Update management device and update management method

Abstract

The objective is to efficiently update some software modules installed in in-vehicle devices using state-of-the-art technology while guaranteeing the operation of the updated software modules. [Solution] The information processing device 100 of the update system 1 is a device for updating a software module to be updated, which is part of a plurality of software modules provided in the in-vehicle device 110. The information processing device 100 includes a determination unit 101 that determines the update range of the software module in the plurality of software modules. The determination unit 101 determines the update range based on whether the combination of the software module to be updated and other software modules after the update of the software module to be updated is a combination whose operation of each software module has been verified.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus for an update system that updates software modules provided in an in-vehicle device.

Background Art

[0002] In recent years, automobiles have been equipped with a plurality of various ECUs (Electronic Control Units). Each ECU controls various functions of the automobile by executing various software modules. In future automobiles, with the change of the E / E architecture, the software modules will become larger due to the integration and high functionality of the ECUs, and it is expected that the update time and update frequency of the software modules will increase. For this reason, the introduction of a SOTA (Software updates Over The Air) function for updating some of the plurality of software modules executed in each ECU is being considered.

[0003] As a technique for updating the software module of an ECU, for example, the technique disclosed in Patent Document 1 is known. When the software module is updated and becomes an inconsistent combination with the versions of other software modules, the technique disclosed in Patent Document 1 resolves the inconsistency by activating the software module before the update.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] One purpose of updating a software module is to eliminate vulnerabilities found in the pre-update software module. In this case, it may be undesirable to start the pre-update software module, as is the case with the technology disclosed in Patent Document 1. The technology disclosed in Patent Document 1 makes it difficult to guarantee the operation of the updated software module.

[0006] Furthermore, when a state-of-the-art (SOTA) function is introduced to update some software modules, verifying the operation of all combinations of software modules after updating some software modules and guaranteeing their operation after the update is time-consuming and not easy. In particular, it becomes difficult as the number of software module versions increases, as the number of possible combinations of software modules becomes enormous. The technology disclosed in Patent Document 1 does not consider the efficient updating of some software modules at all, and there is room for improvement.

[0007] The present invention has been made in view of the above, and aims to efficiently update some software modules provided in an in-vehicle device by state-of-the-art means while guaranteeing the operation of the updated software modules. [Means for solving the problem]

[0008] To solve the above problems, the information processing device for an update system according to the present invention is an information processing device for an update system that updates a software module to be updated, which is part of a plurality of software modules provided in an in-vehicle device, and comprises a determination unit for determining the update range of the software modules in the plurality of software modules, wherein the determination unit determines the update range based on whether the combination of the software module to be updated and other software modules after the update of the software module to be updated is a combination whose operation of each software module has been verified. [Effects of the Invention]

[0009] According to the present invention, it is possible to efficiently update some software modules provided in an in-vehicle device by state-of-the-art (SOTA) while guaranteeing the operation of the updated software modules. Other issues, configurations, and effects will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0010] [Figure 1] A diagram showing the configuration of the update system according to Embodiment 1. [Figure 2] A table showing combinations of the latest versions of software modules. [Figure 3] A table showing combinations of software module versions whose operation has been verified. [Figure 4] A table showing combinations of software module versions that have proven to work in other in-vehicle devices. [Figure 5] A flowchart showing the processing of the determination unit, as shown in Figure 1. [Figure 6] A diagram showing the configuration of the update system according to Embodiment 2. [Figure 7] A flowchart illustrating the processing of the determination unit in the information processing device of the update system according to Embodiment 3. [Modes for carrying out the invention]

[0011] Embodiments of the present invention will be described below with reference to the drawings. In each embodiment, components denoted by the same reference numerals have the same function in each embodiment unless otherwise specified, and their descriptions will be omitted.

[0012] [Embodiment 1] The information processing device 100 of the update system 1 according to Embodiment 1 will be described using Figures 1 to 5.

[0013] Figure 1 is a diagram showing the configuration of the update system 1 according to Embodiment 1.

