FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003
COMPLETE SPECIFICATION (See section 10, rule 13)
“METHOD AND SYSTEM FOR OVER-THE-AIR (OTA)
UPDATES”
Name and address of the applicant:
a) Name: TATA MOTORS LIMITED
b) Nationality: Indian
c) Address: Bombay House, 24 Homi Mody Street, Hutatma Chowk, Mumbai 400 001, Maharashtra, INDIA
PREAMBLE TO THE DESCRIPTION
The following specification particularly describes the invention and the manner in which it is to be performed:
1

TECHNICAL FIELD
[0001] The present disclosure generally relates to the field of automobiles. More particularly,
the present disclosure relates to method and device for updating firmware or software of an
5 Electronic Control Unit (ECU) of a vehicle.
BACKGROUND
[0002] Over-The-Air (OTA) updates are widely utilized to update the firmware of vehicle
systems without requiring manual intervention. Vehicles typically comprise multiple
Electronic Control Units (ECUs), and conventional cloud-based systems maintain a
10 comprehensive repository of these vehicles along with the software versions of their ECUs.
[0003] In such systems, a detailed inventory is kept of the software versions deployed across various ECUs in different vehicles. Each vehicle is uniquely identified, such as V1, V2, V3, etc., and is associated with several ECUs, ranging from ECU1 to ECUn. Within a specific vehicle, all ECUs are uniformly updated with respective firmware/software version.
15 [0004] Conventional cloud-based systems manage and store firmware/software version data
for millions of vehicles in extensive databases. Whenever a new firmware/software version for ECU is available, the cloud-based system pushes the updated firmware/software version files from the databases to the vehicle, which incurs both cost and time overheads.
[0005] In view of the above, there exists a need to provide method and device which saves
20 network bandwidth and data usage while improving the firmware/software update process for
vehicles and overcoming the above-mentioned limitations present in the existing technology.
[0006] The information disclosed in this background of the disclosure section is only for
enhancement of understanding of the general background of the invention and should not be
taken as an acknowledgement or any form of suggestion that this information forms the prior
25 art already known to a person skilled in the art.
SUMMARY
2

[0007] The present disclosure overcomes one or more shortcomings of the prior art and provides additional advantages discussed throughout the present disclosure. Additional features and advantages are realized through the techniques of the present disclosure. Other aspects and aspects of the disclosure are described in detail herein.
5 [0008] In an aspect of the present disclosure, a method for updating firmware or software of
an Electronic Control Unit (ECU) of a vehicle is disclosed. The method comprises receiving, from an over the air (OTA) server, an update notification for the ECU. The update notification at least comprises an ECU ID of the ECU and update firmware/software version of the ECU. The method also comprises determining whether firmware/software update is required by
10 comparing exiting firmware/software version with the update firmware/software version
received for the at least one ECU. In response to the determining that the firmware/software update is required, the method comprises retrieving, from the OTA server, an updated firmware/software file. Further, the method also includes determining whether a plurality of preconditions of the vehicle are met and flashing the updated firmware/software file on the
15 ECU if the plurality of preconditions of the vehicle are met.
[0009] In an aspect of the present disclosure, a domain controller unit (DCU) for updating firmware/software of an Electronic Control Unit (ECU) of a vehicle is disclosed. The DCU comprises a memory and at least one processor communicatively coupled to the memory. The at least one processor is configured to receive, from an over the air (OTA) server, an update notification for the ECU. The update notification at least comprises an ECU ID of the ECU and update firmware/software version of the ECU. The at least one processor is also configured to determine whether firmware/software update is required by comparing exiting firmware/software version with the update firmware/software version received for the at least one ECU. In response to the determining that the firmware/software update is required, the at least one processor is also configured to retrieve, from the OTA server, an updated firmware/software file. Further, the at least one processor is also configured to determine whether a plurality of preconditions of the vehicle are met and flash the updated firmware/software file on the ECU if the plurality of preconditions of the vehicle are met.
[0010] The foregoing summary is illustrative only and is not intended to be in any way limiting.
30 In addition to the illustrative aspects, aspects, and features described above, further aspects,

