In-vehicle device, information processing method, and computer program product

Abstract

An in-vehicle device includes a processing section and a storage section that stores a plurality of programs executable by the processing section, wherein the processing section acquires information about the presence or absence of an update provided from a server outside the vehicle, saves the acquired information about the presence or absence of the update in a shared area by executing an input / output function different from an input / output function included in a basic program, and selectively executes the basic program or an update processing program based on the saved information about the presence or absence of the update after the start of execution of the basic program.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an in-vehicle device, an information processing method, and a computer program.

[0002] This application claims priority based on Japanese Application No. 2020-69814 filed on April 8, 2020, and all the descriptions recited in the Japanese Application are incorporated herein by reference. BACKGROUND

[0003] An in-vehicle ECU (Electronic Control Unit) for controlling an in-vehicle device for a power train for engine control and the like, a body train for air conditioning control and the like is mounted on a vehicle. The in-vehicle ECU includes an arithmetic processing unit such as an MPU, a non-volatile storage unit such as a RAM that can be rewritten, and a communication unit for communicating with other in-vehicle ECUs, and controls the in-vehicle device by reading and executing a control program stored in the storage unit. In addition, a relay device having a function of wireless communication is installed in the vehicle, and communicates with a program providing device connected to a network outside the vehicle via the relay device, downloads (receives) a control program of the in-vehicle ECU from the program providing device, and can update the control program of the in-vehicle ECU (for example, refer to Patent Literature 1).

[0004] PRIOR ART DOCUMENTS

[0005] PATENT LITERATURE

[0006] Patent Literature 1: Japanese Patent Application Publication No. 2017-97851 SUMMARY

[0007] An in-vehicle device of an aspect of the present disclosure includes a processing unit and a storage unit that stores a plurality of programs executable by the processing unit, wherein the plurality of programs includes a boot program executed at startup of the processing unit, a basic program selectively executed by the boot program, and an update processing program selectively executed by the boot program, and communicates information related to an update with a server outside the vehicle, the storage unit includes a shared area that holds information related to presence or absence of an update of a control program of the device, the shared area is accessible by execution of the boot program, the shared area is a different area from an area accessible by an input / output function included in the basic program, the processing unit acquires information related to the presence or absence of the update provided from the server outside the vehicle, the processing unit holds the acquired information related to the presence or absence of the update in the shared area by an input / output function different from the input / output function included in the basic program, and the processing unit executes the basic program or the update processing program after start of execution of the boot program based on the held information related to the presence or absence of the update. BRIEF DESCRIPTION OF DRAWINGS

[0008] Figure 1 is a schematic view illustrating a structure of an in-vehicle system including a relay device (in-vehicle device) of the present embodiment.

[0009] Figure 2 is a block diagram illustrating a structure of a relay device or the like.

[0010] Figure 3 is a flowchart showing a sequence of a saving process of an update flag performed by the relay device of the present embodiment.

[0011] Figure 4 is a flowchart showing a sequence of a startup process performed by the relay device of the present embodiment. DETAILED DESCRIPTION

[0012] [PROBLEMS TO BE SOLVED BY THE PRESENT DISCLOSURE]

[0013] The relay device of Patent Literature 1 does not take into account matters related to a process of updating a control program executed by the device, and thus it can not be able to efficiently perform the update of the control program of the device.

[0014] An object of the present disclosure is to provide an in-vehicle device capable of efficiently performing an update of a control program of the device.

[0015] [EFFECTS OF THE PRESENT DISCLOSURE]

[0016] According to an aspect of the present disclosure, it is possible to efficiently perform an update of a control program of the device.

[0017] [EXPLANATION OF THE EMBODIMENTS OF THE PRESENT DISCLOSURE]

[0018] First, an embodiment of the present disclosure is explained. Also, at least a part of the embodiments described below can be arbitrarily combined.

[0019] (1) The on-vehicle device of one aspect of the present disclosure includes a processing section and a storage section that stores a plurality of programs executable by the processing section, wherein the plurality of programs includes a boot program executed at startup of the processing section, a basic program selectively executed by the boot program, and an update processing program selectively executed by the boot program, and communicates information related to an update with a server outside the vehicle, the storage section includes a shared area that holds information related to the presence or absence of an update of a control program of the device, the shared area is accessible by execution of the boot program, the shared area is a different area from an area accessible by an input / output function included in the basic program, the processing section acquires information related to the presence or absence of the update provided from the server outside the vehicle, the processing section saves the acquired information related to the presence or absence of the update in the shared area by an input / output function different from the input / output function included in the basic program, and the processing section executes the basic program or the update processing program after the start of execution of the boot program based on the saved information related to the presence or absence of the update.

