Information processing device, in-vehicle system, information processing method, and computer program

Abstract

To shorten a starting time while ensuring security.SOLUTION: An information processing device comprising: a control unit configured to execute a first process of diagnosing validity of a partial area of a data set stored in a register at the time of starting the information processing device, and a second process of diagnosing a remaining area which is an area other than the partial area of the data set after completion of a starting process of the information processing device.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, an in-vehicle system, an information processing method, and a computer program. [Background technology]

[0002] There are known techniques for diagnosing registers to ensure the security of devices. For example, Patent Document 1 discloses a technique in which a microcomputer in an on-board ECU (Electronic Control Unit) diagnoses the configuration registers of peripheral functions.

[0003] In the technology of Patent Document 1, in consideration of the fact that repeating register diagnosis at predetermined intervals increases the computational load and may affect vehicle control, register diagnosis for a peripheral function is performed only when an abnormality is detected in that peripheral function, thereby limiting the range of register diagnosis and suppressing an increase in the computational load. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2017-211812 Summary of the Invention [Problem to be solved by the invention]

[0005] As devices become more multifunctional and sophisticated, the capacity of registers to be diagnosed is also increasing, and the time required to diagnose registers is also increasing. In particular, if register diagnosis takes time when starting up a device, the startup time of the device increases.

[0006] In the technology of Patent Document 1, when a device is started up, setting data related to peripheral functions is set in a Config register (initialization process). After this initialization process, a register diagnostic process may be performed during the startup process to determine whether the initialization process was executed correctly. However, Patent Document 1 does not mention how to deal with the situation when the amount of processing required for the initialization process and diagnostic process during the startup process becomes large.

[0007] In view of the above problem, an object of the present disclosure is to provide an information processing device, an in-vehicle system, an information processing method, and a computer program that can further shorten the startup time while ensuring security. [Means for solving the problem]

[0008] The information processing device of the present disclosure is an information processing device that includes a control unit that executes a first process of diagnosing the validity of a partial area of ​​a dataset stored in a register when the information processing device is started, and a second process of diagnosing a remaining area of ​​the dataset other than the partial area after the start-up process of the information processing device is completed. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to further shorten the startup time while ensuring security. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment. [Figure 2] FIG. 2 is a diagram for explaining the problem and the solution of the present disclosure. [Figure 3] FIG. 3 is a sequence diagram illustrating an example of an information processing method. [Figure 4] FIG. 4 is a subroutine showing the details of the first process. [Figure 5] FIG. 5 shows a subroutine for when the control unit calculates the number of diagnoses. [Figure 6] FIG. 6 is table data showing an example of priority information. [Figure 7] FIG. 7 shows table data indicating a state in which priorities are assigned to data stored in a register based on priority information. [Figure 8] FIG. 8 is table data showing another example of priority information. [Figure 9] FIG. 9 is a subroutine showing the details of the second process. [Figure 10] FIG. 10 is a diagram showing the configuration of an in-vehicle device according to a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0011] [Description of the embodiments of the present disclosure] The gist of the present disclosure includes the following configurations.

[0012] (1) The information processing device of the present disclosure is an information processing device that includes a control unit that executes a first process of diagnosing the validity of a partial area of ​​a dataset stored in a register when the information processing device is started, and a second process of diagnosing a remaining area of ​​the dataset other than the partial area after the start-up process of the information processing device is completed.

[0013] The control unit executes the diagnostic process by dividing it into a first process for executing a diagnosis when the information processing device is started up and a second process for executing a diagnosis after the information processing device is started up. Because only the first process is executed during the startup process, the diagnostic process is shortened by the amount that the second process is not executed. Furthermore, because the second process is also executed after the startup process, the entire register area is ultimately diagnosed. Therefore, the startup time can be further shortened while ensuring security.

[0014] (2) In the information processing device of (1) above, the control unit may, in the first process, diagnose up to a predetermined number of data by counting the data in descending order of priority in priority information that links the data stored in the register from among the data sets to the priority of the data.

[0015] Since data with a high priority can be diagnosed first in the first process, it is possible to prevent the adverse effects of diagnosing a portion (remaining area) of the data set stored in the register after the startup process.

[0016] (3) In the information processing device of (2) above, the control unit may perform the diagnosis in the first process in descending order of priority.

[0017] Since data can be diagnosed in descending order of priority, it is possible to prevent the adverse effects of diagnosing the remaining area after the startup process, and to discover any irregularities in high-priority data early on.

[0018] (4) In the information processing device of (2) or (3) above, the number of diagnoses may be less than or equal to the value obtained by dividing the allowable diagnostic time of the data set, excluding predicted values ​​of other processing times, within the allowable startup time of the information processing device, by the unit diagnostic time per data piece of the data set, and greater than or equal to the number of data pieces in the data set used when starting up the information processing device, and the control unit may obtain the number of diagnoses based on the allowable startup time and the unit diagnostic time.

[0019] This allows the number of diagnoses to be determined flexibly, reducing the required margin and enabling the startup time to be shortened more flexibly.

