Vehicle Software Update Device Validity Confirmation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software update systems for vehicle electronic control units (ECUs) face challenges in maintaining a valid and up-to-date state when a software update campaign is canceled after data has been downloaded, leading to potential installation of invalid updates.
Innovation Solution
A software update device and method that includes a server and in-vehicle network system, which verifies the validity of update data before installation and activation, ensuring that only valid updates are applied by using a dual data storage approach in ECUs and multiple validity confirmations with the server to prevent installation of canceled campaign data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the vehicle downloads update data and then performs installation and activation after a lapse of time, then the update process can be flexible and not continuous, but the software update campaign may be canceled during this period, leading to installation of invalid update data
Solution Approach 1:
The system performs preliminary validity confirmation of the software update campaign at multiple stages: initially when the vehicle requests update data, again when the update data is received, and finally before installation. This preliminary checking mechanism ensures that even if the campaign is canceled during the update process, invalid update data will not be installed, thus maintaining reliability while allowing flexible timing.
Solution Approach 2:
The system implements feedback loops where the vehicle continuously communicates with the server to confirm campaign validity. The server provides feedback on whether the campaign is still active at each critical stage, and based on this feedback, the vehicle decides whether to proceed with installation. This feedback mechanism resolves the contradiction by ensuring reliability through continuous validation while maintaining operational flexibility.
2Reliability
If multiple validity confirmations are performed with the server during the update process, then the reliability of update data is improved, but the communication overhead and time required for the update process increases
Solution Approach 1:
The system performs validity confirmations at predetermined critical points (when requesting update data, when receiving update data, and before installation) rather than continuously. This preliminary action approach ensures reliability at key decision points while avoiding excessive communication overhead, thus balancing reliability with time efficiency.
3Productivity
If the update data is installed immediately after downloading, then the update process is continuous and efficient, but there is no time to check campaign validity again, risking installation of canceled campaign data
Solution Approach 1:
The system performs the final validity confirmation as a preliminary action before installation occurs. This ensures that the update process remains efficient with minimal delay, while still maintaining reliability by confirming campaign validity at the critical moment just before installation. The confirmation is done quickly using cached information from the server.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A software update device (11) configured to control software update of an electronic control unit (13a, 13b, 13c, 13d) mounted on a vehicle, the software update device (11) includes one or more processors configured: to download update data of software of the electronic control unit (13a, 13b, 13c, 13d) from a server (1); to transmit a validity confirmation request for confirming whether the update data is valid to the server (1) before the update data is installed, to receive a confirmation result indicating whether the update data is valid from the server (1); to control the software update of the electronic control unit (13a, 13b, 13c, 13d); and not to install the update data when the one or more processors determine that the update data is invalid based on the confirmation result received by the one or more processors.