FR3104769A1 - Vehicle computer software update control method and device - Google Patents

Abstract

The invention relates to a method and a device for controlling the software update of one or more computers (103 to 105) of a vehicle. To this end, information representing the temperature of each computer (103 to 105) is received, for example the current temperature in the computer and the maximum temperature admissible by each computer. The update of the computer is controlled as a function of this or these temperature information. For example, the computer update is only launched if the difference between the maximum admissible temperature and the current temperature is greater than a determined threshold. Figure for abstract: Figure 1

Description

Vehicle ECU software update control method and device

The invention relates to a method and a device for controlling the software update of one or more computers of a vehicle, in particular of the automotive type. The invention also relates to a method and a device for controlling the temperature in one or more computers of a vehicle.

Technology background

Contemporary vehicles carry a number of computers, each performing one or more functions, such as, for example, the management of driving assistance, traction control, electronic brake distribution or even the control of actuators to ensure the operation optimal for a combustion engine.

These computers are also called UCE ("Electronic Control Unit" or in English ECU "Electronic Control Unit"). These computers embed software which is executed to ensure the functions for which they are responsible. Updates to this software are sometimes necessary, for example to improve a function or to correct an error, also called a “bug” in computing. These updates can be critical, especially for software that ensures the proper functioning of the vehicle and the safety of vehicle passengers. Controlling these updates is therefore particularly important

These computers each embed one or more microprocessors which dissipate a lot of thermal energy, especially when they are heavily used, which may be the case when loading and installing the update of one or more on-board software on each of these calculators. Furthermore, certain areas of a vehicle concentrate several computers in a small space, which increases the risk of overheating of these computers and of premature deterioration of the electronic components of these computers.

An object of the present invention is to limit the rise in temperature of a computer on board a vehicle.

Another object of the present invention is to reduce the risks of thermal failure of a computer on board a vehicle.

Another object of the present invention is to limit the risk of interruption of a software update of a computer on board a vehicle.

According to a first aspect, the invention relates to a method for controlling the software update of a vehicle computer, the method being implemented in a communication device on board the vehicle, the method comprising the following steps:

- reception of at least one piece of information representative of the computer temperature;

- control of the software update of the computer as a function of at least one piece of information.

According to a variant, the at least one item of information belongs to a set of information comprising:

- information representative of a current temperature value in the computer;

- information representative of a maximum temperature acceptable by the computer.

According to yet another variant, the control includes a download of the software update via a wireless link according to the at least one piece of information.

According to another variant, the control comprises a control of a download rate as a function of the at least one piece of information.

According to an additional variant, the download is implemented when a difference between the maximum admissible temperature and the current temperature value is greater than a threshold.

According to an additional variant, the download rate is controlled according to a difference between the maximum admissible temperature and the current temperature value.

According to a second aspect, the invention relates to a software update control device for a vehicle computer, the device comprising a memory associated with a processor configured for the implementation of the steps of the method according to the first aspect of the 'invention.

According to a third aspect, the invention relates to a system comprising a device as described above according to the second aspect of the invention and the computer connected to the device via a wired connection.

According to a fourth aspect, the invention relates to a vehicle, for example of the automobile type, comprising a device as described above according to the second aspect of the invention or a system as described above according to the third aspect of the invention. 'invention.

According to a fifth aspect, the invention relates to a computer program which comprises instructions adapted for the execution of the steps of the method according to the first aspect of the invention, this in particular when the computer program is executed by at least one processor.

Such a computer program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

According to a sixth aspect, the invention relates to a computer-readable recording medium on which is recorded a computer program comprising instructions for the execution of the steps of the method according to the first aspect of the invention.

On the one hand, the recording medium can be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM memory, a CD-ROM or a ROM memory of the microelectronic circuit type, or even a magnetic recording means or a hard disk.

On the other hand, this recording medium can also be a transmissible medium such as an electrical or optical signal, such a signal being able to be conveyed via an electrical or optical cable, by conventional or hertzian radio or by self-directed laser beam or by other ways. The computer program according to the invention can in particular be downloaded from an Internet-type network.

Alternatively, the recording medium may be an integrated circuit in which the computer program is incorporated, the integrated circuit being adapted to execute or to be used in the execution of the method in question.

