Selective software updates with in situ monitoring of non-homogeneous automotive electronic control units

The number and complexity of in-vehicle electronic control units (ECUs) is rapidly increasing with theadaption of autonomous driving capabilities and the integration of advanced driver assistance systems(ADAS). The ECUs in a modern vehicle contain numerous software components forming a complexnetwork of dependencies, while today’s rapid development of software creates the need for more andmore updates of such components during the lifetime of a vehicle, for example, to adapt to securitythreats. Currently, an update of a safety-critical component requires extensive re-validation of the wholesystem.We have developed a prototype to test, deploy, and monitor updates of single components with min-imal effort while ensuring that safety and other requirements of the entire system are still fulfilled. Thesafety and other properties of each component are defined as formal contracts. Virtual integration testsmake sure that the contracts of all components together always satisfy the safety and other requirementsof the entire system. Subsequently, it is sufficient to test an updated component only against applicablecontracts. This is tested before deployment as well as monitored, in the field, during runtime.This paper describes an implementation of these techniques by leveraging existing and mature tech-nologies to update a safety-critical vehicle ECU