GB2634950A

GB2634950A - Communication system and method

Info

Publication number: GB2634950A
Application number: GB2316487.4A
Authority: GB
Inventors: Latham James
Original assignee: Haldex AB
Current assignee: Haldex AB
Priority date: 2023-10-27
Filing date: 2023-10-27
Publication date: 2025-04-30
Also published as: GB202316487D0; WO2025088199A1

Abstract

A system 1 and a communication method for a system 1 including a plurality of mobile devices 20, each including a first software element 230 and a second software element 240, and a communication interface 260, 270 configured to communicate across a wireless personal area network. The method including: providing at least one principal mobile device 21; determining the presence of one or more other mobile devices 20 of the system 1 within a predetermined range of the principal mobile device 21. Sending a message from the principal mobile device 21 to a mobile device 20 within the predetermined range using a wireless personal area protocol. Wherein the message causes an error condition in one of the first software element 230 and the second software element 240 of the or each mobile device 20 in the predetermined range. The response to the error may include updating/replacing the software. The message may be a KILLAPP command.

Description

COMMUNICATION SYSTEM AND METHOD

FIELD

The invention relates to a communication system and method, in particular, but not exclusively to a communication system and method suitable for fleet vehicles.

BACKGROUND

Mobile devices, which may be vehicles or parts of vehicles, for example, may have an electronic control unit (ECU) that includes one or more software elements that require updating from time to time, and/or in response to a fault or error condition. The present disclosure relates to a communication system and method, in which one or more software elements of an ECU of a mobile device may be updated or replaced.

BRIEF DESCRIPTION OF THE INVENTION

There is provided a system including a plurality of mobile devices, each mobile device including an electronic control unit, including a first software element and a second software element, and a communication interface configured to receive a command across a wireless personal area network, wherein at least one of the plurality of mobile devices is a principal mobile device operable to detect mobile devices within a predetermined range of the principal mobile device, and to send a message using a wireless personal area protocol to each mobile device within the predetermined range, the message being configured to cause an error condition in one of the first and second software elements of each mobile device in the predetermined range.

The principal mobile device may be operable to detect whether the first and/or second software elements is faulty, and to send the message in response to detecting a faulty software element.

The principal mobile device may be operable to send the message to each mobile device within the predetermined range, regardless of whether the or each mobile device includes a faulty software element.

The first and/or second software element may be configured to store the message in a format that is readable by the other software element.

The message may be a KILLAPP command.

The message may cause an error condition to be exhibited by one of the first or second software elements that is detectable by the other of the first or second software elements of the electronic control unit.

The first and/or second software element may be operable to carry out a response in the event of the first or second software element detecting an error condition in the other software element.

The response may include updating or replacing the software element exhibiting the error condition.

The system may include a server device.

The or each mobile device may be a vehicle or part of a vehicle.

There is also provided a communication method for a system including a plurality of mobile devices, each mobile device including a first software element and a second software element, and a communication interface configured to communicate across a wireless personal area network, the method including: providing at least one principal mobile device; determining the presence of one or more other mobile devices of the system within a predetermined range of the principal mobile device; in the event that one or more mobile devices are present within the predetermined distance, sending a message from the principal mobile device to a mobile device within the predetermined range using a wireless personal area protocol; wherein the message causes an error condition in one of the first software element and the second software element of the or each mobile device in the predetermined range.

The method may include storing the message in one of the first or second software elements, in a format readable by the other software element.

The method may include the principal device carrying out a check of at least one of the first and second software elements of the one or more mobile devices present in the predetermined range, to determine whether the or each present mobile device includes a faulty software element; and sending the message from the principal mobile device to the present mobile device including a faulty software element in response to detecting that a present mobile device has a faulty software element.

The message may cause an error condition relating to the faulty software element.

In the event that the first or second software element is determined to be a faulty software element, the message may causes an error condition to which the other software element is configured to respond.

A response to the error condition by the first or second software element may include an automatic response.

The message may include a command, and the response of the other software element may include executing the command.

A response to the error condition may include obtaining a replacement software element to replace the faulty software element.

BRIEF DESCRIPTION OF THE FIGURES

In order that the present disclosure may be more readily understood, preferable embodiments thereof will now be described, by way of example only, with reference to the accompanying drawings, in which: FIGURE 1 is a schematic illustration of a system including a first server device and a plurality of mobile devices, one of the mobile devices being a principal device.