[0020] In this aspect, the on-vehicle device stores a plurality of programs including a boot program, a basic program, an update processing program, a control program executed on the basic program, and the like in the storage section. The processing section of the on-vehicle device executes processing based on control contents and access authority that differ depending on the executed program. The processing section that executes the boot program determines which of the basic program and the update processing program to start by recognizing information related to the presence or absence of an update provided from the server outside the vehicle and stored in the storage section. In the presence of information related to the update, the processing section saves an identifier indicating the presence of the information related to the update in a shared area accessible by the processing section that executes the boot program without passing through the basic program. Even before the start of execution of the basic program, by acquiring information related to the presence or absence of an update using the processing section that executes the boot program, it is possible to determine the program that becomes an execution target in the boot phase, and thus it is possible to efficiently implement an update of a program based on the update processing program selectively started according to the determination result. The shared area is provided as a dedicated area that is not accessible by the processing section that executes the basic program and holds only information related to the presence or absence of an update, and thus it is possible to prevent the occurrence of a conflict and to achieve efficient execution of processing by a simple structure.

[0021] (2) In the vehicle-mounted device of one aspect of the present disclosure, the plurality of programs include the control program and a diagnosis program executed on the basic program, the diagnosis program contains an input / output function different from the input / output function contained in the basic program, a processing section during execution of the control program controls relaying between a plurality of vehicle-mounted ECUs connected through communication, a processing section during execution of the diagnosis program acquires information on presence / absence of the update provided from a server outside the vehicle, and the acquired information on presence / absence of the update is stored in the shared area through the input / output function different from the input / output function contained in the basic program.

[0022] In this aspect, the control program and the diagnosis program are executed in parallel on the basis of the basic program, whereby the vehicle-mounted device has a function as a gateway, for example, and can perform efficient update processing.

[0023] (3) In the vehicle-mounted device of one aspect of the present disclosure, the processing section specifies the shared area by a physical address indicating a physical storage location in the storage section, and the information on presence / absence of the update is stored in the specified shared area.

[0024] In this aspect, the information on presence / absence of the update is stored in the shared area specified directly by the physical address. Thus, the other programs can refer to the shared area without control based on the input / output function contained in the basic program, and processing can be efficiently performed.

[0025] (4) In the vehicle-mounted device of one aspect of the present disclosure, the shared area is accessible by executing the update processing program, and a processing section executing the update processing program stores information indicating completion of the update processing in the shared area in a case where the update processing is completed.

[0026] In this aspect, the update processing program stores the information indicating completion of the update in the shared area in a case where the update processing is completed. The shared area is configured to be accessible by the processing section executing the update processing program without passing through the basic program, and thus processing can be efficiently performed.

[0027] (5) An information processing method of one aspect of the present disclosure includes: a boot process performed at startup; a basic process selectively executed by the boot process; and an update process selectively executed by the boot process, communication of information related to update with a server outside the vehicle is performed, a shared area in which information related to presence or absence of update of a control program of the device is stored is accessible by execution of the boot process, the shared area is a different area from an area accessible based on an input / output function included in the basic process, information related to the presence or absence of the update provided from the server outside the vehicle is acquired, the acquired information related to the presence or absence of the update is stored in the shared area by an input / output function different from the input / output function included in the basic process, based on the stored information related to the presence or absence of the update, the basic process or the update process is executed after the start of execution of the boot process.

[0028] In this aspect, the update of the control program of the device can be efficiently implemented.

[0029] (6) A computer program of one aspect of the present disclosure includes: a boot program executed at startup; a basic program selectively executed by the boot program; and an update process program selectively executed by the boot program, communication of information related to update with a server outside the vehicle is performed, a shared area in which information related to presence or absence of update of a control program of the device is stored is accessible by execution of the boot program, the shared area is a different area from an area accessible by an input / output function included in the basic program, information related to the presence or absence of the update provided from the server outside the vehicle is acquired, the acquired information related to the presence or absence of the update is stored in the shared area by an input / output function different from the input / output function included in the basic program, based on the stored information related to the presence or absence of the update, the basic program or the update process program is executed after the start of execution of the boot program.

[0030] In this aspect, the update of the control program of the device can be efficiently implemented.

