Method to update software components

0001The invention relates to a method for updating at least one software component of a motor vehicle, comprising at least the steps of: determining vehicle configuration information includes at least information about which hardware and / or software components that are present in the specific motor vehicle, by a state determining device; Providing a telecommunications connection between a vehicle and a service interface external to the vehicle service device; Sending the configuration information determined by the vehicle state determining device, and identification data of the motor vehicle from the motor vehicle via the telecommunication link to the vehicle-external service device; Check based on the vehicle configuration information by the vehicle-external service device, whether one or more software components to be updated according to a available at the vehicle-external service device control law; Providing a corresponding update procedure by the vehicle-external service and updating of the software component to be updated based on the updating procedure.

0002Motor vehicles according to the present state of the art include a plurality of electronic control units, which include not only hardware components and software components or software components. Today, motor vehicles have an average lifespan of several years. Over this period, referred to as vehicle life cycle, intervention in the software shares are due to technical changes required, in particular exchanges, the addition or expansion of software, that certain software modules or software-based functions. Such procedures are referred to as updates of software components. If necessary, can be single update measures differ in Updates, in which the previously specified functions normally substantially maintained, and so enters a function Mehrung in upgrades, in which the specified functions is usually extended. A possible reason for the need of updates / upgrades can with regard to the connection to external devices, in particular accessory devices, for example, represent changing requirements. With the update of software components associated usually a change of configuration data of the motor vehicle. A possible reason for the need of updates / upgrades can with regard to the connection to external devices, in particular accessory devices, for example, represent changing requirements. With the update of software components associated usually a change of configuration data of the motor vehicle. A possible reason for the need of updates / upgrades can with regard to the connection to external devices, in particular accessory devices, for example, represent changing requirements. With the update of software components associated usually a change of configuration data of the motor vehicle.

0003From the prior art, for example from the <patcit id="pcit0001" dnum="WO2007098781A1"><text>WO 2007/098781 A1</text></patcit> and the <patcit id="pcit0002" dnum="US6820259B1"><text>US 6,820,259 B1</text></patcit>, A method for performing an upgrade of software components in motor vehicles, in particular processes of the type mentioned are already known. However, the known from the prior art have still considerable disadvantages in terms of the overall effort, which is to operate to all motor vehicles in which a particular update action should be made easily and efficiently on this fact to be informed and deemed necessary updating measure easily, safely and with little effort to perform.

0004It is an object of the invention to provide a simple and reliable method with low total cost of updating software components in motor vehicles to provide.

0005This object is achieved by a method having the features of claim 1. Advantageous embodiments and further developments of the invention emerge from the dependent claims.

0006According to the invention, the actual update of a software component to be updated only by the driver of the vehicle can be released. In order to move the driver in a corresponding release, updating the software to be updated component is offered to the driver from the vehicle-external service device prior to implementation. This can be done for example, by the transmission of an electronic message into the vehicle and their display in the MMI (Man Machine Interface) of the motor vehicle. The release may then be left by a confirmation action by the driver, for example the selection of a confirmation response (such as "OK." Or "Start Update."), Which is displayed to the driver at the same time with the transmitted message in the MMI.

0007In other words, extensive measures to prepare for the actual update of the driver are taken unnoticed before the release of the driver is not obtained for performing the actual update. The driver thus retains control over software upgrades, since the actual update is performed only on its release back. At the same time the driver, however, sending the vehicle configuration information and the identification data is not news, notes and / or requests concerning bothered because this is done in his view unremarkable "in the background" and without his intervention. The total cost in terms of actions and / or notifications of the driver is reduced by the invention.

0008The inventive method is based on a partial departure from the commonly untouched in the prior art approach to leave the driver's authority over the data traffic between his vehicle and the vehicle-external service device. However, this departure is only to the extent that information on the vehicle configuration and vehicle identification to the service center are transmitted so that this individual update action plan for the vehicle and may propose. Function Involved software components of the automobile are preferably not changed without driver intervention, removed and / or added.

0009With the participation of the driver is within the scope of this document, unless otherwise stated, a participation in a particular case, that is to understand at every single Versendevorgang. Later will be clear that the need for a unique driver's participation such as in the form of a MMI-controlled activation by which a plurality of Versendevorgängen is then initiated a service, certainly may be appropriate.

