FR3091608A1 - Method and device for updating an electronic control unit - Google Patents

Abstract

Method and device for controlling the power supply of an audio amplifier The invention relates to a method and a device for updating software of a computer of an on-board system in a vehicle. To this end, first information representative of a configuration of a reference system for updating the software is received. The first information is compared with second information representative of a configuration of the computer. The software update is installed based on the result of the comparison between the first information and the second information. Third information representative of a configuration of a target system after the software update is received. The software update is finally verified by comparing the third information with fourth information representative of a configuration of the computer after updating the software. Figure for the abstract: Figure 1

Description

Description

Title of the invention: Method and device for updating an electronic control unit

Technical area

The invention relates to methods and devices for controlling the software update of a vehicle, in particular of the automobile type.

Technological background

[0002] Contemporary vehicles have a number of computers each providing one or more functions, such as, for example, management of the driving aid, traction control, electronic brake distribution or even actuator control for ensure optimal operation of a combustion engine.

These computers are also called UCE ("Electronic Control Unit" or in English ECU "Electronic Control Unit"). These computers carry software which is executed to perform the functions for which they are responsible. Updates to this software are sometimes necessary, for example to improve a function or to correct an error, also called a "bug" in computer science.

These updates can be critical, especially for software that ensures the proper functioning of the vehicle and the safety of vehicle passengers. Checking for these updates is therefore particularly important.

Summary of the invention

An object of the present invention is to improve the installation process of software update (s) of one or more computers of a vehicle.

Another object of the invention is to reduce the risk of error and problem associated with the software update of one or more computers of a vehicle.

According to a first aspect, the invention relates to a method for updating at least one software of at least one computer of a system embedded in a vehicle. To this end, the method comprises the steps of:

- reception of first information representative of a configuration of a reference system for updating the at least one software;

- comparison of the first information with second information representative of a configuration of the at least one computer;

- installation of the update according to the result of the comparison of the first information with the second information;

- reception of third information representative of a configuration of a target system after updating at least one software;

- verification of the update by comparing the third information with

[0008]

[0009]

[0010]

[0011]

[0012]

[0013]

[0014]

[0015]

Fourth information representative of a configuration of the at least one computer after updating the at least one software.

Alternatively, the method further includes the step of canceling the update based on the result of the verification.

According to yet another variant, the method further comprises the step of rendering an alert message as a function of the result of the verification.

According to another variant, the second and / or fourth information each includes one or more of the following information:

- information representative of characteristics of the at least one software installed in the at least one computer; and or

- information representative of hardware characteristics of the at least one computer; and or

information representative of the configuration and calibration parameters of the at least one computer.

According to a second aspect, the invention relates to a device for updating at least one software for at least one computer of an on-board system in a vehicle. To this end, the device comprises:

- means for receiving first information representative of a configuration of a reference system for updating the at least one software;

- means for comparing the first information with second information representative of a configuration of the at least one computer;

- means of installing the update according to the result of the comparison of the first information with the second information;

means for receiving third information representative of a configuration of a target system after updating at least one software;

- means for verifying the update by comparing the third information with fourth information representative of a configuration of the at least one computer after updating the at least one software.

Alternatively, the device further includes means for canceling the update based on the result of the verification.

According to another variant, the device further comprises means for rendering an alert message according to the result of the verification.

According to a third aspect, the invention relates to an on-board system in a vehicle comprising one or more computers and a device as described above according to the second aspect of the invention.

According to a variant, the device corresponds to a computer of the on-board system.

According to a fourth aspect, the invention relates to a vehicle, for example of the tomobile type, comprising the device as described above according to the second aspect of the invention.

According to a fifth aspect, the invention relates to a computer program which includes instructions suitable for the execution of the steps of the method according to the first aspect of the invention, this in particular when the computer program is executed by at least one processor.

Such a computer program can use any programming language, and be in the form of a source code, an object code, or an intermediate code between a source code and an object code , such as in a partially compiled form, or in any other desirable form.

According to a sixth aspect, the invention relates to a recording medium readable by a computer on which is recorded a computer program comprising instructions for the execution of the steps of the method according to the first aspect of the invention.

On the one hand, the recording medium can be any entity or device capable of storing the program. For example, the support may include a storage means, such as a ROM memory, a CD-ROM or a ROM memory of the microelectronic circuit type, or also a magnetic recording means or a hard disk.

On the other hand, this recording medium can also be a transmissible medium such as an electrical or optical signal, such a signal being able to be routed via an electrical or optical cable, by conventional or hertzian radio or by laser beam. self-directed or by other means. The computer program according to the invention can in particular be downloaded from a network of the Internet type.

