Method for updating a controller

Abstract

The invention relates to a method for updating a controller of a vehicle, wherein the vehicle comprises a connectivity control unit which is connected to the controller, wherein a smartphone connected to the connectivity control unit receives an update packet, the update packet is divided into a plurality of sub-packets by the smartphone, the sub-packets are transmitted to the connectivity control unit, and the controller is updated on the basis of the sub-packets. The invention additionally relates to a device which is configured to establish a connection to a smartphone, to receive sub-packets transmitted from the smartphone, to create bus messages on the basis of the sub-packets, and to send the bus messages to a controller such that the controller is updated.

Description

[0001] R. 401153

[0002] - 1 -

[0003] Description

[0004] title

[0005] Procedure for updating a control unit

[0006] The present invention relates to a method for updating a control unit, in particular of a vehicle, and to a device provided for this purpose.

[0007] State of the art

[0008] Wireless software updates via mobile networks, known as over-the-air (OTA) updates, are a well-established technology. For example, control units in vehicles can be updated by a backend system. This typically uses a connectivity unit installed in the vehicle, such as an LTE modem.

[0009] If the connectivity unit does not have an integrated modem, a smartphone can be used as a connection to the backend if the connectivity unit can be connected to the smartphone via Bluetooth or cable.

[0010] If multiple control units are present in a vehicle, they are often connected via a bus system, such as CAN, allowing them to exchange messages. The control units can be programmed using diagnostic protocols such as UDS or KWP2000.

[0011] The methods known from the prior art, which provide for a software update to be received by the connectivity unit and forwarded to the control unit to be updated, presuppose that the connectivity unit has sufficient capacity for this purpose. For example, R. 401153

[0012] - 2 -

[0013] Software updates can be temporarily stored by the connectivity unit before being forwarded to the control unit to be updated. However, especially in the case of low-cost vehicles, and particularly in the case of two-wheelers or powersports equipment such as jet skis, the resources of the connectivity unit are insufficient to fully store software updates. Furthermore, for cost reasons, such vehicles often lack a dedicated modem.

[0014] Disclosure of the invention

[0015] The inventive method for updating a vehicle's control unit, wherein the vehicle comprises a Connectivity Control Unit (CCU) that communicates with the CCU, has the advantage that a smartphone connected to the CCU receives an update package, the smartphone splits the update package into several sub-packages, the sub-packages are transmitted to the CCU, and the CCU is updated based on these sub-packages. Thus, even large update packages can be forwarded to a control unit to be updated by a Connectivity Control Unit with only limited resources, such as storage capacity. The vehicle can be, in particular, a small car, a motorcycle, a quad bike, a jet ski, a snowmobile, or other powersports vehicles.

[0016] It is advantageous if the sub-packets are transmitted sequentially to the Connectivity Control Unit and processed there one after the other. It is particularly advantageous if only one sub-packet is cached in the Connectivity Control Unit at any given time. This allows for consideration of potentially limited storage space on the Connectivity Control Unit.

[0017] It is advantageous if the processing of the partial packages includes a security check. This ensures that the partial packages only require software updates that cannot compromise the vehicle's security. In particular, it can be verified whether the partial packages are unchanged. The security check can, in particular, be performed using calculation R. 401153.

[0018] - 3 - include a checksum, for example a CMAC, which is compared with a reference value that is also transmitted.

[0019] It is advantageous if, starting from the sub-packets, a bus message is created for each and transmitted to the control unit via a communication bus, with the bus message containing the update content of the sub-packets. In particular, the communication bus can be a CAN bus and the bus message a CAN message, especially a UDS message. The bus message can contain the update content, i.e., parts of software code to be made available to the control unit being updated, as a payload.

[0020] It is advantageous if the control unit is updated by installing the update content transmitted to the control unit via bus messages.

[0021] It is advantageous if the smartphone includes an update package interpreter that creates sub-packages based on the update package.

[0022] It is also advantageous to have a device configured to establish a connection with a smartphone, to receive partial packets transmitted by the smartphone, and to create bus messages from the partial packets and send the bus messages to a control unit so that the control unit is updated, especially if the device is further configured to perform a security check of the partial packets.

[0023] The functionalities typically found in a so-called FOTA master can be distributed across multiple computing units by the inventive method and its advantageous further developments. The FOTA master, which is typically designed as a software block, is advantageously divided into several functional blocks, which can then be executed on the various computing units involved in the update process. These functional blocks advantageously include an Update Coordinator, an Update Package Interpreter, a Security Handler, and a UDS Handler. R. 401153

[0024] - 4 -

[0025] The Update Coordinator is advantageously the central (software) unit of the update process. Its task is to put the control unit to be updated into a programmable state (boot mode), request authorization (security access), synchronize the transfer of a programming sequence (source code), and finally ensure a restart of the control unit.

[0026] The update package is usually stored in a description language such as XML. The XML file contains control commands, metadata, and the actual source code. Ideally, the Update Package Interpreter's task is to extract this information and make it available to the Update Coordinator.

[0027] The security handler is advantageously responsible for activating a programming mode of the control unit to be updated. It contains, for example, the necessary information for calculating an activation key. Typically, a seed and key method can be used for this purpose. The security handler must therefore be separately protected against unauthorized access.

[0028] The UDS handler is advantageously responsible for communication on a vehicle's onboard network (CAN, Ethernet). Its task is then to package the commands of the Update Coordinator into a UDS message and make it available to a communication stack (CAN / Ethernet driver).

