send commands to each other at the root level. Meanwhile, ECUs 291C-293C represent controllers that control electrical systems or subsystems within the vehicle. Examples of electrical systems include power steering, anti-lock braking, air conditioning, tire pressure monitoring, cruise control, and numerous other functions.

[0108] In this example, ECU 291C includes a transceiver 2911C and a microcontroller 2912C. The transceiver may be used to send and receive messages to and from CAN bus 297C. For example, transceiver 2911C may convert data from microcontroller 2912C into a format for CAN bus 297C and convert data from CAN bus 297C into a format for microcontroller 2912C. Meanwhile, in one embodiment, microcontroller 2912C interprets messages and determines which messages to send using ECU software installed on microcontroller 2912C.

[0109] Various security protocols can be implemented to protect CAN 290C from cyber threats. For example, subnetworks (e.g., subnetworks A and B) can be used to divide CAN 290C into smaller sub-CANs to limit an attacker's ability to remotely access the vehicle. In the example of FIG. 2K, ECUs 291C and 292C can be part of the same subnetwork, while ECU 293C is part of a separate subnetwork. Additionally, a firewall 294C (or gateway, etc.) can be added to prevent messages from crossing subnetworks and traversing CAN bus 297C. If an attacker gains access to one subnetwork, they do not gain access to the entire network. In one embodiment, to further secure the subnetworks, the most critical ECUs are not placed in the same subnetwork.

[0110] Although not shown in Figure 2K, other examples of security controls within the CAN include an intrusion detection system (IDS) that may be added to each sub-network to read all passing data and detect malicious messages. If a malicious message is detected, the IDS may notify the vehicle user. Other possible security protocols include encryption / security keys that may be used to obfuscate messages. As another example, in one embodiment, an authentication protocol is implemented that allows messages to authenticate themselves.

[0111] In addition to protecting a vehicle's internal network, the vehicle may also be protected when communicating with external networks, such as the Internet. One advantage of connecting a vehicle to a data source, such as the Internet, is that information from the vehicle can be transmitted over the network to a remote location for analysis. Examples of vehicle information include GPS, on-board diagnostics, tire pressure, and the like. These communication systems are often referred to as telematics because they involve a combination of telecommunications and informatics. Furthermore, the present solution, such as that described and depicted with respect to FIG. 2K, may be utilized with this and other networks and / or systems, including those described and depicted herein.

[0112] FIG. 2L illustrates a secure end-to-end vehicle communication channel according to an exemplary embodiment. Referring to FIG. 2L, telematics network 290D includes vehicle 291D and host server 295D, which is located at a remote location (e.g., a web server, cloud platform, database, etc.) and connected to vehicle 291D via a network such as the Internet. In this example, device 296D associated with host server 295D may be located within vehicle 291D within the network. Additionally, although not shown, device 296D may be connected to other elements of vehicle 291D, such as a CAN bus, an on-board diagnostics (ODBII) port, a GPS system, a SIM card, a modem, and the like. Device 296D may collect data from any of these systems and transfer the data to server 295D via the network.

[0113] The secure management of data begins with the vehicle 291D. In some embodiments, the device 296D may collect information before, during, and after a trip. The data may include GPS data, trip data, passenger information, diagnostic data, fuel data, speed data, and the like. However, the device 296D may simply communicate collected information back to the host server 295D upon the vehicle ignition and completion of a trip. Furthermore, communications may only be initiated by the device 296D, not by the host server 295D. Thus, in one embodiment, the device 296D does not accept communications initiated by external sources.

[0114] To communicate, the device 296D may establish a secure private network between the device 296D and the host server 295D. Here, the device 296D may include a tamper-resistant SIM card that provides secure access to the carrier network 294D via radio tower 292D. When preparing to send data to the host server 295D, the device 296D may establish a one-way secure connection with the host server 295D. The carrier network 294D may communicate with the host server 295D using one or more security protocols. As a non-limiting example, the carrier network 294D may communicate with the host server 295D through a VPN tunnel that allows access through the host server's 295D firewall 293D. As another example, the carrier network 294D may use data encryption (e.g., AES encryption) when sending data to the host server 295D. In some cases, the system may use multiple security measures, such as both VPN and encryption, to further secure the data.

[0115] In addition to communicating with external servers, vehicles may also communicate with each other. In particular, vehicle-to-vehicle (V2V) communication systems enable vehicles to communicate with each other and with roadside infrastructure (e.g., traffic lights, signs, cameras, parking meters, etc.) and the like through wireless networks. The wireless networks may include one or more of a Wi-Fi network, a cellular network, a dedicated short-range communications (DSRC) network, and the like. Vehicles may use V2V communications to provide other vehicles with information regarding the vehicle's speed, acceleration, braking, and direction, to name a few. Thus, vehicles can receive insight into conditions ahead before those conditions become visible, thus significantly reducing collisions. Furthermore, the present solution, as described and depicted with respect to FIG. 2L, may be utilized in this and other networks and / or systems, including those described and depicted herein.

[0116] FIG. 2M illustrates example 290E of vehicles 293E and 292E using security certificates to secure V2V communication, according to an exemplary embodiment. Referring to FIG. 2M, vehicles 293E and 292E may communicate with each other via V2V communication over a short-range network, a cellular network, or the like. Prior to sending a message, vehicles 293E and 292E may sign the message using their respective public key certificates. For example, vehicle 293E may sign a V2V message using public key certificate 294E. Similarly, vehicle 292E may sign a V2V message using public key certificate 295E. In one embodiment, public key certificates 294E and 295E are associated with vehicles 293E and 292E, respectively.

