PRE-SHUTDOWN SWAP VERIFICATION

• US 20180189049A1
• Filed: 01/03/2017
• Published: 07/05/2018
• Est. Priority Date: 01/03/2017
• Status: Active Grant

• Current Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Original Assignee: Ford Global Technologies, LLC (Ford Motor Company)
• Granted Patent: US 10,782,955 B2
• Time in Patent Office: Days
• CPC Class Codes: B60R 16/02 electric constitutive elements
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4408 Boot device selection

Abstract

A system includes a first storage, a second storage, and a vehicle electronic control unit (ECU). The ECU is programmed to download a software update received from a server to the first storage, at keyoff, attempt a reboot of the ECU before vehicle shutdown, and confirm the first storage as being active for booting instead of the second storage, responsive to the vehicle ECU successfully booting to the first storage.

Claims

1. A system comprising:

a first storage;

a second storage; and

a vehicle electronic control unit (ECU), programmed to

download a software update received from a server to the first storage,

at keyoff, attempt a reboot of the ECU before vehicle shutdown, and

confirm the first storage as being active for booting instead of the second storage, responsive to the vehicle ECU successfully booting to the first storage.

2. The system of claim 1, wherein the vehicle ECU is further programmed to retain the second storage as active for booting, responsive to the vehicle ECU unsuccessfully booting to the first storage.

3. The system of claim 1, wherein the vehicle ECU is further programmed to apply the software update to the first storage while the vehicle ECU executes a software installation to the second storage of the vehicle ECU.

4. The system, of claim 1, wherein the vehicle ECU is further programmed to continue shutdown to a keyoff mode after the reboot.

5. The system of claim 1, wherein the vehicle ECU is further programmed to send a signal over a vehicle bus to other vehicle ECUs requesting that the vehicle shutdown be paused to allow the vehicle ECU to attempt the reboot.

6. The system of claim 1, wherein the vehicle ECU is further programmed to send a signal over a vehicle bus to other vehicle ECUs requesting that the vehicle shutdown be continued after the reboot.

7. The system of claim 1, wherein the vehicle ECU is further programmed to:

receive a first signal over a vehicle bus from a telematics control unit (TCU) requesting that the vehicle shutdown be paused to allow the vehicle ECU to attempt the reboot; and

receive a second signal over the vehicle bus from the TCU requesting that the vehicle shutdown be continued after the reboot.

8. The system of claim 1, wherein the first storage and the second storage are integral to the vehicle ECU.

9. A system comprising:

a telematics control unit (TCU); and

a plurality of vehicle electronic control units (ECUs) in communication with the TCU over a vehicle bus, one of the ECUs programmed to

at keyoff, reboot the ECU using a software update received from the TCU to a first storage, and

confirm the first storage as active for booting over a second storage, responsive to success of the reboot using the first storage.

10. The system of claim 9, wherein the TCU is further programmed to:

download the software update from a server; and

send the software update over the vehicle bus to the one of the ECUs.

11. The system of claim 9, wherein the vehicle ECU is further programmed to, responsive to an unsuccessful boot of the vehicle ECU to the first storage, retain the second storage as active for booting.

12. The system of claim 11, wherein the TCU is programmed to receive the software update from a remote server, and the vehicle ECU is further programmed to, responsive to an unsuccessful boot of the vehicle ECU using the software update, send a message to the TCU to cause the TCU to report the unsuccessful boot to the remote server.

13. The system of claim 9, wherein the vehicle ECU is further programmed to:

apply the software update to the first storage while the vehicle ECU executes a software installation to the second storage of the vehicle ECU; and

continue shutdown to a keyoff mode after the reboot.

14. The system of claim 9, wherein the vehicle ECU is further programmed to:

send a first signal over a vehicle bus to other vehicle ECUs requesting that vehicle shutdown be paused to allow the vehicle ECU to attempt the reboot; and

send a second signal over a vehicle bus to other vehicle ECUs requesting that the vehicle shutdown be continued after the reboot.

15. The system of claim 9, wherein the TCU is further programmed to:

send a first signal over a vehicle bus to the vehicle ECUs requesting that vehicle shutdown be paused to allow the vehicle ECU to attempt the reboot; and

send a second signal over a vehicle bus to the vehicle ECUs requesting that the vehicle shutdown be continued after the reboot.

16. A method for over-the-air software updates comprising:

confirming, by a vehicle ECU at keyoff before vehicle shutdown, a first storage as being active for booting instead of a second storage, responsive to the vehicle ECU successfully rebooting to the first storage, the first storage including a downloaded software update received from a remote server.

17. The method of claim 16, further comprising sending the software update over a vehicle bus to the vehicle ECU, responsive to downloading the software update from a server by a telematics control unit.

18. The method of claim 16, further comprising retaining the second storage as active for booting, responsive to the vehicle ECU unsuccessfully booting to the first storage.

19. The method of claim 16, further comprising:

applying the software update to the first storage while the vehicle ECU executes a software installation to the second storage of the vehicle ECU; and

continuing shutdown to a keyoff mode after rebooting.

20. The method of claim 16, further comprising:

sending a first signal over a vehicle bus to other vehicle ECUs requesting that the vehicle shutdown be paused to allow the vehicle ECU to attempt the reboot; and

sending a second signal over a vehicle bus to other vehicle ECUs requesting that the vehicle shutdown be continued after the reboot.