Module updating device

• US 9,128,798 B2
• Filed: 07/31/2014
• Issued: 09/08/2015
• Est. Priority Date: 10/17/2012
• Status: Expired due to Fees

• Current Assignee: Movimento Group (Aptiv PLC)
• Original Assignee: Movimento Group (Aptiv PLC)
• Inventors: Hoffman, Benjamin J., Umbach, Dan, Dorfstatter, Walter A., Withun, Brian
• Primary Examiner(s): Chen, Xi D
• Application Number:
  US14/448,830
• Publication Number:
  US 20150007155A1
• Time in Patent Office: 404 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

An automobile, vehicle, vessel or other device may include a plurality of modules, software applications, computer program products, controllers or other logically executing entities to facilitate controlling, implementing or otherwise enabling various operations according to computer-readable instructions, code or other information stored within a memory, such as within a file or other memory construct. A controller having capabilities sufficient to facilitate updating, modifying, creating or otherwise manipulating such stored files and/or corresponding instructions is contemplated.

Claims

1. A method for updating an old file stored within a memory of a module included within an automobile, the module being operable to facilitate an automobile related operation based at least in part on a first plurality of computer-readable instructions included within the old file, the method comprising:

determining a new file to be stored within the memory of the module in order to facilitate the automobile related operation, the new file including a second plurality of computer-readable instructions different in at least content and/or form than the first plurality of computer-readable instructions, the second plurality of computer-readable instructions being partitioned into a plurality of blocks;

transmitting a first set of instructions for commanding the module to begin a replacement operation for replacing at least part of the old file stored within the memory with the new file such that the module thereafter facilitates the automobile related operation at least based in part on the second plurality of computer-readable instructions;

logging progress of the replacement operation, including identifying a first block of the plurality of blocks being successfully written to the memory in place of a corresponding first portion of the old file and a second block of the plurality of blocks being unsuccessfully written to the memory in place of a corresponding second portion of the old file

determining whether the memory of the module is one of symmetrical and asymmetrical;

generating a second set of instructions to command the module to begin a re-replacement operation sufficient for at least replacing the second portion of the old file with the second block of the new file, the second set of instructions commanding the module to;

i). complete the re-replacement operation without replacing or re-writing the first block to the memory if the memory is symmetrical; and

ii). complete the re-replacement operation with replacement and re-writing of the first block to the memory if the memory is asymmetrical.

2. The method claim 1 further comprising transmitting a second set of instructions over a Controller Area Network (CAN) for commanding the module to begin the re-replacement operation.

3. The method claim 2 further comprising:

generating and transmitting the second set of instructions after transmitting the first set of instructions to the module and after determining the interruption while the module attempts to replace the old file with the new file according to the first set of instructions; and

determining the interruption in response to a controller on the automobile failing to determine a successful update message within a predefined period of time after the first block is successfully written to the memory, the controller transmitting the second set of instructions to the module while the module is unable to perform the automobile related operation, the automobile relying solely on the module to perform the automobile related operation such that the automobile is unable to provide the automobile related operation at a time when the second set of instructions are received at the module.

4. The method claim 1 further comprising:

determining an agenda for the replacement operation, the agenda defining each erase and program operation associated with replacing the old file with the new file, each erase operation specifying a beginning location and a length in the module to be erased and each program operation specifying a beginning location in the module to be programmed with the new file; and

generating the second set of instructions for the re-replacement operation according to progress indicated in the agenda so as to avoid replacing the first block and any additional blocks of the plurality of blocks successfully erased and programmed as part of the replacement operation if the memory is symmetrical.

5. The method claim 4 further comprising logging progress of the replacement operation by assigning an erased status and a programmed status in the agenda for each of the erase and program operations, the erased status indicating whether the corresponding erase operation has been one of successful and unsuccessful and the programmed status indicating whether the corresponding program operation has been one of successful and unsuccessful.

6. The method claim 5 further comprising determining the erased and programmed statuses as a function of a verification performed with a controller in the automobile following each erase and program operation, the verification indicating successful completion of the corresponding erase or program operation upon receipt of a suitable acknowledgement from the module and unsuccessful completion of the corresponding erase or program operation upon failure to receive a suitable acknowledgement from the module.

7. The method claim 1 further comprising transmitting the first set of instructions over a controller area network (CAN) of the automobile to the module.

8. The method claim 1 further comprising:

determining whether a user-engaged security state is active or inactive;

determining whether an operational state of the module is sufficient to perform the replacement operation;

determining whether a battery state of charge is sufficient to power the module for a period of time sufficient to perform the replacement operation;

transmitting the first set of instructions if the user-engaged security state is inactive and the operational and battery states are sufficient to perform the replacement operation; and

delaying transmission of the first set of instructions if the user-engaged security state is activated or the operational or battery states are insufficient to perform the replacement operation.