[0117] Upon receiving communications from each other, the transport means may verify the signature with a certificate authority 291E or the like. For example, the transport means 292E may verify with the certificate authority 291E that the public key certificate 294E used by the transport means 293E to sign the V2V communication is authenticated. If the transport means 292E successfully verifies the public key certificate 294E, the transport means knows that the data is from a legitimate source. Similarly, the transport means 293E may verify with the certificate authority 291E that the public key certificate 295E used by the transport means 292E to sign the V2V communication is authenticated. Furthermore, the solution as described and depicted with respect to FIG. 2M may be utilized in this and other networks and / or systems, including those described and depicted herein.

[0118] 2N shows yet another diagram 290F depicting an example vehicle interacting with a security processor and a wireless device, according to an exemplary embodiment. In some embodiments, the computer 224 shown in FIG. 2B may include a security processor 292F as shown in example process 290F of FIG. 2N. In particular, the security processor 292F may perform authorization, authentication, cryptography (e.g., encryption), and the like, for data transmissions sent between the ECU and other devices on the vehicle's CAN bus, and for data messages sent between different vehicles.

[0119] In the example of FIG. 2N , security processor 292F may include authorization module 293F, authentication module 294F, and cryptography module 295F. Security processor 292F may be implemented within a vehicle's computer and may communicate with other elements of the vehicle, such as ECU / CAN network 296F and wired and wireless devices 298F, such as wireless network interfaces, input ports, and the like. Security processor 292F may ensure that data frames (e.g., CAN frames, etc.) transmitted internally within the vehicle (e.g., via ECU / CAN network 296F) are secure. Similarly, security processor 292F may ensure that messages transmitted between different vehicles and to devices attached or connected via wires to the vehicle's computer are also secure.

[0120] For example, the authorization module 293F may store passwords, usernames, PIN codes, biometric scans, and the like for various vehicle users. The authorization module 293F may determine whether a user (or technician) has permission to access certain settings, such as the vehicle's computer. In some embodiments, the authorization module may communicate with a network interface to download any necessary authorization information from an external server. When a user requests to make a change to the vehicle's settings or modify the vehicle's technical details through a console or GUI within the vehicle or through an attached / connected device, the authorization module 293F may require the user to identify themselves in some way before the settings are changed. For example, the authorization module 293F may require a username, password, PIN code, biometric scan, a predefined line drawing or gesture, and the like. In response, the authorization module 293F may determine whether the user has the necessary permission (e.g., access) being requested.

[0121] The authentication module 294F may be used to authenticate internal communications between ECUs on a vehicle's CAN network. As an example, the authentication module 294F may provide information for authenticating communications between ECUs. As an example, the authentication module 294F may send a bit signature algorithm to the ECUs on the CAN network. The ECUs may use the bit signature algorithm to insert authentication bits into the CAN field of a CAN frame. All ECUs on the CAN network typically receive each CAN frame. Each time a new CAN frame is generated by one of the ECUs, the bit signature algorithm may dynamically change the position, amount, etc. of the authentication bits. The authentication module 294F may also provide a list of ECUs that are exempt (safe list) and do not need to use authentication bits. The authentication module 294F may communicate with a remote server to retrieve updates to the bit signature algorithm and the like.

[0122] The encryption module 295F may store asymmetric key pairs used by the vehicle to communicate with other external user devices and vehicles. For example, the encryption module 295F may provide a private key used by the vehicle to encrypt / decrypt communications, while a corresponding public key may be provided to other user devices and vehicles to enable the other devices to decrypt / encrypt communications. The encryption module 295F may communicate with a remote server to receive new keys, updates to keys, new vehicle or user keys, and the like. The encryption module 295F may also send any updates to the local private / public key pair to the remote server.

[0123] 3A shows a flow diagram 300 according to an example embodiment. Referring to FIG. 3A, the flow includes downloading 302 an update for non-volatile electrically erasable memory storage in a vehicle, determining 304 whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory, selecting 306 a programming protocol based on the arrangement of the memory storage, and writing 308 to the memory storage based on the selected programming protocol.

[0124] An exemplary method includes downloading updates to non-volatile electrically erasable memory storage in a vehicle. The vehicle's multimedia (MM) system updates and includes software that powers the MM, such as startup, navigation, voice assistant, and over-the-air (OTA) updates for Bluetooth, CAN communication, Wi-Fi, and the like. The method determines whether the memory storage is arranged in one of blocks of bytes of memory and individual bytes of memory. OTA updates involve non-volatile electrically erasable memory formed in one of blocks of bytes of memory, known as NAND flash memory, and individual bytes of memory, known as NOR flash memory. The method selects a programming protocol based on the memory storage arrangement and writes to the memory storage based on the selected programming protocol. The memory storage arrangement may comprise individual bytes of memory that are NOR memory or individual blocks of memory that are NAND memory. The OTA reprogramming logic may execute, in whole or in part, on one or more of a processor in the vehicle, a processor in a server that may reside onboard or offboard the vehicle, a device (e.g., a mobile device) associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0125] 3B shows another flow diagram 320 according to an example embodiment. Referring to FIG. 3B, the flow may include generating a pause flag 322 if the download is paused, determining a memory storage location of the paused download that matches the pause flag 324, and resuming the download based on the memory storage location 326. The flow may also include determining whether the download is complete 328, issuing a pause flag 330 if the download is incomplete, generating a magic number 332 if the pause flag is detected, the magic number being randomly generated, writing the magic number to memory storage at the memory location where the download finished 334, and resuming the download at the memory location where the download finished 336. The flow may further include writing the download to temporary storage 338, verifying the download 340, and copying the verified download from temporary storage to memory storage 342. The flow may also include generating an interruption flag 344 if the download is interrupted, booting from memory storage 346 if the interruption flag was not generated, and booting from previous memory storage 348 if the interruption flag was generated.

