Efficient over-the-air software update for a connected vehicle

• US 10,203,947 B2
• Filed: 08/03/2016
• Issued: 02/12/2019
• Est. Priority Date: 08/03/2016
• Status: Active Grant

• Current Assignee: DENSO Corporation, Runtime Verification Inc., Toyota Infotechnology Center USA, Inc.
• Original Assignee: DENSO Corporation, Runtime Verification Inc., Toyota Infotechnology Center USA, Inc.
• Inventors: Shiraishi, Shinichi, Rosu, Grigore, Daian, Philip, Iwai, Akihito, Mae, Yuki
• Primary Examiner(s): Deng, Anna C
• Application Number:
  US15/227,413
• Publication Number:
  US 20180039489A1
• Time in Patent Office: 923 Days
• Field of Search: 717171
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators

Abstract

The disclosure includes a system and method for providing a wireless software update for a connected vehicle. The connected vehicle includes a processor, an engine, a battery, a non-transitory memory storing a vehicle application and a wireless antenna that is powered by the battery and operable to receive a monitor module from a wireless network while the battery is not being charged. The processor is communicatively coupled to the battery, the wireless antenna and the non-transitory memory. The monitor module is written in an aspect language and includes a software patch for the vehicle application. The wireless antenna receives the monitor module from the wireless network while leaving a sufficient charge in the battery to enable the battery to start the engine. The processor installs the monitor module in the vehicle application stored in the non-transitory memory. Installation of the monitor module provides the software patch for the vehicle application.

Claims

1. A method comprising:

determining that an observed behavior of a vehicle application that is installed in a connected vehicle fails to conform to a desired behavior of the vehicle application as specified by runtime rules data, wherein the connected vehicle includes an engine and a battery;

receiving, by the connected vehicle, a monitor module via a wireless network; and

installing the monitor module in the vehicle application so that an object code of the vehicle application is modified to include the monitor module;

wherein the monitor module includes a software patch that is operable to correct an error that caused the observed behavior of the vehicle application to fail to correspond to the desired behavior of the vehicle application as specified by runtime rules data;

wherein the monitor module includes user input data describing user instructions for configuring the monitor module to generate the software patch;

wherein the vehicle application is an element of the connected vehicle;

wherein the monitor module is received and installed in the connected vehicle while the connected vehicle is powered off and the battery of the connected vehicle is not being charged; and

wherein the monitor module is written in an aspect language so that the connected vehicle receives the monitor module from the wireless network while also leaving a sufficient charge in the battery to start the engine.

2. A method comprising:

determining that an observed behavior of a vehicle application that is installed in a connected vehicle fails to conform to a desired behavior of the vehicle application as specified by runtime rules data, wherein the connected vehicle includes an engine and a battery;

receiving, by the connected vehicle, a monitor module with monitor data that describes the monitor module via a wireless network, wherein the monitor module includes a software patch that is operable to correct an error that caused the observed behavior of the vehicle application to fail to correspond to the desired behavior, the monitor data includes user input data describing user instructions for configuring the monitor module to generate the software patch; and

installing the monitor module in the vehicle application so that an object code of the vehicle application is modified to include the monitor module;

wherein the monitor module with the monitor data is received and installed in the connected vehicle while the connected vehicle is powered off and the battery of the connected vehicle is not being charged; and

wherein the monitor module is written in an aspect language so that the connected vehicle receives the monitor module with the monitor data from the wireless network while also leaving a sufficient charged in the battery to start the engine.

3. The method of claim 2, wherein the monitor module is generated by a Runtime Verification Monitor application (RV-Monitor application) present on a computing device that is communicatively coupled to the wireless network.

4. The method of claim 2, wherein receiving the monitor module includes downloading monitor data that describes the monitor module from the wireless network.

5. The method of claim 2, wherein the monitor module is installed in the vehicle application by a virtual machine.

6. The method of claim 5, wherein the virtual machine is a Java virtual machine.

7. The method of claim 2, wherein the monitor module includes code and routines that is operable to create trace data describing an operation of the vehicle application upon the vehicle application being executed by a processor of the connected vehicle.

