Vehicle Processor State Control After Failed Remote Software Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Failed remote software updates in vehicle assistance systems can lead to safety risks due to the potential execution of faulty software, as existing solutions may not effectively block or prevent the operation of assistance functions.
Innovation Solution
A processor system comprising a machine state manager, execution manager, and safety module for remote software updates, which receives a degradation signal to change the system state and prevent execution of certain processes, ensuring only allowed processes are started, with a watchdog monitoring for compliance via a heartbeat mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If remote software update is implemented, then system functionality is improved, but safety risks arise if the update fails and faulty software is executed
Solution Approach 1:
The patent implements preliminary safety checks before allowing software execution. The safety module proactively monitors the software update process and identifies failed updates before they can compromise system safety. By performing preliminary verification of software integrity and update status, the system prevents faulty software from being executed, thereby maintaining both update capability and safety.
Solution Approach 2:
The patent establishes a feedback mechanism where the safety module continuously monitors the state of assistance functions and software update status. When a degradation signal indicating a failed update is detected, the safety module provides feedback to the execution manager to prevent execution of affected functions. This closed-loop feedback ensures that safety risks from faulty software are continuously managed while preserving beneficial update capabilities.
Data Source
AI summary
A processor system for a vehicle, in particular a motor vehicle. The processor system includes a state manager module designed to manage states with respect to processes; an execution manager module designed to output instructions for starting and stopping the processes; and a safety module for remote software updates, said safety module being designed to receive an error signal which indicates an erroneous remote software update. In response to receiving the error signal, the safety module is designed to: output instructions to the state manager module, said instructions ordering a changeover to a specified state, wherein at least one process is not allowed to be executed in the specified state; receive a process list with processes which have been started from the execution manager module; and output an abort signal in order to stop the at least one process if the process list comprises the at least one process.