DE102017201467A1 - Updating a software scope of a means of transport - Google Patents

Abstract

A control device, a means of transportation and a method for updating a software scope of a means of transportation are proposed. The method comprises the steps of: receiving and checking a data set received from a first control device (1) of the means of locomotion in the first control device (1), adapting or reinserting a coding or software of a second control device (2) by means of the data set by the first control device (1 ) or a third control device (4), outputting a request (13) by the first control device (1) or the third control device (4) to the second control device (2), and receiving and checking a response (14) to the request ( 13) by the second control unit (2) based on a predefined reference.

Description

The present invention relates to a control device, a means of transportation and a method for updating a software scope of a means of transportation. In particular, the present invention relates to updates ASIL A-D relevant software scopes in means of locomotion. Modern means of transport have considerable amounts of data, which are sometimes to change or supplement when components for security purposes or functional additions and bug fixes are to be updated. Nowadays, it is only possible / permitted to carry out vehicle programming of safety-relevant (ASIL-relevant) scopes in controlled environments (eg authorized specialist workshop). Only non-safety-critical scopes can currently be programmed / updated via a corresponding back-end in a vehicle on the road. A disadvantage of the above-mentioned prior art is that updates of the software at safety-relevant / ASIL-relevant scopes may only be carried out under controlled conditions. In particular, purposeful computing machines / laptops are to be used and a cable connection (eg via an OBD socket) must be established for data transmission. Thus, no functional improvements of ASIL-relevant functions over an available back-end are possible. If security holes have become known in existing vehicles, callbacks must be organized, which is complicated and expensive. In addition, it is not possible to load new functionalities that are ASIL-relevant into a vehicle. Thus, it is also not possible for the customer to subsequently increase the scope of optional extras for security-relevant / ASIL-relevant functions. B. in the driver assistance area. If safety-relevant volumes are to be loaded into vehicles on the road via a back-end, the E / E infrastructure of the entire vehicle would have to be ASIL-capable, which is very complicated and expensive. It is an object of the present invention to meet the above need.

The above object is achieved by a method for updating a software scope of a means of transport according to the invention. The scope of software may represent an update and / or an upgrade. The means of transport can be designed as a car, van, truck, motorcycle, air and / or watercraft. For example, a corresponding data record can preferably be played in a first control device of the means of locomotion via a back-end. In other words, the data set is downloaded from the back end by a first control device of the means of locomotion. The data record represents a programming job, which can be checked by the first controller first for completeness and integrity. The data record can be designed as a data packet for updating a control device or a plurality of control devices. It can access the first or second controller from a local data memory (e.g., a USB stick, a smartphone, or the like) via a wired or wireless information channel. Subsequently, a coding or software of a second control unit is adapted or newly introduced by means of the data set by the first control unit. In other words, the first control unit, which is permanently installed in the means of locomotion (that is, no coding / update computer), defines scopes defined in the data record in a second control unit. The second control unit is thus programmed via the first control unit. The software / coding previously present in the second control unit is therefore flashed / overwritten by means of the data record in the first control unit. Then the actual update / flash process is finished. In order to ensure that the function of the second control device is properly ensured in accordance with the second data set, a request is subsequently issued by the first control device to the second control device. Its purpose is to check whether the functional scope of the second control unit has been produced as planned. For example. can the first controller output the second controller for outputting certain information (eg which software version do you have?) and / or perform predefined functional scopes (eg output the sensor value XY, calculate the result of the following formula o. Ä.). Subsequently, a response to the request by the second control device is received by the first control device and checked on the basis of a predefined reference (eg based on a data set stored in the first control device, which has been created in particular via an ASIL-compliant process). If the response is received and tested positive, it can be assumed that the update of the coding / software of the second control unit has been successful and the security-relevant / ASIL-relevant scope is working properly. As a result, an ASIL compliant update of the second control device is ensured. Since such operations can be carried out outside of specialized workshops and in particular carried out by the customer / user of the means of transport, costly workshop visits and time-consuming appointments can be omitted. In this way costs can be saved and thus smaller updates / improvements can be made, which would otherwise lead to disproportionate expenses.