8. The method of claim 7, wherein trace data describes a trace log.

9. The method of claim 7, wherein the processor is an element of an onboard computer of the connected vehicle.

10. A method comprising:

analyzing a set of runtime rules for a vehicle application to generate the monitor module for the vehicle application, wherein the set of runtime rules describes desired behavior of the vehicle application;

receiving user input data describing user instructions for configuring the monitor module to generate a software patch that is operable to correct an error that caused observed behavior of the vehicle application to fail to correspond to the desired behavior of the vehicle application;

distributing the monitor module with monitor data describing the monitor module to a connected vehicle via a wireless network, wherein the connected vehicle includes an engine and a battery; and

installing the monitor module in the connected vehicle to modify an object code of the vehicle application to include the monitor module so that the observed behavior of the vehicle application conforms to the desired behavior of the vehicle application;

wherein the monitor module with the monitor data is received and installed in the connected vehicle while the connected vehicle is powered off and the battery of the connected vehicle is not being charged; and

wherein the monitor module is written in an aspect language so that the connected vehicle receives the monitor module and the monitor data from the wireless network while also leaving a sufficient charge in the battery to start the engine.

11. The method of claim 10, wherein the connected vehicle receives the monitor data that describes the monitor module from the wireless network.

12. The method of claim 10, wherein the vehicle application is written in a Java language.

13. The method of claim 10, wherein the vehicle application is written in a C language.

14. A method comprising:

receiving, by a wireless antenna of a connected vehicle, a runtime monitoring software and digital data that describes the runtime monitoring software that is operable to patch a vehicle application stored in a non-transitory memory of the connected vehicle, wherein the runtime monitoring software includes a patch that is configured based on user input, and the connected vehicle includes an engine and a battery;

applying the patch to correct an error that caused an observed behavior of the vehicle application to fail to correspond to desired behavior of the vehicle application;

installing the runtime monitoring software in the vehicle application of the connected vehicle by modifying an object code of the vehicle application to include the runtime monitoring software in the vehicle application of the connected vehicle;

wherein the runtime monitoring software configures the vehicle application so that the observed behavior of the vehicle application conforms to the desired behavior of the vehicle application as specified by runtime rules data;

wherein the runtime monitoring software is received and installed in the vehicle application of the connected vehicle while the connected vehicle is powered off and the battery of the connected vehicle is not being charged; and

wherein the runtime monitoring software with the digital data is written in an aspect language in a file size that is configured based on an engine size of the connected vehicle so that the battery of the connected vehicle has sufficient charge to start the connected vehicle after receiving and installing the runtime monitoring software in the vehicle application.

15. A method comprising:

analyzing, by a processor of a computing device, a specification of a vehicle application to generate a runtime monitoring software for the vehicle application;

receiving user input data describing user instructions for configuring the runtime monitoring software to generate a software patch that is operable to correct an error that caused observed behavior of the vehicle application to fail to correspond to desired behavior of the vehicle application;

transmitting the runtime monitoring software with digital data describing the runtime monitoring software to a connected vehicle via a wireless network, wherein the connected vehicle includes an engine and a battery;

installing the runtime monitoring software in the connected vehicle by modifying an object code of the vehicle application to include the runtime monitoring software, wherein the runtime monitoring software modifies and configures the vehicle application so that the observed behavior of the vehicle application conforms to the desired behavior of the vehicle application as specified by runtime rules data;

wherein the runtime monitoring software with the digital data is transmitted and installed in the vehicle application of the connected vehicle while the connected vehicle is powered off and the battery of the connected vehicle is not being charged; and

wherein the runtime monitoring software with the digital data is written in an aspect language in a file size that is configured based on an engine size of the connected vehicle so that the battery of the connected vehicle has sufficient charge to start the connected vehicle after receiving and installing the runtime monitoring software in the vehicle application.

16. The method of claim 15, wherein the connected vehicle installs the runtime monitoring software in the vehicle application.

17. The method of claim 15, wherein the connected vehicle installs the runtime monitoring software during a boot time.

18. A connected vehicle comprising:

an engine;

a battery;

a non-transitory memory storing a vehicle application;

a wireless antenna that is powered by the battery and operable to receive a monitor module from a wireless network, the monitor module being configured based on user input data describing user instructions for configuring the monitor module to generate a software patch, the software patch is operable to correct an error that caused observed behavior of the vehicle application to fail to correspond to desired behavior; and

a processor installs the monitor module in the vehicle application stored in the non-transitory memory, and the monitor module provides the software patch for the vehicle application;

wherein the processor is communicatively coupled to the battery, the wireless antenna and the non-transitory memory;

wherein the wireless antenna receives a monitor module from the wireless network and the processor installs the monitor module in the vehicle application while the battery is not being charged and the engine is powered off; and

wherein the monitor module is written in an aspect language and includes the software patch

so that after the wireless antenna receives the monitor module from the wireless network and the processor installs the monitor module in the vehicle application while also leaving a sufficient charge in the battery to enable the battery to start the engine.

19. The connected vehicle of claim 18, wherein the monitor module further includes a runtime monitoring software that is operable to be executed by the processor to create a trace log describing a behavior of the vehicle application responsive to the vehicle application being executed by the processor.