[0020] (5) In the information processing device of (1) to (4) above, the partial area may include data used when the information processing device is started up, and the remaining area may include data not used when the information processing device is started up.

[0021] This configuration allows the data required for the startup process to be diagnosed first within the allowable startup time, while the diagnosis of data that does not need to be diagnosed urgently can be postponed. As a result, various processes such as the startup process can be executed using data whose validity has been confirmed, thereby shortening the startup time while ensuring security.

[0022] (6) In the information processing device of (1) to (5) above, the remaining area may include data used when a specified application is executed, and the control unit may execute the second processing after the startup processing of the information processing device is completed and before the specified application is executed.

[0023] This allows the application to be executed after the validity of the data has been diagnosed, thereby ensuring security.

[0024] (7) The in-vehicle system of the present disclosure is an in-vehicle system comprising the information processing device (1) to (6) mounted on a vehicle, and the register located within the information processing device of the vehicle or outside the information processing device.

[0025] In the case of an in-vehicle system, there is a particular demand for a shorter startup time. The in-vehicle system of the present disclosure achieves the same effects as the information processing device described above in (1) to (6), and therefore can more effectively meet the demand for a shorter startup time.

[0026] (8) The information processing method of the present disclosure is an information processing method performed by the information processing devices described above in (1) to (6). Therefore, the information processing method of the present disclosure has the same effects as the information processing devices described above in (1) to (6).

[0027] (9) The computer program of the present disclosure is a computer program for causing a computer to function as the information processing device described above in (1) to (6). Therefore, the computer program of the present disclosure has the same effects as the information processing device described above in (1) to (6).

[0028] [Details of the embodiments of the present disclosure] Hereinafter, details of embodiments of the present disclosure will be described with reference to the drawings.

[0029] [In-vehicle system 1] FIG. 1 is a diagram showing an example of the configuration of an in-vehicle system 1 according to an embodiment. The in-vehicle system 1 is a system mounted on a vehicle V1 such as an automobile. The in-vehicle system 1 includes an in-vehicle device 10, a plurality of processing devices 40, and a communication device 50. The in-vehicle device 10 and the processing device 40 are connected by a communication line L1. The in-vehicle device 10 and the communication device 50 are connected by a communication line L2. The in-vehicle system 1 may include a plurality of in-vehicle devices 10 and a plurality of communication devices 50.

[0030] The processing device 40 is hardware that performs various processes, such as a braking device, a sliding door, a battery, an air conditioner, or a sensor of the vehicle V1. The processing device 40 may be an ECU (Electronic Control Unit).

[0031] The communication device 50 has an antenna and is a device that performs wireless communication with the outside of the vehicle V1. The communication device 50 is, for example, a TCU (Telematics Control Unit), and transmits and receives information to and from external devices via a public communication network.

[0032] The in-vehicle device 10 is, for example, an ECU. Although the function of the in-vehicle device 10 is not particularly limited, the in-vehicle device 10 will be described below as a relay device that relays communication between a plurality of processing devices 40. Note that the in-vehicle device 10 may be a device that controls the processing devices 40 (operation system ECU), or may be a device that monitors the state of each part of the vehicle V1 based on information input from the processing devices 40 (cognition system ECU).

[0033] The communication lines L1 and L2 are communication cables that comply with a communication protocol such as Ethernet (registered trademark) or CAN (Controller Area Network).

[0034] [In-vehicle device 10] The in-vehicle device 10 includes a first device 20 and a second device 30. The first device 20 and the second device 30 are connected by a signal line L3.

[0035] The first device 20 is a device that diagnoses a register 35 included in the second device 30, and is, for example, a computer device such as an MCU (Micro Controller Unit) or an MPU (Micro Processor Unit). The first device 20 is an example of an "information processing device" of the present disclosure.

[0036] The second device 30 is, for example, a switch integrated circuit (IC) that functions as an L2 switch, such as an Ethernet switch. The second device 30 includes a register 35. The second device 30 is an example of a "diagnosis target device" in the present disclosure.

[0037] Like the in-vehicle device 10, the function of the second device 30 is not particularly limited. The second device 30 may be, for example, a sensor that detects the interior or exterior conditions of the vehicle V1, an actuator that drives each part of the vehicle V1, or a control unit that controls the actuators. In the following, the second device 30 will be described as a switch IC as an example.

[0038] The register 35 is a temporary storage device, specifically a volatile memory, that stores instructions or settings related to the operation of the second device 30. When the power supply to the second device 30 is stopped, the register 35 returns to its initial state (default). Therefore, each time the second device 30 is powered on, the first device 20 executes an initialization process to write settings to the register 35.

[0039] At this time, if the initialization process is executed by a program that has been tampered with through unauthorized access or the like, an incorrect value may be written to the register 35. Furthermore, since the in-vehicle device 10 is used in a harsh environment, such as inside the vehicle V1, where temperatures tend to be relatively high, an incorrect value may be written to the register 35 due to external disturbances or the like.

[0040] Therefore, to ensure security, after initializing register 35, first device 20 executes a diagnostic process to diagnose the validity of the data stored in register 35. Note that while determining the validity of the data written to register 35 may be referred to as "register verification" or "register check," in the following explanation it will mainly be referred to as "register diagnosis."