[0031] [Details of Embodiments of the Present Disclosure]

[0032] Hereinafter, a specific example of a relay device of an embodiment of the present disclosure will be described with reference to the drawings. Note that the present disclosure is not limited to these examples, and is disclosed by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0033] Figure 1 is a schematic view illustrating a structure of a vehicle-mounted system including a relay device (vehicle-mounted device) 2 of the present embodiment. Figure 2is a block diagram illustrating the structure of a relay device or the like. A vehicle-mounted system includes an external communication device 1 mounted on a vehicle C, a relay device 2, and an external server 100. In the present embodiment, the relay device 2 corresponds to a vehicle-mounted device that stores a boot program 2a, a basic program 2b, an update processing program 2g, and the like. The relay device 2 acquires a program or data from the external server 100 connected via an external network N and transmits to a vehicle-mounted ECU 3 (Electronic Control Unit) mounted on the vehicle C. Also, in a case where an external authentication device 5 is connected to the vehicle C, the external authentication device 5 communicates with the external server 100 via the external network N.

[0034] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and has a storage section 101 formed of a RAM (Random Access Memory), a ROM (ReadOnly Memory), or a hard disk. The storage section 101 stores a program or data for controlling the relay device 2 made by a manufacturer or the like of the relay device 2. The program or data is transmitted to the vehicle C as an update program as described later and is used to update a control program 2c or data of the relay device 2 mounted on the vehicle C. The external server 100 configured in this way is also called an OTA (Over The Air) server. The relay device 2 mounted on the vehicle C acquires the update program transmitted from the external server 100 by wireless communication, applies as a control program for executing the update program, and can update (adapt) the control program executed by the device. The storage section 101 of the external server 100 stores structure information of the relay device 2 transmitted from the external authentication device 5. The structure information includes identification information (VIN: Vehicle Identification Number) for identifying the vehicle C. The external server 100 determines the vehicle C based on the identification information and performs communication with the relay device 2 of the determined vehicle C about the structure information of the relay device 2 of the vehicle C.

[0035] The vehicle C mounts the external communication device 1, the relay device 2, a display device 7, and a plurality of vehicle-mounted ECUs 3 for controlling various vehicle-mounted equipment. The external communication device 1 and the relay device 2 are connected to be communicable by a wire harness such as a serial cable. The relay device 2 and the vehicle-mounted ECUs 3 are connected to be communicable by a communication line 41 and an in-vehicle LAN 4 corresponding to a communication protocol such as CAN (Control Area Network / registered trademark) or Ethernet (registered trademark).

[0036] The vehicle exterior communication device 1 includes a vehicle exterior communication section 11 and an input / output I / F (interface) 12 for communication with the relay device 2. The vehicle exterior communication section 11 is a communication device for wireless communication using a protocol for mobile communication such as 3G, LTE, 4G, 5G, WiFi, and the like, and transmits and receives data with the external server 100 via an antenna 13 connected to the vehicle exterior communication section 11. The communication of the vehicle exterior communication device 1 with the external server 100 is performed via a vehicle exterior network N such as a public line network or the Internet.

[0037] The input / output I / F 12 is a communication interface for serial communication with the relay device 2, for example. The vehicle exterior communication device 1 and the relay device 2 communicate with each other via the input / output I / F 12 and a wire harness such as a serial cable connected to the input / output I / F 12. In the present embodiment, the vehicle exterior communication device 1 is provided as a device different from the relay device 2, and these devices are connected to be communicable by the input / output I / F 12 or the like, but are not limited thereto. The vehicle exterior communication device 1 can also be a structure built in the relay device 2 as a structural part of the relay device 2.

[0038] The relay device 2 includes a processing section 20, a storage section 21, an input / output I / F 22, a vehicle interior communication section 23, and the like, as shown in FIG. 2. Figure 2 The relay device 2 comprehensively manages segments of systems based on a plurality of communication lines 41, such as a control system vehicle-mounted ECU 3, a safety system vehicle-mounted ECU 3, and a body system vehicle-mounted ECU 3, and relays communication of the vehicle-mounted ECUs 3 among the segments to each other. The relay device 2 is, for example, a gateway or an Ethernet switch. The relay device 2 can also constitute a function as a body ECU that controls the entire vehicle C, an automatic driving ECU that controls automatic driving, or the like.

