Memory image of a software update and method for updating the software of a computing unit

Abstract

The invention relates to a memory image (1) of a software update, comprising at least two update packages (2) in a payload data part (1.2) which are applicable to different program versions. The memory image according to the invention is characterised in that a full update package (2.FULL) contains the complete program code of the software (3) to be updated in the current program version, and at least one differential update package (2.DIFF) contains a subset of the program code of the software (3) to be updated, wherein the subset corresponds exactly to the changes required to update an older program version of the software (3) to be updated to a newer version of the software (3) to be updated.

Description

[0001] Memory image of a software update and method for updating the software of a computing unit

[0002] The invention relates to a memory image of a software update according to the type defined in more detail in the preamble of claim 1 and to a method for updating the software of a computing unit by means of such a memory image.

[0003] With increasing digitalization, more and more computing units are being integrated into vehicles to perform a wide variety of tasks. Such a computing unit can, for example, function as a central on-board computer or control unit for a vehicle subsystem. This enables the provision of a wide variety of comfort and safety assistance functions. Powerful hardware is particularly required for environmental detection and analysis, as well as for deriving control commands in connection with at least partially automated or even autonomous vehicle control.

[0004] As is typical for information technology systems, on-board electronics are based on an interplay of hardware and software components. It may be necessary to update the software on the respective processing units. This allows errors, also known as bugs, to be fixed, new functions to be provided, and security gaps to be closed.

[0005] To install a software update, the software in question must not be running or the computing unit in question cannot be used for other tasks due to the load caused by installing the update. Accordingly, it is preferable to keep the installation time for software updates as short as possible. To implement the software update in question on the computing unit in question or in the vehicle, the corresponding data packets must be transferred from a system that provides the software update, such as an update server. The larger the software update, the more data must be transferred. Depending on the available transmission bandwidth, this may also take a certain amount of time. If the available bandwidth is fully utilized, no further data packets can be transferred.Accordingly, the file size of each software update should also be as small as possible. To achieve this, so-called differential updates are known. These do not include the entire code of an update, but only the changes from the previous version. Such a differential update can be correspondingly small, but it can only be applied to a specific program version.

[0006] Keeping the respective software components of a vehicle manufacturer's vehicles up-to-date is a significant effort. The vehicles in a vehicle manufacturer's fleet differ in their wide variety of special equipment, hardware configurations, and correspondingly different software configurations. It is therefore desirable to provide tools that simplify the installation of software updates on the corresponding computing units of a vehicle, despite the high variety of variants.

[0007] EP 3273 350 A1 discloses a software update device and a method for updating software. A first communication unit receives update control information comprising update data for various computing units. Furthermore, the update control information contains instructions and conditions for installing the respective update. A second communication unit forwards the update data to the respective computing units. An update control unit controls the installation process. The update data comprises various software updates for different computing units. For each software update, the program version to which it is applicable, i.e., installable, is specified. This information serves as a boundary condition for checking the general installability on a respective computing unit prior to installation.In general, this can be a full update or a differential update.

[0008] EP 3462 305 A1 also discloses the updating of control units and peripherals using a central processing unit. In addition to the actual update package, a so-called transient update agent is transmitted to the processing unit to be updated. This agent is executed to install the update on the processing unit and is then deleted. Furthermore, US Pat. No. 6,581,159 B1 describes a secure method for updating a BIOS using a simply authenticated external module to validate additional new firmware code. The module is validated by comparing hash values ​​as part of a digital signature process.

[0009] The present invention is based on the object of providing an improved memory image of a software update and a corresponding method for its installation, with the aid of which the effort for updating software can be reduced when there is a high variety of different computing units and different program versions.

[0010] According to the invention, this object is achieved by a memory image of a software update having the features of claim 1 and a corresponding method for updating the software of a computing unit using such a memory image. Advantageous embodiments and further developments are set out in the dependent claims.