Alternatively, the recording medium can be an integrated circuit in which the computer program is incorporated, the integrated circuit being adapted to execute or to be used in the execution of the process in question.

Brief description of the figures

Other characteristics and advantages of the invention will emerge from the description of the nonlimiting embodiments of the invention below, with reference to Figures 1 to 3 attached, in which:

[Fig.l] schematically illustrates an environment for updating an on-board system in a vehicle, according to a particular embodiment of the present invention;

[Fig.2] illustrates a flowchart of the different steps of an update process of the on-board system of Figure 1, according to a particular embodiment of the present invention;

[Fig.3] schematically illustrates a device configured for updating the on-board system of Figure 1, according to a particular embodiment of the present invention.

Description of the embodiments

A method of controlling the power supply of one or more audio amplifiers as well as the associated device and / or system will now be described in the following which will follow with reference to FIGS. 1 and 2.

According to a particular and non-limiting example of embodiment of the invention, a method for updating one or more software installed on one or more computers of a vehicle comprises receiving first information representative of the configuration d 'a reference system, i.e. the configuration of the system targeted by the update. The first information is compared with second information representative of the current configuration of the computer or computers on which the update is to be performed. The update is then performed as a function of the result of the comparison, for example the update is implemented if the current configuration of the computer or computers appears to be compatible with the configuration of the reference system. Third information representative of the configuration of a target system, that is to say of the system as it should be after updating the software (s) (the target system corresponds for example to the updated reference system with the software update) are received. A verification of the software update of the computer or computers is then carried out by comparing the third information with fourth information representative of the configuration of the computer or computers which have been updated via the software update.

A 2-step verification of the update, that is to say with a first verification before installing the update and a second installation after updating, improves the reliability of the computers and vehicle passenger safety. Indeed, the first check makes it possible to make sure that the update will not cause a problem a priori and the second check makes it possible to check that indeed no problem occurred during the update.

A device configured for the implementation of the method is also described.

FIG. 1 schematically illustrates an environment for updating an on-board system 10 in a vehicle, according to a particular and nonlimiting example of an embodiment of the present invention.

The system 10 is advantageously on board a vehicle, for example of the automobile type. The system 10 comprises for example a device 101 connected to one or more computers 102, 103. The device 101 also corresponds, for example, also to a computer, for example a computer of the ECU type. An ECU is made up of an electronic computer and one or more on-board software programs that perform one or more servo controls. The computers 102 and 103 are for example also of the ECU type. The device 101 is also called the orchestrator computer (or ECU orchestrator) in that it is responsible for the orchestration and the control of the software update of all the computers 101, 102 and 103. The computers 101, 102 , 103 form, for example, a multiplexed architecture for the realization of various services useful for the proper functioning of the vehicle and to assist the driver and / or passengers of the vehicle in controlling the vehicle.

The computers 101, 102 and 103 communicate and exchange data with one another via one or more computer buses, for example a CAN data bus type communication bus (from the “Controller Area Network” "Or in French" Network of controllers ")

The device 101 is connected to an external device 11 via a wired or wireless connection. The external device 11 is for example a server remote from the "cloud" (or "cloud" in French). The device 101 loads for example the software updates stored for download in the external device 11 via for example the Internet with an OTA type connection (from English "over-the-air", or in French "by way Aerial ").

Of course, the number of computers in the system 10 is not limited to 3 and extends to any number, for example 10, 20, 50, 100 or more computers. According to a variant, the system 10 comprises a single computer, namely the computer 101. An example of hardware embodiment of such a computer 101 is described with reference to FIG. 3.

FIG. 3 schematically illustrates a device 3 configured for updating one or more computers of an on-board vehicle system, according to a particular and nonlimiting example of an embodiment of the present invention.

The device 3 is for example configured for the implementation of the steps of the method described with reference to Figure 2. Examples of such a device 3 include, but are not limited to, on-board electronic equipment such as on-board computer of a vehicle, an electronic computer such as an ECU. The elements of the device 3, individually or in combination, can be integrated into a single integrated circuit, into several integrated circuits, and / or into discrete components. The device 3 can be produced in the form of electronic circuits or software (or computer) modules or even a combination of electronic circuits and software modules. According to different particular embodiments, the device 3 is coupled in communication with other similar devices or systems, for example by means of a communication bus or through dedicated input / output ports.

The device comprises one (or more) processor (s) 30 configured to execute instructions for carrying out the steps of the method. The processor 30 can include built-in memory, an input / output interface, and various circuits known to those skilled in the art. The device 3 also comprises at least one memory 31, by a volatile at / or non-volatile memory and / or comprises a memory storage device which can include volatile and / or non-volatile memory, such as EEPROM, ROM, PROM , RAM, DRAM, SRAM, flash, magnetic or optical disc.