0010In order to satisfy data requirements, the sending of the vehicle configuration information and the identification data is preferably done via a secured connection or in encrypted form.

0011In order to meet even further privacy requirements, the vehicle configuration information and the identification data in the vehicle-external service device after processing immediately (or after a predetermined period of time) are deleted can automatically. The invention allows an individual examination of each to log on to the external to the vehicle service facility (and its vehicle configuration information and identification data transmitted) vehicle on the need for software updates and / or upgrades and an individual carrying out the actual required updates / upgrades. A purpose similar service quality can not be achieved through fleet-based testing and Notifizierungsmaßnahmen. The appearing at first glance to be a disadvantage (or even a practical implementation by way of standing) traffic for repeated transmission of the vehicle configuration information to the vehicle-external service facility is outweighed by the advantages of the process and can, if necessary by appropriate data selection and / or appropriate data preprocessing and / or a matched transmission timing of the individual vehicles of a vehicle fleet will be limited to a reasonable degree. associated with the process costs are at least partially compensated by reduced warranty costs, and increased customer satisfaction.

0012The vehicle configuration information includes, optionally in the form of a list, preferably have one or more of the following categories:<ul><li>Information concerning the vehicle to date and / or originally installed hardware components,</li><li>Information concerning the vehicle to date and / or originally existing software components</li><li>Mappings between the vehicle-date and / or originally installed hardware components and the vehicle to date and / or originally existing software components.</li></ul>

0013The identification data preferably includes at least a unique vehicle identification number, for example, the chassis number. Other information on the origin of the vehicle, in particular information regarding manufacturer, model, time of manufacture and / or-period, batch etc. are conceivable, as a so-called vehicle order, ie, a vehicle description and a corresponding production order.

0014It may alternatively or additionally, a special award for remote maintenance service identifier, such as a username for this award can be used.

0015In addition to the vehicle configuration information and the identification data further vehicle data, in particular fault memory contents and / or maintenance-related vehicle data and / or operating the vehicle's data and / or the vehicle's data and / or the use of software-based functions of the vehicle data relating to motor vehicle can be transmitted to the vehicle-external service facility.

0016The vehicle configuration information can be pre-processed onboard the effect automatically that it is compressed and / or reduced to potentially relevant for software updates information. Thus, the amount of data to be transmitted can be reduced or it can be sent to the vehicle-external service facility with the same total amount of data common vehicle configuration information.

0017The automatic preprocessing may vehicle side, for example, by the condition determining device, but alternatively by another processing unit of the vehicle can be carried out on a compression and / or filter rule. Such compression and / or filter rule can be permanently deposited with the vehicle, but can also be transmitted from the external to the vehicle service facility to the motor vehicle.

0018It can also take place an automatic pre-processing to the effect that only changes, so to speak, an increment or delta, from an earlier vehicle configuration is determined and transmitted to the vehicle-external service facility. The vehicle configuration information relating to the previous vehicle configuration then preferably remains stored in the vehicle-external service facility and is assigned to the increment or delta transmitted based on the identification data or based specifically mitgesendeter association data. In this way the amount of data to be transmitted can be significantly reduced or it can be sent to the vehicle-external service facility with the same total amount of data common vehicle configuration information.

0019Another way to considerable reduction of the transferred amount of data in a particular case is merely to determine a unique for a specific vehicle configuration identification code and transfer, in particular a so-called hash sum. been made in particular in cases in which a specific vehicle configuration has been transferred already at an earlier point in time to the vehicle-external service device and optionally also already in the vehicle-external service device based on this vehicle configuration, a check for updates needed and / or an update rule provided has been (but the updating according to the update instruction has not yet been voergenommen) the future process costs can be reduced, for example, as follows: It may initially both onboard as one such vehicle configuration clearly distinctive identification code, for example, the hash sum on the transmitted vehicle configuration, also be stored by the vehicle-external service facility. The part of the vehicle-external service facility stored identification code can optionally also not related to the actual vehicle configuration, but provided on its base update procedure. can then take a renewed transfer of the entire vehicle information in the sequence (or instead of having re-examined on need for updating and / or a recent deployment of an update rule) only a balance of mutual identification codes are made. As long as the mutual identification codes remain unchanged, no additional measures are required. However, the changes transmitted from the vehicle identification code due to a change of the vehicle configuration, new (full or complete) vehicle configuration information must be transmitted to the vehicle-external service apparatus accordingly. the stored in the vehicle-external service device identification code, for example, changes as a result of a particular Neuverfügbarkeit updates / upgrades,