The dependent claims show preferred developments of the invention.

Preferably, the assurance of the proper functioning of the second control device can be checked by issuing a plurality of requests by the first control device to the second control device. For example. may ask more questions like "What is the line X of your code?" or "Give me a response to the sensor value Y". Subsequently, the replies to the requests are received by the second controller and checked using predefined references. Only in the case of a plurality of responses that are 100% identical to the predefined references will the update of the second controller be considered successful, otherwise it will be categorized as failed.

The first control unit and the second control unit can, for example, be connected to one another via a bus system in terms of information technology. The bus system can be a CAN bus, CAN FD, an optical bus (MOST), a FlexRay bus and / or an Ethernet. It will be apparent to those skilled in the art that a plurality of controllers in accordance with the invention can be provided by the first controller with a new coding / software in this way.

In order to reduce the likelihood of failed updating or programming / control of the second controller, the presence of predefined constraints on the coding / software locomotive may be checked first. For example. can be checked whether the means of locomotion is, a predefined gear is engaged, a predefined terminal status prevails, a user authorization request has been positive and a braking system of the means of transport prevents unintentional rolling of the means of locomotion. Only in response to the positive check for the presence of the predefined boundary conditions, the first controller may begin with the coding / programming of the second controller. This takes place in particular under conditions which ensure a low utilization of the data transport medium used between the first control device and the second control device. In this way, a particularly reliable and rapid Bedatung the second control device can be ensured.

The coding or the software can represent an update and / or a function increase and / or a safety measure. Correspondingly, the coding / software can be linked as a free bug fix or as a chargeable function increase to the prior confirmation or payment of a predefined range of functions.

In order not to impair the traffic safety of the present invention updated means of transport, in the event that the adaptation of the coding / software has failed, a limitation of the functional scope of the means of transport can be carried out automatically. For example. can be prevented that the means of transport are started, driven and / or a brake system is released. In this way, therefore, the participation of the means of transport on the road or even the mobility of the means of transport per se is prevented until the second controller is working properly.

According to a second aspect of the present invention, a control device for a means of transportation (eg, a car, van, truck, motorcycle, air and / or water vehicle) is proposed. The control unit can also be understood as a composite of a plurality of control unit, which are linked by information technology, for example via a bus system or own lines. The control device comprises an information interface (eg a bus, a proprietary data connection), a data memory (eg a flash memory, in particular a RAM) and an evaluation unit which, for example, as a programmable processor, microcontroller or the like. can be designed. The evaluation unit is set up to receive and check a data record. In other words, the programming job to adapt the coding / programming of the second controller is checked. By means of the data set, the evaluation unit is also set up to adapt the coding or software of the second control unit. This represents the actual flash process / coding or update / upgrade. By means of the information interface, the evaluation unit is set up to issue a request to the second control device in order to check the proper functioning of the second control device. Predefined queries may, upon proper operation of the second controller, result in the receipt of an answer to the request and be checked against in the data store of predefined references. The predefined reference may be obtained, for example, along with the record / program order (e.g., from a back-end server). In this way, the control unit according to the invention is set up to carry out a method according to the first aspect of the invention. In particular, the control unit according to the invention or the combination of control units is set up to participate in a method according to the first aspect of the invention as the first control unit and / or the third control unit. The features, combinations of features and the advantages resulting from these correspond so clearly to those of the method according to the invention that reference is made to avoid repetition of the above statements.

According to a third aspect of the present invention, a means of transportation is proposed which, for example, is designed as a passenger car, van, truck, motorcycle, aircraft and / or watercraft. The means of locomotion comprises a control device according to the second-mentioned aspect of the invention as the first control device and is thus configured to carry out the coding / programming according to the invention of a second control device permanently installed in the means of locomotion according to the invention. Also with respect to the means of locomotion, the features, combinations of features and advantages arise in a corresponding manner.