aspects, and features will become apparent by reference to the drawings and the following detailed description.
BRIEF DESCRIPTION OF THE ACCOMPANYING DRAWINGS
[0011] The accompanying drawings, which are incorporated in and constitute a part of this
5 disclosure, illustrate exemplary aspects and, together with the description, explain the disclosed
principles. In the figures, the left-most digit(s) of a reference number identifies the figure in
which the reference number first appears. The same numbers are used throughout the figures
to reference features and components. Some aspects of system and/or methods in accordance
with aspects of the present subject matter are now described, by way of example only, and
10 regarding the accompanying figures, in which:
[0012] FIG. 1 illustrates an environment for updating firmware/software of an Electronic Control Unit (ECU) of a vehicle, in accordance with some aspects of the present disclosure;
[0013] FIG. 2 illustrates a signalling diagram for updating firmware/software for an Electronic Control Unit (ECU) of a vehicle, in accordance with some aspects of the present disclosure;
15 [0014] FIG. 3 illustrates a block diagram of a domain controller unit (DCU) for updating
firmware/software of an Electronic Control Unit (ECU) of a vehicle, in accordance with some aspects of the present disclosure; and
[0015] FIG. 4 illustrates a flowchart illustrating a method for updating firmware/software for
an Electronic Control Unit (ECU) of a vehicle, in accordance with some aspects of the present
20 disclosure.
[0016] It should be appreciated by those skilled in the art that any block diagrams herein
represent conceptual views of illustrative systems embodying the principles of the present
subject matter. Similarly, it will be appreciated that any flow charts, flow diagrams, state
transition diagrams, pseudo code, and the like represent various processes which may be
25 substantially represented in computer readable medium and executed by a computer or
processor, whether such computer or processor is explicitly shown.
DETAILED DESCRIPTION

[0017] In the present document, the word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any aspect or implementation of the present subject matter described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects.
5 [0018] While the disclosure is susceptible to various modifications and alternative forms,
specific aspect thereof has been shown by way of example in the drawings and will be described in detail below. It should be understood, however that it is not intended to limit the disclosure to the specific forms disclosed, but on the contrary, the disclosure is to cover all modifications, equivalents, and alternative falling within the scope of the disclosure.
10 [0019] The terms “comprises”, “comprising”, “includes”, or any other variations thereof, are
intended to cover a non-exclusive inclusion, such that a setup, device, or method that comprises a list of components or steps does not include only those components or steps but may include other components or steps not expressly listed or inherent to such setup or device or method. In other words, one or more elements in a system or apparatus proceeded by “comprises… a”
15 does not, without more constraints, preclude the existence of other elements or additional
elements in the system or method.
[0020] In the following detailed description of the aspects of the disclosure, reference is made
to the accompanying drawings that form a part hereof, and in which are shown by way of
illustration specific aspects in which the disclosure may be practiced. These aspects are
20 described in sufficient detail to enable those skilled in the art to practice the disclosure, and it
is to be understood that other aspects may be utilized and that changes may be made without departing from the scope of the present disclosure. The following description is, therefore, not to be taken in a limiting sense.
[0021] The term ‘vehicle’ as used herein refers to passenger vehicles or commercial vehicles
25 such as, but not limited to, cars, buses, trucks, and the like.
[0022] The term “server” and “over the air (OTA) server” have same meaning and have been alternatively used throughout the specification.
[0023] The term “Electronic Controller Unit” and “ECU” have same meaning and have been alternatively used throughout the specification.

