# US 11,442,721 B2 · Opportunistic software updates during select operational modes

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,442,721 B2
- Document ID: US11442721B2
- Status: Granted
- Kind: B2
- Application number: 17/466,560
- Filed: 2021-09-03
- Published: 2021-12-23
- Granted: 2022-09-13
- Earliest claimed: 2017-07-25
- Assignees: Aurora Labs Ltd.
- Applicants: Aurora Labs Ltd.
- Inventors: Zohar Fox
- Web page: https://patentgrep.com/patent/US11442721B2

## CPC

- G06F 8/658: Incremental updates; Differential updates
- B60W 50/02: Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
- B60W 50/0205: {Diagnosing or detecting failures; Failure detection models}
- B60W 50/0225: {Failure correction strategy}
- B60W 50/04: Monitoring the functioning of the control system
- B60W 50/045: {Monitoring control system parameters}
- G06F 8/60: Software deployment
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 8/654: using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
- G06F 8/656: while running
- G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management
- G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57)
- G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57)
- G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading}
- G06F 11/0721: {within a central processing unit [CPU]}
- G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)}
- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/1433: {during software upgrading}
- G06F 11/1629: {Error detection by comparing the output of redundant processing systems}
- G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)}
- G06F 12/0284: {Multiple user address space allocation, e.g. using different base addresses (interprocessor communication G06F15/163)}
- G06F 12/0646: {Configuration or reconfiguration}
- G06F 16/188: Virtual file systems
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- B60W 2050/021: {Means for detecting failure or malfunction}
- G06F 8/66: {of program code stored in read-only memory [ROM]}
- G06F 2212/1008: Correctness of operation, e.g. memory ordering
- G06F 2212/1044: Space efficiency improvement
- G06F 2212/1056: Simplification
- G06F 2221/033: Test or assess software
- G06N 20/00: Machine learning
- Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

Disclosed embodiments relate to opportunistically updating Electronic Control Unit (ECU) software in a vehicle. Operations may include receiving, at a controller in a vehicle, a wireless transmission indicating a need to update software running on at least one ECU in the vehicle; monitoring an operational status of the vehicle to determine whether the vehicle is in a first mode of operation in which an ECU software update is prohibited; delaying the ECU software update when the operational status is prohibited; continuing to monitor the operational status of the vehicle to determine whether the vehicle is in a second mode of operation in which the ECU software update is permitted; and enabling updating of the at least one ECU with the delayed ECU software update when it is determined that the vehicle is in the second mode of operations.

## Claims

### Claim 1

A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for opportunistically updating controller software, the operations comprising:
determining a device is in a first mode of operation at a first time;
accessing a controller software change based on the device being determined to be in the first mode of operation, the controller software change comprising a delta file generated based on comparing two multidimensional grids, each multidimensional grid representing a version of software in multiple dimensions; and
implementing the controller software change on a controller associated with the device when the device is in the first mode of operation, wherein implementing the controller software change comprises:
storing the delta file adjacent to current software on the controller; and
linking at least one code segment of the delta file to the current software.

### Claim 2 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the first mode of operation comprises a predetermined safe operating condition.

### Claim 3 (depends on 2)

The non-transitory computer-readable medium of claim 2, wherein the predetermined safe operating condition is one of a plurality of predetermined safe operating conditions.

### Claim 4 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the first mode of operation comprises a power-down status or an idling status.

### Claim 5 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein accessing the controller software change comprises:
sending a message to a remote server requesting the controller software change; and
in response to the message, receiving the controller software change.

### Claim 6 (depends on 5)

The non-transitory computer-readable medium of claim 5, wherein the message is sent after discarding the controller software change.

### Claim 7 (depends on 6)

The non-transitory computer-readable medium of claim 6, wherein the controller software change is discarded while the device is in a second mode of operation.

### Claim 8 (depends on 1)

The non-transitory computer-readable medium of claim 1, the operations further comprising:
determining a device is in a second mode of operation at a second time, the second time being before the first time; and
delaying the controller software change when the device is in the second mode of operation.

### Claim 9 (depends on 1)

The non-transitory computer-readable medium of claim 1, the operations further comprising configuring the controller so that a code segment of the current software is executed after a code segment of the delta file.

### Claim 10 (depends on 9)

The non-transitory computer-readable medium of claim 9, wherein configuring the controller comprises updating a program counter.

### Claim 11 (depends on 1)

The non-transitory computer-readable medium of claim 1, the operations further comprising configuring the controller to skip a code segment of the current software and instead execute a code segment of the delta file.

### Claim 12 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein accessing the controller software change is performed in response to identifying an anomaly associated with the controller.

### Claim 13 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein determining a device is in the first mode of operation is performed as part of monitoring an operational status of the device according to a preestablished interval.

### Claim 14 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the first mode of operation comprises a preselected environmental condition of the device.

### Claim 15 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the multiple dimensions comprise at least two of: a binary data dimension, a source attribute dimension, or a map file dimension.

### Claim 16

A computer-implemented method for opportunistically updating controller software, the method comprising:
determining a device is in a first mode of operation at a first time;
accessing a controller software change based on the device being determined to be in the first mode of operation, the controller software change comprising a delta file generated based on comparing two multidimensional grids, each multidimensional grid representing a version of software in multiple dimensions; and
implementing the controller software change on a controller associated with the device when the device is in the first mode of operation, wherein implementing the controller software change comprises:
storing the delta file adjacent to current software on the controller; and
linking at least one code segment of the delta file to the current software.

### Claim 17 (depends on 16)

The computer-implemented method of claim 16, wherein the first mode of operation comprises a predetermined safe operating condition.

### Claim 18 (depends on 16)

The computer-implemented method of claim 16, further comprising configuring the controller so that a code segment of the current software is executed after a code segment of the delta file.

### Claim 19 (depends on 16)

The computer-implemented method of claim 16, further comprising configuring the controller to skip a code segment of the current software and instead execute a code segment of the delta file.

### Claim 20 (depends on 16)

The computer-implemented method of claim 16, wherein the multiple dimensions comprise at least two of: a binary data dimension, a source attribute dimension, or a map file dimension.