DE102019000493A1 - Method for updating a respective software of several control units of a vehicle - Google Patents

Abstract

The invention relates to a method for updating a respective software of several control devices of a vehicle. According to the invention, new software is created on the basis of a new communication list for the communication of the control units for each affected control unit of the vehicle and a flashware is created from this new software and sent wirelessly to the vehicle transfer. The flashware for the respective control unit is loaded into the respective control unit and thereby updated the software of the respective control unit, first with controllers without gateway function, the respective flashware is loaded and the respective flashware is loaded last with controllers with gateway function and a bus master. The control units are kept in an update state until the respective flashware has been loaded into all affected control units, with the respective old software or at least one communication component of the respective old software remaining stored in a volatile memory of the respective control unit. A synchronization command is sent to all affected ECUs, causing them to reboot.

Description

The invention relates to a method for updating a respective software of a plurality of control devices of a vehicle.

From the DE 10 2016 210 675 A1 is a telematics control unit with a differential update package that is installable in a vehicle known. The telematics control unit includes a wireless network interface, an interface for a vehicle bus connected to a plurality of electronic control units, a memory, a processor, and the differential update packet received over the wireless network interface for updating for a specific electronic To provide control unit. The differential update package includes a flash tool, differential update commands for the specific electronic control unit, and differential update data for the flash memory of the specific electronic control unit. The processor uses the flash tool to provide the differential update commands for a boot loader of the specific electronic control unit and to update the flash memory of the specific electronic control unit.

In the DE 10 2018 003 777 A1 The applicant, the full contents of which is hereby incorporated by reference, a method for updating a software at least one control device of a vehicle is described. If the controller does not use a file system, a hash is formed over the current software of the controller and sent to a backend. The backend looks for a hash of the current software and a new software is compared with the current software. Changed software blocks are identified and a table is formed from a respective block number and a respective new content for the changed software blocks. This table is compressed and the compressed table is hashed and signed. The compressed, hashed, and signed table is sent from the backend to the vehicle, checked for integrity, and the software is updated. Alternatively or additionally, if the controller uses a file system, a virtual form of the file system is stored in an image in the backend. By means of an adjustment method, an overview of data that has been changed is formed. This data is summarized in a data package which is compressed, hashed and signed. The compressed, hashed, and signed data packet is sent from the backend to the vehicle, checked for integrity, and the software is updated.

The invention has for its object to provide a comparison with the prior art improved method for updating a respective software of multiple control units of a vehicle.

The object is achieved by the features specified in claim 1.

Advantageous embodiments of the invention are the subject of the dependent claims.

In a method according to the invention for updating a respective software of a plurality of control devices of a vehicle, in particular for subsequently changing a communication matrix, ie of communication relations between the control devices, new software is created for each affected control device of the vehicle based on a new communication list for the communication of the control devices. The respective new software is created in particular by creating a list of all changes, messages and affected ECUs based on the new communication list and based on this list for each ECU concerned a corresponding data section, in particular a corresponding data block and / or a corresponding file, the software is adapted, d. h, in particular a communication component of the software. Such delta formation is for example in the DE 10 2018 003 777 A1 the applicant whose complete content is hereby incorporated by reference, in particular in the description of their figures, in particular with respect to their 2 and 3 , Advantageously, the respective new software is compared in blocks with the respective old software, wherein it is checked whether other areas have been changed in addition to the communication portion and wherein the method is aborted, if this is the case.

From this new software a Flashware is created. The flashware advantageously contains only the changed portion of the software, ie advantageously only the communication portion and thus the corresponding data portion. This compilation of only the modified portion of the software is in the DE 10 2018 003 777 A1 the applicant described, in particular in their description of figures, in particular with respect to their 2 and 3 ,

The respective new software and / or the respective flashware is advantageously signed. The respective flashware is wirelessly, ie "over the air", in particular via a radio-based data transmission connection, for example via mobile or WLAN, transmitted to the vehicle, in particular by a data packet from all flashwares for the affected control units of the vehicle is formed and wirelessly to the vehicle is transmitted. The flashware for the respective control unit is loaded into the respective control unit and thereby updated the software of the respective control unit, first with controllers without gateway function, the respective flashware is loaded and the respective flashware is loaded last with controllers with gateway function and a bus master. In this case, for example, the respective flashware can be loaded simultaneously into a plurality of control devices. This updating of the controllers by loading the flashware is advantageously carried out in the delta method, ie as in the DE 10 2018 003 777 A1 the applicant, in particular in their description of figures, in particular with respect to their 2 and 3 , described. The control units are kept in an update state until the respective flashware has been loaded into all affected control units, the respective old software or at least the communication portion of the respective old software being stored in a volatile memory of the respective control unit, so that at least the old communication relationships in that volatile memory are stored Memory is saved. A synchronization command is sent to all affected ECUs, causing them to reboot. This synchronization command takes place when all control units concerned have been updated, ie when the relevant flashware has been loaded into all affected control units.