[0041] Normally, the initialization process and the diagnostic process are executed when the first device 20 is started up, and these processes must be executed within a time allowed for the start-up process of the first device 20 (hereinafter referred to as the allowable start-up time Ta). The allowable start-up time Ta is a time set by a user, such as the manufacturer of the vehicle V1, and if the time Ta is exceeded, the first device 20 may be deemed a defective product.

[0042] In particular, the allowable startup time Ta of the first device 20 mounted on the in-vehicle device 10 tends to be set shorter than that of other devices such as home appliances. The first device 20 is supplied with power from a battery (not shown) of the vehicle V1, and is therefore powered off when the engine of the vehicle V1 is stopped. For example, when the engine of the vehicle V1 is started, power supply to the first device 20 begins, and the first device 20 is powered on.

[0043] When the first device 20 is involved in driving control of the vehicle V1, the first device 20 must complete a series of startup processes between the start of the engine of the vehicle V1 and the start of driving of the vehicle V1. For this reason, the allowable startup time Ta is set to several hundred milliseconds. Thus, there is a need to further shorten the time required for the startup process (startup time) of the first device 20.

[0044] Fig. 2 is a diagram that outlines the problems and solutions of the present disclosure. The left side of Fig. 2 shows the startup time of the first device 20 in the first state (conventional), the center of Fig. 2 shows the startup time of the first device 20 in the second state (problem), and the right side of Fig. 2 shows the startup time of the first device 20 in the third state (present embodiment).

[0045] The first state indicates a state in which the startup time falls within the range of the allowable startup time Ta. The startup process of first device 20 includes initialization process of second device 30, including initialization of register 35, diagnostic process of register 35, and other processes. Conventionally, in a normal first device 20, the startup time falls within the range of the allowable startup time Ta, and the problem described in the present disclosure did not occur.

[0046] The second state indicates a state in which the startup time exceeds the allowable startup time Ta. For example, as the number of networks set in the second device 30 (such as the number of connected processing devices 40) increases, the amount of data to be set in the register 35 also increases, which increases the time required for the initialization process and the diagnostic process, resulting in a longer startup time than in the first state. In particular, with the development of connected car technology and autonomous driving technology, the number of devices included in the in-vehicle system 1 is on the rise, and the number of networks is also increasing, so if things continue as they are, a longer startup time is unavoidable.

[0047] The third state represents the startup time according to the embodiment. The first device 20 divides the diagnostic process into a first process executed at startup and a second process executed after startup. Since only the first process of the diagnostic process is executed during startup, the diagnostic process is shorter than in the second state by the amount of the second process. This shortens the startup time and keeps it within the allowable startup time Ta.

[0048] Since the second process is also executed after the startup process, the entire area of ​​the register 35 is ultimately diagnosed. Therefore, the startup time can be further shortened while ensuring security.

[0049] [First device 20] The first device 20 (information processing device) includes a control unit 21, a storage unit 22, a communication unit 23, and an interface unit 24. These units 21 to 24 are electrically connected to each other via a bus 26.

[0050] The control unit 21 is an arithmetic processing unit including a circuit such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit), and may include a programmable logic device such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0051] The storage unit 22 includes a volatile memory and a non-volatile memory. The volatile memory is a semiconductor memory for temporary storage, such as a static random access memory (SRAM) or a dynamic random access memory (DRAM). The non-volatile memory is a storage device for long-term storage, such as a hard disk drive (HDD), a solid state drive (SSD), a read only memory (ROM), or a flash memory.

[0052] The storage unit 22 stores a computer program 25, priority information Y1, and various other parameters in a non-volatile memory. The computer program 25 includes a program for executing initialization processing and diagnostic processing of the second device 30 when the first device 20 is started up, etc. The priority information Y1 is information that associates data stored in the register 35 with the priority of the data. The priority information Y1 may be stored in the storage unit 32, which will be described later.

[0053] The communication unit 23 is a communication card that complies with a communication protocol such as Ethernet, and converts a digital signal input from the bus 26 to the communication unit 23 into a communication signal and outputs it to the communication line L2. The communication unit 23 also converts a communication signal input from the communication line L2 to the communication unit 23 into a digital signal and takes it into the bus 26.

[0054] The interface unit 24 is, for example, a PHY device, and is connected to the signal line L3. The interface unit 24 converts a digital signal input to the interface unit 24 from the bus 26 into an analog signal and outputs the analog signal to the signal line L3. The interface unit 24 also converts an analog signal input to the interface unit 24 from the signal line L3 into a digital signal and inputs the digital signal into the bus 26.

[0055] [Second device 30] The second device 30 (device to be diagnosed) includes a control unit 31, a storage unit 32, a plurality of communication units 33, 33, and an interface unit . These units 31 to are electrically connected to each other via a bus .

[0056] The control unit 31 is an arithmetic processing unit including a circuit configuration such as a CPU or a GPU, etc. The control unit 31 may include a programmable logic device such as an ASIC or an FPGA as a part thereof.