[0024] The term “driver” and “user” have same meaning and have been alternatively used throughout the specification.
[0025] The term “Domain Controller Unit” and “DCU” have same meaning and have been alternatively used throughout the specification.
5 [0026] Embodiments of the present disclosure relate to method and device for updating
firmware/software for an Electronic Control Unit (ECU) of a vehicle. According to an embodiment of the present disclosure, the method for updating firmware/software of an ECU of the vehicle comprises determining whether firmware/software update is required by comparing exiting firmware/software version with the update firmware/software version
10 received for the at least one ECU. Further, if it is determined that the firmware/software
updated is required, the method comprises flashing the updated firmware/software file on the ECU if the plurality of preconditions of the vehicle are met. Thus, the method and device of the present disclosure save network bandwidth and data usage while improving the firmware/software update process for vehicles. Further, the method and device also prevent
15 false software updates through the over-the-air process and enhances tracking of updates,
ensuring that the latest software version is running on the target ECU. Additionally, repeated firmware/software updates on vehicles are avoided by improving the performance of the vehicle's TCU and contributing to overall system efficiency.
[0027] FIG. 1 illustrates an environment 100 for updating firmware/software of an Electronic
20 Control Unit (ECU) 1 to n of a vehicle, in accordance with some aspects of the present
disclosure.
[0028] In an aspect of the present disclosure, the environment 100 may include a vehicle (not
shown) driven by a driver 101. The vehicle may comprise a Telematic Control Unit (TCU)
105, a domain controller unit (DCU) 107, and one or more Electronic Control Units (ECUs) 1
25 to n.
[0029] The one or more ECUs are connected to the DCU 107. The connection between the
ECUs and DCU 107 may be achieved via CAN communication, Bluetooth, Wi-fi or any other
communication protocol known to a person skilled in the art. The environment 100 may also
include an over the air (OTA) server 103 connected to the TCU 105. The OTA server 103 may
30 be configured to provide update notification to the TCU 105. The TCU 105 in turn,
6

communicates the update notification to the DCU 107 to check if a firmware/software update for one or more ECU is required.
[0030] In an embodiment, the update notification may comprise at least an ECU ID of the ECU
and update firmware/software version of the ECU. Moreover, the OTA server 103 may also be
5 configured to send the firmware/software update file to the DCU 107 via the TCU 105 if the
DCU 107 determines that the firmware/software update of the one or more ECUs is required.
The firmware/software update file is sent by the OTA server 103 to the DCU 107 for flashing
the firmware/software update file on the one or more ECUs. However, the functionality of the
OTA server 103 is not limited to the above explanation and any other functionality of the OTA
10 server 103 known to a person skilled in the art is well within the scope of the present disclosure.
[0031] The TCU 105 may be configured to receive an update notification and
firmware/software update file for the ECUs from the OTA server 103. The TCU may also be
configured to communicate the update notification and firmware/software update file to the
DCU 107. However, the functionality of the TCU 105 is not limited to the above explanation
15 and any other functionality of the TCU 105 known to a person skilled in the art is well within
the scope of the present disclosure.
[0032] The DCU 107 may be configured to receive an update notification for updating an ECU
and may determine if a firmware/software update for one or more ECUs is required. The DCU
107 may be configured to determine if a firmware/software update of an ECU is required by
20 comparing exiting firmware/software version of the ECU with the update firmware/software
version received for the OTA server 103.
[0033] The DCU 107 may be communicatively coupled to the TCU 105 to receive update
notifications and firmware/software update file for the ECUs 1 to n from the OTA server 103.
Further, the DCU 107 may also be configured to flash the software update file to the one or
25 more ECUs 1 to n in the case where it is determined that the firmware/software update is
required. However, the functionality of the DCU 107 is not limited to the above explanation and any other functionality of the DCU 107 known to a person skilled in the art is well within the scope of the present disclosure.
[0034] FIG. 2 illustrates a signal diagram 200 for updating firmware/software of an Electronic
30 Control Unit (ECU) of a vehicle, in accordance with some aspects of the present disclosure.
7