[0011] A generic memory image of a software update, comprising at least two update packages applicable to different program versions in a payload, is further developed according to the invention in that a full update package contains the complete program code of the software to be updated in the current program version, and at least one differential update package contains a subset of the program code of the software to be updated, wherein the subset corresponds precisely to the changes required to update an older program version of the software to be updated to a newer version of the software to be updated. The memory image according to the invention, typically referred to as a so-called "image," contains program code modules for updating a very specific software, i.e., a very specific program.This can be any program, such as an application program or firmware, or even parameters used by the respective program, such as variables. Each memory image is intended for a very specific program, for example, an engine control program, an air conditioning control program, a media player, an internet browser, the firmware of a control unit, and the like. The memory image is created from a single computer-readable file. The memory image contains suitable update packages for the different program versions of the software to be updated, so that, in the most complex case, updating to the currently current program version is possible regardless of the program version of the respective software installed on the computing unit to be updated.

[0012] If the memory image is only used for a small number of different variant combinations of processing units and program versions, it is not necessarily required that a corresponding differential update package be included for each program version. Thus, in the simplest case, it is sufficient to include at least one differential update package, with the help of which an older program version of the software to be updated can be updated to a newer version of the software to be updated. The "newer version" of the software to be updated does not necessarily have to correspond to the current program version. This also makes it possible to update particularly outdated program versions to not quite as outdated program versions, which may also be relevant depending on the application.

[0013] Using the full update package, any version of the software, especially the first version, can be updated to the latest version. This may require first uninstalling the outdated version of the software and then reinstalling it completely on the respective computer using the full update package. It may also be possible to update the outdated version without first uninstalling it.

[0014] An advantageous further development of the memory image provides that at least one differential update package contains suitable program code sections for updating a program version immediately preceding the current program version to the current program version. System administrators will generally strive to keep the programs executable on the respective computing units up-to-date. Thus, the program version immediately preceding the current program version is particularly relevant, since it can be assumed that this program version is installed on a large proportion of the computing units in the field and must be updated accordingly.

[0015] According to a further advantageous embodiment of the memory map according to the invention, the update packages in the payload section are sorted according to the program version of the software to be updated, to which they are applicable. The update packages can be sorted in ascending or descending order, i.e., starting with the newest version and ending with the oldest version, or vice versa. Sorting the update packages according to the program version offers advantages for the process of installing a respective update, as this allows the respective update package to be implemented to be found more quickly at the appropriate location in the memory map.

[0016] Preferably, a header is followed by the differential update package suitable for updating the program version immediately preceding the current program version, and the full update package forms the last update package. This typically makes it possible to locate the update package to be implemented even faster. If the software needs to be updated, the processing unit will typically first read the header of the memory image. The header contains additional information, such as the number and versions of the respective update packages, the location of each update package in the memory image, the communication protocol to be used, rules of conduct in the event of errors, and the like.

[0017] The arrangement of update packages based on the program version, starting with the version immediately preceding the current program version and ending with the full update package, has the advantage that only a particularly short portion of the memory map needs to be traversed to reach the starting position of a differential update package for a newer software version. Thus, the majority of computing units in the field tend to maintain newer versions of the software to be updated and must be updated accordingly. This can accelerate the installation speed of the respective software update in the majority of installation cases.

[0018] According to a further advantageous embodiment of the memory image according to the invention, differential update packages are included for all program versions preceding the current program version. The memory image is thus capable of bringing all outdated program versions of the software to be updated up to the current program version. This makes the memory image according to the invention particularly universally applicable. No information about the program version currently installed on a particular processing unit is required. Thus, the memory image according to the invention can be used directly, and the header section can be read by the respective processing unit, which then independently selects the appropriate update package from the memory image. Thus, no different versions of the memory image need to be maintained.

[0019] This makes installation particularly easy for a technician. The technician doesn't have to first read the program version from the processor unit and then download the appropriate (differential) update and install it in the processor unit. Instead, the technician can directly download the memory image according to the invention and provide it to the processor unit. This eliminates a single work step.

[0020] The memory image can, for example, be developed and assembled on a developer computer and then forwarded to a central computing device, such as an update server. The update server can then distribute the memory image for integration into the respective computing units. Intermediate media, such as dedicated installation computers, can also be used for this purpose.