[0039] The processing section 20 is constituted by a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or the like. The processing section 20 performs various control processing and arithmetic processing, and the like, by reading out and executing each program and data stored in advance in the storage section 21. Note that, hereinafter, the description of "program" can include data required for execution of the program.

[0040] The storage section 21 is constituted by a volatile memory element such as a RAM (Random Access Memory), or a non-volatile memory element such as a ROM (ReadOnly Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory. The storage section 21 includes a boot program area 211, a basic program area 212, an update processing program area 215, a shared area 216, and the like.

[0041] The boot program 2a is saved in the boot program area 211. The boot program 2a is a program that is first started after reset of the relay device 2. The processing section 20 performs processing of selectively starting either of the basic program 2b and the update processing program 2g described later, according to information about presence or absence of update saved in the shared area 216, by executing the boot program 2a. The information about presence or absence of update is information indicating whether or not the external server 100 has information about update. The information about presence or absence of update includes, for example, an update flag indicating a case where information about update is present, a completion flag indicating a case where information about update is absent, and the like. In a case where the update flag is present, the processing section 20 starts the update processing program 2g. In a case where the completion flag is present, the processing section 20 starts the basic program 2b. The boot program 2a can also end after performing processing of starting the update processing program 2g or the basic program 2b.

[0042] The update processing program area 215 saves the update processing program 2g. The update processing program 2g is a program for performing update processing of updating the control program 2c that is an update target to an update program, in a case where the update program is provided from the external server 100. The processing section 20 performs update processing of acquiring the update program from the external server 100, by performing the update processing program 2g, and performing communication of information about update of the control program 2c described later with the external server 100 via the vehicle exterior communication device 1. The acquired update program is saved in the basic program area 212. In a case where the update processing is completed, the processing section 20 saves an identifier indicating a case where the update processing is completed in the shared area 216.

[0043] The basic program area 212 includes a program area (code flash) 213 and a data area (data flash) 214. The basic program 2b, the control program 2c executed on the basic program 2b, the diagnosis program 2d, the safety program 2e, and the like are saved in the program area 213. The data area 214 includes an NVM management area 2f managed by an input / output function (NVM) possessed by the basic program 2b. The basic program 2b is a computer program related to an operating system. The basic program 2b can also be a program that complies with a standard such as AUTOSAR (Automotive Open System Architecture).

[0044] The control program 2c, the diagnosis program 2d, and the safety program 2e are all programs executed on the platform of the basic program 2b.

[0045] The control program 2c is a program executed in a state where the update processing based on the update processing program 2g is not performed, and relays communication between the in-vehicle ECUs 3, or between the external server 100 and the in-vehicle ECUs 3, for example. This control program 2c is an object to be updated by the update program transmitted from the relay device 2. The processing section 20 relays the CAN message, IP packet, or the like transmitted from the in-vehicle ECUs 3 by referring to the relay path information (routing table) stored in the storage section 21, for example, by executing the control program 2c.

[0046] The diagnosis program 2d is a program executed in parallel with the control program 2c, and monitors the presence or absence of information related to the update program. The processing section 20 performs communication with the external server 100 using the vehicle external communication device 1 by executing the diagnosis program 2d, and periodically performs inquiry as to whether or not information related to the update of the control program 2c mounted on the vehicle C is present. In the case where the information related to the update is present, the processing section 20 saves an identifier indicating the presence of the update request in the shared area 216. Note that the diagnosis program 2d is not limited to a program executed in parallel with the control program 2c. For example, it can be configured as a module included in the control program 2c, or can be executed as a sub-process of the control program 2c.

[0047] The security program 2e is a program executed in parallel with the control program 2c and the diagnosis program 2d, and manages security information in the above-described control program 2c and diagnosis program 2d.

[0048] In the above, an example in which the control program 2c, the diagnosis program 2d, and the security program 2e executed on the basic program 2b are configured as different program modules is described, but the present embodiment is not limited thereto. For example, the control program 2c, the diagnosis program 2d, and the security program 2e can be included in the basic program 2b as a part of the function of the basic program 2b.

[0049] The above-described boot program 2a, the basic program 2b, the control program 2c, the diagnosis program 2d, the security program 2e, and the update processing program 2g stored in the storage section 21 can each be stored in a recording medium 2A from which the boot program 2a, the basic program 2b, the control program 2c, the diagnosis program 2d, the security program 2e, and the update processing program 2g can be read by the relay device 2. Further, the boot program 2a, the basic program 2b, the control program 2c, the diagnosis program 2d, the security program 2e, and the update processing program 2g can each be downloaded from an external computer not shown connected to a communication network not shown, and stored in the storage section 21. Furthermore, the structure information of the entire relay device 2 and the in-vehicle ECUs 3 mounted on the vehicle C is stored in the storage section 21.