[0035] As shown in Fig. 2, the OTA server 103 may send update notification to the DCU 107 of a vehicle. (as shown by step S1). The update notification may relate to a software/firmware update available for the one or more ECUs of the vehicle and the update notification may comprise at least an ECU ID of the ECU and update firmware/software version of the ECU.
5 [0036] In one non-limiting aspect, the communication between the OTA server 103 and the
DCU 107 can take place over an internet connection. In another non-limiting aspect, the OTA
server 103 and the DCU 107 may communicate with each other via a TCU 105. In such a case,
upon receipt of the update notification from the OTA server 103, the TCU 105 may forward
the notification to the DCU 107 of the vehicle. The TCU 105 may communicate with the DCU
10 107 via a controller area network (CAN) protocol. However, the communication between the
TCU 105 and the DCU 107 is not limited to the above protocol and any other communication protocol is well within the scope of the present disclosure.
[0037] In response to the receipt of the update notification, the DCU 107 may determine whether a firmware/software update is required for any one or more of the ECUs of the vehicle.
15 For this purpose, the DCU 107 may request the ECU 1 for the ECU software version currently
installed on the ECU 1. (as shown by step S2). In response, the ECU 1 may send the ECU software version to the DCU 107. (as shown by step S3). If it is determined by the DCU 107 that a firmware/software update is required, the DCU 107 will request the OTA server 103 to send the firmware/software update file to the DCU 107. (as shown by step S4). In response,
20 the OTA server 103 may send the firmware/software update file to the DCU 107 and the DCU
107 may store the firmware/software update file in the DCU 107 memory (as shown by step S5).
[0038] Thereafter, the DCU 107 may carry out preconditions check to determine if a plurality of conditions for the firmware/software update have been met (as shown by step S6). The
25 plurality of preconditions of the vehicle at least comprises vehicle speed is zero, ignition status
is ON, and battery status greater than a predetermined threshold. If the pre-conditions have been met (as shown by step S7), the DCU 107 may send a user authorization request to the user to receive authorization to proceed with the software update of the ECU (as shown by step S8). In response, a driver may authorize the firmware/software update by sending the authorization
30 (as shown by step S9).
8

[0039] In one non-limiting aspect, the authorization request may be displayed on the
instrument cluster of the vehicle and the driver may authorize/authenticate the request by
pressing the hazard switch of the vehicle twice. However, the driver authorization is not limited
to hazard switch and any other means of authorization known to a person skilled in the art is
5 well within the scope of the present disclosure.
[0012] Upon receiving the driver authorization, the DCU 107 may reverify the plurality of
preconditions of the vehicle. Upon reverification, the DCU 107 may flash the updated
firmware/software file on the ECU 1 (as shown by step 10). Upon flashing the update, the
existing firmware/software version of the ECU will be updated to the firmware/software update
10 received from the OTA server 103.
[0013] During the firmware/software update, the DCU 107 may monitor a status of the flashing to detect a failure or completion of the software update. Upon completion of the firmware/software update, the DCU 107 may be notified of the completion by the ECU (as shown by step S11).
15 [0014] However, if the DCU 107 detects a failure in flashing the updated firmware/software
on the ECU, the DCU 107 may initiate rollback to the existing firmware/software version of the ECU. The rollback to the existing firmware/software version is discussed in further detail in the below embodiments. The DCU 107 may store the existing firmware/software version file in its memory for rollback to existing version.
20 [0040] FIG. 3 illustrates a block diagram of a domain controller unit (DCU) 300 for updating
firmware/software for an Electronic Control Unit (ECU) of a vehicle, in accordance with some aspects of the present disclosure. In one embodiment, the DCU 300 may be similar to the DCUs of figs. 1 and 2.
[0041] In an embodiment of the present disclosure, the DCU 300 may comprise a memory 303,
25 at least one processor 301 and an input/ output unit 305 communicatively coupled with each
other.
[0042] It may be noted that, in some embodiments, the DCU 300 may include more or fewer components than those depicted herein. The various components of the DCU 300 may be implemented using hardware, software, firmware or any combinations thereof. Further, the