DETAILED DESCRIPTION OF THE DISCLOSURE

Referring to Figure 1, there is shown a system 1. The system 1 may include a first server device 10. The system 1 includes one or more mobile devices 20. The or each mobile device 20 may be a vehicle, for example a fleet vehicle, or a component of a vehicle. The system 1 may include any number of mobile devices 20. Each mobile device 20 may include at least one corresponding electronic control unit (ECU) 200. Each mobile device 20 may include a plurality of ECUs 200.

The or each ECU 200, may include data storage 220. The data storage 220 may include memory, for example flash memory. The or each ECU 200 may include a first software element 230, which may be an application, for example. The ECU 200 may include a second software element 240, which may be a bootloader, for example. The first software element 230 and/or the second software element 240 may be stored in the ECU memory.

The or each ECU 200 may be configured to communicate with the first server device 10. The first server device 10 may remain substantially stationary, although it will be appreciated that this is not essential. The or each ECU 200 may include a first communication interface 260. The first communication interface 260 may enable communication between the ECU 200 and the first server device 10. The first communication interface 260 may be configured to communicate with the server device 10 via wireless communication technology, for example mobile communication technology, for example 4G, 5G, etc. The first communication interface 260 may be configured to enable relatively long-range communications, for example global communication may be possible between the ECU 200 and the server device 10 and/or other mobile devices 20. It will be appreciated that the first communication interface 260 may additionally or alternatively enable short and/or medium range communications, for example Bluetooth®, Zigbee® or VViFi0.

The or each ECU 200 may be operable to communicate with the ECU 200 of another mobile device 20. The or each ECU 200 may be operable to communicate with a second or further ECU 200 of the same mobile device 20.

The ECU 200 may include a second communication interface 270. The second communication interface 270 may enable communication between the ECU 200 and an ECU 200 of another, e.g. a second, mobile device 20. The second communication interface 270 may be configured to enable relatively short-range communications. The second communication interface 270 may be configured to communicate with the ECU 200 of the second mobile device 200 via wireless communication technology. The second communication interface 270 may be operable to communicate with the second mobile device 20 via a wireless personal area network (WPAN) for example. The second communication interface 270 may enable communication via Bluetooth®, Bluetooth® LE or Zigbee®, for example. The second communication interface 270 may be operable to communicate with the ECU 200 of each other mobile device 20 in the system 1. The second communication interface 270 may be operable to communicate with the server device 10. The second communication interface 270 may enable communication between two or more ECUs 200 of a single mobile device 20. The second communication interface 270 may enable two-way communication with the ECU 200.

The second communication interface 270 may be operable to enable two way communication with another mobile device 20. The second communication interface 270 may enable communication with another device via an app, for example. The second communication interface 270 may enable the transfer of status data, and/or enable the setting of options, for example.

Each ECU 200 may be configured to broadcast advertising data. The advertising data may include any of the following, for example: IMEI (a serial number, for example), boot loader version number, application version number, a status byte, identifiable manufacturer data.

It will be appreciated that the advertising data will be selected as appropriate.

The first software element 230 may be configured to transfer data to the second software element 240. The first software element 230 may be configured to transfer messages and/or control to the second software element 240. The first software element 230 may include a dedicated section of memory to transfer data to the second software element 240. The dedicated section of memory may be non-volatile memory, for example. The first software element 230 may be configured to accept a command via the second communication interface 270. The first software element 230 may be configured to receive a command from another mobile device 20. The first software element may be configured to receive a command from the first server device 10.

The second software element 240 may be configured to transfer data to the first software element 230. The second software element may be operable to check for an error condition of the first software element. The second software element 240 may be operable to check the presence of the first software element 230. The second software element 240 may be operable to check version data of the first software element 230. The second software element 240 may be operable to check an error detecting code, for example a cyclic redundancy check (CRC) of the first software element 230. The second software element 240 may be operable to run the first software element 230, for

example at power-up.

The second software element 240 may be operable to repair, modify or replace the first software element 230. The second software element 240 may obtain updates and/or replacements for the first software element 230 from the first server device 10, and/or another mobile device 20, and/or another ECU 200 of the same device 20.