[0126] The method may include generating an abort flag when a download is interrupted, determining a memory storage location of the interrupted download that matches the abort flag, and resuming the download based on the memory storage location. The abort flag indicates a failure during the download of the update. The type of memory block in which the update failed determines how the update is resumed. In NAND flash memory comprising blocks of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage location and writes to the memory storage based on the selected programming protocol. One memory storage location may be in the form of individual bytes for NOR-type memory, and another storage location may be in the form of blocks of bytes for NAND-type memory. A failure in reprogramming NOR-type memory is resumed at the failed byte, and a failure in reprogramming NAND-type memory is resumed at the failed memory block. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. Memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The processor in the vehicle may be the ECM of the vehicle or another processor, such as a processor in the ECU, HU, or another processor in the vehicle.

[0127] The method may also include determining whether the download is complete, issuing an abort flag if the download is incomplete, generating a magic number if the abort flag is detected, the magic number being randomly generated, writing the magic number to memory storage at the memory location where the download ended, and resuming the download at the memory location where the download ended. The abort flag indicates a failure during the download of the update, and how to resume the update depends on the type of memory block where the update failed. The location of the download failure may be indicated by the magic number, which is a number indicating the location of the last good download. The magic number serves as protection against software attacks during the download because only the delivery vehicle and the server know what the magic number is. In NAND flash memory comprising a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage layout and writes to the memory storage based on the selected programming protocol. One memory storage arrangement may be in the form of individual bytes of NOR type memory, and another storage arrangement may be in the form of blocks of bytes of NAND type memory. A failure in reprogramming NOR type memory restarts at the failed byte, and a failure in reprogramming NAND type memory restarts at the failed memory block. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle.The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0128] The method may include writing the download to temporary storage, verifying the download, and copying the verified download from the temporary storage to permanent memory storage. The temporary storage may be memory storage where data is not permanently stored, such as random access memory (RAM), or, in another example, a temporary storage area in flash memory, NOR data (individual bytes of memory) in a NOR temporary storage area, and NAND data (individual blocks of memory) in a NAND temporary storage area. The location of the RAM, NOR temporary storage area, or NAND temporary storage area of ​​the temporary storage may be in the vehicle's ECM, such as an ECU, a processor in the HU, or another processor in the vehicle, including a mobile device that communicates with the vehicle. The temporary storage area serves as intermediate storage to collect the download to be verified before copying it to permanent storage for use. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located on-board or off-board the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0129] The method may also include generating an abort flag if the download is aborted, booting from the memory storage if the abort flag is not generated, and booting from the previous memory storage if the abort flag is generated. This prevents the system from booting from a failed download. The abort flag indicates a failure during the download of the update, and the type of memory block where the update failed determines how the update is resumed. In NAND flash memory comprising a block of bytes of memory, a failure during download requires a re-download of the entire block of bytes. In NOR flash memory comprising individual bytes of memory, a failure during download requires a re-download starting at the failed byte. The method selects a programming protocol based on the memory storage location and writes to the memory storage based on the selected programming protocol. The OTA reprogramming logic for robust OTA reprogramming may be executed, in whole or in part, in one or more of a processor in the vehicle, a processor in a server that may be onboard or offboard the vehicle, a device associated with the vehicle, or any other processor associated with the vehicle. The memory utilized by the one or more processors may likewise be located onboard or offboard the vehicle. The vehicle processor may be the vehicle's ECM or another processor, such as an ECU, a processor in the HU, or another processor in the vehicle.

[0130] 3C illustrates yet another flow diagram 360 according to an exemplary embodiment. Referring to FIG. 3C, the flow diagram includes one or more of determining whether a mobile device is located within a vehicle 362, receiving a portion of the software update via at least one of Bluetooth and near field communication by the mobile device located within the vehicle 364, determining whether a nearby vehicle is within communication range of the vehicle 366, and receiving a portion of the software update via the nearby vehicle 368.

[0131] 4 illustrates a machine learning vehicle network diagram 400 according to an example embodiment. Network 400 includes a vehicle 402 coupled with a machine learning subsystem 406. The vehicle includes one or more sensors 404.

[0132] The machine learning subsystem 406 includes a learning model 408, which is a mathematical artifact created by a machine learning training system 410 that generates predictions by finding patterns in one or more training datasets. In some embodiments, the machine learning subsystem 406 resides within the vehicle 402. In other embodiments, the machine learning subsystem 406 resides outside of the vehicle 402.

[0133] The vehicle 402 sends data from one or more sensors 404 to a machine learning subsystem 406. The machine learning subsystem 406 provides the data from the one or more sensors 404 to a learning model 408, which returns one or more predictions. The machine learning subsystem 406 sends one or more instructions to the vehicle 402 based on the predictions from the learning model 408.

[0134] In further embodiments, vehicle 402 may transmit data from one or more sensors 404 to machine learning training system 410. In yet another embodiment, machine learning subsystem 406 may transmit data from sensors 404 to machine learning subsystem 410. One or more of the applications, functions, steps, solutions, etc. described and / or depicted herein may utilize machine learning network 400 as described herein.

[0135] FIG. 5A illustrates an example vehicle configuration 500 for managing database transactions associated with a vehicle, according to an exemplary embodiment. Referring to FIG. 5A , as a particular vehicle / vehicle 525 engages in a transaction (e.g., car service, dealership transaction, delivery / pickup, vehicle service, etc.), the vehicle may receive (510) assets and / or issue / transfer (512) assets in response to the transaction. A vehicle processor 526 resides within the vehicle 525, and communication exists between the vehicle processor 526, database 530, vehicle processor 526, and transaction module 520. Transaction module 520 may record information such as assets, parties, credits, service descriptions, dates, times, locations, outcomes, notifications, unexpected events, etc. Those transactions in transaction module 520 may be replicated in database 530. The database 530 may be one of an SQL database, an RDBMS, a relational database, a non-relational database, a blockchain, a distributed ledger, may be on-board the vehicle, may be off-board the vehicle, may be accessible directly and / or through a network, or may be accessible to the vehicle.

