Opportunistic software updates during select operational modes

• US 10,691,525 B2
• Filed: 06/24/2019
• Issued: 06/23/2020
• Est. Priority Date: 07/25/2017
• Status: Active Grant

• Current Assignee: Aurora Labs Limited
• Original Assignee: Aurora Labs Limited
• Inventors: Fox, Zohar
• Primary Examiner(s): Aponte, Francisco J
• Application Number:
  US16/450,022
• Publication Number:
  US 20190310843A1
• Time in Patent Office: 365 Days
• Field of Search: 717173
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction
• CPC Class Codes: B60W 50/02 Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/0225 Failure correction strategy
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: B60W 50/045 Monitoring control system parameters
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1629 Error detection by comparing the output of redundant processing systems
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 12/0284 Multiple user address space allocation, e.g. using different base addresses interprocessor communication G06F15/163
• CPC Class Codes: G06F 12/0646 Configuration or reconfiguration
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2212/1008 Correctness of operation, e.g. memory ordering
• CPC Class Codes: G06F 2212/1044 : Space efficiency improvement
• CPC Class Codes: G06F 2212/1056 : Simplification
• CPC Class Codes: G06F 2221/033 : Test or assess software
• CPC Class Codes: G06F 8/60 : Software deployment
• CPC Class Codes: G06F 8/65 : Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/654 : using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 8/656 : while running
• CPC Class Codes: G06F 8/658 : Incremental updates; Differential updates
• CPC Class Codes: G06F 8/66 : of program code stored in read-only memory [ROM]
• CPC Class Codes: G06F 8/71 : Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/4401 : Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/445 : Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/44521 : Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
• CPC Class Codes: G06N 20/00 : Machine learning
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Disclosed embodiments relate to opportunistically updating Electronic Control Unit (ECU) software in a vehicle. Operations may include receiving, at a controller in a vehicle, a wireless transmission indicating a need to update software running on at least one ECU in the vehicle; monitoring an operational status of the vehicle to determine whether the vehicle is in a first mode of operation in which an ECU software update is prohibited; delaying the ECU software update when the operational status is prohibited; continuing to monitor the operational status of the vehicle to determine whether the vehicle is in a second mode of operation in which the ECU software update is permitted; and enabling updating of the at least one ECU with the delayed ECU software update when it is determined that the vehicle is in the second mode of operations.

Claims

1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for opportunistically updating controller software, comprising:

receiving, at a controller, a wireless transmission indicating a need to update software running on the controller, the controller controlling at least a portion of a device;

monitoring an operational status of the device at a first time to determine whether the device is in a first mode of operation in which a controller software update is prohibited;

delaying the controller software update when the operational status is prohibited;

continuing to monitor the operational status of the device at a second time to determine whether the device is in a second mode of operation in which the controller software update is permitted;

determining the device to be in the second mode of operation;

sending a message to a remote server when it is determined that the device is in the second mode of operation;

enabling updating of the controller with the delayed controller software update when it is determined that the device is in the second mode of operation, wherein the delayed controller software update is maintained on the remote server or on the device when the device is in the first mode of operation;

receiving the controller software update in response to the message; and

installing the controller software update on the controller when the device is in the second mode of operation;

wherein the controller software is mapped to a plurality of functional units, and the controller is configured to utilize a virtual file system (VFS) to manage and track one or more symbols representing versions of the plurality of functional units.

2. The non-transitory computer readable medium of claim 1, wherein continuing to monitor the operational status of the device comprises repeatedly monitoring the operational status of the device according to a preestablished interval.

3. The non-transitory computer readable medium of claim 1, wherein the instructions further comprise:

storing the controller software update in a memory located on the device for delayed updates when the device is in the first mode of operation.

4. There non-transitory computer-readable medium of claim 1, wherein the controller software update comprises at least one position-independent executable code segment.

5. The non-transitory computer readable medium of claim 1, wherein the second mode of operation comprises one of a plurality of predetermined safe operating conditions.