[0050] The NVM management area 2f is a data holding area managed by the input / output function (memory management function) included in the basic program 2b. The processing section 20 executing the basic program 2b accesses the NVM management area 2f using the input / output function that converts a logical address into a physical address in the processing based on the basic program 2b, and holds data. That is, the processing section 20 executing the basic program 2b stores conversion information converted by the input / output function so as to correspond the logical address to the physical address, and holds data in the NVM management area 2f determined by referring to the conversion information. Therefore, the NVM management area 2f restricts the case of being accessed from the processing section 20 executing another program not having the input / output function included in the basic program 2b. That is, in the case of executing the boot program 2a and the update processing program 2g, the processing section 20 cannot refer to the information of the NVM management area 2f. With the NVM management area 2f thus configured, the input / output processing is executed using the input / output function possessed by the basic program 2b, whereby the processing section 20 executes the read / write of data, sound, and the like to / from the NVM management area 2f.

[0051] The shared area (data flash) 216 is an identifier dedicated area that holds only an identifier indicating information on the presence / absence of update. The identifier indicating information on the presence / absence of update includes, for example, the update flag, the completion flag, and the like described above. The shared area 216 is a data holding area not managed by the input / output function possessed by the basic program 2b, and is a storage area in which a position can be uniquely specified using a physical address. The processing section 20 executing the input / output function possessed by the basic program 2b cannot access the shared area 216. The processing section 20 executing the diagnosis program 2d and the update processing program 2g holds an identifier corresponding to the result in the case of recognizing the information on the presence / absence of update or in the case of the completion of update processing in the shared area 216. In this case, the processing section 20 specifies the shared area 216 using the physical position information, that is, the physical address in the nonvolatile memory of the storage section 21, and holds the identifier in the shared area 216. That is, the processing section 20 executing the diagnosis program 2d or the update processing program 2g accesses the shared area 216 using the input / output function that directly specifies the physical address, which is different from the input / output function of the basic program 2b that performs the conversion processing of corresponding the logical address to the physical address, and holds data.

[0052] As described above, the storage section 21 has the shared area 216 not managed by the input / output function possessed by the basic program 2b, whereby the shared area 216 can be directly accessed from the processing section 20 executing another program without executing the basic program 2b. Even in the case of the processing section 20 executing the processing based on the boot program 2a, the basic program 2b is not started, the identifier indicating information on the presence / absence of update can be recognized by directly accessing the shared area 216, and the subsequent start processing can be efficiently performed.

[0053] The input / output I / F 22 is a communication interface for performing, for example, serial communication, like the input / output I / F 12 of the off-vehicle communication device 1. The relay device 2 is connected to the off-vehicle communication device 1 and the IG switch 6 via the input / output I / F 22 so as to be communicable.

[0054] The in-vehicle communication section 23 is an input / output interface using a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark), and the processing section 20 communicates with the in-vehicle ECUs 3 or other in-vehicle devices such as relay devices connected to the in-vehicle LAN 4 via the in-vehicle communication section 23. The in-vehicle communication section 23 is provided in plurality, and the communication lines 41 constituting the in-vehicle LAN 4 are connected to the in-vehicle communication sections 23, respectively. By providing the in-vehicle communication sections 23 in plurality, the in-vehicle LAN 4 is divided into a plurality of segments, and the in-vehicle ECUs are connected to each segment according to the functions (control system function, safety system function, body system function) of the in-vehicle ECUs. The in-vehicle communication section 23 connects the external authentication device 5 described later as needed, and the processing section 20 communicates with the external authentication device 5 via the in-vehicle communication section 23 in the case where the external authentication device 5 is connected.

[0055] The in-vehicle ECUs 3 include a control section 30, a storage section 31, and an in-vehicle communication section 32. The storage section 31 is constituted by a volatile memory element such as RAM or a non-volatile memory element such as ROM, EEPROM, or flash memory, and stores programs or data of the in-vehicle ECUs 3. The control section 30 is constituted by a CPU or an MPU, and performs control processing and the like by reading out and executing the programs and data stored in the storage section 31, and controls in-vehicle devices or actuators and the like including the in-vehicle ECUs 3.