[0136] FIG. 5B illustrates an exemplary vehicle configuration 550 that manages database transactions between various vehicles, according to an exemplary embodiment. When a vehicle reaches a situation where a service needs to be shared with another vehicle, the vehicle 525 may engage another vehicle 508 to perform various operations, such as sharing, transferring, or obtaining a service request. For example, the vehicle 508 may be due for battery charging and / or may have a tire problem and may be on route to pick up a delivery package. A vehicle processor 528 resides within the vehicle 508, and communication exists between the vehicle processor 528, the database 554, and the transaction module 552. The vehicle 508 may notify another vehicle 525 within its network and operating on its blockchain member services. A vehicle processor 526 resides within the vehicle 525, and communication exists between the vehicle processor 526, the database 530, the vehicle processor 526, and the transaction module 520. The vehicle 525 may then receive information via a wireless communication request to pick up the package from the vehicle 508 and / or from a server (not shown). The transaction is recorded in transaction modules 552 and 520 of both vehicles. Credits are transferred from vehicle 508 to vehicle 525 and a record of the transferred service is recorded in database 530 / 554, assuming the blockchains are different from each other, or recorded on the same blockchain used by all members. Database 554 may be one of an SQL database, an RDBMS, a relational database, a non-relational database, a blockchain, a distributed ledger, and may be on-board the vehicle or off-board the vehicle and may be accessible directly and / or through a network.

[0137] FIG. 6A illustrates a blockchain architecture configuration 600 according to an example embodiment. Referring to FIG. 6A, the blockchain architecture 600 may include a group of blockchain member nodes 602-606 as part of a particular blockchain element, e.g., a blockchain group 610. In an example embodiment, a permissioned blockchain is accessible only to members who have permission to access the blockchain data, rather than all parties. Blockchain nodes participate in numerous activities, such as the addition and validation process (consensus) of blockchain entries. One or more of the blockchain nodes may approve entries based on an endorsement policy and provide an ordering service for all blockchain nodes. Blockchain nodes may initiate blockchain operations (e.g., authentication) and attempt to write to the blockchain immutable ledger stored in the blockchain, a copy of which may also be stored on the underlying physical infrastructure.

[0138] Once a transaction is received and approved by a consensus model determined by the member nodes, the blockchain transaction 620 is stored in the computer's memory. The approved transaction 626 is stored in the blockchain's current block and committed to the blockchain via a commit procedure, which involves performing a hash of the data content for the transaction in the current block and referencing the previous hash of the previous block. Within the blockchain, there may be one or more smart contracts 630 that define the terms of transaction agreement and operation, such as registered recipients, vehicle capabilities, requirements, permissions, sensor thresholds, etc., contained in smart contract executable application code 632. The code may be configured to identify whether a requesting entity is registered for car service, which service features the entity is eligible / required to receive given the entity's profile status, and whether to monitor the entity's behavior at a later time. For example, if a service event occurs and the user is in the car, sensor data monitoring may be activated and a particular parameter, such as the car's charge level, may be identified as being above / below a particular threshold for a particular period of time, which may then result in a change in the current status, requiring the sending of an alert to a controlling party (i.e., the car owner, the car operator, a server, etc.), so that a service can be identified and stored for reference. The car sensor data collected may be based on the type of sensor data used to collect information about the car's status. The sensor data may also be the basis for car event data 634, such as where to travel, average speed, top speed, acceleration, whether there have been any collisions, whether the expected route has been taken, where the next destination is, whether safety measures have been implemented, whether the car has sufficient charge / fuel, etc. All such information may be the basis for smart contract terms 630, which are then stored on the blockchain.For example, sensor thresholds stored in a smart contract can be used as the basis for whether a service needs to be detected and when and where the service should be performed.

[0139] FIG. 6B illustrates a shared ledger configuration, according to an example embodiment. Referring to FIG. 6B, example blockchain logic 640 includes a blockchain application interface 642 as an API or plug-in application that couples to computing devices and execution platforms for specific transactions. The blockchain configuration 640 may include one or more applications coupled to the application programming interface (API) to access and execute stored program / application code (e.g., smart contract executable code, smart contracts, etc.), which may be created according to customized configurations desired by participants, maintain their own state, control their own assets, and receive external information. This may be deployed and installed as an entry by appending it to the distributed ledger on all blockchain nodes.

[0140] Smart contract application code 644 provides the foundation for blockchain transactions by establishing application code that, when executed, enables transaction conditions and states. Smart contracts 630, when executed, result in the creation of specific approved transactions 626, which are then forwarded to a blockchain platform 652. The platform includes security / authorization 658, a computing device 656 that performs transaction management, and a storage unit 654 as memory for storing transactions and smart contracts in the blockchain.

[0141] A blockchain platform may include various layers of blockchain data, services (e.g., cryptographic trust services, virtual execution environments, etc.), as well as an underlying physical computer infrastructure that can be used to receive and store new entries and provide access to auditors seeking to access data entries. The blockchain may expose interfaces that provide access to the virtual execution environments necessary to process program code and interact with the physical infrastructure. Cryptographic trust services may be used to verify entries, such as asset exchange entries, and keep information private.

[0142] The blockchain architecture configurations of Figures 6A and 6B may process and execute program / application code through one or more interfaces and services exposed by the blockchain platform. As a non-limiting example, smart contracts may be created to implement reminders, updates, and / or other notifications of changes, updates, etc. The smart contract itself may be used to identify authorization and access requirements and rules associated with use of the ledger. For example, information may include new entries that may be processed by one or more processing entities (e.g., processors, virtual machines, etc.) included in the blockchain layer. Results may include decisions to reject or approve new entries based on criteria defined in the smart contract and / or peer consensus. Physical infrastructure may be utilized to retrieve any of the data or information described herein.