[0057] The storage unit 32 includes a volatile memory and a non-volatile memory. The volatile memory is a semiconductor memory for temporary storage, such as an SRAM or a DRAM. The non-volatile memory is a storage device for long-term storage, such as an HDD, an SSD, a ROM, or a flash memory.

[0058] The register 35 is configured as part of the volatile memory of the storage unit 32. The register 35 is, for example, a configuration register (also called a control register) that holds instructions or settings related to the operation of the second device 30. Note that the function of the register 35 is not limited to a configuration register, and it may be another register, such as a base register that stores a reference value of an address.

[0059] The register 35 includes a plurality of addresses for storing data such as programs. For example, data D1 is stored at address 0x0001 of the register 35, and data D2 is stored at address 0x0002 of the register 35. The plurality of data D1 and D2 stored in the register 35 are appropriately referred to as a "data set."

[0060] The communication unit 33 is a communication card that complies with a communication protocol such as Ethernet, and converts a digital signal input from the bus 36 to the communication unit 33 into a communication signal and outputs it to the communication line L1. The communication unit 33 also converts a communication signal input from the communication line L1 to the communication unit 33 into a digital signal and takes it into the bus 36.

[0061] The interface unit 34 is, for example, a PHY device, and is connected to the signal line L3. The interface unit 34 converts a digital signal input to the interface unit 34 from the bus 36 into an analog signal and outputs the analog signal to the signal line L3. The interface unit 34 also converts an analog signal input to the interface unit 34 from the signal line L3 into a digital signal and inputs the digital signal into the bus 36.

[0062] [Information processing method] Fig. 3 is a sequence diagram showing an example of an information processing method executed by the in-vehicle device 10. Each process in Fig. 3 is realized by the control unit 21 reading out the computer program 25 from the storage unit 22 and executing various calculations and controls. In the following description, each process is mainly executed by the control unit 21, but some of these processes may be shared by the control unit 31. The order of each process shown in Fig. 3 may be changed as appropriate.

[0063] First, the outline of the information processing method will be described. In the information processing method of the present disclosure, when in-vehicle device 10 is started, first device 20 executes initialization processing and diagnosis processing of register 35. At this time, instead of diagnosing the entire area of ​​register 35, diagnosing only a portion of the data set stored in register 35 can shorten the start-up time.

[0064] Furthermore, the remaining areas of the data set stored in the register 35 that were not diagnosed during the startup process are diagnosed after startup. As a result, all areas of the register 35 are ultimately diagnosed, thereby ensuring the security of the in-vehicle device 10.

[0065] Furthermore, the data stored in the register 35 can be prioritized using various methods, and only high-priority data can be diagnosed during the startup process, while low-priority data can be diagnosed later, so that appropriate diagnostic processing can be performed according to priority.

[0066] Each step will be described in detail below.

[0067] First, the in-vehicle device 10 is powered on, thereby starting the supply of power to the components 20 and 30 of the in-vehicle device 10 (step S101). For example, the driver turns on the ignition switch of the vehicle V1, thereby powering on the in-vehicle device 10. This starts various startup processes described below.

[0068] The following startup process may be performed not only when the power is turned on (power ON), but also when the in-vehicle device 10 transitions from a sleep state to a normal state (wake-up). The sleep state is a state in which, for example, some functions of the in-vehicle device 10 are stopped to reduce power consumption compared to the normal state. In the present disclosure, both power ON and wake-up are collectively referred to as "starting up" the in-vehicle device 10 (or the first device 20 or the second device 30).

[0069] In addition, in the present disclosure, "startup of in-vehicle device 10 (or startup of first device 20, or startup of second device 30)" refers to the period from the start point when power is turned on or when the device is woken up to the end point when communication activation (step S106) described below is completed. The series of processes from step S101 to step S106 is referred to as "startup processing."

[0070] Next, first device 20 is initialized (step S102). For example, various flags included in volatile memories of control unit 21 and storage unit 22 are initialized, and the process waits until the voltage within the circuit stabilizes. This initialization process is also called "initialization of the microcomputer" or "resetting the microcomputer."

[0071] Next, software initialization of first device 20 is performed (step S103). For example, control unit 21 reads computer program 25 from the nonvolatile memory of storage unit 22 into the volatile memory, and makes computer program 25 executable.

[0072] Thereafter, the second device 30 is initialized (step S104). For example, the control unit 21 writes a setting value stored in the nonvolatile memory of the storage unit 22 or 32 to the register 35, thereby initializing the register 35. As a result, data is stored in each address of the register 35.

[0073] Next, a first process is executed to diagnose the validity of a partial area of ​​the data set stored in the register 35 (step S105).

[0074] FIG. 4 is a subroutine showing the details of the first process. First, the control unit 21 acquires the number of data to be diagnosed (hereinafter referred to as the "diagnosis number Th1") (step S201). The diagnosis number Th1 may be stored as a preset parameter in the storage unit 22 or the storage unit 32, for example, or may be calculated by the control unit 21 every time the in-vehicle device 10 is started up.