In order to enable this method, each software for the control units has the data section, for example in the form of defined data blocks or, for data system controllers, in the form of a file in which the communication relationships for this control device are described, d. H. saved are. This data section, for example in the form of the file name or the data blocks in a flash memory of the respective control device, is advantageously individually writable. The backend documents which data section, i. H. which data blocks or which file it is. Furthermore, in order to enable the method, the synchronization command is provided for all control devices.

Below is an explanation of the terms software and Flashware. Each controller that can load new software has a flash memory. Usually this flash memory is first deleted during a software download and then rewritten with the new software. The process of loading new software into a controller is called flashing, and the software loaded into the controller is the so-called flashware. In the method described here, the software of the respective controller is updated by advantageously not deleted the entire old software and the entire new software is loaded, but it is only the changed proportion, ie. H. the communication portion, and thus the corresponding data portion, which transmits software as flashware to the vehicle and, after the corresponding portion of the old software has been deleted, loaded into the controller to thereby form the new software in the controller. As a result, a transmission time and a transferred amount of data as well as a required time for updating the respective control device are reduced.

By means of the method according to the invention also vehicles in the field, d. H. already delivered to customers vehicles, be provided with new communication lists. Even more complex and / or complex functions, which require communication changes between several control devices, can be implemented in this way, in particular even later.

Since the respective old software or at least the respective communication relationships remain stored in the volatile memory of the respective control unit and the restart of all affected control devices is performed only when the respective software has been updated in all affected control devices, a consistent communication of the control units is ensured at all times ,

Embodiments of the invention will be explained in more detail below with reference to a drawing.

• 1 schematisch ein Verfahren zur Aktualisierung einer jeweiligen Software mehrerer Steuergeräte eines Fahrzeugs.

Showing:

• 1 schematically a method for updating a respective software of multiple control units of a vehicle.

1 shows a schematic representation of a method for updating a respective software of multiple control units of a vehicle, in particular for subsequently changing a communication matrix, ie of communication relationships between the control units.

Each controller that can load new software has a flash memory. Usually this flash memory is first deleted during a software download and then rewritten with the new software. The process of loading new software into a controller is called flashing, and the software loaded into the controller is the so-called flashware. In the method described below, the software of the respective control device is updated by advantageously not all the old software deleted and the entire new software is loaded, but it is only a modified portion of the software, ie a communication component comprising the Communication relationships, and thus a corresponding portion of the software as Flashware transmitted to the vehicle and, after the corresponding portion of the old software has been deleted, loaded into the controller, thereby forming the new software in the control unit. As a result, a transmission time and a transferred amount of data as well as a required time for updating the respective control device are reduced.

In order to facilitate this procedure, each piece of software for the controllers has this portion of the data, for example in the form of defined data blocks or, for data system controllers, in the form of a file describing the communication relationships for that controller; H. saved are. This data section, for example in the form of the file name or the data blocks in the flash memory of the respective control device, is advantageously individually writable. As a result, it is not necessary to delete the entire flash memory during the flash and to load the entire new software, for example, only this data section or flash memory area for this data section is deleted and only the data section is reloaded. In a backend, d. H. in a vehicle-external service device, for example a server device of a manufacturer of the vehicle, it is documented to which data section, i. H. which data blocks or which file it is. Furthermore, to enable the method, a synchronization command, i. H. a corresponding signal, intended for all control units.

In this method, the backend receives in a first step S1 a new communication list and / or signal list, hereinafter referred to as communication list, for the vehicle, ie for an already existing and in particular already delivered to a customer vehicle.

In a second process step S2 From the existing documentation in the backend, in particular from a comparison of the old and new communication list, first a list of all changes and messages and the affected ECUs is formed, for example ECU1 -> message 1 changed, message 4711 new, ECU2 -> message 4711 changed, Message 2 new, message 4712 deleted.

On the basis of this list and thus on the basis of the new communication list for the communication of the ECUs, which has received the backend, is in a third step S3 For each affected control device of the vehicle creates a new software, in particular by the corresponding data section, ie the corresponding data block and / or the corresponding file of the software is adjusted based on this list for each control unit. The software to be adapted for the respective control unit is stored in the backend. For example, it will be unpacked before it is packed. As a result of this adaptation of the software, the same software is created as new software, which is installed on the vehicle, ie in the respective control unit of the vehicle, according to a database which is advantageously present on the backend, but with other communication relationships. Thus, only the communication relationships are changed, while the other parts of the software of the respective control unit remain unchanged. Such a delta formation, ie such an adaptation of the software by changing only one or more portions of the software, is described, for example, in US Pat DE 10 2018 003 777 A1 the applicant whose complete content is hereby incorporated by reference, in particular in the description of their figures, in particular with respect to their 2 and 3 ,

In a fourth process step S4 is the respective new software, ie the entire new software, which contains the communication portion, ie the data section with the communication relationships, as well as the other parts of the software, block by block with the respective old software, also with the complete old software. It is checked for security, whether other parts, ie other parts of the software, have been changed in addition to the communication component, since this is not allowed. Therefore, if this is the case, ie, other than the communication portion other areas, ie other portions of the software have been changed, the process is aborted, for example, to avoid malfunction of the respective control unit.