[0143] Within smart contract executable code, smart contracts may be authored via high-level application and programming languages ​​and then written into blocks within a blockchain. Smart contracts may include executable code that is registered, stored, and / or replicated using a blockchain (e.g., a decentralized network of blockchain peers). Entry is the execution of smart contract code, which may occur in response to conditions associated with the smart contract being met. Execution of a smart contract may result in reliable modifications to the state of a digital blockchain ledger. Modifications to the blockchain ledger resulting from smart contract execution may be automatically replicated throughout the decentralized network of blockchain peers via one or more consensus protocols.

[0144] A smart contract may write data to the blockchain in the format of key-value pairs. Additionally, smart contract code may read values ​​stored in the blockchain and use those values ​​during application operation. Smart contract code may write the output of various logical operations into the blockchain. The code may be used to create temporary data structures within a virtual machine or other computing platform. Data written to the blockchain may be public and / or encrypted and kept private. Temporary data used / generated by a smart contract is kept in memory by the provided execution environment and then deleted once the data needed by the blockchain is identified.

[0145] The smart contract executable code may include a code interpretation of the smart contract along with additional functionality. As described herein, the smart contract executable code may be program code deployed on a computational network, which together are executed and verified by a chain validator during a consensus process. The smart contract executable code receives the hash and retrieves from the blockchain a hash associated with a data template created by using a previously stored function extractor. If the hash of the hash identifier matches the hash created from the stored identifier template data, the smart contract executable code sends an authorization key to the requested service. The smart contract executable code may write data associated with the cryptographic details to the blockchain.

[0146] FIG. 6C illustrates a blockchain configuration for storing blockchain transaction data, according to an exemplary embodiment. Referring to FIG. 6C, the exemplary configuration 660 provides a vehicle 662, a user device 664, and a server 666 that share information with a distributed ledger (i.e., a blockchain) 668. The server may represent a service provider entity that queries a car service provider to share user profile rating information when a known, established user profile attempts to rent a car with an established rating profile. The server 666 may receive and process data related to the vehicle's service requirements. When a service event occurs, such as when vehicle sensor data indicates a need for fuel / charging, maintenance service, etc., a smart contract may be used to invoke rules, thresholds, collection of sensor information, etc., that can be used to invoke a car service event. Blockchain transaction data 670 is stored for each transaction, such as an access event, a subsequent update to the vehicle's service status, an event update, etc. The transaction may include the parties involved, requirements (e.g., age 18, eligible candidate for service, valid driver's license, etc.), coverage level, distance traveled during the event, registered recipients authorized to access the event and provide car service, rights / permissions, sensor data retrieved during the car event operation to record details of the upcoming service event and identify the vehicle's health status, and thresholds used to make a determination as to whether the service event is completed and whether the vehicle's health status has changed.

[0147] FIG. 6D illustrates the contents of a blockchain block 680 and block structures 682A-682n that may be added to a distributed ledger, according to an example embodiment. Referring to FIG. 6D , a client (not shown) may submit entries to a blockchain node to perform activities on the blockchain. As an example, a client may be an application that acts on behalf of a requester, such as a device, person, or entity, to propose entries to the blockchain. Multiple blockchain peers (e.g., blockchain nodes) may maintain a copy of the blockchain network state and the distributed ledger. Various types of blockchain nodes / peers may exist in a blockchain network, including endorsing peers that simulate and approve entries proposed by clients, and committing peers that confirm the endorsements, validate the entries, and commit the entries to the distributed ledger. In this example, a blockchain node may perform the role of an endorser node, a committer node, or both.

[0148] The system includes a blockchain that stores immutably ordered records in blocks and a state database (current world state) that maintains the current state of the blockchain. One distributed ledger may exist per channel, with each peer maintaining its own copy of the distributed ledger for each channel in which it is a member. The blockchain is an entry log structured as hash-linked blocks, with each block containing a sequence of N entries. Blocks may contain various components, such as those shown in Figure 6D. Block combinations may be generated by appending the hash of the previous block's header to the current block's block header. In this way, all entries on the blockchain are ordered and cryptographically linked, preventing tampering with blockchain data without breaking the hash link. Furthermore, because they are linked, the latest block in the blockchain represents all entries that occurred before it. The blockchain may be stored on a peer file system (local or attached storage) to support append-only blockchain workloads.

[0149] The current state of the blockchain and distributed ledger may be stored in a state database, where current state data represents the most recent values ​​for all keys to date contained in the blockchain's on-chain entry log. Invocations of smart contract executable code execute entries against the current state in the state database. To make these smart contract executable code interactions highly efficient, the most recent values ​​for all keys are stored in the state database. The state database may contain an indexed view into the blockchain's entry log and therefore can be regenerated off-chain at any time. The state database may be automatically restored (or generated if necessary) upon peer startup, before entries are accepted.

[0150] The endorsing node receives entries from clients and approves the entries based on the simulated results. The endorsing node holds a smart contract that simulates the entry proposal. When the endorsing node approves an entry, it creates an entry endorsement, which is a signed response from the endorsing node to the client application indicating the endorsement of the simulated entry. The manner in which an entry is approved depends on the endorsement policy, which may be specified in the smart contract executable code. An example of an endorsement policy is "a majority of endorsing peers must approve the entry." Different channels may have different endorsement policies. The approved entry is forwarded by the client application to the ordering service.

[0151] The ordering service accepts approved entries, orders the entries into blocks, and distributes the blocks to committing peers. For example, the ordering service may initiate a new block when a threshold number of entries is reached, a timer times out, or another condition occurs. In this example, a blockchain node is a committing peer that receives data block 682A for storage on the blockchain. The ordering service may consist of a cluster of orderers. The ordering service does not process entries, smart contracts, or maintain a shared ledger. Rather, the ordering service may accept approved entries and specify the order in which those entries are committed to the distributed ledger. The architecture of a blockchain network may be designed so that specific implementations of "ordering" (e.g., Solo, Kafka, BFT, etc.) are pluggable components.