[0075] 5 shows a subroutine for calculating the number of diagnoses Th1 by the control unit 21. In this case, the control unit 21 calculates the number of diagnoses Th1 based on the permissible start-up time Ta and the unit diagnosis time T1 per data item stored in the register 35.

[0076] First, the control unit 21 acquires the allowable startup time Ta (step S301). The allowable startup time Ta is stored in advance in the storage unit 22 as a parameter by, for example, the creator of the computer program 25.

[0077] Next, the control unit 21 acquires a unit diagnosis time T1 (step S302). The unit diagnosis time T1 is stored in advance as a parameter in the storage unit 22. The unit diagnosis time T1 may be a fixed value (static value), or may be a value (dynamic value) calculated and updated at appropriate timing by the control unit 21 as an average value of the diagnosis time per data item when the control unit 21 previously diagnosed the register 35.

[0078] Furthermore, the control unit 21 acquires a predicted time Tb (step S303). The predicted time Tb is a predicted value of the time required for the startup process from step S101 to step S106 excluding the first process (step S105), and is stored in advance in the storage unit 22 as a parameter.

[0079] More specifically, table data including a plurality of predicted times Tb is stored in the storage unit 22. In the table data, the predicted time Tb is stored as a larger value as the number of processing devices 40 connected to the second device 30 (or the number of networks set in the second device 30) increases.

[0080] For example, table data is stored such that when the number of processing devices 40 is three, the predicted time Tb is 30 milliseconds, and when the number of processing devices 40 is four, the predicted time Tb is 40 milliseconds. Note that a function (e.g., Tb = α × n1 + β) for deriving the predicted time Tb using the number n1 of processing devices 40 connected to the second device 30 as a variable may be stored in the storage unit 22. Furthermore, when the number n1 of processing devices 40 connected to the second device 30 is determined in advance, the storage unit 22 may store one predicted time Tb corresponding to the number n1 as a parameter.

[0081] Finally, the control unit 21 calculates the number of diagnoses Th1 based on these parameters Ta, T1, and Tb (step S304). For example, the control unit 21 first subtracts the estimated time Tb that will be required for other processing from the allowable startup time Ta to calculate the allowable diagnosis time Tr that can be used for diagnosing the register 35 (Tr=Ta-Tb).

[0082] The allowable diagnostic time Tr is then divided by the unit diagnostic time T1 to obtain a quotient (integer) that is the maximum number of diagnoses Ymax that can be performed within the allowable startup time Ta (Tr = T1 Ymax + r). Here, r is the remainder obtained by dividing the allowable diagnostic time Tr by the unit diagnostic time T1. Ymax may be calculated using an appropriate function, such as the QUOTIENT function.

[0083] Finally, the control unit 21 calculates the number of diagnoses Th1 by subtracting a predetermined margin M1 from the maximum number of diagnoses Ymax (Th1=Ymax-M1). The margin M1 is appropriately set so that even if the diagnosis time is extended due to the influence of disturbances or the like, the diagnosis time falls within the allowable diagnosis time Tr.

[0084] The margin M1 is an integer value equal to or greater than 0, and is stored in advance as a parameter in the storage unit 22. The value of the margin M1 is set so that the number of diagnoses Th1 is equal to or greater than the number n2 of data stored in the register 35 that is used in the startup process.

[0085] For example, if the margin M1 is set too large and the number of diagnoses Th1 becomes less than the number of data n2, the startup process will be performed using data that has not been diagnosed in the first process, which could result in a security problem. By setting the number of diagnoses Th1 to a value equal to or greater than the number of data n2 used in the startup process, all of the data used in the startup process can be diagnosed in the first process, preventing such a problem. In other words, it is preferable that the number of diagnoses Th1 be equal to or less than the maximum number of diagnoses Ymax and equal to or greater than the number of data n2.

[0086] When the control unit 21 calculates the number of diagnoses Th1 as described above, the control unit 21 stores the number of diagnoses Th1 in the storage unit 22.

[0087] See Fig. 4. Next, the control unit 21 acquires the priority information Y1 stored in the storage unit 22 (step S202).

[0088] FIG. 6 is table data showing an example of the priority information Y1. The priority is assigned based on, for example, the time when the data is used. For example, the earlier the data is used, the higher the priority is assigned. Specifically, data used when the in-vehicle device 10 is started (i.e., data used during the start-up process) is assigned a higher priority than other data.

[0089] For example, the priority is specified in advance for each area attribute of the data stored in the register 35. In this case, a label such as "High" or "Low" is assigned to each area attribute in descending order of priority. The area attribute is, for example, an attribute related to network setting information.

[0090] 6, when the area attribute is ARL (Address Resolution Logic table), VLAN (Virtual Local Area Network), or ACL (Access Control List), a priority of "High" is assigned, and when the area attribute is QoS (Quality of Service), a priority of "Low" is assigned. That is, in the register 35, data with an area attribute of ARL, VLAN, or ACL has a higher priority than data with an area attribute of QoS.