0020Therefore, a preferred example of the present invention determined and transmitted vehicle configuration information represents a calculated via the respective vehicle configuration hash sum, which uniquely identifies this vehicle configuration.

0021Sending the vehicle configuration information and the identification data takes place time-controlled and / or event-controlled repeated.

0022A timing allows, for example, to ensure a maximum time delay between the availability of a new software component in the vehicle-external service device and a corresponding update range of the driver.

0023A timer also makes it possible to coordinate the traffic of a large number of motor vehicles in such a way that certain limits manageable amounts of data are not exceeded. To this end, the sending of the vehicle configuration information may be made periodically to each vehicle of a plurality of motor vehicles, wherein the transmission time points of the individual vehicles to be distributed within the period as uniformly as possible. The determination of the period and / or the transmission times can be accomplished by a factory and / or subsequent configuration of the vehicle. To comply with a specified "schedule" the motor vehicle preferably has a clock and / or a timer. A possible subsequent, that is not factory, Configuration of the temporal behavior of the motor vehicle transmission can either be made on site in a service mode or a wireless connection from a centralized service point. The central service point can thereby be the already mentioned outside the vehicle service facility. The wireless connection can be the same that is used for the transmission of the configuration information and identification data and / or for the transmission of updates / upgrades to the car.

0024Preferably, the sending of the vehicle configuration information and the identification data from the central service point, which may in particular the already mentioned external to the vehicle service device, also be completely deactivated or activated.

0025An event control in particular allows us to respond quickly to events as opposed to a time control.

0026As a triggering event, for example, the vehicle-side detecting a change in a hardware and / or software component of the motor vehicle can be defined. Thus, required for safe vehicle operation software "over the air" from the external to the vehicle service facility, for example, by a control device replacement in a workshop that does not have appropriate programming means, offered the driver to load into the vehicle.

0027As a triggering event can also be the first time and / or repeated connect a certain accessory device, particularly a mobile phone, an audio / video player or a portable computer, be defined to the motor vehicle. It can then be offered in a timely manner to the driver, the load of the accessory device suitable driver and / or integration software components into the vehicle.

0028As a triggering event and the exceeding of a certain running performance limit and / or refueling of the vehicle can be defined. This ensures that particularly heavily used vehicles in obtaining updated offers.

0029As a triggering event and the crossing of a country boundary or approaching a border can be defined. This ensures that updates / upgrades that are particularly suitable and / or for a particular country required to be offered to the driver in good time.

0030As a triggering event, the restarting of the vehicle after a prolonged non-use can be defined and / or the restoration of wireless access by the vehicle-external service device after a prolonged interruption of that accessibility. So the driver of a parked for example, for a long time in an underground parking the vehicle can be offered as soon as possible the resumption of vehicle use to bring their vehicles in the latest software version.

0031As a triggering event and the vehicle-side identification can be defined one, for example via a MMI commanded update request of the driver. According to an alternative embodiment of the present invention, the possibility of commanding such an update request, however, is deliberately not provided by the driver to free the driver completely from worrying about the need for software updates.

0032As a triggering event of receipt of a sent from the external to the vehicle service device or from another individual vehicle service facility trigger signal may optionally even be defined. In this way could the vehicle-external service facility or other service facility - subject to a reaction of the triggered Vehicles - control which vehicles are to be at what time checked for the availability of software updates. It is particularly advantageous appears to create the conditions to ensure that the vehicle-external control device can emit a vehicle-specific trigger that leads to the vehicle immediate or deferred review of updates / upgrades, if and when figures relate to the vehicle customer ordered free of charge or paid in a (online) software store an application, a content, a service or a feature that is then transferred into the vehicle, unlocked there or to be made available in the vehicle (upgrade case). According to an alternative embodiment of the present invention, the possibility of triggering an update by external to the vehicle service devices, however, is deliberately not provided to minimize the logistic effort in vehicle-external service device. In extreme cases, then no knowledge about it must be in the vehicle-external service facility which vehicles could get in touch with her to check the availability of a software update.