[0152] Entries are written to the distributed ledger in a consistent order. The order of entries is established to ensure that updates to the state database are valid when the entries are committed to the network. Unlike cryptocurrency blockchain systems (e.g., Bitcoin) where ordering occurs through solving cryptographic puzzles or through mining, in this example, the parties to the distributed ledger can choose the ordering mechanism that best suits their network.

[0153] Referring to FIG. 6D , block 682A (also referred to as a data block) stored on a blockchain and / or distributed ledger may include multiple data segments, such as block headers 684A-684n, transaction-specific data 686A-686n, and block metadata 688A-688n. It should be understood that the various blocks and their contents depicted, such as block 682A and its contents, are for illustrative purposes only and are not meant to limit the scope of the illustrative embodiments. In some cases, both block header 684A and block metadata 688A may be smaller than transaction-specific data 686A, which stores entry data, although this is not a requirement. Block 682A may store transaction information for N entries (e.g., 100, 500, 1000, 2000, 3000, etc.) in block data 690A-690n. Block 682A may also include a link to a previous block (e.g., on the blockchain) in block header 684A. In particular, the block header 684A may include a hash of the header of the previous block. The block header 684A may also include a unique block number, a hash of the block data 690A of the current block 682A, and the like. The block numbers of the blocks 682A may be unique and assigned in increasing / consecutive order starting from zero. The first block in a blockchain may be referred to as a genesis block, which contains information about the blockchain, its members, the data stored therein, etc.

[0154] The block data 690A may store entry information for each entry recorded in the block. For example, the entry data may include one or more of the following: entry type, version, timestamp, distributed ledger channel ID, entry ID, epoch, payload visibility, smart contract executable path (deployment transmission), smart contract executable name, smart contract executable version, inputs (smart contract executable and functions), client (creator) identification such as public key and certificate, client signature, endorser identification, endorser signature, proposal hash, smart contract executable event, response status, namespace, read set (e.g., list of keys and versions read by the entry), write set (e.g., list of keys and values), start key, end key, list of keys, Merkle tree query summary, and the like. Entry data may be stored for each of the N entries.

[0155] In some embodiments, block data 690A may also store transaction-specific data 686A that adds additional information to the block's hash link chain in the blockchain. Thus, data 686A may be stored in an immutable log of blocks on a distributed ledger. Some of the benefits of storing such data 686A are reflected in various embodiments disclosed and depicted herein. Block metadata 688A may store multiple fields of metadata (e.g., as a byte array, etc.). The metadata fields may include a signature at the time of block creation, a reference to the last constituent block, an entry filter that identifies valid and invalid entries in the block, the last surviving offset of the ordering service that ordered the blocks, and the like. The signature, last constituent block, and orderer metadata may be added by the ordering service. Alternatively, the block's committer (e.g., a blockchain node) may add valid / invalid information based on endorsement policies, validation of read / write sets, and the like. The entry filter may include a byte array of a size equal to the number of entries in the block data 610A and a verification code that identifies whether the entry was valid / invalid.

[0156] The other blocks 682B-682n in the blockchain also have headers, files, and values. However, unlike the first block 682A, each of the headers 684A-684n in the other blocks includes a hash value of the immediately preceding block. The hash value of the immediately preceding block may simply be a hash of the previous block's header, or it may be a hash value of the entire previous block. By including the hash value of the previous block in each of the remaining blocks, tracking may be performed block by block, from the Nth block back to the genesis block (and associated original files), as shown by arrow 692, establishing an auditable and immutable chain of custody.

[0157] The above embodiments may be implemented in hardware, in a computer program executed by a processor, in firmware, or a combination of the above. The computer program may be embodied on a computer-readable medium, such as a storage medium. For example, the computer program may reside in random access memory ("RAM"), flash memory, read-only memory ("ROM"), erasable programmable read-only memory ("EPROM"), electrically erasable programmable read-only memory ("EEPROM"), registers, a hard disk, a removable disk, a compact disk read-only memory ("CD-ROM"), or any other form of storage medium known in the art.

[0158] A suitable storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. Alternatively, the storage medium may be integrated into the processor. The processor and the storage medium may reside in an application-specific integrated circuit ("ASIC"). Alternatively, the processor and the storage medium may reside as discrete components. For example, FIG. 7 shows an exemplary computer system architecture 700 that may represent or be integrated with any of the components described above.

[0159] 7 is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the present application described herein, although computing node 700 may nonetheless implement and / or perform any of the functionality described herein.

[0160] Within computing node 700 is computer system / server 702, which is capable of operating in many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations that may be suitable for use with computer system / server 702 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, distributed cloud computing environments that include any of the above systems or devices, and the like.

[0161] The computer system / server 702 may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system / server 702 may be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices that are coupled through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0162] 7, a computer system / server 702 in a cloud computing node 700 is shown in the form of a general-purpose computing device. Components of the computer system / server 702 may include, but are not limited to, one or more processors or processing units 704, a system memory 706, and a bus connecting various system components including the system memory 706 to the processor 704.

[0163] The bus may represent any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures, including, by way of example and without limitation, an Industry Standard Architecture (ISA) bus, a MicroChannel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0164] Computer system / server 702 typically includes a variety of computer system-readable media. Such media may be any available media accessible by computer system / server 702, including both volatile and nonvolatile media, removable and non-removable media. In one embodiment, system memory 706 implements the flow diagrams of other figures. System memory 706 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 708 and / or cache memory 710. Computer system / server 702 may further include other removable / non-removable volatile / non-volatile computer system storage media. By way of example only, memory 706 may be provided to read from and write to non-removable, non-volatile magnetic media (not shown, typically referred to as a "hard drive"). Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media, may be provided. In such cases, each may be connected to the bus by one or more data media interfaces. As further depicted and described below, memory 706 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of various embodiments of the present application.