[0021] A method for updating the software of a computing unit using a memory image as described above provides, according to the invention, for carrying out the following method steps:

[0022] - Determination of the program version of the software stored on the computing unit by the computing unit;

[0023] - Providing the memory image on an update unit and establishing a communication connection between the computing unit and the update unit;

[0024] - Reading a header of the memory image, wherein the header describes the arrangement of the update packets in the memory image, and determining, depending on the arrangement read from the header and the program version, the part of the memory image to be transferred from the update unit to the computing unit, by the computing unit; and

[0025] - Transferring the relevant part of the memory image to the computing unit and executing the corresponding update package on the computing unit.

[0026] With the aid of the memory image according to the invention and the method according to the invention for updating the software of the computing unit, a particularly universal and simple update process for the software to be updated is ensured. The memory image can thus be used independently of the program version of the software to be updated stored on the computing unit, which guarantees universal and reliable implementation in the field. Each computing unit is independently capable of selecting the relevant part of the memory image, i.e., the update package applicable to the program version of the software stored on the respective computing unit, in order to update the program version of the software stored on the computing unit to the current program version.

[0027] The update unit can be a dedicated computer system, such as a system-on-a-chip (SoC), a mobile device such as a smartphone, tablet computer, laptop, or the like, a desktop computer, a server, or the like. The communication connection between the computing unit and the update unit can be wireless, for example via NFC, Bluetooth, Wi-Fi, or the like, or wired, for example via a USB cable, Ethernet cable, or the like. The update unit can also simply be a storage medium such as a flash memory, for example embodied as an SD card or USB stick. In this case, the communication connection is established by inserting the SD card or USB stick into a corresponding reading slot or socket of the computing unit.In order for the processing unit to read the header of the memory image, in the simplest case, the processing unit only needs read access to the memory image. The memory image can also be stored in its entirety, at least temporarily, on a computer-readable storage medium of the processing unit, such as an internal hard disk, solid state drive, RAM, or the like. However, this requires the complete memory image to be transferred to the processing unit, which leads to high utilization of a corresponding data line and memory space consumption of the processing unit's data memory. This approach can, however, be advantageous if the software version is switched between old and new versions several times, for example, during development.

[0028] Preferably, however, the complete memory image remains on the update unit, and the processing unit simply retrieves the update package corresponding to the respective program version from the update unit. If only the relevant part of the memory image is transferred to the processing unit, the load on the corresponding communication connection is reduced, thus freeing up resources for other functions. After the software to be updated has been successfully updated to the current program version, the complete memory image, or preferably the relevant part of the memory image transferred to the processing unit, can be deleted from the processing unit.

[0029] According to an advantageous embodiment of the method according to the invention, the software of an in-vehicle computing unit is updated. As already explained, vehicles are characterized by a particularly high degree of variant diversity in the form of different computing units and different program versions stored on the respective computing units. Thus, the method according to the invention is particularly suitable for implementing updates on the computing units of vehicles.

[0030] A further advantageous embodiment of the method according to the invention further provides that one of the following communication protocols is used for the communication between the computing unit and the updating unit:

[0031] - Hypertext T ransfer Protocol;

[0032] - Hypertext T ransfer Protocol Secure; or

[0033] - Unified Diagnostic Services.

[0034] These protocols are used as standard by a large number of computing units in vehicles, which simplifies the applicability of the method according to the invention in the automotive sector and ensures broad applicability.

[0035] When using Hypertext Transfer Protocol (http) or Hypertext Transfer Protocol Secure (https), the data transfer is aborted after the processing unit reads the header and resumes at the location determined by the processing unit, depending on the program version and the order of the update packages in the memory image read from the header. The use of https is particularly preferred due to the additional cryptographic security mechanisms. This makes it more difficult for attackers to manipulate the memory image or the processing unit, thus improving cybersecurity.

[0036] When using Unified Diagnostic Services (UDS), the transmission is not simply aborted, but is sometimes completely omitted. Instead, the processing unit informs the update unit which part of the data should be sent, i.e., where the update unit needs to continue reading to transfer to the relevant part of the memory image. For this purpose, a so-called flash abort can be sent from the processing unit to the update unit, followed by the triggering of a so-called "resume mechanism." This is particularly useful when an update packet located very far back in the memory image is to be transmitted, as it eliminates the unnecessary transmission of irrelevant data.