[0091] 7 is table data showing a state in which priorities are assigned to data stored in the register 35 based on the priority information Y1. For example, if data of the area attribute ARL is stored in the range from address 0x0001 to address 0x0FFF in the register 35, the priority of that range will be "High" based on the priority information Y1.

[0092] Similarly, if area-attribute VLAN data is stored in the range of addresses 0x1000 to 0x1FFF in the register 35, the priority of that range will be "High" based on the priority information Y1. Also, if area-attribute QoS data is stored in the range of addresses 0x2000 to 0x2FFF in the register 35, the priority of that range will be "Low" based on the priority information Y1.

[0093] In this way, by specifying a priority for each area attribute, it is not necessary to specify a priority individually for each address in register 35, and there is no need to revise the priority each time, for example, when the area attribute of the data set in register 35 is changed. This reduces the burden of revising the priority, etc.

[0094] 8 is table data showing priority information Y2 as another example of priority information. The priority information Y2 may be stored in the storage unit 22 instead of the priority information Y1. As shown in FIG. 8, the priority information Y2 specifies a priority for each address of the register 35.

[0095] In this case, as shown in the "Priority 1" column in Figure 8, three levels of priority, "High," "Medium," or "Low," may be assigned to each address in the register 35. For example, "High" is assigned to addresses 0x0001, 0x0002, and 0x0005, "Medium" is assigned to address 0x0003, and "Low" is assigned to address 0x0004. By specifying a priority for each address in this way, it is possible to set priorities in more detail.

[0096] As shown in the "Priority 2" column in Fig. 8, the priority may be assigned using a numerical value such as "1," "2," or "3." In this case, for example, a smaller numerical value indicates a higher priority.

[0097] Furthermore, as shown in the "Priority 3" column in Figure 8, priorities may be assigned in more than three stages. For example, data with higher priority may be assigned lower numerical values. In the example of Figure 8, priorities of 1, 2, 4, 5, and 3 are assigned to addresses 0x0001 to 0x0005 in that order.

[0098] 4. Next, the control unit 21 diagnoses the validity of the data with the highest priority among the data sets stored in the register 35 based on the priority information Y1 (step S203). For example, if two levels of priority are assigned as in the example of FIG. 7 and multiple pieces of data with the same priority exist, the data with the same priority are diagnosed in ascending order of address number.

[0099] In the example of Figure 7, the control unit 21 checks the data stored at address 0x0001. The method of checking the data is not particularly limited, and any known method can be used. For example, if the memory unit 22 stores valid data that should be stored in the register 35, and the valid data in the memory unit 22 matches the data in the register 35, the control unit 21 diagnoses that the data in the register 35 is valid. On the other hand, if the valid data in the memory unit 22 does not match the data in the register 35, the control unit 21 diagnoses that the data in the register 35 is invalid.

[0100] If the check process (step S203) diagnoses that the data is valid, the control unit 21 proceeds to the next step S204. On the other hand, if the data is diagnosed as invalid, the control unit 21 overwrites the address of the register 35 containing the invalid data with valid data based on the computer program 25, and performs the check process again on the data at that address.

[0101] The control unit 21 may end the first process (step S105) without overwriting the address with regular data, and output an error message indicating that there is an abnormality in the data stored in the register 35. The error message is transmitted to a device outside the vehicle V1 (for example, a management device that manages the in-vehicle device 10) via the communication unit 23 and the communication device 50, for example.

[0102] After outputting the error message, the control unit 21 may restart the in-vehicle device 10 and execute the startup process again, starting from step S101. This is because if normal data is not set in the register 35 due to an external disturbance or the like, executing the startup process again may result in normal data being set in the register 35.

[0103] In addition, when the control unit 21 restarts the in-vehicle device 10 multiple times (for example, twice) and normal data is not set in the register 35, after outputting an error message, the control unit may stop the process at the stage of the first process (step S105) and maintain the standby state until there is an input from the user. When normal data is not set in the register 35 even after multiple restarts, there is a possibility that the computer program 25 has been tampered with due to unauthorized access or the like, and it is unlikely that normal data will be set in the register 35 even if the startup process is repeated further.

[0104] Subsequently, the control unit 21 compares the check count X1 (that is, the number of executions of step S203) with the diagnosis count Th1 (step S204). When the check count X1 is equal to or greater than the diagnosis count Th1 (X1 ≥ Th1), the control unit 21 ends the first process and exits the register diagnosis loop.

[0105] On the other hand, when the check count is less than the diagnosis count Th1 (X1 < Th1), the control unit 21 adds "1" to the check count X (step S205) and proceeds to the check process (step S203).

[0106] In the second check process, the control unit 21 checks the data stored at the next address 0x0002 with a high priority. As long as each data is valid, the control unit 21 repeats steps S203 to S205 until the check count X1 becomes equal to or greater than a predetermined diagnosis count Th1, and diagnoses the data stored in the register 35 in descending order of priority.

[0107] As described above, when the check for a predetermined diagnosis count Th1 is performed and there is no illegal data in the checked range, the control unit 21 exits the loop (the YES route of step S204) and ends the first process.