While in the prior art dedicated computers and test steps for verifying the proper coding / programming of a built-in locomotion control device are required, the end-to-end protection with a confirmation by "hash" values within the means of transport by a master controller and a to be updated (slave) controller executed. For example, a so-called Media Graphic Unit (also: "MGU") can be used as the first control device. After updating the further control unit with an ASIL-relevant functional scope / software package, the MGU or a third control unit (eg the body domain controller) checks by means of questions and answers and / or by checking the response with the updated control unit whether the flash operation is successful was and the functionality is guaranteed as expected.

According to the invention, callbacks in the event of known security vulnerabilities can be avoided by SW (software) updates. Vehicles can be kept up-to-date in all areas (including safety-relevant / ASIL-related scopes) over the age of the vehicle. New functionalities that are relevant to safety / ASIL can be brought into the existing vehicle by a customer request / order. All this is possible via a back-end connection. Controlled environments are no longer necessary. In addition, there is no ASIL distribution in the vehicle. This means that the vehicle E / E infrastructure does not need to be equipped with better hardware and more sophisticated software, which would increase costs. It suffices that the software which is to be programmed / flashed (including the "checker software" according to the invention) corresponds to the required ASIL level. This software can be handed over to the backend as a "secured package". The invention describes a method that allows such functionality (via a back-end security-relevant software to flash in existing vehicles).

• 1 eine schematische Darstellung eines Ausführungsbeispiels eines erfindungsgemäßen Steuergerätes in einem Ausführungsbeispiel eines erfindungsgemäßen Fortbewegungsmittel bei der Ausführung eines erfindungsgemäßen Verfahrens; und
• 2 eine schematische Übersicht über den Informationsfluss bei der Ausführung eines erfindungsgemäßen Verfahrens.

Further details, features and advantages of the invention will become apparent from the following description and the figures. Show it:

• 1 a schematic representation of an embodiment of a control device according to the invention in an embodiment of a means of transport according to the invention in the execution of a method according to the invention; and
• 2 a schematic overview of the flow of information in the execution of a method according to the invention.

1 shows a car 10 as a means of transport according to the invention, which is a second control unit to be updated 2 and a third controller to be updated 4 having. These are over a bus 3 with a first inventively designed control device 1 linked in terms of information technology. The first controller 1 has a data store 5 and an information technology associated with this evaluation 9 on. The first controller 1 is information technology further with an antenna 6 connected, which is set up by a back-end 7 secured data packets via a transmission tower 8th to receive a terrestrial mobile network. About the transmission tower 8th can the car 10 Also, the need to be communicated, the second controller 2 and the third controller 4 to update. Corresponding need can, for example, in the occurrence of security vulnerabilities, the availability of functional increases (fee or charge) o. Ä. from a manufacturer of the car 10 be communicated.

2 shows an MGU 1 as the first control unit, in their data memory 5 four data packets D1 . D2 . D3 . D4 stored and for updating a second control unit 2 and a third control device 4 are provided. interfaces 11a . 11b . 11c . 12a . 12b . 12c are provided according to the state of the art for signal flow path monitoring and provide a mechanism of interface monitoring. About the interfaces is a flow monitoring in accordance with a possibly existing. Flash rule, whereby a "coded processing" (English: "coded-processing") is performed , About the interfaces 12a . 12c arrive after the coding of the second control unit 2 and the third control device 4 Requests 13 over the bus 3 to the control units 2 . 4 , which evaluate the requests and corresponding answers 14 back to the MGU 1 send. Unless the answers 14 are in the datastore 5 saved references, causes the MGU 1 via another data interface 18 a fixing of the means of transport, until a proper programming of the second control unit 2 and the third control device 4 ensured is. For example, a body domain controller (BDC), a digital engine electronics (DME) and / or a brake control unit (DSC) may be used by the MGU 1 be controlled to prevent starting the engine, releasing a brake or allowing a trip of the means of locomotion.