various components of the DCU 300 may be operably coupled with each other. More specifically, various components of DCU 300 may be capable of communicating with each other using communication channel media (such as buses, interconnects, etc.).
[0043] In one embodiment, the at least one processor 301 may be embodied as a multi-core
5 processor, a single core processor, or a combination of one or more multi-core processors and
one or more single core processors. For example, the at least one processor 301 may be
embodied as one or more of various processing devices, such as a coprocessor, a
microprocessor, a controller, a digital signal processor (DSP), a processing circuitry with or
without an accompanying DSP, or various other processing devices including, a
10 microcontroller unit (MCU), a hardware accelerator, a special-purpose computer chip, or the
like.
[0044] In one embodiment, the memory 303 is capable of storing machine executable
instructions, referred to herein as instructions. In an embodiment, the at least one processor 301
is embodied as an executor of software instructions. As such, the at least one processor 301 is
15 capable of executing the instructions stored in the memory 303 to perform one or more
operations described herein.
[0045] The memory 303 can be any type of storage accessible to the at least one processor 301
to perform respective functionalities. For example, the memory 303 may include one or more
volatile or non-volatile memories, or a combination thereof. For example, the memory 303 may
20 be embodied as semiconductor memories, such as flash memory, mask ROM, PROM
(programmable ROM), EPROM (erasable PROM), RAM (random access memory), etc. and the like.
[0046] In an embodiment of the present disclosure, the at least one processor 301 may be
configured to update firmware/software for an Electronic Control Unit (ECU) of a vehicle. The
25 at least one processor 301 may be configured to receive from an over the air (OTA) server, an
update notification for one or more ECUs. The update notification may comprise at least an ECU ID of the ECU and update firmware/software version of the ECU.
[0047] Further, the at least one processor 301 may be configured to determine whether
firmware/software update is required by comparing exiting firmware/software version with the
30 update firmware/software version received for the ECU. If it is determined that the
firmware/software update is required, the at least one processor 301 may be configured to
10

retrieve an updated firmware/software file from the OTA server and store the updated firmware/software in storage. In one embodiment, the updated firmware/software may be stored in the memory 303.
[0048] The at least one processor 301 may be configured to determine whether a plurality of
5 preconditions of the vehicle are met. The plurality of preconditions of the vehicle includes at
least that vehicle speed is zero, ignition status is ON, and battery status is greater than a
predetermined threshold. If the plurality of preconditions of the vehicle are met, the at least one
processor 301 may be configured to flash the updated firmware/software file on the ECU. For
this purpose, the at least one processor 301 may be configured to generate an alert to authorize
10 the flashing of the updated firmware/software file on the ECU. The alert is generated to obtain
an authorization from the driver of the vehicle prior to flashing the updated firmware/software file on the ECU.
[0049] After receiving authorization from the driver of the vehicle, the at least one processor
301 may be configured to reverify the plurality of preconditions of the vehicle. If the plurality
15 of preconditions of the vehicle are met, the at least one processor 301 may be configured to
update the exiting firmware/software version of the ECU with the updated firmware/software file.
[0050] Moreover, during the flashing of the updated firmware/software file on the ECU, the at
least one processor 301 may be configured to monitor the status of the flashing of the updated
20 firmware/software file and display the status of the flashing of the updated firmware/software
file on a display device of the vehicle. Furthermore, the at least one processor 301 may be configured to detect a failure in flashing the updated firmware/software file on the ECU.
[0051] If a failure in flashing the flashing the updated firmware/software file on the ECU is
detected, the at least one processor 301 may be configured to reattempt the flashing of the
25 updated firmware/software file after a predetermined time period, when the plurality of
preconditions of the vehicle are met. Then, if the failure to flash the updated firmware/software on the ECU is detected, the at least one processor 301 may be configured to initiate rollback to the exiting firmware/software version.
[0052] In order to initiate rollback to the exiting firmware/software version, the at least one
30 processor 301 may be configured to retrieve exiting firmware/software from a storage. In an
embodiment, the existing firmware/software file may be stored in the memory 303. Lastly, the