[0056] The external authentication device 5 is a device (diagnostic tool) used by a vehicle C maintenance business such as an authorized dealer who performs maintenance work such as replacement of the in-vehicle ECUs 3, and is, for example, a device in which a dedicated application program is installed in a general-purpose information terminal such as a personal computer, a tablet PC, or a smartphone, or a device including hardware and constituting a dedicated information terminal. The external authentication device 5 includes a control section, a storage section, and an in-vehicle communication section (all not shown) based on a CPU or an MPU, like the in-vehicle ECUs 3 described above. The in-vehicle communication section of the external authentication device 5 is not limited to CAN or Ethernet like the in-vehicle ECUs 3, and can be, for example, an input / output I / F or a communication module for communication based on a wire harness such as a serial cable.

[0057] The external authentication device 5 communicates with the relay device 2 or the in-vehicle ECU 3 via an in-vehicle LAN or the like through the in-vehicle communication section. Alternatively, the in-vehicle communication section of the external authentication device 5 has a function of wireless communication, and the external authentication device 5 can also be configured to communicate with the relay device 2 through wireless communication. Further, the external authentication device 5 includes an out-of-vehicle communication section (not shown) for communicating with the external server 100. The out-of-vehicle communication section of the external authentication device 5 is a communication module having a communication function based on wired or wireless communication, and the external authentication device 5 communicates with the external server 100 via an out-of-vehicle network N through the out-of-vehicle communication section.

[0058] The IG (ignition) switch 6 that performs start or stop of the vehicle C is communicably connected to the input / output I / F 22 of the relay device 2 through a wire harness such as a serial cable. In a case where the IG switch 6 is turned on or off, the processing section 20 of the relay device 2 acquires (receives) a signal output (transmitted) from the IG switch 6 via the input / output I / F 22. The processing section 20 of the relay device 2 transmits information (a signal of IG on or a signal of IG off) related to the turning on or off of the IG switch 6 to all the in-vehicle ECUs 3 via the in-vehicle communication section 23 on the basis of the acquired signal, and also transmits to the external authentication device 5 in a case where the external authentication device 5 is connected to the vehicle C. The in-vehicle ECUs 3 and the external authentication device 5 acquire the information related to the turning on or off of the IG switch 6 transmitted from the relay device 2, and perform a prescribed action on the basis of the acquired information.

[0059] The display device 7 is an HMI (Human Machine Interface) device such as a display of a vehicle navigation. The display device 7 is communicably connected to the input / output I / F 22 of the relay device 2 through a wire harness such as a serial cable. The display device 7 displays data or information output from the processing section 20 of the relay device 2 via the input / output I / F 22.

[0060] Figure 3 is a flowchart showing the order of the saving process of the update flag performed by the relay device 2 of the present embodiment. The processing section 20 of the relay device 2 stably performs the following process in a case where, for example, the vehicle C is in a start state (the IG switch 6 is on) or a stop state (the IG switch 6 is off).

[0061] The processing section 20 of the relay device 2 communicates with the external server 100 via the vehicle exterior communication device 1, and performs inquiry of the presence or absence of information related to the update program (step Sll). The processing section 20 determines whether or not information related to the update program, such as advertising information, exists, that is, whether or not an update request exists (step S12). The determination of the presence or absence of the update request can be not only pull communication based on the inquiry from the relay device 2 to the external server 100, but also push communication based on a message or the like transmitted from the external server 100 to the relay device 2. Note that the inquiry of the information related to the update program can also be performed by connecting the external authentication device 5 to the in-vehicle communication section 23.

[0062] In a case where it is determined that the information related to the update program does not exist by receiving a response indicating that the information related to the update program does not exist from the external server 100 (step S12: No), the processing section 20 performs loop processing in order to perform the processing of step Sll again. The processing section 20 periodically performs the inquiry related to the update program to the external server 100 by performing the loop processing.

[0063] In a case where it is determined that the information related to the update program exists by receiving a response indicating that the information related to the update program exists from the external server 100 (step S12: Yes), the processing section 20 saves an update flag (for example, an identifier "1") indicating that the information related to the update program exists in the shared area 216 (step S13), and ends the processing. In this case, the processing section 20 does not perform the conversion processing of establishing correspondence between the logical address and the physical address, directly designates the physical address of the shared area 216 as the physical position information, and saves the update flag in the shared area 216. That is, the processing section 20 saves the update flag in the shared area 216 by an input / output function different from the input / output function of the basic program 2b.