[0165] A program / utility having a set of program modules (at least one) may be stored in memory 706, as well as, by way of example and not limitation, an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or any combination thereof, may include an implementation of a network environment. The program modules generally perform the functions and / or methods of the various embodiments of the present application as described herein.

[0166] As will be appreciated by one skilled in the art, aspects of the present application may be embodied as a system, method, or computer program product. Accordingly, aspects of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may be generally referred to herein as a "circuit," "module," or "system." Furthermore, aspects of the present application may take the form of a computer program product embodied in one or more computer-readable medium(s), the computer-readable medium(s) having computer-readable program code embodied thereon.

[0167] The computer system / server 702 may also communicate with one or more external devices via I / O devices 712 (such as I / O adapters), which may include a keyboard, pointing device, display, voice recognition module, etc., one or more devices that allow a user to interact with the computer system / server 702, and / or any device (e.g., a network card, modem, etc.) that allows the computer system / server 702 to communicate with one or more other computing devices. Such communication may occur through I / O interfaces of the devices 712. Furthermore, the computer system / server 702 may communicate with one or more networks, such as a local area network (LAN), a general wide network (WAN), and / or a public network (e.g., the Internet), via a network adapter. As depicted, the devices 712 communicate with other components of the computer system / server 702 via a bus. It should be understood that other hardware and / or software components, not shown, may be used with the computer system / server 702. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving storage systems.

[0168] While at least one preferred embodiment of the system, method, and non-transitory computer-readable medium is illustrated in the accompanying drawings and described in the foregoing detailed description, it will be understood that the present application is not limited to the disclosed embodiments, but is capable of many rearrangements, modifications, and substitutions as set forth and defined by the following claims. For example, the functions of the various illustrated systems may be performed by one or more of the modules or components described herein, or in a distributed architecture, and may include a transmitter, a receiver, or a pair thereof. For example, all or part of the functions performed by individual modules may be performed by one or more of these modules. Furthermore, the functions described herein may be performed at various times and in conjunction with various events internal or external to the modules or components. Furthermore, information transmitted between the various modules may be transmitted between the modules via at least one of a data network, the Internet, a voice network, an Internet Protocol network, a wireless device, a wired device, and / or multiple protocols. Furthermore, messages sent or received by any of the modules may be transmitted or received directly and / or via one or more of the other modules.

[0169] Those skilled in the art will appreciate that the "system" may be embodied as a personal computer, a server, a console, a personal digital assistant (PDA), a mobile phone, a tablet computing device, a smartphone, or any other suitable computing device or combination of devices. Presenting the above-described functions as being performed by the "system" is not intended to limit the scope of the present application in any way, but rather to provide one example of many embodiments. Indeed, the methods, systems, and apparatuses disclosed herein may be implemented in both local and distributed fashions consistent with computing technology.

[0170] It should be noted that some of the system functionality described herein has been presented as modules to more specifically emphasize their implementation independence. For example, a module may be implemented as a hardware circuit comprising custom very large scale integrated (VLSI) circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented within programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, graphics processing units, or the like.

[0171] Modules may also be implemented at least partially in software for execution by various types of processors. For example, an identified unit of executable code may comprise one or more physical or logical blocks of computer instructions, which may be organized, for example, as an object, procedure, or function. Nevertheless, the executable files of an identified module need not be physically located together, but may comprise different instructions stored in different locations that, when logically combined, comprise the module and achieve the specified purpose for the module. Furthermore, modules may be stored on a computer-readable medium, which may be, for example, a hard disk drive, a flash device, a random access memory (RAM), a tape, or any other such medium used to store data.

[0172] Indeed, a module of executable code may be a single instruction or many instructions, and may even be distributed among several different code segments, among different programs, and across several memory devices. Similarly, computational data may be identified and illustrated herein in modules, and may be embodied in any suitable form and organized within any suitable type of data structure. Computational data may be collected as a single data set or distributed among different locations, including different storage devices, and may exist at least in part as simple electronic signals over a system or network.

[0173] It will be readily understood that the components of the present application, as generally described and illustrated in the figures herein, could be arranged and designed in a wide variety of different configurations. Thus, the detailed description of the embodiments is not intended to limit the scope of the present application as claimed, but is merely representative of selected embodiments of the present application.

[0174] Those skilled in the art will readily appreciate that the foregoing may be performed in a different order of steps and / or with hardware elements in different configurations than those disclosed. Thus, while the present application has been described based on these preferred embodiments, certain modifications, variations, and alternative constructions will be apparent to those skilled in the art.