0033Also, data protection concerns that may exist could, given the unnoticed by the driver sending the vehicle configuration information and identification data to the vehicle-external service facility, are particularly unjustified when these data are not or not long for a concrete, individual upgrade process also in the vehicle-external service equipment are stored.

0034Preferably, the sending of the vehicle configuration information and the identification data - even if it is event-controlled - completely deactivated from a central service point or activated.

0035Alternatively or additionally, the sending of the vehicle configuration information and the identification information by the driver of the motor vehicle can be activated or completely deactivated, for example by deactivation or activation of a corresponding service. Repeatedly sending the vehicle configuration information and the identification data can therefore in particular due to a one-off - MMI-controlled involvement of the driver take place - or at least to repeated sending to be carried out with significantly less repetition rate (/ wöchentlicht / monthly / yearly re-activating service eg daily).

0036The determination of vehicle configuration information by the condition determining device can be carried out in manner known per se. Also, the provision of the wireless telecommunications link between the in-vehicle service interface and the vehicle-external service device can be carried out in manner known per se, as well as sending the vehicle configuration information and the identification data to the vehicle-external service device and the running at the vehicle-external service facility check whether one or more software components according to an available there control law is to be updated. The latter test can in the inventive method for example, correspond to that test,

0037Providing a corresponding update procedure by the vehicle-external service device and the updating of the software to be updated component based on the updating procedure is preferably carried out by specific software update packages or software upgrade packages are determined by using a title of each package, optionally together with a brief description of the packages transferred to the vehicle, where it is brought to the driver as available and suitable for display, and by transferring to a release of the driver's back and / or on a selection of individual packages offered by several, with subsequent release through these packages to the vehicle and are installed there.

0038Hereinafter, a preferred embodiment of the invention will be described with reference to the single accompanying drawing. This results in further detail, preferred embodiments and developments of the invention. Specifically schematically show<dl id="dl0001" compact="compact"><dt>Fig. 1</dt><dd>a flow chart of the process steps of an exemplary service based on the invention.</dd></dl>

0039According to the currently in use state of the art software-based updates and upgrades are carried out by different technical solutions in motor vehicles.

0040are known, inter alia, the following systems and methods:<ol><li>a) Workshop programming systems: To perform an update or upgrade the motor vehicle is wired or wireless connected via a local communication network to a workshop system via which the programming of the motor vehicle is carried out. Here, the workshop system checks through specific diagnostic queries sent to the motor vehicle which software version is present. Due to already available information is checked with a central system at the manufacturer then the system itself or a communication based on one (Wide Area) communication network, whether there are for this automotive software updates / upgrades. In the case of a positive test, the workshop system (off-board) takes over the programming of the motor vehicle. As an interface to the motor vehicle act special programming and diagnostic interface. are known workshop programming systems for programming the overall motor vehicle, but also for the updating of individual software components.</li><li>b) CD / DVD-based systems: Individual controllers called in motor vehicles (eg head units, that is the central navigation / entertainment system) or dedicated program components in the control devices can also be programmed by special programming CD / DVD. This usually involves the existing CD / DVD-feeder bays are used. are known in particular CD / DVD-based systems for programming the firmware of the navigation system of a motor vehicle.</li><li>c) USB-based systems: Individual control devices in motor vehicles (eg head units or even telephone / communication control devices) or dedicated program components in the control devices can also be programmed by software that resides on an external storage device connected via a USB port is connected to the motor vehicle. In such a storage medium, the software must be downloaded before, eg via the Internet and home PC. For this, the existing USB interfaces are used in motor vehicles. Known examples of the use of such USB-based systems are updating a driver software for telephone control, updating of applications for the head unit and the updating of map data of a navigation system.</li></ol>