Brief description of figures

Other characteristics and advantages of the invention will emerge from the description of the non-limiting embodiments of the invention below, with reference to the appended figures 1 to 3, in which:

schematically illustrates an environment for updating an on-board system in a vehicle, according to a particular embodiment of the present invention;

schematically illustrates a software update control device for one or more computers of the on-board system of FIG. 1, according to a particular embodiment of the present invention;

illustrates a flowchart of the different steps of a software update method for one or more computers of the on-board system of FIG. 1, according to a particular embodiment of the present invention.

A method and a software update control system for a vehicle computer will now be described in the following with reference to FIGS. 1 to 3. The same elements are identified with the same reference signs throughout. of the following description.

According to a particular and non-limiting embodiment of the invention, a method for controlling the software update of one (or more) computer(s) of a vehicle comprises the reception of information(s) representative of temperature of each computer, for example the current temperature in the computer and the maximum temperature admissible by each computer. The update of the computer is controlled as a function of this or these temperature information. For example, the computer update is only launched if the difference between the maximum admissible temperature and the current temperature is greater than a determined threshold.

Control of the software update (for example update of one or more firmwares) of a computer according to temperature information associated with this computer makes it possible to reduce the risks of overheating of the computer by limiting the updates. update (or not launching an update) if the temperature is too high or too close to a maximum allowed temperature. This avoids launching an update and having to interrupt it during loading or installation because the temperature of the ECU has become too high, an interruption that could cause malfunctions or harmful alerts for the user of the vehicle.

schematically illustrates an environment for updating an on-board system 10 in a vehicle, according to a particular and non-limiting embodiment of the present invention.

The system 10 is advantageously embedded in a vehicle, for example of the automobile type. The system 10 includes for example a communication device 101 connected to one or more computers 103, 104 and 105 on the one hand and to a communication box 102 on the other hand. The computers 103 to 105 are for example of the UCE type. An ECU is made up of an electronic computer and one or more on-board software which perform one or more servo-controls. By way of example, the computer 103 corresponds for example to a computer in charge of the IVI system (from the English “In Vehicle Infotainment” or in French “Infodivertissement dans le vehicle”). The computer 104 corresponds for example to a computer in charge of the ADAS system (from the English “Advanced Driver-Assistance System” or in French “Advanced Driving Assistance System”)). The computer 105 corresponds for example to a computer of the VSM type (from the English "Vehicle Supervisor Module" or in French "Vehicle Supervision Module") in charge of coordinating the vehicle electronic functions of the passenger compartment and in charge of providing the interconnection network infrastructure of all the other computers in the vehicle. Of course, the number of ECUs in System 10 is not limited to 3 and extends to any number, for example 10, 20, 50, 100 or more ECUs. The computers are not limited to the types of computers described above but extend to any type of computer on board a vehicle.

The communication device 101 also corresponds, for example, to a computer or to a gateway. The device 101 is responsible for orchestrating and controlling the software update of all the computers 103 to 105. The communication device 101 is for example connected to the computers 103 to 105 via a wired connection, for example a data bus type communication bus. The computers 101 and 103 to 105 form, for example, a multiplexed architecture for performing various useful services for the correct operation of the vehicle and for assisting the driver and/or the passengers of the vehicle in controlling the vehicle. The computers 101 and 103 to 105 communicate and exchange data with each other via one or more computer buses, for example a communication bus of the CAN data bus type (from the English “Controller Area Network” or in French “Réseau de Contrôleurs”), CAN FD (from the English “Controller Area Network Flexible Data-Rate” or in French “Réseau de Contrôleurs à Flow de Data Flexible”), FlexRay (according to the ISO 17458 standard) or Ethernet ( according to ISO/IEC 802-3).