The second software element 240 may be able to carry out a response to an error condition of the first software element 230. An error condition may be that the first software element is absent, or is present but corrupted, or that the first software element 230 is present but is not the current, or most appropriate, version, for example. The second software element 240 may be operable to detect when one or more error conditions is met. The response of the second software element 240 may be dependent upon the or each error condition met. The second software element 240 may be operable to overwrite, delete and/or replace the first software element 230, for example in response to an error condition being met, and/or in response to a command, for example from the server device 10 and/or another mobile device 20. The second software element 240 may be operable in response to a command stored by the first software element 230.

The first software element 230 and/or the second software element 240 may be configured to accept one or more commands which may be delivered via the second communication interface 270, for example. This feature may be advantageous where communication via the first communication interface 260 is not possible. Interrupted communication between the mobile device 20 and other devices, for example other mobile devices 20 and/or the first server device 10 may occur as a result of mobile communication faults, the mobile device 20 being in a communication "black spot", the first software element 230 being corrupted or including a bug, the first communication interface 230 being faulty or damaged, a faulty, expired or damaged SIM, etc.. It is advantageous to be able to recover an ECU 200 with a faulty software element 230, 240 quickly, even when the ECU 200 is not able to communicate with the first device 10, either temporarily or permanently.

A method of operating the system 1, and its components, will be described, by way of example.

The system and method described herein may be advantageous in relation to a network or fleet of mobile devices 20. It may be desirable to update a software element 230, 240 of a mobile device 20, for example because a new version of the software element 230, 240 has been launched and/or because of a fault or error in the software element 230, 240. It may be desirable for the new version of the software element 230, 240 to be rolled out to all mobile device 20 in the system 1 quickly, or at least within a maximum time period. This could be for several reasons, for example so that each mobile device 20 is running the same version of the software element 230, 240 and/or because the existing version of the software element 230, 240 includes a bug or other problem. Where the existing software element 230, 240 is faulty, it may be desirable to replace the software element 230, 240 as soon as a fault is detected.

Rather than requiring each mobile device 20 to communicate with the first server device 10, and/or for the first server device 10 to push a software update to every mobile device 20 in the system, the present method enables communication between the mobile devices 20 to enable a software element 230, 240 to be updated or replaced.

One or more of the mobile devices 20 in the system 1 may be a principal device 21. A proportion of the mobile devices 20 in the system 1, for example 20%, may be selected as a principal device 21. The or each principal device 21 may be provided with a third software element 250. The third software element 250 may be embedded in the ECU 210 of the or each principle device 21. The ECU 210 of the or each principal device 21 may have additional or alternative functionality compared with the ECU 200 of the or each "standard" mobile device 20. The or each mobile device 20, 21 may be a node in a meshed network. The or each ECU 200, 210 may be a node of a meshed network. The network may be fully connected or partially connected. The ECU 210 of the or each principal mobile device 21, may be configured to be communicable with the second communication interface 270 of every mobile device 20 in the system. Where there is a plurality of principal mobile devices 21, each principal mobile device 21 may also be communicable with the or each other principal mobile device 21. The or each principal mobile device 21 may be configured to communicate with other mobile devices 20, 21 via the second communication interface 270, i.e. the relatively shorter range communication interface. The or each principal mobile device 21 may communicate with each other mobile device 20 (and, optionally, each other principal mobile device 21), within a predetermined range. The predetermined range may correspond with the range of the communication protocol of the second communication interface 270. The or each principal device 21 may be operable to communicate with every other mobile device 20 of the system 1 within a predetermined distance of that principal device 21. The communication protocol of the second communication interface 270 of each ECU 200, 210 and/or the proportion of mobile devices that are configured as principal devices 21, may be selected to optimise the speed of communication between at least one principal mobile device 21 and every "standard" mobile device 20 in the system 1. For example, routes may be planned such that it is known when and/or how frequently each mobile device 20 will be in communication range with another device 20, 21.