0041In the said processes and systems (workshop programming systems, CD / DVD-based systems, USB-based systems)<ul><li>either vehicle configuration data and vehicle condition data from a central unit, from the motor vehicle checked at subsequent comparison of possible software updates / upgrades to carry out (especially so handled at workshop programming systems)</li><li>or else it is restricted or not checked whether the current known in the motor vehicle motor vehicle software is compatible with the software updates / upgrades, simply because the existing software will be overwritten. (Particularly as handled in CD / DVD-based systems, and USB-based systems).</li></ul>

0042In cases where a software or hardware must be subjected to operational reasons or because of the identified post-market functional errors updating or replaced during the life cycle of a motor vehicle in automotive experts also from a technical action (TA) is spoken. In such TA is usually a centralized system in which all data is already produced motor vehicles, a calibration is carried out which motor vehicles are however affected by a necessary software update or a hardware replacement. It can be made with the customer data then an adjustment of the motor vehicle records, so that the driver of the TA can be informed. but it can alternatively or additionally also create a list of relevant motor vehicles, to be performed for a TA at the next workshop visit. It can also be determined in the diagnosis of the motor vehicle in the workshop if there is a new software version for this car (see above description of workshop programming systems). The<patcit id="pcit0003" dnum="WO2007098781A1"><text>WO 2007/098781 A1</text></patcit> describes a telematics system or Tele-programming system that allows an online connection of the motor vehicle with a central infrastructure via a preferably wireless communication network. Within the framework of technical actions in such a system relevant motor vehicles could be informed by means of an electronic message that a software update, or a hardware replacement needs to be made for them. a necessary software update or a wanted by the client software upgrade over the wireless communication network can be made on the basis of such a telematic system or tele-programming system - in a comparable per se manner as prior art for mobile phones and computer ,

0043Workshop programming systems have particular drawbacks<ul><li>that an update of the software object requires a repair shop of the vehicle, which is connected to corresponding costs (Workshop assignment, loss of use for the driver, replacement vehicle) and</li><li>that the driver can not influence the update process itself, but what is updated alone decides the workshop.</li></ul>

0044CD / DVD-based systems, and USB-based systems in particular have the disadvantages,<ul><li>that stands on the date that a software update is usually no current vehicle configuration information available, which is why a supplied software update either - must carry sometimes very complex Kompatiblitätsbeschreibung or even - if in doubt - due to lack of information about the currently existing in the vehicle hardware and software can be carried out no update, although a deployed update would actually compatible, and</li><li>that the driver can not update independently and directly perform from the vehicle, but rather the software update / upgrade to pick up only "indirectly" (eg purchase of a CD / DVD or download via PC) and must bring the motor vehicle.</li></ul>

0045Both workshop programming systems and CD / DVD-based systems and USB-based systems have the disadvantages<ul><li>that software will only delay introduced updates to the vehicle (maintenance stay of the motor vehicle, customer informs himself about available updates, information by post / e-mail)</li><li>that is relevant for that information is the driver of a software-based TA motor vehicles consuming (create and manage lists) from available data must be determined,</li><li>that for a possible notification (by post or e-mail) the driver of a software update additional costs and additional expenses incurred (postage, administration, customer information) and</li><li>that drivers of vehicles that are now brought, where appropriate, alternative routes and without the knowledge of competent external to the vehicle service facility, the current software version, unnecessary information.</li></ul>

0046With the help of a data-transmission-capable communications device in the vehicle (vehicle service interface) it is possible to use a current status of all installed in the motor vehicle from the factory and / or subsequently exchanged in a workshop and / or upgraded hardware and software components (vehicle configuration information) to the determination to transfer (external to the vehicle service equipment) (by a state determining device) to a so-called back-end system. Since the current vehicle status (SW, HW and, if relevant fault memory, etc.) very often differs from the original factory-installed software and hardware components, it makes sense to make such data alignment periodically.

0047Once the vehicle data in the backend system are received, can take place individually for the currently connected with the back end each vehicle checking whether new for this vehicle - or optional subject - updates. Due to the "on-time" review of the received vehicle data can be ensured that the update processes are only triggered for the respective motor vehicle when it is actually affected.

