Abstract:
A method of updating a vehicle ECU includes establishing communication between a data communications module of a vehicle and an update server via a cellular network; validating the vehicle using a key exchange protocol between the data communications module and the update server; and sending update information from the update server to the data communications module of the vehicle via the cellular network, the update information configured to be used to update the vehicle ECU.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation of U.S. patent application Ser. No. 12/823,301 filed Jun. 25, 2010. 
     
    
     TECHNICAL FIELD 
       [0002]    The present specification generally relates to automated vehicle systems updating, and more particularly to over-the-air vehicle systems updating and associated security protocols. 
       BACKGROUND 
       [0003]    Vehicles, such as cars and trucks, are becoming increasingly computer controlled. Many operating characteristics are generally based on computer algorithms that are pre-programmed into various electronic control units (ECUs). The ECUs control one or more of the electrical systems or subsystems in the vehicle. Managing the increasing complexity and number of ECUs in a vehicle has become a key challenge for vehicle manufacturers. 
         [0004]    Currently, if there are any software or ECU issues with the vehicle or updates to the software or ECUs are available, the customer must drive or somehow transport the vehicle to a dealer for service. This can be inconvenient for the customer. Accordingly, a need exists for more convenient ways to update vehicle software and ECUs. 
       SUMMARY 
       [0005]    In one embodiment, a method of updating a vehicle ECU includes establishing communication between a data communications module of a vehicle and an update server via a cellular network; validating the vehicle using a key exchange protocol between the data communications module and the update server; and sending update information from the update server to the data communications module of the vehicle via the cellular network, the update information configured to be used to update the vehicle ECU. 
         [0006]    In another embodiment, an over-the-air system for updating a vehicle includes an update server including update information for use in updating a vehicle ECU. A data communications module on a vehicle is configured to communicate with the update server via a cellular network for receiving the update information from the update server. A diagnostic ECU is configured to communicate with the data communications module for receiving the update information from the data communications module. A vehicle ECU is configured to communicate with the diagnostic ECU for receiving update information from the diagnostic ECU. 
         [0007]    In another embodiment, a method of updating a vehicle ECU includes establishing communication between a data communications module of a vehicle and an update server via a cellular network; sending a security key from the data communications module of the vehicle to the update server; and sending update information from the update server to the data communications module of the vehicle via the cellular network if the security key is valid. 
         [0008]    These and additional features provided by the embodiments described herein will be more fully understood in view of the following detailed description, in conjunction with the drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]    The embodiments set forth in the drawings are illustrative and exemplary in nature and not intended to limit the subject matter defined by the claims. The following detailed description of the illustrative embodiments can be understood when read in conjunction with the following drawings, where like structure is indicated with like reference numerals and in which: 
           [0010]      FIG. 1  is a diagrammatic view of over-the-air updating of a vehicle according to one or more embodiments shown and described herein; 
           [0011]      FIG. 2  illustrates a method of over-the-air updating of a vehicle using a data communications module according to one or more embodiments shown and described herein; 
           [0012]      FIG. 3  illustrates another method of over-the-air updating of a vehicle using a data communications module according to one or more embodiments shown and described herein; 
           [0013]      FIG. 4  illustrates an over-the-air updating method where no updates are available according to one or more embodiments shown and described herein; 
           [0014]      FIG. 5  illustrates another method of over-the-air updating of a vehicle using a data communications module according to one or more embodiments shown and described herein; 
           [0015]      FIG. 6  illustrates an exemplary security protocol for validating update communications according to one or more embodiments shown and described herein; 
           [0016]      FIG. 7  illustrates an exemplary security key update and security key exchange protocol for update communications according to one or more embodiments shown and described herein; and 
           [0017]      FIG. 8  illustrates an exemplary security key exchange protocol for update communications according to one or more embodiments shown and described herein. 
       
    
    
     DETAILED DESCRIPTION 
       [0018]    Embodiments described herein generally relate to over-the-air (OTA) updating of vehicle systems and associated security protocols that can be used to validate an update source, update destination and/or the update communications themselves. The OTA updating systems and methods may utilize a data communications module (DCM) that provides a connection to update servers, for example, through a cellular network. The DCM may receive various updates from the update servers OTA (e.g., without any need for visiting a dealership or physical connection to a diagnostic device) that can be used to reprogram the vehicle&#39;s ECUs. A security protocol may be provided that is used to validate the source and destination of the update communications. The DCM may be connected to a diagnostic ECU capable of communicating with the vehicle ECUs, for example, via a controller area network (CAN). 