[0108] In the first process, the data sets stored in the register 35 are counted in descending order of priority in the priority information Y1, and the data up to a predetermined number Th1 of diagnoses are diagnosed in descending order of priority. However, the order of diagnosis of the data does not necessarily have to be in descending order of priority.

[0109] For example, if the predetermined number of diagnoses Th1 is 3, in the example of "priority 3" in Fig. 8, three pieces of data at addresses 0x0001, 0x0002, and 0x0005 are counted in descending order of priority and are checked in the first process. At this time, the addresses may be diagnosed in descending order of priority, such as 0x0001, 0x0002, and 0x0005, or may be diagnosed in some other order, such as 0x0005, 0x0002, and 0x0001.

[0110] In either case, the data with higher priority can be diagnosed first in the first process. In the present disclosure, the diagnosis of a part (remaining area) of the data set stored in register 35 is postponed until after the startup process. Therefore, if high-priority data is included in the data for which diagnosis is postponed, there is a risk of adverse effects such as malfunctions in the startup process. In contrast, by diagnosing the high-priority data in the first process, such adverse effects can be prevented.

[0111] See Fig. 3. Next, the control unit 21 activates communication (step S106). For example, the control unit 21 initializes the communication unit 33, enabling communication between the processing device 40 and the communication unit 33 via the communication line L1. This completes the series of startup processes.

[0112] Next, the in-vehicle device 10 executes a link-up process to establish communication between the processing device 40 and the second device 30 (step S107). For example, the control unit 21 transmits a link-up signal to the processing device 40 via the second device 30. If the processing device 40 is in a state where communication is possible, the processing device 40 outputs a response signal in response to the link-up signal. When the second device 30 receives the response signal, communication between the processing device 40 and the second device 30 is established (link-up completed).

[0113] Finally, control unit 21 executes a second process (step S108) to diagnose the remaining area of ​​the data set stored in register 35 that was not diagnosed in the first process (step S105). The timing for executing the second process is not particularly limited, but for example, if the data contained in the remaining area of ​​register 35 is used when a specific application is executed, control unit 21 executes the second process after the startup process and before the application is executed. This allows the application to be executed after the validity of the data has been diagnosed, thereby ensuring security.

[0114] FIG. 9 is a subroutine showing the details of the second process. First, the control unit 21 determines whether or not the data set stored in the register 35 includes undiagnosed data (step S401). If undiagnosed data exists, the control unit 21 sequentially checks the undiagnosed data (step S402). For example, the control unit 21 checks the undiagnosed data in ascending order of addresses. Note that the control unit 21 may check the undiagnosed data in descending order of priority based on the priority information Y1.

[0115] If the diagnosis reveals that the register 35 contains invalid data, the control unit 21 writes the data again based on the computer program 25 and rechecks the data. As in the first process, if the diagnosis reveals that the data is invalid, the control unit 21 may stop the subsequent process and output an error message.

[0116] After diagnosing the validity of the data stored in the remaining area of ​​register 35, control unit 21 again determines whether or not the data set stored in register 35 includes undiagnosed data (step S401). In the second iteration of step S401, diagnosis of all data in the remaining area of ​​register 35 has been completed, so control unit 21 exits the loop (NO route in step S401) and ends the second process.

[0117] In the information processing method of this embodiment, in the first process (step S105), the control unit 21 diagnoses the validity of data in only a partial area of ​​the data set stored in the register 35 that falls within a predetermined diagnosis number Th1.

[0118] Therefore, as shown in Figure 2, even if there is a risk that the startup time will exceed the allowable startup time Ta if diagnostic processing is performed on all areas of the data set stored in register 35 in one go during startup processing, the first processing diagnoses fewer data items than the diagnostic processing performed in one go and can be executed in a shorter time, so the startup time can be kept within the allowable startup time Ta.

[0119] Furthermore, in this embodiment, the validity of data is diagnosed only in a partial area during the startup process, so that there is a remaining area in the register 35 that is not diagnosed during the startup process. By diagnosing the data stored in this remaining area after the startup process, it is possible to ultimately diagnose the entire area of ​​the register 35 without omission. This makes it possible to further shorten the startup time while ensuring security.

[0120] In particular, by limiting the data whose validity is diagnosed in the startup process to high-priority data based on the priority information Y1, the validity of high-priority data can be diagnosed first, and the diagnosis of other data can be postponed. This makes it possible to prevent the adverse effects of executing part of the diagnostic process after the startup process. Furthermore, by diagnosing data in descending order of priority, it is possible to quickly discover any irregularities in high-priority data.

[0121] In particular, by increasing the priority of data used in the startup process, the data used in the startup process can be included in a portion of the register 35 that is diagnosed in the first process. Furthermore, the remaining portion of the register 35 that is diagnosed in the second process can be included in data that is not used in the startup process. This allows data necessary for the startup process to be diagnosed first within the allowable startup time Ta, while the diagnosis of data that does not need to be diagnosed urgently can be postponed. As a result, various processes, such as the startup process, can be executed using data whose validity has been confirmed, thereby shortening the startup time while ensuring security.