The computer code comprising the instructions to be loaded and executed by the processor is for example stored on the memory or the memory storage device 31.

According to a particular and non-limiting embodiment, the device 3 comprises a block 32 of interface elements for communicating with external devices, for example a remote server or the "cloud", odometric sensors, a sensor GPS. The interface elements of block 32 include one or more of the following interfaces:

- RE radio interface, for example of Bluetooth® or Wi-Ei®, LTE (from English “Long-Term Evolution” or in French “Evolution à long terme”), LTE-Advanced (or in French LTE-advanced );

- USB interface (from English "Universal Serial Bus" or "Bus Universel en Série" in French);

- HDMI interface (from English "High Definition Multimedia Interface", or "Interface Multimedia Haute Definition" in French).

Data is for example loaded to the device 3 via the interface of block 32 using a Wi-Fi® network such as according to IEEE 802.11 or a mobile network such as a 4G network (or LTE Advanced according to 3GPP release 10 - version 10) or 5G.

According to another particular embodiment, the device 3 comprises a communication interface 33 which makes it possible to establish communication with other devices (such as other computers or ECU) via a communication channel 330. L the communication interface 33 corresponds for example to a transmitter configured to transmit and receive information and / or data via the communication channel 330. The communication interface 33 corresponds for example to a wired network of CAN type.

According to a further particular embodiment, the device 3 can supply output signals to one or more external devices, such as a display screen, one or more speakers and / or other peripherals via respectively not shown output interfaces.

FIG. 2 illustrates a flow diagram of the different stages of a method of the software update of one or more computers of an on-board vehicle system, according to a particular and nonlimiting embodiment of the present invention. The method is for example implemented in the device 101 of FIG. 1 or the device 3 of FIG. 3.

In a first step 21, first information representative of the configuration of a reference system for updating the software (s) (for example firmware (s)) to be installed on the computer or computers of the on-board system are received, for example from the cloud via an Internet or OTA connection. The reference system corresponds to the system as provided by the publisher of the software or software for the installation of the latter software. The information representative of the configuration includes for example the hardware characteristics of the computer or computers required for the update (for example processor speed, memory space) and / or the software characteristics (level of version of the software (s) already installed before the update).

Third information representative of the configuration of a target system is also received during this first step. The target system corresponds to the system after the update (s) have been installed. The target system corresponds for example to the reference system to which the update (s) would have been applied. According to an alternative embodiment, the third information is received in a subsequent step, for example after the installation of the update or updates.

Second information representative of the configuration of each of the computers can also be received during this first step 21. The orchestrator computer receives for example from each of the other computers of the system their second associated information. This second information can for example be received on request (s) formulated by the orchestrator calculator. According to a variant, the second information has been received beforehand, that is to say prior to the first step, and is stored in the memory of the orchestrator calculator. According to this variant, the second information can be received from each computer periodically, on request or not from the orchestrator computer.

The second information associated with each computer includes one or more of the following information:

information representative of characteristics of the at least one software installed in said at least one computer, for example the software version; and / or - information representative of the hardware characteristic of the at least one computer, for example processor speed, processor type, memory space; and or

- information representative of the configuration and calibration parameters of the at least one computer.

In a second step 22, a check of the compatibility between the configuration of the reference system and the configuration of each of the computers on which the update must be carried out is carried out. To this end, the first information representative of the configuration of the reference system is compared to the second information representative of the configuration of the computer (s) to which the software update is to be applied. If it appears from the comparison that the configuration of the computer or computers does not allow the update to be applied, the latter is not implemented and the process goes into an update failure state 221. A message can optionally be rendered, for example for display on an update tracking tool (for example a Smartphone (or “smart phone” in French) or a tablet or computer) or on a screen of the dashboard of the vehicle. If it emerges from the comparison that the configuration of the computer or computers is compatible with the update, the latter is implemented in a third step 23.

Alternatively, it is also checked in step 22 if the state of the vehicle is compatible with the installation of the update. It is for example checked if the vehicle is immobilized, if the battery level is sufficient and / or if there is no prohibitive fault code. If these latter conditions are satisfied, then the update is deployed in step 23. Otherwise, the installation is not deployed 221.

In the third step 23, the updating of the software or software is implemented on the target computer or computers. The update corresponds for example to the reprogramming of a flash memory associated with the target computer.

