Vehicle ECU Dual-Memory OTA Updates With Immediate Rollback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing over-the-air (OTA) software update methods for vehicle control units are complex and risky, particularly due to the potential for software corruption during updates, which can render vehicles unavailable and pose safety risks, and existing rollback mechanisms are inefficient, increasing the risk of failure.
Innovation Solution
Implementing a dual-memory system in vehicle ECUs with a segregated execution and backup memory area, allowing for immediate rollback by switching a pointer to the backup memory in case of update failure, ensuring uninterrupted vehicle operation and enhanced security by preventing data corruption during the rollback phase.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single memory area is used for software updates, then the update process is simpler, but the risk of data corruption and vehicle unavailability increases
Solution Approach 1:
The memory is divided into two separate areas: a first memory area for storing current software and a second memory area for storing updated software. This segmentation allows the system to maintain the current working software while simultaneously receiving and validating updated software, eliminating the risk that update corruption will affect the running system. The pointer mechanism selectively activates either the first or second memory area based on update success.
Solution Approach 2:
The updated software is completely written to the second memory area before any activation occurs. The system performs integrity verification on the updated software in the second memory area before switching the pointer. This preliminary completion and verification approach ensures that if the update fails or is corrupted, the original software in the first memory area remains intact and can continue to execute.
2Adaptability or versatility
If rollback mechanisms are implemented with software block generation and verification, then update recovery is possible, but the rollback failure risk and process complexity increase
Solution Approach 1:
The system creates a complete copy of the updated software in the second memory area before activation. This full copy approach eliminates the need for complex block-by-block verification and regeneration during rollback. The pointer simply switches between the first memory area (original software) and the second memory area (updated software), providing a reliable and simple rollback mechanism that avoids the pitfalls of partial updates and block verification failures.
3Reliability
If the update process is interrupted for integrity verification, then data corruption is prevented, but the update time increases
Solution Approach 1:
The system performs integrity verification on the updated software in the second memory area before activating it by switching the pointer. This preliminary verification approach allows the update to proceed efficiently without repeated interruptions during activation. The full updated software is written and verified upfront, and if it passes verification, the switch is immediate and seamless.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for installing a software update of an on-board computer of a vehicle, comprising a memory including a first zone in which current software is stored, a second zone and a pointer indicating to the computer which instructions to execute, the method comprising steps of: - issuing (311) a request to delete the second zone, - determining (312) whether the update is partial, and if this is the case: - issuing (313') a request to copy the current software from the first zone to the second zone, - issuing (316) a request to partially delete the second memory zone, - issuing (317) a request to write the update in the second memory zone, so as to obtain updated software, - issuing (315) a request to activate the updated software.