The communication device 101 is also connected to a computer 102 in charge of communications with the exterior of the vehicle. The computer 102 corresponds for example to a communication box of the TCU telematic control unit (Telematic Control Unit) type, BTA box ("Autonomous Telematics Box") or BSRF box ("Radio Frequency Services Box") ). Such a computer 102 is advantageously connected to one or more antennas for example to receive data from a remote device, for example a remote server of the "cloud" 11 (or "cloud" in French), via a wireless link, according to OTA technology for example. The computer 102 receives for example the software updates stored for downloading in a server of the “cloud” 11 via for example the Internet with an OTA type connection (from English “over-the-air”, or in French “by air”). The OTA type connection uses for example one or more wireless communication protocols such as Bluetooth®, Wi-Fi® (based on IEEE 802.11), LTE (from English “Long-Term Evolution” or in French “Evolution à long term”), LTE-Advanced (or in French LTE-advanced).

The communication device 101 is linked to the computer 102 via a wired link, for example a CAN, CAN FD, FlexRay or Ethernet type data bus. The communication device acts as a gateway between the computer 102 and the other computers 103 to 105 of the vehicle's on-board system. The communication device 101 is thus adapted to control and regulate the downloading of update data(s) of one or more software installed or embedded on one or more of the computers 103 to 105 of the vehicle's embedded system.

In a first operation, one or more pieces of information representative of temperature are received by the communication device 101. This information comprises for example one or more of the following data or pieces of information:

- information representative of a current temperature value in the computer, that is to say the value of the temperature in the computer 103 to 105 concerned at a time “t”;

- information representative of a maximum temperature admissible by the computer, that is to say for example the value of the maximum temperature which is admitted by a given computer 103 to 105, this value being for example determined and fixed once for all (for example according to the components forming the computer); according to another example, this information representative of a maximum temperature admissible by the computer corresponds to a temperature difference ‘∆T’ between the current temperature at time “t” and the maximum admissible temperature.

The temperature information(s) are for example transmitted automatically, without request, by each of the computers 103 to 105 at regular intervals to the communication device 101, for example every 1, 5, 10, 30 seconds. According to a variant, the frequency of raising the temperature information increases when the temperature exceeds a threshold value (the threshold value is for example equal to the maximum admissible temperature minus a percentage (for example 10, 20 or 30%) of this maximum temperature eligible).

According to a variant embodiment, the temperature information or information is transmitted by one or more computers 103 to 105 following receipt of a request transmitted by the communication device 101 to obtain this temperature information from one, several or all the computers 103 to 105. According to a particular example, the communication device 101 transmits a request to obtain the temperature information only to the computers concerned by a software update.

This temperature information, in particular the current temperature values, is for example received from a temperature sensor integrated in each computer 102 to 105. A temperature sensor corresponds for example to a silicon temperature sensor or a sensor operating as a two-terminal Zener diode, providing temperature information on a few bits, for example on 8, 10, 12 or 14 bits. According to another example, the temperature sensor or sensors correspond to a linear analog temperature sensor with a CMOS integrated circuit (from the English "Complementary Metal Oxide Semiconductor" or in French "Semiconductor to complementary metal oxide") with an output voltage proportional to temperature.

According to another variant embodiment, part of the temperature information, for example the maximum admissible temperature value, is received by the processor or microprocessor of the communication device 101 from a memory element of this communication device 101. This element of memory comprises for example a LUT (Look-Up table) type correspondence table establishing the correspondence between a computer identifier and the maximum temperature value admissible by this computer. The communication device 101 thus determines for each computer of the on-board system concerned by a software update the maximum admissible temperature value from the identifier of each computer concerned and the correspondence table. The identifier of each computer 103 to 105 is for example transmitted to the communication device 101 following a request from the latter or during exchanges of data frames (the identifier being for example included in the header of a frame) .

In a second operation, the software update of one or more computers 102 to 105 is controlled by the communication device 101 according to the temperature information or information received. For example, when the communication device 101 receives one or more notifications indicating that one or more software updates are available for one or more computers 103 to 105, the communication device checks the temperature of each of the computers 102 to 105 concerned . The notification or notifications are, for example, received from a “cloud” server 11 via the computer 102.

According to a first particular embodiment, the communication device 101 compares, for example, the temperature of a target computer 103 to 105 (that is to say, recipient of the update(s)) with a temperature threshold value before to accept the downloading of the update data for transmission of these data to the target computer 103 to 105 so that the latter carries out the update, the downloading and the updating being launched only if the current temperature in the computer is below the threshold value.