         [0019]    Referring to  FIG. 1 , a vehicle  10  (represented by dotted lines) may include a number of vehicle ECUs  12 . As used herein, a vehicle ECU refers to any embedded system that controls one or more of the electrical systems or subsystems in a motor vehicle. Exemplary vehicle ECUs include Airbag Control Units (ACU), Body Control Modules that control door locks, electric windows, courtesy lights, etc., Convenience Control Units (CCU), Door Control Units, Engine Control Units (ECU), Man Machine Interfaces (MMI), On-Board Diagnostics (OBD), Powertrain Control Modules (PCM), Seat Control Units, Speed Control Units, Telephone Control Units (TCU) that dial the telephone, Transmission Control Units (TCU), and the like. A diagnostic ECU  14  is provided that reprograms one or more of the vehicle ECUs  12  based on update information received via a communications link provided via a DCM  16 . The DCM  16  (e.g., vehicle telematics) provides the communications link to update servers  18  containing the update information, for example, through a cellular network  20 . 
         [0020]    Update information may be used to reprogram one or more of the vehicle ECUs  12  in order to modify one or more of the vehicle&#39;s systems. Some examples of modifications that can be made using the update information include fuel injection, ignition, water temperature correction, transient fueling, cam timing, gear control, and the like. 
         [0021]    Referring to  FIG. 2 , an exemplary method  22  for providing an update OTA includes the DCM  16  contacting the update servers  18  via the cellular network  20  at step  24  to determine whether an update is available. In the example of  FIG. 2 , the DCM  16  may contact the update servers  18  upon ignition start of the vehicle  10 . In another embodiment, the DCM  16  may contact the update servers  18  at some other time, such as upon the operator&#39;s request. This determination step  24  may include one or more substeps such as at step  24   a,  the DCM  16  may send current ECU update version and VIN number information to the update servers  18 , which may be used in determining whether an update is available for that particular requesting vehicle. If an update is available, at step  24   b,  an indication of the availability of an update may be provided to the DCM  16 . At step  26 , the DCM  16  may provide an indication to the update servers  18  that it is ready for the update download. The update servers  18  may then send the update information to the DCM  16  at step  28  and a download complete message may be sent from the DCM  16  to the update servers  18  at step  30 . 
         [0022]    The update information may be provided from the DCM  16  to a software buffer  32  for temporary storage of the update information. The diagnostic ECU  14  may control storage and delivery of the update information that is saved in the software buffer  32 . In some embodiments, the update information may include data for use by the diagnostic ECU  14  in determining the type of update that is available. In  FIG. 2 , for example, the update information is for updating a navigation ECU  34  (e.g., with map information and the like). Once the destination is determined by the diagnostic ECU  14 , the diagnostic ECU  14  notifies the navigation ECU  34  that an update is available at step  36  and the navigation ECU  34  notifies the diagnostic ECU  14  that it is ready to receive the update information at step  38 . At step  40 , the diagnostic ECU  14  provides the update information over the CAN  42  to the navigation ECU  34 , which is used to update the navigation ECU  34 . A message may be sent from the navigation ECU  34  to the diagnostic ECU  14  that the update is complete at step  44 . 
         [0023]    The OTA updating systems may also be used to calibrate or reconfigure various vehicle systems, such as the engine, brakes, lights, climate control, etc. Referring to  FIG. 3 , another exemplary method  50  for providing an update OTA includes the DCM  16  contacting the update servers  18  via the cellular network  20  at step  52  to determine whether a configuration update is available. The DCM  16  may contact the update servers  18  upon ignition start of the vehicle  10  or at other times, such as upon operator command. This determination step  52  may include one or more substeps such as at step  52   a,  the DCM  16  may send current ECU update version information and VIN number information to the update servers  18 , which may be used in determining whether a configuration update is available. If a configuration update is available, at step  52   b,  an indication of the availability of an update may be provided to the DCM  16 . At step  54 , the DCM  16  may provide an indication to the update servers  18  that it is ready for the update download. The update servers  18  may then send the configuration update information to the DCM  16  at step  56  and a download complete message may be sent from the DCM  16  to the update servers  18  at step  58 . 
         [0024]    The configuration update information may be provided from the DCM  16  to the software buffer  32  for temporary storage of the configuration update information. The diagnostic ECU  14  may control storage and delivery of the configuration update information that is saved in the software buffer  32 . In some embodiments, the configuration update information may include data for use by the diagnostic ECU  14  in determining the type of configuration update that is available. In  FIG. 3 , for example, the configuration update information is for reconfiguring an engine ECU  60  (e.g., fuel injection and the like). Once the destination is determined by the diagnostic ECU  14 , the diagnostic ECU  14  notifies the engine ECU  60  that an update is available at step  62  and the engine ECU  60  notifies the diagnostic ECU  14  that it is ready to receive the update information at step  64 . At step  66 , the diagnostic ECU  14  provides the configuration update information over the CAN  42  to the engine ECU  60 , which is used to reconfigure the engine ECU  60 . A message may be sent from the engine ECU  60  to the diagnostic ECU  14  that the update is complete at step  68 . 
