Error-resilient over-the-air software updates for vehicles

Abstract

An on-board vehicle computer system receives a software update package from a remote computer system via a wireless communication network. The update package includes a software update for an updatable electronic component (e.g., an ECU) of the vehicle. Prior to installing the update, the vehicle computer system may check for a valid backup software version in a storage medium in the vehicle computer system to facilitate reversion to a previous software version in the event of an error during installation of the update. Installation of the update may be delayed until a compatible backup software version is obtained. After installation of the update, the system stores the update in the storage medium as the current backup software version for the updatable electronic component. This facilitates roll-back to a functional state in the event of an error during a future update.

1 . - 23 . (canceled) 
     
     
         24 . A non-transitory computer-readable medium having computer-executable instructions stored thereon that, in response to execution by one or more processors of a vehicle computer system of a vehicle, cause the vehicle computer system to perform actions comprising:
 receiving a software update package, wherein the software update package comprises a first software update for a first updatable electronic component of the vehicle;   after receiving the software update package and prior to installing the first software update:
 checking a storage device of the vehicle for a previously stored backup software version for the first updatable electronic component that is compatible with a current configuration of the vehicle; 
 in response to determining that the previously stored backup software version is not compatible with the current configuration of the vehicle, and prior to determining that the previously stored backup software version is to be re-installed:
 updating the stored backup software version with a compatible backup software version in the non-transitory computer-readable media; and 
 
   installing, only after updating to the compatible backup software version, the first software update in the first updatable electronic component.   
     
     
         25 . The non-transitory computer-readable medium of  claim 24 , wherein the actions further comprising:
 in response to determining that the installation of the first software update is successful, storing the first software update in a storage medium in the vehicle computer system as a current backup software version for the first updatable electronic component.   
     
     
         26 . The non-transitory computer-readable medium of  claim 25 , wherein storing the first software update as a current backup software version comprises overwriting the compatible backup software version for the first updatable electronic component. 
     
     
         27 . The non-transitory computer-readable medium of  claim 25 , wherein the vehicle computer system comprises a computing device including a wireless modem, a processor, and the storage medium. 
     
     
         28 . The non-transitory computer-readable medium of  claim 24 , wherein the first updatable electronic component comprises an electronic control unit (ECU). 
     
     
         29 . The non-transitory computer-readable medium of  claim 24 , wherein the actions further comprising:
 based on receiving an indication that the first updatable electronic component is functioning correctly, determining that the installation of the first software update is successful.   
     
     
         30 . The non-transitory computer-readable medium of  claim 24 , wherein the software update package comprises a second software update for a second updatable electronic component of the vehicle, the actions further comprising:
 installing the second software update in the second updatable electronic component;   determining that the installation of the second software update is successful; and   in response to determining that the installation of the second software update is successful, storing the second software update as a backup software version for the second updatable electronic component.   
     
     
         31 . A method of returning an updatable electronic component of a vehicle to a functional state after a software update error or interruption, the method comprising, by an on-board computer system of the vehicle:
 receiving a software update package comprising a first software update for a first updatable electronic component of the vehicle;   after receiving the software update package and prior to installing the first software update:
 checking a storage medium in the on-board computer system for a backup software version for the first updatable electronic component that is compatible with a current configuration of the vehicle; and 
 in response to determining that the backup software version is not compatible with the current configuration of the vehicle, and prior to determining that the previously stored backup software version is to be re-installed:
 updating the stored backup software version with a compatible backup software version in the non-transitory computer-readable media; and 
 
   initiating, only after updating to the compatible backup software version, an installation of the first software update for the first updatable electronic component.   
     
     
         32 . The method of  claim 31 , further comprising:
 detecting an error or interruption in the installation of the first software update;   canceling the installation of the first software update;   retrieving the compatible backup software version from the storage medium; and   installing the compatible backup software version on the first updatable electronic component.   
     
     
         33 . The method of  claim 32 , wherein the on-board computer system performs at least the steps of detecting the error or interruption, suspending the installation of the first software update, retrieving the compatible backup software version, and installing the compatible backup software version automatically without requiring user input. 
     
     
         34 . The method of  claim 31 , wherein requesting and receiving the compatible backup software version comprises requesting and receiving the compatible backup software version from a remote server. 
     
     
         35 . The method of  claim 31 , wherein the on-board computer system comprises a computing device including a wireless modem, a processor, and the storage medium, and wherein the computing device performs at least the steps of receiving the software update and retrieving the compatible backup software version from the storage medium. 
     
     
         36 . The method of  claim 31 , wherein the first updatable electronic component comprises an electronic control unit (ECU). 
     
     
         37 .The method of  claim 31  wherein the software update package comprises a second software update for a second updatable electronic component of the vehicle, the method further comprising:
 installing the second software update in the second updatable electronic component; 
 validating installation of the second software update in the second updatable electronic component; and 
 storing the second software update as a backup software version for the second updatable electronic component in the storage medium. 
 
     
     
         38 . The method of  claim 31 , wherein the software update package is received from a remote computer system via a wireless communication network. 
     
     
         39 . The method of  claim 31 , further comprising:
 monitoring a vehicle state condition during installation of the first software update; and   in response to a change in the vehicle state condition, pausing installation of the first software update.   
     
     
         40 . A vehicle comprising:
 a first electronic control unit (ECU); and   a computing device comprising a wireless modem, a processor, and non-transitory computer-readable storage media, the computing device being programmed to perform actions comprising:
 receiving a first software update package, wherein the first software update package comprises a first software update for the first ECU; 
 after receiving the first software update package and prior to installing the first software update:
 checking the non-transitory computer-readable media for a previously stored backup software version for the first ECU that is compatible with a current configuration of the vehicle; 
 in response to determining that the previously stored backup software version is not compatible with the current configuration of the vehicle, and prior to determining that the previously stored backup software version is to be re-installed: 
 updating the stored backup software version with a compatible backup software version in the non-transitory computer-readable media; and 
 
 installing, only after updating to the compatible backup software version, the first software update in the first ECU. 
   
     
     
         41 . The vehicle of  claim 40 , wherein the computing device is further programmed to perform actions comprising:
 storing the first software update in the storage media as a current backup software version for the first ECU.   
     
     
         42 . The vehicle of  claim 41 , wherein storing the first software update in the storage media as the current backup software version for the first ECU comprises overwriting the compatible backup software version for the first ECU. 
     
     
         43 . The vehicle of  claim 41 , wherein the computing device is further programmed to perform actions comprising:
 receiving a second software update package from the remote computer system via the wireless modem, wherein the second software update package comprises a second software update for the first ECU;   initiating an installation of the second software update in the first ECU;   detecting an error or interruption in the installation of the second software update;   suspending the installation of the second software update;   retrieving the current backup software version from the storage media; and   reinstalling the current backup software version in the first ECU.