[0029] The method according to the invention and its advantageous embodiments make it possible, in particular, to split the functionality of a FOTA master into that of the update coordinator, the update package interpreter, the security handler, and the UDS handler, thus enabling a resource-optimized distribution of these functionalities across different computing units. A further advantage is that boundary conditions such as various security aspects, for example, an increased need for tamper protection for individual functionalities, can be taken into account.

[0030] A particularly advantageous first alternative distribution of the various functionalities across a system that includes multiple computing units, especially an R. 401153

[0031] - 5 -

[0032] The backend comprises a smartphone, a connectivity control unit, and a control unit, wherein the backend is connected to the smartphone via a long-range radio connection – such as LTE – the smartphone is connected to the connectivity control unit via a short-range radio connection – such as Bluetooth – and the connectivity control unit is connected to the control unit via a message bus – such as a CAN bus.

[0033] The first alternative distribution of functionalities can involve implementing the Update Coordinator, the Update Package Interpreter, the Security Handler, and the UDS Handler on the Connectivity Control Unit. The smartphone can then establish a connection to the backend and receive an update package from there, even if there is no connection to the Connectivity Control Unit at that time. The update package can then be transmitted to the Connectivity Control Unit at a later time, which is particularly advantageous if the Connectivity Control Unit has sufficient storage capacity.

[0034] A second alternative distribution of functionalities involves implementing the Update Coordinator, the Update Package Interpreter, and the Security Handler on the backend. The UDS Handler is then implemented on the Connectivity Control Unit. This distribution is particularly advantageous if the Connectivity Control Unit has very limited memory and is connected to the smartphone via a low-bandwidth connection, such as Bluetooth Low Energy (BLE).

[0035] An embodiment of the present invention will now be explained in more detail with reference to the accompanying drawing. The drawing shows:

[0036] Brief description of the drawing

[0037] Fig. 1 shows a schematic representation of the distribution of update functionalities across multiple computing units in connection with an update of a vehicle's control unit;

[0038] embodiment of the invention R. 401153

[0039] - 6 -

[0040] Figure 1 shows a schematic representation of the distribution of update functionalities across multiple processing units in connection with an update of a control unit (40) of a vehicle (100). In addition to the control unit (40), the vehicle (100) also includes a Connectivity Control Unit (30). The Connectivity Control Unit (30) communicates with the control unit (40) via a message bus, for example, a CAN bus, and can thus transmit bus messages, representing sub-packets of an update package, to the control unit (40).

[0041] The Connectivity Control Unit (30) is connected to a smartphone (20). The smartphone (20) is advantageously associated with the vehicle (100), for example, by a vehicle owner or user having previously activated and established a connection between the vehicle (100) and the smartphone (20). The smartphone (20) is connected to a backend (10). The backend can be, for example, the internet or the cloud.

[0042] An update package interpreter (12) is implemented on the smartphone (20). The update package interpreter can, in particular, be software installed on the smartphone (20). An update coordinator (14), a security handler (16), and a UDS handler (18), preferably in software, are implemented on the connectivity control unit (30).

[0043] In an advantageous embodiment of the method according to the invention, an update package, i.e., a package comprising a software update for the control unit (40) of the vehicle (100), is transferred to the smartphone (20) and fully cached there. The Update Package Interpreter (12) forms several sub-packages from the update package and transfers these to the Connectivity Control Unit (30) of the vehicle (100). Advantageously, the transfer is sequential, so that the sub-packages are transferred one after the other and only one sub-package at a time needs to be processed by the Connectivity Control Unit (30). The processing in the Connectivity Control Unit (30) includes a security check by the Security Handler (16) and the provision of the sub-package in the form of a UDS message by the UDS Handler (18). The UDS message, which represents the sub-package, is sent to the control unit (40).

[0044] - 7 - transferred, so that the software contained in the UDS message and previously in the subpackage is installed on the control unit (40). The Update Coordinator (14) performs preparatory tasks beforehand, such as putting the control unit (40) into a programmable state.

[0045] By sequentially transferring the sub-packages to the Connectivity Control Unit (30) and subsequently in the form of UDS messages to the control unit (40), the control unit (40) is updated with the software from the update package without intermediate storage of the complete update package within the vehicle (100).

[0046] The presented embodiment of the method according to the invention thus enables a flexible update process for control units in vehicles with only limited resources in the Connectivity Control Unit.

Claims

R. 401153 - 8 - Claims 1. Method for updating a control unit of a vehicle, wherein the vehicle comprises a Connectivity Control Unit which is connected to the control unit, characterized in that a smartphone connected to the Connectivity Control Unit receives an update package, the update package is split by the smartphone into several sub-packages, the sub-packages are transmitted to the Connectivity Control Unit and the control unit is updated based on the sub-packages.

2. Method according to claim 1, characterized in that the sub-packets are transmitted sequentially to the Connectivity Control Unit and processed one after the other.

3. Method according to claim 2, characterized in that the processing of the sub-packets includes a security check.

4. Method according to claim 2 or 3, characterized in that, starting from the sub-packets, a bus message is created for each and transmitted to the control unit via a communication bus, wherein the bus messages include update contents of the sub-packets.

5. Method according to claim 4, characterized in that the update of the control unit is carried out by installing the update content transmitted to the control unit via the bus messages.

6. Method according to one of the preceding claims, characterized in that the smartphone comprises an Update Package Interpreter which creates the sub-packages starting from the update package.

7. Device configured to establish a connection with a smartphone, to receive partial packets transmitted by the smartphone, and to send and receive partial packets from the smartphone. R. 401153 - 9 - To create bus messages from sub-packets and send the bus messages to a control unit so that the control unit is updated.

8. Device according to claim 7, further configured to perform a security check of the sub-packages.

Images