According to another example, the communication device compares the temperature difference 'ΔT' between the current temperature in the target computer 103 to 105 and the maximum admissible temperature for this target computer 103 to 105. The downloading of the update data update by the communication device 101 and the update by the target computer receiving the update data from the communication device 101 are launched only if the difference 'ΔT' is greater than a threshold. This check ensures that the target computer will not exceed the maximum admissible temperature value during the execution of the update by its microprocessor(s). This makes it possible to avoid an interruption of the update due to excessively high temperature, such an interruption leading for example to a reinitialization of the computer with the consequence of a fault in the functions provided by this computer. Such a fault may worry the driver of the vehicle and/or require the performance of a diagnosis after the fact, which is a source of annoyance for the driver of the vehicle.

The threshold value with which the difference “∆T” is compared is for example determined and fixed beforehand (for example stored in the memory of each computer 103 to 105 or in the correspondence table in the memory of the communication device 101).

According to a variant, this threshold value is a function of the update, for example a function of the data volume of the update or of the load induced by this update for the microprocessor of the target computer 103 to 105. According to this variant , the higher the data volume and/or the induced load, the higher the threshold value.

According to a second particular embodiment, the communication device 1 adjusts the bit rate for downloading update data and the bit rate for transferring (downloading) this data to the computer(s) 103 to 105 concerned as a function of the temperature information. For example, when the difference '∆T' decreases, for example until it reaches a threshold, the data download and/or transfer rate is reduced to reduce the load on the microprocessor of the computer receiving this data and thus limit or reduce the computer temperature rise. This embodiment is for example implemented in parallel and in addition to the first particular embodiment described above.

According to a variant, the communication device 101 downloads the update data when the latter are available in the "cloud" 11, without taking into account the temperature information of the computers 103 to 105. This data is advantageously stored in the memory of the device communication device 101. The communication device 101 then controls the transmission of this data according to the temperature information or information received intended for one or more computers 103 to 105, according to the first and/or the second embodiment described above. This variant makes it possible to store the updates when they are available in order to install them at a favorable moment, that is to say when the processors or microprocessors of the computers 103 to 105 are less or little used. This further allows update data to be downloaded when a wireless connection is available with the 'cloud' 11 and to install updates later if needed, even if there is no wireless connection to the 'cloud' 11 is then available.

Such a process makes it possible to reduce the risk of overheating of the computers while guaranteeing that the necessary update(s) of the computers of the vehicle's on-board system will be carried out, without generating an alert at the level of the vehicle due to an excessive temperature rise. in calculators.

schematically illustrates a device 2 configured to control a software update of one or more vehicle computers, according to a particular and non-limiting embodiment of the present invention. The device 2 corresponds for example to the communication device 101 or to a computer 102 to 105.

The device 2 is for example configured for the implementation of the operations described with regard to FIG. 1 and/or the steps of the method described with regard to FIG. 3. Examples of such a device 2 comprise, without being limited thereto , a gateway, a telematics control unit, known as a TCU, on-board electronic equipment such as a vehicle's on-board computer, an electronic computer such as an ECU ("Unité de Electronic Control”). The elements of device 2, individually or in combination, can be integrated in a single integrated circuit, in several integrated circuits, and/or in discrete components. The device 2 can be made in the form of electronic circuits or software (or computer) modules or else a combination of electronic circuits and software modules. According to different particular embodiments, the device 2 is coupled in communication with other similar devices or systems, for example via a communication bus or through dedicated input/output ports.

The device 2 comprises one (or more) processor(s) 20 and/or one or more microcontrollers configured to execute instructions for carrying out the steps of the method and/or for executing the instructions of the software or software embedded in the device 2. Processor 20 may include onboard memory, an input/output interface, and various circuits known to those skilled in the art. The device 2 further comprises at least one memory 21 corresponding for example to a volatile and/or non-volatile memory and/or comprises a memory storage device which can comprise volatile and/or non-volatile memory, such as EEPROM, ROM, PROM, RAM, DRAM, SRAM, flash, magnetic or optical disk.

The computer code of the on-board software or software comprising the instructions to be loaded and executed by the processor is for example stored on the first memory 21.