[0037] According to a further advantageous embodiment of the method according to the invention, a tester is used as the update unit. The tester is often also referred to as a so-called diagnostic tester. This is a special mobile device used to read and influence computing units that can be contacted via UDS, such as vehicle control units. For example, the complete memory image is distributed from an update server to the tester, and only the relevant part of the memory image is then distributed to the individual computing units via the tester.

[0038] A further advantageous embodiment of the method according to the invention further provides that at least the relevant part of the memory image is transmitted wirelessly from a central computing device to the computing unit. As already mentioned, the complete memory image can be distributed from a corresponding update server to individual testers, and then the relevant part can be transmitted to the computing units. However, this typically requires the vehicle user to visit a workshop where such a tester is available. The data transmission then takes place via a cable. This involves increased effort for the user.

[0039] Preferably, at least the relevant portion of the memory image can also be distributed directly from the update server to the respective computing units. For this purpose, a telecommunications unit can be installed in the respective vehicles, allowing the in-vehicle computer network to be connected to the Internet via mobile radio, allowing corresponding memory images, or portions thereof, to be retrieved from the central computing unit. In this case, the central computing unit or the telecommunications unit forms the update unit.

[0040] Further advantageous embodiments of the memory image according to the invention and of the method according to the invention for updating the software of a computing unit using such a memory image also emerge from the exemplary embodiments, which are described in more detail below with reference to the figures.

[0041] Fig. 1 is a schematic representation of a memory image according to the invention; and

[0042] Fig. 2 shows a schematic flow of a method according to the invention for installing a software update contained in the memory image on a computing unit.

[0043] Figure 1 shows a memory image 1 according to the invention, comprising a header 1.1 and a payload 1.2 appended thereto. The header 1.1 contains supplementary information about the information contained in the payload 1.2, such as the number and arrangement of update packets 2 contained in the payload 1.2.

[0044] The memory image 1 shown in Figure 1, usually referred to as an “image,” allows the universal updating of software 3 stored on a computing unit 4 shown in Figure 2. For example, the respective software 3 is available in the current program version “1.n.”

[0045] The original version of Software 3 is referred to here as "1.0" purely for illustrative purposes. The version numbers used are purely illustrative, so version 1.0 does not necessarily correspond to a final release version of Software 3, but could also correspond to an early beta or even alpha version. Such a version is commonly referred to as 0.x, where x can be any number.

[0046] With the help of the memory image 1, it is possible to update any outdated program version of the corresponding software 3 to the respective current program version 1.n. ​​For this purpose, the memory image 1 can contain a suitable update package 2 for each program version of the software 3. At a minimum, the memory image 1 contains a so-called full update package 2. FULL, which contains the complete program code of the software 3 to be updated in the current program version, and at least one differential update package 2. DI FF, which contains a subset of the program code of the software 3 to be updated, wherein the subset corresponds exactly to the changes required to update an older program version of the software 3 to be updated to a newer version of the software 3 to be updated.Figure 1 shows a particular embodiment of the memory image 1 according to the invention, which contains a suitable update package 2 for each previous program version of the software 3. In addition, the update packages 2 are ordered according to the program version of the software 3 to which they are to be applied. For example, the current program version corresponds, as already mentioned, to version 1.n. ​​The respective previous versions can be referred to as: 1.ni, where i starts from 1. The last update package 2 is formed by the full update package 2.VOLL. This contains the complete program code of the software 3 to be updated, which allows a complete reinstallation of the program 3 in the current program version. As Figure 1 suggests, the size of the respective update packages 2 constantly increases with increasing distance from the current program version.This results from the fact that updating older program versions requires more and more changes, so corresponding update packages 2 also contain more lines of program code. In individual cases, changes could also be reverted to newer program versions, so it cannot be ruled out that a differential update package 2.DI FF for a newer program version could be larger than a differential update package 2.DIFF for an older program version (not shown).

[0047] Figure 2 illustrates the sequence of a method according to the invention for updating the software 3 of the computing unit 4 by means of such a memory image 1.