[0064] Figure 4 is a flowchart showing the order of the startup processing performed by the relay device 2 of the present embodiment. The following processing is performed by the processing section 20 of the relay device 2, for example, when a reset signal indicating reset of the vehicle C is acquired, or the IG switch 6 changes from the off state to the on state or from the on state to the off state.

[0065] The processing section 20 expands the boot program 2a stored in the storage section 21 onto the RAM, and starts the boot program 2a (step S21). The processing section 20 refers to the shared area 216 determined based on the physical address, and determines whether the update flag exists (step S22). The processing section 20 determines that the update flag exists, for example, when the shared area 216 stores the identifier "1". On the other hand, when the shared area 216 stores the identifier "0", the processing section 20 determines that the update flag does not exist. The processing section 20 determines the program to be started based on the presence or absence of the update flag.

[0066] When it is determined that the update flag exists (step S22: YES), the processing section 20 determines to start the update processing program 2g. The processing section 20 selects the update processing program 2g stored in the update processing program area 215, and starts it (step S23), and ends the processing of the boot program 2a.

[0067] The processing section 20 shifts to the processing based on the update processing program 2g. The processing section 20 acquires the update program from the external server 100 via the vehicle exterior communication device 1 (step S24). The processing section 20 can also acquire the update program from the external authentication device 5 via the vehicle interior communication section 23.

[0068] The processing section 20 performs the update processing of updating the control program 2c to the acquired update program, that is, the new control program 2c (step S25). Specifically, the processing section 20 performs the update processing of deleting the control program 2c stored in the program area, and applying the update program by newly storing the acquired update program. Alternatively, when the storage section 21 has two areas in the program area, the processing section 20 can store the acquired update program in the other area different from the area storing the control program 2c as the update target. The processing section 20 switches the area of the storage section 21 from which the control program 2c is read out to the area storing the update program from the area in which the control program 2c was previously stored, thereby performing the update processing.

[0069] When the update processing is normally completed by applying the new control program 2c, the processing section 20 resets the flag stored in the shared area 216. The processing section 20, for example, stores the completion of the update processing, that is, stores the information related to the update appropriately and stores the completion flag (for example, the identifier "0") indicating that the information related to the update does not exist in the shared area 216 (step S26), and ends the processing of the update processing program 2g. Even in this case, the processing section 20 does not perform the conversion processing of establishing the correspondence between the logical address and the physical address, directly specifies the physical address of the shared area 216 as the physical position information, and stores the completion flag in the shared area 216. That is, the processing section 20 stores the completion flag in the shared area 216 by the input / output function different from the input / output function of the basic program 2b.

[0070] On the other hand, in a case where it is determined that the update flag does not exist (step S22: No), the processing section 20 determines to start the basic program 2b. The processing section 20 selects the basic program 2b stored in the program area 213 and starts it (step S27), and ends the processing of the boot program 2a.

[0071] The processing section 20 shifts to the processing based on the basic program 2b. The processing section 20 starts the control program 2c on the basic program 2b (step S28), and starts the processing based on the control program 2c. The processing section 20 performs the relay processing of relaying, for example, a CAN message, an IP packet, and the like transmitted from the in-vehicle ECU 3 (step S29), and ends the processing of the control program 2c and the basic program 2b.

[0072] The processing section 20 causes a sub-process to occur, and performs the processing of step S30 in parallel with the processing of step S28 and the following steps. The processing section 20 starts the diagnosis program 2d on the basic program 2b (step S30), and starts the processing based on the diagnosis program 2d. The processing section 20 performs the processing of monitoring and updating the information on the presence or absence of the update (step S31), and ends the processing of the diagnosis program 2d and the basic program 2b. Note that the processing section 20 can further cause a sub-process to occur, and perform the processing of starting the safety program 2e in parallel with step S28 and step S30. Figure 3

[0073] According to the present embodiment, the shared area 216 that is commonly accessed by the processing section 20 that executes a plurality of programs can store the information on the presence or absence of the update. The processing section 20 can determine the program to be started by referring to the information on the presence or absence of the update stored in the shared area 216 by the function of the boot program, and thus can efficiently implement the update of the control program 2c of the device.

[0074] The embodiments disclosed this time can be modified as follows. The present application is not limited to the above embodiments. The scope of the present application is indicated not by the above embodiments but by the claims for patent, and all modifications equivalent to the claims for patent and within the scope of the claims for patent are to be embraced.