According to a particular and non-limiting embodiment, the device 2 comprises a block 22 of interface elements for communicating with external devices, for example a remote server or the "cloud", communication antennas of a cellular network . Block 22 interface elements include one or more of the following interfaces:

- RF radio frequency interface, for example of the Bluetooth®, Wi-Fi®, LTE type (from English “Long-Term Evolution” or in French “Evolution à long terme”) and/or LTE-Advanced (or in French LTE -advance);

- USB interface (from the English “Universal Serial Bus” or “Bus Universel en Série” in French);

- HDMI interface (from the English “High Definition Multimedia Interface”, or “Interface Multimedia Haute Definition” in French).

Data are for example loaded to the device 2 via the interface of block 22 using a Wi-Fi® network such as according to IEEE 802.11, an ITS G5 network based on IEEE 802.11p or a mobile network such as a 4G network (or LTE Advanced according to 3GPP release 10 – version 10) or 5G.

According to another particular embodiment, the device 2 comprises a communication interface 23 which makes it possible to establish communication with other devices (such as other computers of the on-board system when the device 2 corresponds to the communication device 101 or to a computer of the on-board system) via a communication channel 230, for example to receive or transmit the software update data. The communication interface 23 corresponds for example to a transmitter configured to transmit and receive information and/or data via the communication channel 230. The communication interface 23 corresponds for example to a CAN-type wired network (of the 'English "Controller Area Network" or in French "Réseau de Contrôleurs"), CAN FD (from English "Controller Area Network Flexible Data-Rate" or in French "Réseau de Contrôleurs à Flow de Data Flexible"), FlexRay or ethernet.

According to an additional particular embodiment, the device 2 can supply output signals to one or more external devices, such as a display screen, one or more loudspeakers and/or other peripherals respectively via interfaces output not shown.

illustrates a flowchart of the different steps of a software update control method for a computer on board a vehicle, according to a particular and non-limiting embodiment of the present invention. The method is for example implemented in the communication device 101 or in the device 2 of Figure 2.

In a first step 31, one or more pieces of information representing the temperature of the computer are received, for example from the computer or from a memory of the communication device 101 for at least part of this temperature information.

In a second step 32, the software update of the computer is controlled according to the information or information received. The update is for example initiated or not as a function of the temperature and/or the transfer rate of the update data is controlled and adapted as a function of the temperature information(s).

Steps 31 and 32 are advantageously repeated for each computer to be updated and for each update to be installed on one or more computers.

Of course, the invention is not limited to the embodiments described above but extends to a method for controlling the temperature of one or more computers and to the device configured for implementing the method.

The invention also relates to a vehicle, for example an automobile or more generally a land motor vehicle, comprising the device 2 of FIG. 2 or the on-board system 10 of FIG. 1.

Claims (10)

Method for controlling the software update of a vehicle computer (103), said method being implemented in a communication device (101) on board said vehicle, said method comprising the following steps:
- reception (31) of at least one piece of information representing the temperature of said computer (103);
- Control (32) of the software update of said computer according to said at least one piece of information. Method according to claim 1, for which said at least one piece of information belongs to a set of information comprising:
- information representative of a current temperature value in said computer (103);
- information representative of a maximum temperature admissible by said computer (103). Method according to one of claims 1 to 2, for which said control comprises downloading said software update via a wireless link as a function of said at least one piece of information. Method according to one of claims 1 to 3, for which said control comprises controlling the bit rate of said downloading as a function of said at least one item of information. Method according to claim 3 or 4 dependent on claim 2, for which said downloading is implemented when a difference between said maximum admissible temperature and said current temperature value is greater than a threshold. A method according to claim 4 when dependent on claim 2, wherein said download rate is controlled as a function of a difference between said maximum allowable temperature and said current temperature value. Device (2) for controlling the software update of a vehicle computer, said device comprising a memory (21) associated with at least one processor (20) configured for the implementation of the steps of the method according to any of claims 1 to 6. System (10) comprising the device (2) according to claim 7 and said computer (103) connected to said device (2) via a wired connection. Motor vehicle comprising the device (2) according to Claim 7 or the system (10) according to Claim 8. Computer program product comprising instructions adapted for the execution of the steps of the method according to one of Claims 1 to 6, when the computer program is executed by at least one processor.