0048There are exemplified the following individual steps for the practical implementation of the solution generally described above proposed (see flowchart. In <figref idrefs="f0001">Fig. 1</figref>):<ol><li>1. A motor vehicle registers communicatively wirelessly at regular time intervals, that is based on time (but possibly also on an event basis), at a communication device on the backend. The vehicle does not need to be located near the back-end system. The backend system, a single processing unit, or a plurality, if necessary locally distributed and networked together, comprise computing units (see FIG. 1 in block<figref idrefs="f0001">Fig. 1</figref>).</li><li>2. After a successful login, a set-vehicle-related data, which includes a vehicle identification number and a description of the motor vehicle configuration, consisting of the current hardware and software components and their versions, and all error memory entries, is transmitted via an application protocol to the back-end system (see FIG. block 2 in <figref idrefs="f0001">Fig. 1</figref>).</li><li>3. The backend system evaluates the received data and compares them with compatibility and configuration data from databases in the backend system to individually for the registered motor vehicle to check whether this vehicle is affected by one or more updates and upgrades. The review found both optional, as well as requiring updates or upgrades instead (see FIG. 3 in block<figref idrefs="f0001">Fig. 1</figref>).</li><li>4. An update / upgrade or even several recommended updates / upgrades for registered motor vehicle required or is to the motor vehicle (or its fahrzeuginteme service interface or other communication interface of the motor vehicle) transmits an electronic message (see. Block 4 in <figref idrefs="f0001">Fig. 1</figref>).</li><li>5. After this electronic message was received from the motor vehicle, the driver of the motor vehicle is informed through an appropriate MMI dialogue that (and if so, which) new updates / upgrades are available (see. Block 5 in <figref idrefs="f0001">Fig. 1</figref>).</li><li>6. The update / upgrade process is actively initiated by the driver by a control command within the MMI dialogue (cf. block 6. In <figref idrefs="f0001">Fig. 1</figref>).</li></ol>

0049The method steps according to blocks 1, 2 and 3 of <figref idrefs="f0001">Fig. 1</figref> preferably take place periodically repeated; the method steps according to the blocks 4, 5 and 6 from<figref idrefs="f0001">Fig. 1</figref> will only go through if actually recommended an update / upgrade for registered motor vehicle required or. The operation performed by the back end test in accordance with block 7 illustrates this. If an update / upgrade before, the method steps according to blocks 4 through 5 and 6. FIG. Otherwise, the next step in the application according to block. 1

0050The time or the frequency of transmission can be preferably adjusted from the backend. In this case, the following transmission rules can be defined as:<ul><li>Time-dependent triggering: The vehicle reports in each case after a predetermined time at the backend, and sends the data referred to.</li><li>Running Performance-Based Triggering: The vehicle logs every predetermined travel distance at the backend, and sends the data referred to.</li><li>Event triggering: upon the occurrence of a predefined condition, the vehicle reports the backend (eg falls below a critical battery voltage).</li><li>Remote triggering: The vehicle can be triggered from the backend individually, to log into the backend.</li></ul>

0051The repeated Log of the vehicle at the backend, and sending predetermined data to the back end can be regarded as the vehicle expiring service. Such a service may preferably central side, ie from the backend, switched on and off. If necessary, the driver can be given the opportunity to turn the self-service via operating means in the vehicle and off. The activation and deactivation of the service can be embedded in an approach to managing, in particular activation and deactivation of multiple services or an entire service package (for example, "TeleServices" in vehicles of the applicant).

0052By implementing the solution described above, among others, the following advantages can be achieved:<ul><li>It is reduced to informational motor vehicles, the number of software related a technical action and / or the availability of other updates / upgrades. Due to the "on-time" review of the actual vehicle state no relevant preselection of motor vehicles is necessary.</li></ul>

0053It is reduced in the back end of the effort to manage the vehicles concerned and / or potentially affected.

0054Through the regular comparison using a communication device, the timeliness of the data is improved, (in the case of storage) in the backend concerning the present installed in the vehicles of a fleet hardware and software components.

0055Finally, the timeliness of the automotive software status is improved as updates / upgrades can be performed on a regular basis regardless of the location of the motor vehicle, that is, without the driver having to visit a workshop for.