• • Es wird eine redundante Möglichkeit zur Signallaufwegabschaltung bereitgestellt.
• • Es werden inkompatible Schnittstellen durch ein unterschiedliches Schnittstellendesign vorgeschlagen.
• • Vorzugsweise wird der Flash-Vorgang geregelt, da die Flash-Vorschrift sicherheitsrelevant ist.
• • Bevorzugt wird lediglich die Aktualisierung eines Steuergerätes zurzeit erlaubt, um die SZ-Einhaltung zu gewährleisten. Mitunter können mehrere Programmierschritte pro Steuergerät an unterschiedlichen Stellen des Gesamtflashprozesses erforderlich sein, was erfindungsgemäß nicht ausgeschlossen ist.
• • Bevorzugt werden ASIL-relevante Schnittstellen nicht verändert werden, zumindest ohne dass eine explizite anschließende Prüfung notwendig ist.
• • Die Rückwärtskompatibilität der aktualisierten Funktionen sollte gewährleistet bleiben, um ihre Verfügbarkeit sicherzustellen und SiZu zu verhindern.
• • Wird ein Steuergerät zu oft angesprochen („angepingt“), wird ein sicherer Zustand hergestellt, wozu mitunter eine Stilllegung des Steuergerätes erforderlich ist.
• • Wird eine erwartete Rückantwort nicht binnen einer vordefinierten Zeitdauer erhalten, werden die Schnittstellen gesperrt, um den Programmiervorgang zu stoppen. Anschließend kann das Steuergerät erneut angesprochen werden.
• • Bevorzugt ist FFI über codierte Verfahrensweise („coded-processing“) sicherzustellen.
• • Wird eine Korruption der Datenpakete oder der Checker-Software sichergestellt, wird der bisherige Datensatz verworfen und der Datensatz erneut vom Back-End angefordert. Als Back-End ist ein bspw. mittels des Internets und/oder eines Intranets angeschlossener Server mit einem Datenspeicher zu verstehen, von welchem das abgesicherte Datenpaket zur Aktualisierung des zweiten Steuergerätes bereitgestellt wird.
• • Alle Datenpakete inklusive der Checker-Software sind bevorzugt End-to-End (E2E) abgesichert und werden zyklisch überprüft.
• • Der Mechanismus kann baukastenartig von QM bis ASIL D gestaltet werden. Bevorzugt ist die Checker-Software inklusive Programmiervorschriften pro Programmiervorgang individuell zu erstellen.
• • Überwiegend sind keine dezidierten Sicherheitsmechanismen an der MGU-Hardware notwendig. Mit anderen Worten kann die Hardware bisher verbauter MGUs auch im Rahmen der vorliegenden Erfindung weiter verwendet werden.
• • Die in der MGU enthaltene Software (außer empfangener Datenpakete inklusive Checker-Software) müssen keine dezidierten SW-Mechanismen umsetzen.
• • Eine Stilllegung erfolgt über divers-redundante SG-Ansteuerung (BDC, DME, DSC). Dies führt zu einer diversitären Redundanz.
• • Um für alle ASIL-Integritäten anwendbar zu sein, kann es erforderlich sein, die vorgesehenen Mechanismen möglicherweise divers redundant auszuführen und die vordefinierte Referenz (insbesondere entsprechend ASIL) zu erstellen.