If it has been determined that only the communication component of the software of the respective control device concerned has been changed, ie only the communication relationships of the relevant control device concerned, then the method is used with a fifth method step S5 in which the respective new software or at least the changed communication component containing the communication relationships of the new software which forms the flashware is advantageously signed. From the new software for the respective affected control device, the flashware for the respective control unit is thus created, ie the part of the new software, which is to be transmitted to the vehicle, ie the changed share, in particular the communication portion of the new software, with which Control unit the software is to be updated. This, ie this delta formation between old and new software, is for example in the DE 10 2018 003 777 A1 the applicant described, in particular in their Description of the figures, in particular regarding their 2 and 3 , As already mentioned, it can be provided that the new software and / or the Flashware created therefrom is signed.

In a sixth process step S6 a data packet is formed from all flashwares for the affected ECUs of the vehicle. This data packet formation is in the DE 10 2018 003 777 A1 the applicant described, in particular in their description of figures, in particular with respect to their 2 and 3 ,

This data package with the flashwares for the affected ECUs of the vehicle is in a seventh process step S7 wirelessly, ie "over the air", in particular via a radio-based data transmission connection, for example via mobile radio or WLAN, transmitted to the vehicle.

In the vehicle are in an eighth step S8 in turn, all the affected ECUs in the delta process, as in the DE 10 2018 003 777 A1 the applicant, in particular in their description of figures, in particular with respect to their 2 and 3 , described, flashed, ie the flashwares for the respective control unit, in particular to those in the DE 10 2018 003 777 A1 the applicant, in particular in their description of figures, in particular with respect to their 2 and 3 , described manner, loaded into the respective affected control unit, thereby updating the software of the respective control unit concerned.

In this case, the order in which control units which do not have a gateway function for a sub-string are first flashed. In this case, in particular in the case of slow bus systems, several control devices can also be flashed simultaneously. The controllers will flash after flashing, i. H. after loading the flashware, but not yet rebooted, d. H. not yet restarted, but held in an update state, for example, in a state "flashing completed". As a result, the old software, at least the old, hitherto still current, communication list with the old communication relationships, which is stored in a volatile memory (for example main memory / RAM) of the respective control unit, is still active in the respective control unit. This ensures consistent communication at all times, as the ECUs initially retain their old communication relationships. Finally, the respective gateway controllers and bus masters are updated, i. H. For controllers with gateway function and for a bus master, the respective flashware is loaded last, thus updating their software.

If all affected ECUs are flashed in the manner described, ie if the respective flashware is loaded in all affected ECUs, then in a ninth process step S9 sent the synchronization command to all affected ECUs, which causes them to reboot. After the restart and the startup of the affected ECUs, a consistent communication is possible again. As a result of this simultaneous restart of all affected control units, triggered by the synchronization command, the failure of the communication is limited to the restart of the affected control units.

LIST OF REFERENCE NUMBERS

S1

first process step

S2

second process step

S3

third process step

S4

fourth process step

S5

fifth process step

S6

sixth process step

S7

seventh process step

S8

eighth process step

S9

ninth process step

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102016210675 A1 [0002]
• DE 102018003777 A1 [0003, 0007, 0008, 0009, 0021, 0023, 0024, 0026]

Claims (6)

A method for updating a respective software of a plurality of control devices of a vehicle, characterized in that - based on a new communication list for the communication of the control units for each affected control unit of the vehicle, a new software is created and from this new software Flashware is created and wirelessly to the Vehicle is transmitted - the flashware for the respective control unit is loaded into the respective control unit and thereby the software of the respective control unit is updated, first with the controllers without gateway function, the respective Flashware is loaded and control devices with gateway function and a bus master the respective Flashware is loaded last, - the control units are kept in an update state until in each affected control devices, the respective flashware has been loaded, the respective old software or at least a communication portion of the respective old software is stored in a volatile memory of the respective control unit, - a synchronization command is sent to all affected ECUs, which causes them to reboot. Method according to Claim 1 , characterized in that the respective new software and / or the respective flashware is signed before being transmitted to the vehicle. Method according to one of the preceding claims, characterized in that the respective flashware is loaded into a plurality of control devices at the same time. Method according to one of the preceding claims, characterized in that the respective new software is created by a list of all changes, messages and affected control devices is created based on the new communication list and adjusted based on this list for each control unit concerned, a corresponding data section of the software becomes. Method according to Claim 4 , characterized in that the respective new software is compared in blocks with the respective old software, wherein it is checked whether other parts of the software were changed in addition to the communication component and wherein the method is aborted, if this is the case. Method according to one of the preceding claims, characterized in that a data packet is formed from all flashwares and is transmitted wirelessly to the vehicle.

Images