[0122] [Variations] Modifications of the embodiment will be described below. In the modifications, the same components as those in the above embodiment will be denoted by the same reference numerals and the description thereof will be omitted.

[0123] [Modification: Modification of device configuration] FIG. 10 is a diagram showing the configuration of an in-vehicle device 10a according to a modified example. In the above embodiment, the in-vehicle device 10 is configured by two devices: a first device 20 (information processing device: MCU, etc.) and a second device 30 (switch IC, etc.). However, the implementation of the present disclosure is not limited to this, and the in-vehicle device 10 may be configured by a single in-vehicle device 10a as shown in FIG. 10. In this case, the in-vehicle device 10a is an example of the "information processing device" of the present disclosure.

[0124] The in-vehicle device 10a includes a control unit 11, a storage unit 12, a communication unit 13, and an interface unit 14. These units 11 to 14 are electrically connected to each other via a bus 17.

[0125] The storage unit 12 includes a volatile memory and a non-volatile memory. The register 15 is configured in the volatile memory of the storage unit 12. The non-volatile memory of the storage unit 12 also stores a computer program 16, priority information Y1, and various parameters.

[0126] The communication unit 13 communicates with the processing device 40, similar to the communication unit 33. The interface unit 14 is, for example, an I / O port, and is connected to a device outside the in-vehicle device 10a.

[0127] The control unit 11 reads the computer program 16 from the storage unit 12 and executes the same processing as the information processing method described above (FIG. 3). That is, during the startup process, the control unit 11 diagnoses the validity of data only for a portion of the data set stored in the register 15 (first processing), and then diagnoses the validity of data for the remaining portion after the startup process (second processing). This makes it possible to further shorten the startup time while ensuring security.

[0128] In this way, in the in-vehicle system 1 of the present disclosure, the information processing device (in-vehicle device 10a or first device 20) diagnoses a data set stored in a register (register 15 or register 35) provided inside or outside the information processing device. In either device configuration, the diagnostic process is divided into a first process and a second process, which can shorten the startup time.

[0129] [Additional Note] It should be noted that at least some of the above-described embodiments and modifications may be combined with each other in any desired manner. Furthermore, the embodiments and modifications disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Explanation of symbols]

[0130] 1. In-vehicle systems 10 Onboard equipment 10a In-vehicle device (information processing device) 11 Control section 12 Storage section 13 Communications Department 14 Interface section 15 Registers 16 Computer Programs 17 Bus 20 1st device 21 Control Unit 22 Memory section 23 Communications Department 24 Interface section 25 Computer Programs 26 Bus 30 Second device 31 Control Unit 32 Storage section 33 Communications Department 34 Interface section 35 registers 36 Bus 40 Processing equipment 50 Communication equipment V1 vehicle L1,L2 communication line L3 signal line Y1,Y2 Priority information Y Number of Th1 diagnoses Ta Allowable startup time Tb predicted time Tr Allowable diagnostic time T1 unit diagnostic time Ymax Maximum number of diagnoses M1 Margin X1 Check count

Claims

1. a control unit that executes a first process of diagnosing the validity of a partial area of ​​a data set stored in a register at the time of startup of the information processing device, and a second process of diagnosing a remaining area of ​​the data set other than the partial area after completion of the startup process of the information processing device; An information processing device comprising:

2. the control unit, in the first processing, diagnoses up to a predetermined number of data items in descending order of priority in priority information linking the data items stored in the register among the data set with the priorities of the data items; The information processing device according to claim 1 .

3. the control unit, in the first process, performs diagnosis in descending order of priority. The information processing device according to claim 2 .

4. the number of diagnoses is equal to or less than a value obtained by dividing an allowable diagnostic time of the data set, excluding predicted values ​​of other processing times, within the allowable startup time of the information processing device, by a unit diagnostic time per data item of the data set, and is equal to or greater than the number of data items in the data set that are used at startup of the information processing device; the control unit acquires the number of diagnoses based on the allowable startup time and the unit diagnosis time.

4. The information processing device according to claim 2 or 3.

5. the partial area includes data used when the information processing device is started up, the remaining area includes data that is not used when the information processing device is started up; The information processing device according to any one of claims 1 to 3.

6. the remaining area includes data used when a predetermined application is executed; the control unit executes the second process after a startup process of the information processing device is completed and before the predetermined application is executed. The information processing device according to claim 1 .

7. an information processing device according to any one of claims 1 to 3, which is mounted on a vehicle; The register is provided inside the information processing device of the vehicle or outside the information processing device; An in-vehicle system comprising:

8. a first step of diagnosing the validity of a partial area of ​​a data set stored in a register at the time of startup of the information processing device; a second step of diagnosing a remaining area of ​​the data set other than the partial area after the startup process of the information processing device is completed; An information processing method comprising:

9. A computer program that causes a computer to function as an information processing device, The computer program comprises: a first step of diagnosing the validity of a partial area of ​​a data set stored in a register at the time of startup of the information processing device; a second step of diagnosing a remaining area of ​​the data set other than the partial area after the startup process of the information processing device is completed; A computer program that causes the computer to execute the above.

Images