at least one processor 301 may be configured to flash the exiting firmware/software file on the ECU and display the status of the rollback to the driver of the vehicle on the display device of the vehicle.
[0053] FIG. 4 shows a flowchart illustrating a method for updating firmware/software for an
5 Electronic Control Unit (ECU) of a vehicle, in accordance with some aspects of the present
disclosure.
[0054] As shown in Fig. 4, at step 402, the method 400 discloses receiving from an over the air (OTA) server, an update notification for the ECU. The update notification at least comprises an ECU ID of the ECU and update firmware/software version of the ECU.
10 [0055] At step 404, the method 400 further discloses determining whether firmware/software
update is required by comparing exiting firmware/software version with the update firmware/software version received for the at least one ECU. In one non-limiting aspect, the exiting firmware/software version and update firmware/software version are same and no update is required for ECU and the method 400 stops. In another non-limiting aspect, the
15 exiting firmware/software version is lower than the update firmware/software version and the
method 400 determines that firmware/software update is required.
[0056] At step 406, in response to the determining that the firmware/software update is
required, the method 400 discloses retrieving from the OTA server, an updated
firmware/software file. The firmware/software update file may be retrieved from an OTA
20 server via TCU by explicit request. The firmware/software update file may be internally stored
before flashing on the ECU.
[0015] At step 408, the method 400 discloses determining whether a plurality of preconditions
of the vehicle are met. The plurality of preconditions of the vehicle at least comprises vehicle
speed is zero, ignition status is ON, and battery status greater than a predetermined threshold.
25 If the pre-conditions have been met, a user authorization request may be sent to a driver of the
vehicle to provide authorization to proceed with the firmware/software update of the ECU. In response, the driver of the vehicle may authorize the firmware/software update by sending the authorization. Upon receiving the driver authorization, the plurality of preconditions of the vehicle may be reverified.

[0057] At step 410, the method 400 discloses flashing the updated firmware/software file on
the ECU if the plurality of preconditions of the vehicle are met. The method 400 further
comprises monitoring the status of the flashing of the updated firmware/software file and
displaying the status of the flashing of the updated firmware/software file on a display device
5 of the vehicle.
[0058] In an aspect, the method 400 discloses that flashing the updated firmware/software file
on the ECU comprises monitoring a status of the flashing of the updated firmware/software
file, detecting a failure in flashing the updated firmware/software file on the ECU, and in
response to the detecting the failure in flashing the updated firmware/software file on the ECU,
10 initiating rollback to the exiting firmware/software version.
[0059] The initiating rollback to the exiting firmware/software version may comprise
retrieving exiting firmware/software from a storage, flashing the exiting firmware/software file
on the ECU, displaying, on a display device, a status of the rollback to the driver of the vehicle.
In another aspect, The method 400 discloses in response to the detecting the failure in flashing
15 the updated firmware/software file on the ECU, reattempting the flashing of the updated
firmware/software file after a predetermined time period, when the plurality of preconditions of the vehicle are met.
[0060] Thus, the method 400 facilitates saving network bandwidth and data usage while
improving the software update process for vehicles. Further, the method 400 also prevents false
20 software updates through the over-the-air process and enhances tracking of updates, ensuring
that the latest software version is running on the target ECU. Additionally, repeated software updates on vehicles are avoided by improving the performance of the vehicle's TCU and contributing to overall system efficiency.
[0061] The method 400 may be described in the general context of computer executable
25 instructions. Generally, computer executable instructions can include routines, programs,
objects, components, data structures, procedures, modules, and functions, which perform specific functions or implement specific abstract data types.
[0062] The order in which the method 400 is described is not intended to be construed as a
limitation, and any number of the described method blocks can be combined in any order to
30 implement the method. Additionally, individual blocks may be deleted from the methods
without departing from the scope of the subject matter described herein. Furthermore, the
13