The or each principal device 21 may interrogate the ECU 200 of a mobile device 20 that is within the predetermined range or enters the predetermined range (optionally the ECU 210 of a principal mobile device 21), to determine whether the ECU 200, 210 includes a "faulty" software element 230, 240. A "faulty" software element 230, 240 may be a software element that needs to be replaced or updated. A "faulty" software element 230, 240, may be a software element that is corrupted, or is absent, and/or is causing a communication failure, and/or is the result of a communication failure, and/or requires updating to a newer version, and/or has an incorrect CRC, for example. When the ECU 210 of the principal device 21 detects a "faulty" software element 230, 240 of the ECU 200, the ECU 210 carries out a response. The response may include providing an indication to a user of the mobile device 20 (e.g. a driver), that maintenance or service is required. It may be possible for a user to manually carry out a software upgrade. Additionally or alternatively, the ECU 210 may be operable to carry out an automatic response, which may include sending one or more commands to the ECU 200, for example to the first software element 230 of the mobile device 20. The command or commands may cause an error condition of the software element 230. The error condition caused may be the same as or different from the "fault" that means that the software element requires updating or replacing. The error condition caused by the command may be detectable by the first and/or second software element 230, 240. The or each command may be sent to the ECU 200 of the mobile device 20 between the second communication interfaces 270 of the principal device 21 and the mobile device 20, for example via Bluetooth® or other PAN communication protocol.

The first software element 230 may store an error condition "message" in the memory that is configured to be readable by the second software element 240. The error condition message may be a command executable by the second software element 240. The command may be a KILLAPP command, for example.

The error condition caused may be detectable by the second software element 240. The routine checks of the first software element 230 carried out by the second software element 240 may be operable to detect the error condition caused by the command of the ECU 210.

The second software element 240 may respond to detecting the error condition. The response may be dependent upon the error condition detected. The second software element 240 may carry out the stored command, where a command is stored. The command or commands may include a KILLAPP command, for example. In the example where the command is a KILLAPP command, the second software element 240 may erase the first software element 230, for example. When the second software element carries out its routine checks of the first software element, an error condition will be identified, since the first software element 230 will not be present. The second software element 240 may carry out a response other than executing a command, for example, by executing a stored routine.

The response may include the second software element 240 communicating with another device and/or another ECU 200. The response may include communicating with the first server device 10 and/or another mobile device 20, 21, and/or with another ECU 200 of the same mobile device 20. The response may include requesting an updated or replacement version of the first software element 230.

Where a mobile device 20 includes a plurality of ECUs 200, each ECU 200 may carry back up software elements 230, 240 for one or more of the other ECUs 200. The ECUs need not be of the same kind to carry back up software elements -the back up software elements need not be executable by the ECU on which they are stored for back up purposes.

The response may include the second software element 240 communicating with the first server device 10, to obtain a replacement first software element 230, if the software element 230 is present, but is exhibiting an error condition, for example it has an incorrect CRC. The first server device 10 may select the most appropriate replacement software element 230, which may depend upon the identity of the mobile device 20 with which the faulty first software element 230 is associated, a serial number (e.g. IMEI) of the mobile device 20 (or of the ECU 200), and/or a version of hardware installed on the mobile device 20. Other characteristics may be used to determine the most appropriate replacement first software element 230, and it will be understood that the foregoing are examples.

The system and method described herein may be advantageous since mobile devices 20 of the same system 1, may frequently be in communication range of other devices 20, 21 of the system 1. For example, where each mobile device 20 is a fleet vehicle, vehicles tend to be parked at regular intervals in the same depots or customer locations. Therefore, each mobile device 20 is likely to receive updated software relatively quickly, even if communication between the mobile device 20 and the first server device 10 is inhibited or prevented. The or each command may be a simple command, which may be communicated between mobile devices 20, 21, and which may be supported by the first software element 230 and/or the second software element 240.

When the or each principal device 21 communicates with a mobile device 20, it may be possible for the principal device to send the third software element to the mobile device 20, such that the ECU of the "receiving" mobile device becomes an ECU 210, i.e. the mobile device becomes a principal device 21. Each new principal device 21 may be operable to check for other mobile devices 20 in range and send a message to the or each message in its range (or that come into range). Therefore the system 1 may operate as a relay network, Where features and functions of a software element 230, 240 have been described herein, it will be appreciated that the features and functions may apply equally to both software elements. Where one component is described as acting on or interacting with another component. it will be appreciated that the opposite action may be possible.

