Structure for updating software in remote device

• US 10,209,981 B2
• Filed: 02/02/2017
• Issued: 02/19/2019
• Est. Priority Date: 11/21/2016
• Status: Active Grant

• Current Assignee: NIO Technology Company Limited (Shanghai Anbin Technology Co., Ltd.)
• Original Assignee: Nio Usa Inc.
• Inventors: Hirshberg, Yanir, North, Craig
• Primary Examiner(s): Wu, Daxin
• Application Number:
  US15/423,186
• Publication Number:
  US 20180143818A1
• Time in Patent Office: 747 Days
• Field of Search: None
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

According to one embodiment, updating software in a remote device comprises operating on a first image of an operating system code, updating to a second image of the operating system code, wherein updating to the second image comprises operating on the second image while maintaining the first image in memory, and in response to detecting an error in operating on the second image, operating on the first image of the operating system code maintained in the memory accessible by the ECU. Operating on the first image of the operating system code can comprise saving the first image in the memory and executing the first image based on a pointer to the first image. Updating can comprise saving the second image without overwriting or erasing the first image and executing the second image based on a pointer to the second image.

Claims

1. A method for updating software in a remote device, the method comprising:

operating, by an Electronic Control Unit (ECU), on a first image of an operating system code;

updating, by the ECU, to a second image of the operating system code, wherein updating to the second image comprises operating, by the ECU, on the second image while maintaining the first image in memory accessible by the ECU; and

in response to detecting an error in operating on the second image, operating, by the ECU, on the first image of the operating system code maintained in the memory accessible by the ECU,

wherein operating on the first image of the operating system code comprises;

saving, by the ECU, the first image in the memory accessible by the ECU;

setting, by the ECU, a pointer to the first image saved in the memory; and

executing, by the ECU, the first image based on the set pointer to the first image,

wherein updating to the second image of the operating system code comprises;

saving, by the ECU, the second image in the memory accessible by the ECU without overwriting or erasing the first image;

setting, by the ECU, a pointer to the second image saved in the memory while maintaining the set pointer to the first image; and

executing, by the ECU, the second image based on the set pointer to the second image,

wherein operating on the first image of the operating system code maintained in the memory accessible by the ECU in response to detecting an error in operating on the second image comprises;

setting, by the ECU, another pointer to the first image based on the maintained set pointer to the first image; and

executing, by the ECU, the first image based on the set another pointer to the first image, and

wherein the ECU comprises an ECU for a component of a vehicle or a system of the vehicle.

2. The method of claim 1, wherein the pointer to the first image and the pointer to the second image are stored in a vector table in the memory accessible by the ECU.

3. The method of claim 1, wherein updating to the second image comprises performing an Over-The-Air (OTA) update of the operating system code of the ECU.

4. An Electronic Control Unit (ECU) comprising:

a processor; and

a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to update software in the ECU by;

operating, by the processor, on a first image of an operating system code;

updating, by the processor, to a second image of the operating system code, wherein updating to the second image comprises operating, by the processor, on the second image while maintaining the first image in the memory; and

in response to detecting an error in operating on the second image, operating, by the processor, on the first image of the operating system code maintained in the memory,

wherein operating on the first image of the operating system code comprises;

saving, by the ECU, the first image in the memory accessible by the ECU;

setting, by the ECU, a pointer to the first image saved in the memory; and

executing, by the ECU, the first image based on the set pointer to the first image,

wherein updating to the second image of the operating system code comprises;

saving, by the ECU, the second image in the memory accessible by the ECU without overwriting or erasing the first image;

setting, by the ECU, a pointer to the second image saved in the memory while maintaining the set pointer to the first image; and

executing, by the ECU, the second image based on the set pointer to the second image,

wherein operating on the first image of the operating system code maintained in the memory accessible by the ECU in response to detecting an error in operating on the second image comprises;

setting, by the ECU, another pointer to the first image based on the maintained set pointer to the first image; and

executing, by the ECU, the first image based on the set another pointer to the first image, and

wherein the ECU comprises an ECU for a component of a vehicle or a system of the vehicle.

5. The ECU of claim 4, wherein the pointer to the first image and the pointer to the second image are stored in a vector table in the memory.

6. The ECU of claim 4, wherein updating to the second image comprises performing an Over-The-Air (OTA) update of the operating system code of the ECU.

7. A non-transitory computer-readable medium comprising a set of instructions stored therein which, when executed by a processor, causes the processor to perform a software update by:

operating, by an Electronic Control Unit (ECU), on a first image of an operating system code;

updating, by the ECU, to a second image of the operating system code, wherein updating to the second image comprises operating, by the ECU, on the second image while maintaining the first image in memory accessible by the ECU; and

in response to detecting an error in operating on the second image, operating, by the ECU, on the first image of the operating system code maintained in the memory accessible by the ECU,

wherein operating on the first image of the operating system code comprises;

saving, by the ECU, the first image in the memory accessible by the ECU;

setting, by the ECU, a pointer to the first image saved in the memory; and

executing, by the ECU, the first image based on the set pointer to the first image,

wherein updating to the second image of the operating system code comprises;

saving, by the ECU, the second image in the memory accessible by the ECU without overwriting or erasing the first image;

setting, by the ECU, a pointer to the second image saved in the memory while maintaining the set pointer to the first image; and

executing, by the ECU, the second image based on the set pointer to the second image,

wherein operating on the first image of the operating system code maintained in the memory accessible by the ECU in response to detecting an error in operating on the second image comprises;

setting, by the ECU, another pointer to the first image based on the maintained set pointer to the first image; and

executing, by the ECU, the first image based on the set another pointer to the first image, and

wherein the ECU comprises an ECU for a component of a vehicle or a system of the vehicle.

8. The non-transitory computer-readable medium of claim 7, wherein the pointer to the first image and the pointer to the second image are stored in a vector table in the memory accessible by the ECU.

9. The non-transitory computer-readable medium of claim 7, wherein updating to the second image comprises performing an Over-The-Air (OTA) update of the operating system code of the ECU.