In a fourth step 24, it is verified that the update has been correctly deployed on the target computer or computers of the update. To this end, the third information representative of the target system is compared to fourth information representative of the configuration of the computer or computers updated in step 23. This verification makes it possible to ensure that the deployment of the update (s) day has been carried out correctly, checking that the configuration of the computer (s) corresponds to what was expected, that is to say corresponds to the target system, the configuration of which is described with the third information. The fourth information is similar to the second information but representative of the computer (s) at another time, after the update.

If it emerges from the comparison that the update has not been deployed correctly, that is to say that there are one or more differences between the configuration of the computers described by the fourth information and the configuration of the target system described by the third information, then the process proceeds to step 241.

In step 241, the update is canceled, that is to say that the computer or computers which have been updated in step 23 are returned to the software version as before update. All the requests implemented for the update are canceled in order to return to the initial state (from English "rollback").

Alternatively, an alert or error message is returned for return to the driver or a technician. The alert message thus rendered is for example displayed on a screen of the dashboard, for example inviting the driver to go without delay to a maintenance center. The message can for example be displayed on a screen of a Smartphone or a tablet or can also be reproduced in the form of a sound or voice message. According to yet another variant, the message is delivered in addition, that is to say in addition, to the cancellation of the update or instead of the cancellation if the latter could not for example be Implementation.

If it emerges from the comparison that the update has been deployed correctly, that is to say that there is no difference (or no unexpected difference) between the configuration of the computers described by the fourth information and the configuration of the target system described by the third information, then the update process ends correctly and the vehicle is considered to be ready for operation.

The second verification of step 24 also makes it possible to ensure that there has been no modification to the configuration of the computer or computers to be updated after the first verification of step 22 has been performed.

The two-step verification increases the safety of vehicle passengers and road users in general by avoiding updating software that is not compatible with the vehicle (ASIL risk (from “Automotive Safetry Integrity Level” or in French "Level of safety and integrity of a vehicle") level D for example if the computer to be updated carries critical functionalities such as driving assistance for example). Such verification also makes it possible to reduce the number of parts judged to be non-compliant by avoiding problems associated with non-consistent updates.

Of course, the invention is not limited to the embodiments described above but extends to a method of controlling the update of at least one software of at least one computer of a on-board system in a vehicle and on the device configured for implementing a method for controlling the updating of at least one software of at least one computer of a system on-board in a vehicle.

The invention also relates to a vehicle, for example automobile or more generally a land motor vehicle, comprising the device 3 of Figure 3 or the system of Figure 10 of Figure 1.

Claims (1)

Claims [Claim 1] Method for updating at least one software of at least one computer (101, 102, 103) of a system (10) on board a vehicle, said method comprising the steps of: - reception (21) of first information representative of a configuration of a reference system for updating said at least one software; - Comparison (22) of said first information with second information representative of a configuration of said at least one computer (101, 102, 103); - installation (23) of said update according to the result of the comparison of said first information with said second information; - reception (21) of third information representative of a configuration of a target system after updating of at least one software; - Verification (24) of said update by comparing said third information with fourth information representative of a configuration of said at least one computer (101, 102, 103) after updating of said at least one software. [Claim 2] The method of claim 1, which further comprises the step of canceling (241) said update based on the result of said verification. [Claim 3] The method according to one of claims 1 and 2, which further comprises rendering (241) an alert message according to the result of said verification. [Claim 4] Method according to one of claims 1 to 3, in which said second and / or fourth information each comprise one or more of the following information: - information representative of characteristics of the at least one software installed in said at least one computer; and or - information representative of material characteristics of the at least one computer; and or - information representative of the configuration and calibration parameters of the at least one computer. [Claim 5] Device (3) for updating at least one software for at least one computer of an on-board system in a vehicle, said device comprising: - means for receiving first information representative of a configuration of a reference system for updating said at least one software; - means for comparing said first information with second information representative of a configuration of said at least one computer; - means for installing said update according to the result of the comparison of said first information with said second information; means for receiving third information representative of a configuration of a target system after updating at least one software; means for verifying said update by comparing said third information with fourth information representative of a configuration of said at least one computer after updating said at least one software. [Claim 6] Device according to claim 5, which further comprises means for canceling said update according to the result of said verification. [Claim 7] Device according to claim 5 or 6, which further comprises means for rendering an alert message according to the result of said verification. [Claim 8] Device according to one of claims 5 to 7, in which said second and / or fourth information each comprise one or more of the following information: - information representative of characteristics of the at least one software installed in said at least one computer; and or - information representative of material characteristics of the at least one computer; and or - information representative of the configuration and calibration parameters of the at least one computer. [Claim 9] Motor vehicle comprising the device according to one of claims 5 to 8. [Claim 10] Computer program product comprising instructions suitable for carrying out the steps of the method according to one of claims 1 to 4, when the computer program is executed by at least one processor. 1/3