The or each ECU 200, 210 may be a telematics ECU of a vehicle, and/or an ECU of another device in a network/fleet, for example, an electronic braking system (EBS) ECU, a refrigeration ECU, suspension ECU, etc.. It will be understood that each mobile device 20 may include a plurality of ECUs 200, and communication between a principal ECU 210 of a principal device 21, need not be with an ECU 200 (or 210) of the same type.

Whilst application recovery has been described herein, the system and method may be used for other functions, for example to maintain a core set of operations for example when long range communication between a mobile device 20 and the first server device 10 is inhibited or prevented.

When used in this specification and claims, the terms "comprises" and "comprising" and variations thereof mean that the specified features, steps or integers are included. The terms are not to be interpreted to exclude the presence of other features, steps or components.

The invention may also broadly consist in the parts, elements, steps, examples and/or features referred to or indicated in the specification individually or collectively in any and all combinations of two or more said parts, elements, steps, examples and/or features. In particular, one or more features in any of the embodiments described herein may be combined with one or more features from any other embodiment(s) described herein.

Protection may be sought for any features disclosed in any one or more published documents referenced herein in combination with the present disclosure.

Although certain example embodiments of the invention have been described, the scope of the appended claims is not intended to be limited solely to these embodiments. The claims are to be construed literally, purposively, and/or to encompass equivalents.

Claims

CLAIMS 1. 2. 3. 4. 5. 6. 7. 8. 9.A system including a plurality of mobile devices, each mobile device including an electronic control unit, including a first software element and a second software element, and a communication interface configured to receive a command across a wireless personal area network, wherein at least one of the plurality of mobile devices is a principal mobile device operable to detect mobile devices within a predetermined range of the principal mobile device, and to send a message using a wireless personal area protocol to each mobile device within the predetermined range, the message being configured to cause an error condition in one of the first and second software elements of each mobile device in the predetermined range.
A system according to claim 1 wherein the principal mobile device is operable to detect whether the first software element and/or the second software element is faulty, and to send the message in response to detecting a faulty software element.
A system according to claim 1 or claim 2 wherein the principal mobile device is operable to send the message to each mobile device within the predetermined range, regardless of whether the or each mobile device includes a faulty software element.
A system according to any of the preceding claims wherein the first and/or second software element is configured to store the message in a format that is readable by the other software element.
A system according to any of the preceding claims wherein the message is a KILLAPP command.
A system according to claim 1 or claim 2 wherein the message causes an error condition to be exhibited by one of the first or second software elements that is detectable by the other of the first or second software elements of the electronic control unit.
A system according to claim 6 wherein the first and/or second software element is operable to carry out a response in the event of the first or second software element detecting an error condition in the other software element.
A system according to claim 7 wherein the response includes updating or replacing the software element exhibiting the error condition.
A system according to any preceding claim including a server device.
10. A system according to any preceding claim wherein the or each mobile device is a vehicle or part of a vehicle.
11. A communication method for a system including a plurality of mobile devices, each mobile device including a first software element and a second software element, and a communication interface configured to communicate across a wireless personal area network, the method including: providing at least one principal mobile device; determining the presence of one or more other mobile devices of the system within a predetermined range of the principal mobile device; in the event that one or more mobile devices are present within the predetermined range, sending a message from the principal mobile device to a mobile device within the predetermined range using a wireless personal area protocol; wherein the message causes an error condition in one of the first software element and the second software element of the or each mobile device in the predetermined range.
12. A method according to claim 11 including one of the first or second software elements storing the message in a format readable by the other software element.
13. A method according to claim 11 or claim 12 including the principal device carrying out a check of at least one of the first and second software elements of the one or more mobile devices present in the predetermined range, to determine whether the or each present mobile device includes a faulty software element; and sending the message from the principal mobile device to the present mobile device including a faulty software element in response to detecting that a present mobile device has a faulty software element.
14. A method according to claim 13 wherein the message causes an error condition relating to the faulty software element.
15. A method according to claim 13 or 14 wherein in the event that the first or second software element is determined to be a faulty software element, the message causes an error condition to which the other software element is configured to respond.
16. A method according to claim 15 wherein a response to the error condition by the first or second software element includes an automatic response.
17. A method according to claim 15 or 16 wherein the message includes a command, and the response of the other software element includes executing the command.
18. A method according to any of claims 15 to 17 wherein a response to the error condition includes obtaining a replacement software element to replace the faulty software element.