6. The non-transitory computer readable medium of claim 1, wherein the second mode of operation comprises a power-down status of the device.

7. The non-transitory computer readable medium of claim 1, wherein the wireless transmission is received in response to activity data related to the controller deviating from expected controller activity data.

8. The non-transitory computer readable medium of claim 1, wherein the second mode of operation comprises a period of wireless communications strength above a threshold of strength.

9. The non-transitory computer readable medium of claim 1, wherein the second mode of operation comprises a preselected environmental condition of the device.

10. The non-transitory computer readable medium of claim 1, wherein the second mode of operation comprises a network connection with an error rate below a threshold.

11. The non-transitory computer readable medium of claim 1, wherein the wireless transmission indicating the need to update the software comprises an indication of whether the update is with or without an override status.

12. The non-transitory computer readable medium of claim 11, wherein the instructions further comprise:

updating the controller software regardless of whether the device is in the first mode of operation when the update is received with the override status.

13. A system for opportunistically updating controller software, the system comprising:

one or more processors; and

one or more memories having instructions that, when executed by the one or more processors, cause the one or more processors to perform operations of;

receiving, at a controller, a wireless transmission indicating a need to update software running on the controller, the controller controlling at least a portion of a device;

monitoring an operational status of the device at a first time to determine whether the device is in a first mode of operation in which a controller software update is prohibited;

delaying the controller software update when the operational status is prohibited;

continuing to monitor the operational status of the device at a second time to determine whether the device is in a second mode of operation in which the controller software update is permitted;

determining the device to be in the second mode of operation;

sending a message to a remote server when it is determined that the device is in the second mode of operation;

enabling updating of the controller with the delayed controller software update when it is determined that the device is in the second mode of operation, wherein the delayed controller software update is maintained on the remote server or on the device when the device is in the first mode of operation;

receiving the controller software update in response to the message; and

installing the controller software update on the controller when the device is in the second mode of operation;

wherein the controller software is mapped to a plurality of functional units, and the controller is configured to utilize a virtual file system (VFS) to manage and track one or more symbols representing versions of the plurality of functional units.

14. The system of claim 13, wherein the controller software update comprises at least one position-independent executable code segment.

15. The system of claim 14, wherein continuing to monitor the operational status of the device comprises repeatedly monitoring the operational status of the device according to a preestablished interval.

16. The system of claim 14, wherein the wireless transmission indicating the need to update the software comprises an indication of whether the update is with or without an override status.

17. The system of claim 16, wherein the one or more processors are further configured to perform the operations of:

updating the controller software regardless of whether the device is in the first mode of operation when the update is received with the override status.

18. A computer-implemented method for opportunistically updating controller software, the method comprising:

receiving, at a controller, a wireless transmission indicating a need to update software running on the controller, the controller controlling at least a portion of a device;

monitoring an operational status of the device at a first time to determine whether the device is in a first mode of operation in which a controller software update is prohibited;

delaying the controller software update when the operational status is prohibited;

continuing to monitor the operational status of the device at a second time to determine whether the device is in a second mode of operation in which the controller software update is permitted;

determining the device to be in the second mode of operation;

sending a message to a remote server when it is determined that the device is in the second mode of operation;

enabling updating of the controller with the delayed controller software update when it is determined that the device is in the second mode of operation, wherein the delayed controller software update is maintained on the remote server or on the device when the device is in the first mode of operation;

receiving the controller software update in response to the message; and

installing the controller software update on the controller when the device is in the second mode of operation;

wherein the controller software is mapped to a plurality of functional units, and the controller is configured to utilize a virtual file system (VFS) to manage and track one or more symbols representing versions of the plurality of functional units.

19. The method of claim 18, wherein continuing to monitor the operational status of the device comprises repeatedly monitoring the operational status of the device according to a preestablished interval.

20. The method of claim 18, wherein the wireless transmission indicating the need to update the software comprises an indication of whether the update is with or without an override status, and wherein the method further comprises:

updating the controller software regardless of whether the device is in the first mode of operation when the update is received with the override status.