[0075] Label Explanation

[0076] C Vehicle

[0077] N Off-vehicle Network

[0078] 100 Off-vehicle Server (OTA Server)

[0079] 101 Storage Section

[0080] 1 Off-vehicle Communication Device

[0081] 11 Off-vehicle Communication Section

[0082] ​12 input / output I / F

[0083] 13 antenna

[0084] 2 relay device (in-vehicle device, gateway)

[0085] 20 processing section

[0086] 21 storage section

[0087] 211 boot program area

[0088] 212 basic program area

[0089] 213 program area

[0090] 214 data area

[0091] 215 update processing program area

[0092] 216 shared area

[0093] 2a boot program

[0094] 2b basic program

[0095] 2c control program

[0096] 2d diagnosis program

[0097] 2e security program

[0098] 2f NVM management area

[0099] 2g update processing program

[0100] 2A recording medium

[0101] 22 input / output I / F

[0102] 23 in-vehicle communication section

[0103] 3 in-vehicle ECU

[0104] 30 control section

[0105] 31 storage section

[0106] 32 in-vehicle communication section

[0107] 4 in-vehicle LAN

[0108] 41 communication line

[0109] 5 external authentication device

[0110] 6 IG switch

[0111] 7 display device (HMI device)

Claims

1. An in-vehicle device that includes a processing unit and a storage unit that stores a plurality of programs executable by the processing unit, wherein the plurality of programs include: a boot program executed at startup of the processing unit; a basic program selectively executed by the boot program; and an update processing program selectively executed by the boot program, which communicates information related to an update with a server outside the vehicle, the storage unit includes a shared area that holds information related to the presence or absence of an update of a control program of the device, the shared area is accessible by execution of the boot program, the shared area is a different area from an area accessible by an input / output function included in the basic program, the processing unit acquires the information related to the presence or absence of the update provided from the server outside the vehicle, the processing unit holds the acquired information related to the presence or absence of the update in the shared area by an input / output function different from the input / output function included in the basic program, and the processing unit executes the basic program or the update processing program after the start of execution of the boot program based on the held information related to the presence or absence of the update.

2. The in-vehicle device according to claim 1, wherein the plurality of programs include the control program and a diagnosis program executed on the basic program, the diagnosis program includes an input / output function different from the input / output function included in the basic program, the processing unit controls relaying between a plurality of in-vehicle ECUs connected by communication during execution of the control program, and the processing unit acquires the information related to the presence or absence of the update provided from the server outside the vehicle, holds the acquired information related to the presence or absence of the update in the shared area by an input / output function different from the input / output function included in the basic program during execution of the diagnosis program.

3. The in-vehicle device according to claim 1 or 2, wherein the processing unit specifies the shared area by a physical address that indicates a physical storage location in the storage unit, and holds the information related to the presence or absence of the update in the specified shared area.

4. The in-vehicle device according to claim 1 or 2, wherein the shared area is accessible by execution of the update processing program, and the processing unit that executes the update processing program holds information indicating completion of update processing in the shared area in the case where the update processing is completed.

5. An information processing method including: a boot process executed at startup; a basic process selectively executed by the boot process; and an update process selectively executed by the boot process, which communicates information related to an update with a server outside the vehicle, a shared area that holds information related to the presence or absence of an update of a control program of the device is accessible by execution of the boot process, the shared area is a different area from an area accessible by an input / output function included in the basic process, and the information processing method is for causing a computer to execute: a process of acquiring the information related to the presence or absence of the update provided from the server outside the vehicle. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ The acquired information about the presence or absence of the update is saved in the shared area through an input / output function different from an input / output function included in the basic process; The basic process or the update process is executed after the start of execution of the boot process, based on the saved information about the presence or absence of the update.

6. A computer program product, comprising: a boot program that is executed at startup; a basic program that is selectively executed by the boot program; and an update process program that is selectively executed by the boot program, which communicates information about an update with a server outside the vehicle, a shared area that saves information about the presence or absence of an update of a control program of the device is accessible by executing the boot program, the shared area being a different area from an area accessible through an input / output function included in the basic program, the computer program is for causing a computer to execute the following processes: acquire information about the presence or absence of the update provided from a server outside the vehicle; save the acquired information about the presence or absence of the update in the shared area through an input / output function different from an input / output function included in the basic program; execute the basic program or the update process program after the start of execution of the boot program, based on the saved information about the presence or absence of the update.

Images