9. A non-transitory computer-readable medium having a plurality of instructions operable with a controller included on a vehicle to facilitate updating an old file stored within a memory of a vehicle module, the vehicle module being operable to facilitate a vehicle related operation based at least in part on a first plurality of computer-readable instructions included within the old file, the non-transitory computer-readable medium comprising instructions sufficient for:

determining a new file to be added to the memory in place of or in addition to at least part of the old file, the new file including a second plurality of computer-readable instructions to facilitate the vehicle related operation, the second plurality of computer-readable instructions being distributed across a plurality of blocks;

determining a plurality of operations to be performed in order to add each of the plurality of blocks to the memory, including determining one or more portions of the memory to be erased for each of the plurality of blocks prior to writing the plurality of blocks thereto, each portion being identified according to a length of the memory to be erased relative a beginning address;

logging performance of the plurality of operations while the new file is being added to the memory;

determining an interruption after successfully performing each of the erasing operations and a first plurality of the writing operations, and thereafter;

i). attempting to perform a second plurality of the writing operations without attempting to re-perform any of the erasing operations if the erasing and writing operations are symmetrical, the second plurality of the writing operations corresponding with the plurality of writing operations remaining after successful completion of the first plurality of the writing operations; and

ii). attempting to perform a third plurality of the writing operations if the erasing and writing operations are asymmetrical, the third plurality of the writing operations corresponding with attempting to re-perform each of the erasing and writing operations.

10. The non-transitory computer-readable medium of claim 9 further comprising instructions sufficient for wirelessly receiving an agenda from a server, the agenda defining at least some of the plurality of operations to be performed in order to add each of the plurality blocks to the memory, including erasing operations sufficient for erasing each of the portions from the memory and writing operations sufficient for writing each of the blocks to the memory, the erasing operations identifying the length of the memory to be erased relative the beginning address associated with the corresponding portion, the writing operations identifying a beginning address of the memory where the writing operation for each block is to commence.

11. The non-transitory computer-readable medium of claim 10 further comprising instructions sufficient for marking a status within the agenda indicating whether each of the erasing and writing operations was successfully or unsuccessfully performed as a function of corresponding acknowledgements transmitted over a Controller Area Network (CAN) of the vehicle from the vehicle module to the controller.

12. The non-transitory computer-readable medium of claim 11 further comprising instructions sufficient for attempting to perform a fourth plurality of the writing operations without attempting to re-perform any of the erasing operations if the interruption is determined and an early acknowledgment process is used to determine successful completion of the writing operations, the fourth plurality of the writing operations corresponding with a last performed one of the first plurality of the writing operations and any additional ones of the plurality of the plurality of writing operations remaining after successful completion of the first plurality of the writing operations.

13. The non-transitory computer-readable medium of claim 10 further comprising instructions sufficient for logging performance by transmitting status messages to the server following completion of each of the plurality of operations, including instructions sufficient for generating the status messages to indicate whether an operation associated with the corresponding one of the plurality of operations was successfully or unsuccessfully completed.

14. The non-transitory computer-readable medium method of claim 9 further comprising:

determining whether a user-engaged security state has been activated for the vehicle;

delaying performance of the plurality of operations in the event the user-engaged security state is activate;

transmitting a key or seed to the module prior to undertaking performance of the plurality of operations in the event the user-engaged security state is inactive, the module processing the key or seed to determine whether the plurality of operations are authorized;

delaying performance of the plurality of operations in the event the module fails to properly acknowledge the key or seed; and

undertaking performance of the plurality of operations in the event the module properly acknowledges the key or seed.

15. The non-transitory computer-readable medium of claim 10 further comprising instructions sufficient for determining the beginning addresses for the portions and the blocks associated with the erasing and writing operations such that at least a segment of the memory between two of the blocks is untouched by the erasing and writing operations.

16. A system for over-the-air (OTA) update of software included within a vehicle module comprising:

a controller configured to update the software of the vehicle module by facilitating erasing of a first plurality of memory blocks from a module memory of the vehicle module and thereafter programming of a second plurality of memory blocks to the module memory; and

a server configured to;

i) keep an agenda as the vehicle module attempts to erase the first plurality of memory blocks and to program the second plurality of memory blocks, the agenda indicating an erased status for each of the first plurality of memory blocks and a programmed status for each of the second plurality of memory blocks; and

ii) determine an interruption while the module attempts to erase one of the first plurality of memory blocks after successfully erasing another one or more of the first plurality of memory blocks, and in response thereto, to instruct the controller to;

(1) begin erasing the first plurality of memory blocks other than those successfully erased prior to the interruption as a function of updates made to the agenda after each one or more the first plurality of memory blocks were successfully erased if the agenda is symmetrical, and thereafter attempt to program the second plurality of memory blocks; and

(2) begin erasing each of the first plurality of memory blocks, including those successfully erased prior to the interruption, if the agenda is asymmetrical, and thereafter attempt to program the second plurality of memory blocks.

17. The system of claim 16 wherein the controller is configured to:

transmit separate erase instructions to the module for each of the first plurality of memory blocks to be erased and separate program instructions for each of the second plurality of memory blocks to be programmed, each the erase and program instructions being individually transmitted over a Controller Area Network (CAN) and according to a sequence specified in the agenda;

verify whether the module successfully or unsuccessfully executed each of the erase and program instructions, including determining successful completion of the corresponding erase or program instruction upon receipt of a suitable acknowledgement from the module and unsuccessful completion of the corresponding erase or program instruction upon failure to receive a suitable acknowledgement from the module; and

to add a last erased one of the memory blocks erased prior to the interruption to the first plurality of memory blocks to be erased following the interrupt when the memory is symmetrical if the module acts according to an early acknowledgement strategy, the early acknowledgment strategy causing the module to automatically indicate a positive response to the erase and program instructions upon receipt thereof.