         [0025]    Referring to  FIG. 4 , in some instances, an update may not be available for a vehicle (e.g., the vehicle may have the most recent software versions and calibration data). At step  70 , the DCM  16  may contact the update servers  18  via the cellular network  20  to determine whether a configuration update is available. At step  74 , the DCM  16  may provide ECU software/calibration version information and VIN information to the update servers  18 . The update servers  18 , upon a determination that the vehicle has the current versions, may provide an indication to the DCM  16  that no updates are available at step  76 . The DCM  16  may then discontinue the connection with the update servers  18  at step  78 . 
         [0026]    Referring to  FIG. 5 , while the OTA update procedures my be initiated from the vehicle, in other embodiments, the OTA updates may be initiated from outside the vehicle, such as using a personal computer  80 , hand-held device such as a cellular phone, etc. For example, the personal computer  80  may have access to the update servers  18  via the Internet  83 . The computer  80  may include software for interacting with the update servers  18 , for example, to determine which updates have been downloaded and what updates are available for the vehicle. The vehicle owner (or other person) may select updates on the computer  80  to be downloaded to the vehicle, for example, upon ignition of the vehicle in a process similar to that discussed above with regard to  FIGS. 2 and 3 . In some of these embodiments, the steps for determining whether updates are available from the vehicle may be skipped and the update servers  18  may provide the selected updates to the DCM  16 . 
         [0027]    Referring to  FIG. 6 , one embodiment of an exemplary security protocol  82  may be provided to validate communications between the DCM  16  and the update servers  18 . The security protocol  82  may include a key update procedure  84  for updating a security key and a key exchange procedure  86  for exchanging the security key between the update servers  18  and the DCM  16 . 
         [0028]      FIG. 7  illustrates an exemplary key update procedure  84  where a security key is updated prior to an update procedure. At step  88 , the DCM  16  may send a first security key along with an update request to the update servers  18  via the cellular network  20 . In this example, the update servers  18  request an updated security key from the DCM  16  at step  90 . There may be any number of reasons that the update servers  18  might request a new security key from the DCM  16 . For example, the first security key may be expired (e.g., keys may expire after a preselected period of time). As another example, the first security key may be compromised. As another example, the vehicle may not have previously initiated an update procedure (e.g., the vehicle may be new). At step  92 , the DCM  16  sends a second security key to the update servers  18 . In some embodiments, the DCM  16  may include an algorithm that is used to reversibly alter the second security key at step  94 . The second security key may be selected from a list of valid security keys saved in memory of the DCM  16 . In another embodiment, the second security key may be generated randomly (e.g.,  128  bit key). The altered second security key may be sent from the DCM  16  to the update servers  18  at step  92 . At step  98 , the altered second security key may be decrypted at the update servers  18 , saved in memory and set as a valid security key. A confirmation that the second security key is valid may be sent from the update servers  18  to the DCM  16  at step  96 . 
         [0029]    Once the second security key is set to valid, the DCM  16  may again send a mathematically altered second security key for an updating procedure at step  100 . At step  102 , the update servers  18  may decrypt the second security key and send a confirmation and valid key message to the DCM. At step  104 , the DCM  16  may request an update in a fashion similar to that described above. The update servers  18  may then send the update information at step  106  and the DCM  16  may send a confirmation that the download is complete at step  108 . Thus, the second security key may be used to validate the vehicle to the update servers  18  and the update servers  18  (i.e., the update source) to the vehicle. If the update servers  18  do not receive a valid security key from the vehicle once the key status has been validated, the update servers  18  may sever the connection with the vehicle Likewise, if the DCM  16  does not receive the appropriate confirmations from the update servers  18 , the DCM  16  may sever the connection. 
         [0030]    Referring to  FIG. 8 , an exemplary key exchange procedure  110  is illustrated where the key update procedure  84  has already been performed and the security key in use by the DCM  16  has been set to valid at the update servers  18 . At step  112 , the security key is mathematically altered and the altered security key is sent to the update servers  18  by the DCM  16  at step  114 . At step  116 , the update servers  18  may decrypt the security key and send a confirmation and valid key message to the DCM  16  at step  118 . At step  120 , the DCM  16  may send an update download request to the update servers  18 , which may also include current update information. If an update is available, the update servers  18  may send the update to the DCM  16  at step  122 . At step  124 , the DCM  16  may send an indication to the update servers  18  that the download is complete. 
         [0031]    The above-described OTA updating of vehicle systems and associated security protocols can be used to provide updates to the various ECUs (and other systems) without requiring a vehicle owner to transport the vehicle to a vehicle manufacturer, while also providing security protocols which can validate an update source, update destination and/or the update communications themselves. The OTA updating systems and methods may utilize the DCM that provides a connection to update servers, for example, through a cellular network. 
         [0032]    While particular embodiments have been illustrated and described herein, it should be understood that various other changes and modifications may be made without departing from the spirit and scope of the claimed subject matter. Moreover, although various aspects of the claimed subject matter have been described herein, such aspects need not be utilized in combination. It is therefore intended that the appended claims cover all such changes and modifications that are within the scope of the claimed subject matter.