[0048] In a method step 201, the computing unit 4 determines the program version of the software 3 stored on the computing unit 4.

[0049] In a method step 202, the memory image 1 is provided on an update unit 5, and a communication connection 6 is established between the computing unit 4 and the update unit 5. The update unit 5 can be, for example, a so-called diagnostic tester. The update unit 5 can have previously obtained the memory image 1 from a central computing device, such as an update server. The corresponding update server could also directly form the update unit 5 (not shown), wherein a telecommunications unit can optionally be interposed. The communication connection 6 uses, in particular, http, https, or UDS as the communication protocol. In a method step 203, the computing unit 4 reads the header section 1.1 of the memory image 1. The computing unit 4 then determines, depending on the information from the header section 1.1 read information and the program version of the software 3 determined by the computing unit 4, the part of the memory image 1 to be transferred.

[0050] In the subsequent method step 204, the relevant part of the memory image 1, i.e. the part of the memory image 1 to be transferred determined by the computing unit 4 in the previous method step, is then transferred to the computing unit 4 and executed on the computing unit 4 to update the software 3.

[0051] Particularly preferably, it is an internal vehicle computing unit 4.

[0052] Particularly in the automotive environment, there is a high diversity of differently configured computing units 4 and different program versions of the software 3 stored thereon. Thus, the method according to the invention is particularly suitable here for universally enabling the simple and rapid installation of software updates. Thus, not all update packages 2 need to be transferred from the update unit 5 to the computing unit 4, but only the actually executable update package 2, which is indicated by hatching in Figure 2.

Claims

Patent claims 1. Memory image (1) of a software update, comprising at least two update packages (2) applicable to different program versions in a payload part (1.2), characterized in that a full update package (2. FULL) contains the complete program code of the software (3) to be updated in the current program version and at least one differential update package (2. DIFF) contains a subset of the program code of the software (3) to be updated, wherein the subset corresponds exactly to the changes required to update an older program version of the software (3) to be updated to a newer version of the software (3) to be updated.

2. Memory image (1) according to claim 1, characterized in that at least one difference update package (2. DIFF) contains suitable program code parts for updating a program version immediately preceding the current program version to the current program version.

3. Memory image (1) according to claim 1 or 2, characterized in that the update packages (2) in the payload part (1.2) are arranged according to the program version of the software (3) to be updated to which they are respectively applicable.

4. Memory image (1) according to claim 3, characterized in that a header (1.1) is followed by the differential update packet (2. DIFF) suitable for updating the program version immediately preceding the current program version, and the full update packet (2. FULL) forms the last update packet (2).

5. Memory image (1) according to one of claims 1 to 4, characterized in that differential update packages (2. DIFF) are included for all program versions preceding the current program version.

6. Method for updating the software (3) of a computing unit (4) by means of a memory image (1) according to one of claims 1 to 5, characterized by the following method steps: - Determining the program version of the software (3) stored on the computing unit (4) by the computing unit (4); - Providing the memory image (1) on an update unit (5) and establishing a communication connection (6) between the computing unit (4) and the update unit (5); - reading a header (1.1) of the memory image (1), wherein the header (1.1) describes the arrangement of the update packets (2) in the memory image (1), and determining, depending on the arrangement read from the header (1.1) and the program version, the part of the memory image (1) to be transferred from the update unit (5) to the computing unit (4), by the computing unit (4); and - Transferring the relevant part of the memory image (1) to the computing unit (4) and executing the corresponding update package (2) on the computing unit (4).

7. Method according to claim 6, characterized in that the software (3) of an internal vehicle computing unit (4) is updated.

8. Method according to claim 6 or 7, characterized in that one of the following communication protocols is used for the communication between the computing unit (4) and the updating unit (5): - Hypertext T ransfer Protocol; - Hypertext T ransfer Protocol Secure; or - Unified Diagnostic Services.

9. Method according to claim 8, characterized in that a tester is used as the updating unit (5).

10. Method according to one of claims 6 to 8, characterized in that at least the relevant part of the memory image (1) is transmitted wirelessly from a central computing device to the computing unit (4).

Images