[0175] While preferred embodiments of the present application have been described, it should be understood that the described embodiments are exemplary only, and that the scope of the present application should be determined solely by the appended claims when considered in light of the full range of equivalents and modifications (e.g., protocols, hardware devices, software platforms, etc.) to which the claims apply. The invention disclosed in this specification includes the following aspects. [Aspect 1] downloading updates to a non-volatile electrically erasable memory storage in the vehicle; determining whether the memory storage is arranged in one of a block of bytes of memory and an individual byte of memory; selecting a programming protocol based on the memory storage arrangement; writing to the memory storage according to the selected programming protocol; A method comprising: [Aspect 2] generating an interruption flag if the download is interrupted; determining the memory storage location of the interrupted download that matches the interruption flag; resuming the download based on the memory storage location; and 2. The method of embodiment 1, further comprising: Aspect 3 determining whether the download is complete; and If the download is incomplete, an interrupt flag is issued. 2. The method of embodiment 1, further comprising: Aspect 4 generating a magic number if the abort flag is detected; writing the magic number to the memory storage at the memory location where the download has completed; resuming the download at the memory location where the download ended; 4. The method of embodiment 3, further comprising: Aspect 5 5. The method of claim 4, wherein the magic number is randomly generated. Aspect 6 writing the download to temporary storage; verifying the download; copying the verified download from the temporary storage to the memory storage; 2. The method of embodiment 1, further comprising: Aspect 7 generating an interruption flag if the download is interrupted; booting from said memory storage if no suspend flag is generated; booting from a previous memory storage when the suspend flag is generated; 2. The method of embodiment 1, further comprising: Aspect 8 1. A system comprising an engine control unit operatively connected to a vehicle, the engine control unit comprising: Download updates to the vehicle's non-volatile electrically erasable memory storage; determining whether the memory storage is arranged in one of a block of bytes of memory and an individual byte of memory; selecting a programming protocol based on the memory storage arrangement; The system writes to the memory storage based on the selected programming protocol. Aspect 9 The engine control unit generating an interruption flag if the download is interrupted; determining the memory storage location of the interrupted download that matches the interruption flag; 9. The system of claim 8, wherein the download is resumed based on the memory storage location. Aspect 10 The engine control unit determining whether the download is complete; 9. The system of claim 8, wherein the system flags an abort if the download is incomplete. Aspect 11 The engine control unit Generate a magic number if an abort flag is detected, writing the magic number to the memory storage at the memory location where the download has completed; 9. The system of claim 8, wherein the download resumes at the memory location where the download ended. Aspect 12 12. The system of claim 11, wherein the magic number is randomly generated. Aspect 13 The engine control unit writing said download to temporary storage; Verifying the download; 9. The system of claim 8, further comprising copying the verified download from the temporary storage to the memory storage. Aspect 14 The engine control unit generating an interruption flag if the download is interrupted; If an interrupt flag is not generated, start the program from the memory storage. 9. The system of claim 8, wherein the system boots from the previous memory storage if the suspend flag is generated. Aspect 15 A non-transitory computer-readable medium comprising instructions that, when read by a processor, cause the processor to: downloading updates to a non-volatile electrically erasable memory storage in the vehicle; determining whether the memory storage is arranged in one of a block of bytes of memory and an individual byte of memory; selecting a programming protocol based on the memory storage arrangement; writing to the memory storage according to the selected programming protocol; A non-transitory computer-readable medium for causing Aspect 16 generating an interruption flag if the download is interrupted; determining the memory storage location of the interrupted download that matches the interruption flag; resuming the download based on the memory storage location; and 16. The non-transitory computer-readable medium of embodiment 15, comprising: Aspect 17 determining whether the download is complete; and If the download is incomplete, an interrupt flag is issued. 16. The non-transitory computer-readable medium of embodiment 15, comprising: Aspect 18 generating a magic number if an abort flag is detected; writing the magic number to the memory storage at the memory location where the download has completed; resuming the download at the memory location where the download ended; 16. The non-transitory computer-readable medium of embodiment 15, comprising: Aspect 19 writing the download to temporary storage; verifying the download; copying the verified download from the temporary storage to the memory storage; 16. The non-transitory computer-readable medium of embodiment 15, comprising: Aspect 20 generating an interruption flag if the download is interrupted; booting from said memory storage if no suspend flag is generated; booting from a previous memory storage when the suspend flag is generated; 16. The non-transitory computer-readable medium of embodiment 15, comprising:

Claims

1. downloading updates to a non-volatile electrically erasable memory storage in the vehicle; determining whether the memory storage is arranged in one of a block of bytes of memory and an individual byte of memory; selecting a programming protocol based on the memory storage arrangement; writing to the memory storage according to the selected programming protocol; determining whether the download is complete; and If the download is incomplete, an interrupt flag is issued. generating a magic number if the abort flag is detected; writing the magic number to the memory storage at the memory location where the download has completed; resuming the download at the memory location where the download ended; A method comprising:

2. generating an interruption flag if the download is interrupted; determining the memory storage location of the interrupted download that matches the interruption flag; resuming the download based on the memory storage location; and The method of claim 1 further comprising:

3. The method of claim 1 , wherein the magic number is randomly generated.

4. writing the download to temporary storage; verifying the download; copying the verified download from the temporary storage to the memory storage; The method of claim 1 further comprising:

5. 1. A system comprising an engine control unit operatively connected to a vehicle, the engine control unit comprising: Download updates to the vehicle's non-volatile electrically erasable memory storage; determining whether the memory storage is arranged in one of a block of bytes of memory and an individual byte of memory; selecting a programming protocol based on the memory storage arrangement; writing to the memory storage according to the selected programming protocol; determining whether the download is complete; If the download is incomplete, an interruption flag is issued; generating a magic number if the interrupt flag is detected; writing the magic number to the memory storage at the memory location where the download has completed; resuming the download at the memory location where the download ended; system.

6. The engine control unit generating an interruption flag if the download is interrupted; determining the memory storage location of the interrupted download that matches the interruption flag; The system of claim 5 , wherein the download is resumed based on the memory storage location.

7. The system of claim 5 , wherein the magic number is randomly generated.

8. The engine control unit writing said download to temporary storage; Verifying the download; The system of claim 5 , further comprising copying the verified download from the temporary storage to the memory storage.

9. A non-transitory computer-readable medium comprising instructions that, when read by a processor, cause the processor to: downloading updates to a non-volatile electrically erasable memory storage in the vehicle; determining whether the memory storage is arranged in one of a block of bytes of memory and an individual byte of memory; selecting a programming protocol based on the memory storage arrangement; writing to the memory storage according to the selected programming protocol; determining whether the download is complete; and If the download is incomplete, an interrupt flag is issued. generating a magic number if the abort flag is detected; writing the magic number to the memory storage at the memory location where the download has completed; resuming the download at the memory location where the download ended; A non-transitory computer-readable medium for causing

Images