In the following, additional concept components of the present invention will be mentioned in addition:

• • There is a redundant option for signal runway deactivation.
• • Incompatible interfaces are suggested by a different interface design.
• • Preferably, the flash process is controlled because the flash policy is security relevant.
• • Preferably only the update of a control unit is currently allowed to ensure SC compliance. Sometimes several programming steps per control unit at different points of the Gesamtflashprozesses may be required, which is not excluded according to the invention.
• • Preferably, ASIL-relevant interfaces are not changed, at least without an explicit subsequent examination being necessary.
• • Backward compatibility of the updated features should be guaranteed to ensure their availability and prevent SiZu.
• • If a control unit is addressed too often ("pinged"), a safe state is established, which sometimes requires a shutdown of the control unit.
• • If an expected response is not received within a predefined period of time, the interfaces are disabled to stop the programming process. Subsequently, the control unit can be addressed again.
• • It is preferable to ensure FFI via coded-processing.
• • If corruption of the data packages or the Checker software is ensured, the previous data record is discarded and the data record is requested again by the backend. As a back-end is an example. By means of the Internet and / or an intranet connected server with a data storage to understand, from which the secured data packet is provided for updating the second control device.
• • All data packages including the Checker software are preferably secured end-to-end (E2E) and are checked cyclically.
• • The mechanism can be designed like a box from QM to ASIL D. Preferably, the checker software including programming instructions per programming process is to be created individually.
• • For the most part, no dedicated security mechanisms are required on the MGU hardware. In other words, the hardware of previously installed MGUs can also be used in the context of the present invention.
• • The software contained in the MGU (except received data packets including Checker software) does not need to implement any dedicated software mechanisms.
• • Shutdown is carried out via diversely redundant SG control (BDC, DME, DSC). This leads to a diverse redundancy.
• • In order to be applicable to all ASIL Integrities, it may be necessary to perform the proposed mechanisms in various redundant ways and to create the predefined reference (in particular according to ASIL).

LIST OF REFERENCE NUMBERS

1

MGU

2

second control unit

3

bus

4

third control unit

5

data storage

6

antenna

7

Back-end / server

8th

transmission tower

9

programmable processor

10

car

11a, 11b, 11c, 12a, 12b, 12c

Interfaces for signal flow monitoring

13

Requests

14

reply

15

BDC

16

DME

17

DSC

18

further interface

D1, D2, D3, D4

data packets

Claims (10)

A method of updating a software scope of a means of transportation (10) comprising the steps of: Receiving a data record in the first control device (1) of the means of locomotion (10), Adapting or reintroducing a coding or software of a second control device (2) by means of the data record by the first control device (1), - Issuing a request (13) by the first control device (1) and / or a third control device (4) to the second control device (2), and - Receiving and checking a response (14) to the request (13) by a third controller (2) based on a predefined reference. Method according to Claim 1 further comprising - issuing a plurality of requests (13) by the first control device (1) and / or the third control device (4) to the second control device (2), and - receiving and checking the responses (14) to the requests (13) by the second control device (2) and / or the third control device (4) based on predefined references. Method according to Claim 1 or 2 further comprising - determining the answer (14) to the request (13) within the second control device (2) and - outputting the response (14) by the second control device (2) to the first control device (1) and / or the third control device (4). Method according to one of the preceding claims, wherein - The first control unit (1) and - The second control unit (2) and - The third control unit (4) via a bus system (3) and / or a gateway are connected by information technology. Method according to one of the preceding claims further comprising - Check predefined boundary conditions for the adaptation of the coding or the software. Method according to one of the preceding claims, wherein the coding or the software of a - Update and / or - Functional increase and / or - Safety measure corresponds. Method according to one of the preceding claims further comprising - Determine that the adaptation of the coding / software has failed and in response to it - Restrict a range of functions of the means of transport (10). Comprising a control device for a means of transportation (10) an information interface (3), a data memory (5) and - An evaluation unit (9), wherein the evaluation unit (9) is established - receive a record, to adapt or reintroduce a coding or software of a second control device (2) by means of the data record, by means of the information interface (3) to issue a request (13) to the second control device (2), and - Receive a response (14) to the request (13) based on a pre-defined in the data memory (5) reference and check. Control unit after Claim 8 , which is arranged, a method according to one of the preceding Claims 1 to 7 perform. Means of transport comprising a control device (1, 2) according to one of the preceding Claims 8 or 9 ,

Images