method can be implemented in any suitable hardware, software, firmware, or combination thereof.
[0063] The disclosed method 400 with reference to FIG. 4, or one or more operations of the
flow diagram 400 may be implemented using software including computer-executable
5 instructions stored on one or more computer-readable media (e.g., non-transitory computer-
readable media, such as one or more optical media discs, volatile memory components (e.g.,
DRAM or SRAM), or non-volatile memory or storage components (e.g., hard drives or solid-
state non-volatile memory components, such as Flash memory components) and executed on a
computer (e.g., any suitable computer, such as a laptop computer, net book, Web book, tablet
10 computing device, smart phone, or other mobile computing device). Such software may be
executed, for example, on a single local computer.
[0064] Furthermore, one or more computer-readable storage media may be utilized in implementing aspects consistent with the present disclosure. A computer-readable storage medium refers to any type of physical memory on which information or data readable by a
15 processor may be stored. Thus, a computer-readable storage medium may store instructions for
execution by one or more processors, including instructions for causing the processor(s) to perform steps or stages consistent with the aspects described herein. The term “computer-readable medium” should be understood to include tangible items and exclude carrier waves and transient signals, i.e., be non-transitory. Examples include Random Access Memory
20 (RAM), Read-Only Memory (ROM), volatile memory, non-volatile memory, hard drives, CD
(Compact Disc) ROMs, DVDs, flash drives, disks, and any other known physical storage media.
[0065] The terms "an aspect", "aspect", "aspects", "the aspect", "the aspects", "one or more
aspects", "some aspects", and "one aspect" mean "one or more (but not all) aspects of the
25 invention(s)" unless expressly specified otherwise.
[0066] The terms "including", "comprising", “having” and variations thereof mean "including but not limited to", unless expressly specified otherwise.
[0067] The enumerated listing of items does not imply that any or all the items are mutually
exclusive, unless expressly specified otherwise. The terms "a", "an" and "the" mean "one or
30 more", unless expressly specified otherwise.

[0068] A description of an aspect with several components in communication with each other does not imply that all such components are required. On the contrary, a variety of optional components are described to illustrate the wide variety of possible aspects of the invention.
[0069] When a single device or article is described herein, it will be clear that more than one
5 device/article (whether they cooperate) may be used in place of a single device/article.
Similarly, where more than one device/article is described herein (whether they cooperate), it
will be clear that a single device/article may be used in place of the more than one device/article
or a different number of devices/articles may be used instead of the shown number of devices
or programs. The functionality and/or features of a device may be alternatively embodied by
10 one or more other devices which are not explicitly described as having such
functionality/features. Thus, other aspects of invention need not include the device itself.
[0070] Finally, the language used in the specification has been principally selected for readability and instructional purposes, and it may not have been selected to delineate or circumscribe the inventive subject matter.
15 [0071] While various aspects and aspects have been disclosed herein, other aspects and aspects
will be apparent to those skilled in the art. The various aspects and aspects disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the detailed description.

WE CLAIM:
1. A method (400) for updating firmware/software of an Electronic Control Unit (ECU) of a
vehicle, the method (400) comprising:
5 receiving, (402) from an over the air (OTA) server (103), an update notification for the
ECU, wherein the update notification at least comprises an ECU ID of the ECU and update firmware/software version of the ECU;
determining (404) whether firmware/software update is required by comparing exiting
firmware/software version with the update firmware/software version received for the at least
10 one ECU; and
in response to the determining that the firmware/software update is required:
retrieving (406), from the OTA server, an updated firmware/software file;
determining (408) whether a plurality of preconditions of the vehicle are met; and
flashing (410) the updated firmware/software file on the ECU if the plurality of
15 preconditions of the vehicle are met.
2. The method (400) as claimed in claim 1, wherein flashing (410) the updated
firmware/software file on the ECU comprises:
generating an alert to authorize the flashing of the updated firmware/software file on the ECU;
receiving, from a driver of the vehicle, an authorization for flashing of the updated firmware/software file on the ECU;
reverifying the plurality of preconditions of the vehicle after the receipt of the authorization; and
updating the exiting firmware/software version of the ECU with the updated firmware/software file if the plurality of preconditions of the vehicle are met.
3. The method (400) as claimed in claim 1, wherein flashing (410) the updated
firmware/software file on the ECU comprises:
30 monitoring a status of the flashing of the updated firmware/software file;
detecting a failure in flashing the updated firmware/software file on the ECU; and in response to the detecting the failure in flashing the updated firmware/software file on the ECU, initiating rollback to the exiting firmware/software version.

4. The method (400) as claimed in claim 3, wherein initiating rollback to the exiting
firmware/software version:
retrieving exiting firmware/software from a storage;
flashing the exiting firmware/software file on the ECU; and
5 displaying, on a display device, a status of the rollback to the driver of the vehicle.
5. The method (400) as claimed in claim 3, further comprising:
in response to the detecting the failure in flashing the updated firmware/software file on
the ECU, reattempting the flashing of the updated firmware/software file after a predetermined
10 time period, when the plurality of preconditions of the vehicle are met.
6. The method (400) as claimed in claim 1, wherein the plurality of preconditions of the vehicle
at least comprises vehicle speed is zero, ignition status is ON, and battery status greater than a
predetermined threshold.
15
7. The method (400) as claimed in claim 1, further comprising:
storing exiting firmware/software file corresponding to the exiting firmware/software version in a storage; and
storing the updated firmware/software file in the storage. 20
8. The method (400) as claimed in claim 1, further comprising:
monitoring a status of the flashing of the updated firmware/software file; and displaying, on a display device, the status of the flashing of the updated firmware/software file. 25
9. A domain controller unit (DCU) (300) for updating firmware/software of an Electronic
Control Unit (ECU) of a vehicle, the domain controller unit (300) comprising:
a memory (303); and
at least one processor (301) communicatively coupled to the memory (303), wherein the
30 at least one processor (301) is configured to:
receive, from an over the air (OTA) server, an update notification for the ECU, wherein the update notification at least comprises an ECU ID of the ECU and update firmware/software version of the ECU;
17

determine whether firmware/software update is required by comparison of exiting firmware/software version with the update firmware/software version received for the at least one ECU; and
in response to the determination that the firmware/software update is required, the at least
5 one processor (301) is configured to:
retrieve, from the OTA server (103), an updated firmware/software file; determine whether a plurality of preconditions of the vehicle are met; and flash the updated firmware/software file on the ECU if the plurality of preconditions of the vehicle are met. 10
10. The DCU (301) as claimed in claim 9, wherein to flash the updated firmware/software file on the ECU, the at least one processor is configured to:
generate an alert to authorize the flashing of the updated firmware/software file on the
ECU;
15 receive from a driver of the vehicle, an authorization for flashing of the updated
firmware/software file on the ECU;
reverify the plurality of preconditions of the vehicle after the receipt of the authorization; and
update the exiting firmware/software version of the ECU with the updated
20 firmware/software file if the plurality of preconditions of the vehicle are met.
11. The DCU (300) as claimed in claim 9, wherein to flash the updated firmware/software file
on the ECU, the at least one processor (301) is further configured to:
monitor a status of the flashing of the updated firmware/software file;
25 detect a failure in flashing the updated firmware/software file on the ECU; and
in response to the detection of the failure in flashing the updated firmware/software file on the ECU, initiate rollback to the exiting firmware/software version.
12. The DCU (300) as claimed in claim 11, wherein to initiate rollback to the existing
30 firmware/software version, the at least one processor (301) is configured to:
retrieve exiting firmware/software from a storage;
flash the exiting firmware/software file on the ECU; and
display, on a display device, a status of the rollback to the driver of the vehicle.

13. The DCU (300) as claimed in claim 11, wherein the at least one processor (301) is further
configured to:
in response to the detection of the failure in flashing the updated firmware/software file
on the ECU, reattempt the flash of the updated firmware/software file after a predetermined
5 time period, when the plurality of preconditions of the vehicle are met.
14. The DCU (300) as claimed in claim 9, wherein the plurality of preconditions of the vehicle at least comprises vehicle speed is zero, ignition status is ON, and battery status greater than a predetermined threshold.
15. The DCU (300) as claimed in claim 9, wherein the at least one processor (301) is further configured to:
store exiting firmware/software file corresponding to the exiting firmware/software version in a storage; and
store the updated firmware/software file in the storage.
16. The DCU (300) as claimed in claim 9, wherein the at least one processor (301) is further
configured to:
monitor a status of the flashing of the updated firmware/software file; and
20 display, on a display device, the status of the flashing of the updated firmware/software
file.