[0014] The update system 1 is a system for updating software modules provided in the in-vehicle device 110. The update system 1 comprises the in-vehicle device 110, which has multiple software modules including the software module to be updated, and a distribution center 120 that distributes the software module to be updated. The in-vehicle device 110 and the distribution center 120 are connected to each other so as to be able to communicate with each other via a wireless communication network 130.

[0015] The in-vehicle device 110 has a processor and memory, and is composed of, for example, an ECU. The in-vehicle device 110 includes a storage area 111 that stores information on each version of a plurality of software modules provided in the in-vehicle device 110, an update execution unit 112 that performs software module updates, and a communication unit 113 that performs data communication with the outside of the in-vehicle device 110. Note that the in-vehicle device 110 may have a configuration other than that shown in Figure 1.

[0016] The distribution center 120 is composed of a server device having a processor and memory. The distribution center 120 includes an information processing device 100 for updating software modules to be updated, which are part of a plurality of software modules provided in the in-vehicle device 110. The information processing device 100 includes a determination unit 101 that determines the update range of the software modules in the plurality of software modules, and a determination information management unit 102 that holds and manages the information used for the determination by the determination unit 101. Furthermore, the distribution center 120 includes a storage area 121 that stores information transmitted from the in-vehicle device 110, a distribution unit 122 that distributes software modules corresponding to the update range determined by the determination unit 101 to the in-vehicle device 110, and a communication unit 123 that performs data communication with the outside of the distribution center 120. Note that the distribution center 120 may have a configuration other than that shown in Figure 1.

[0017] When the in-vehicle device 110 receives a software module update request triggered by the operation of a vehicle user, it determines that an update opportunity for the software module has occurred. When it is determined that an update opportunity has occurred, the in-vehicle device 110 transmits the information used for the determination by the determination unit 101 to the distribution center 120. Examples of the information transmitted from the in-vehicle device 110 to the distribution center 120 include information on the combination pattern of each version of a plurality of software modules currently provided in the in-vehicle device 110. The distribution center 120 determines the update range for a plurality of software modules provided in the in-vehicle device 110 by using the combination pattern information transmitted from the in-vehicle device 110 and the information managed by the determination information management unit 102. The distribution center 120 distributes the software modules corresponding to the determined update range to the in-vehicle device 110.

[0018] FIG. 2 is a table showing the combination of the latest versions of software modules.

[0019] As shown in FIG. 2, the determination information management unit 102 holds and manages, in association with each other, the information on the latest version and the information on whether there is an impact on vehicle control for each of a plurality of software modules provided in the in-vehicle device 110. In the example of FIG. 2, it is shown that the in-vehicle device 110 is provided with "Application A", "Application B", "Application C", "Middleware", and "Driver" as a plurality of software modules. And in the example of FIG. 2, it is shown that the latest versions of "Application A", "Application B", "Application C", "Middleware", and "Driver" are "Ver3", "Ver4", "Ver2", "Ver2", and "Ver2", respectively. And in the example of FIG. 2, it is shown that whether there is an impact on vehicle control for "Application A", "Application B", "Application C", "Middleware", and "Driver" is "Yes", "Yes", "No", "Yes", and "Yes", respectively.

[0020] Information regarding the impact on vehicle control may include, for example, information indicating whether the software module in question is a software module for the vehicle control system. Alternatively, information regarding the impact on vehicle control may include, for example, information indicating whether the software module operates on the same processor core as the vehicle control system software module and could potentially affect the operation of the vehicle control system software module. However, information regarding the impact on vehicle control is not limited to these.

[0021] Figure 3 is a table showing the combinations of software module versions whose operation has been verified.

[0022] As shown in Figure 3, the judgment information management unit 102 maintains and manages information on combination patterns of versions for which the operation of each software module has been verified among the multiple software modules provided in the in-vehicle device 110. In the example in Figure 3, combination pattern No. 1, where the versions of "App A," "App B," "App C," "Middleware," and "Driver" are "Ver1," "Ver1," "Ver1," "Ver1," and "Ver1," respectively, indicates that the operation of each software module has been verified. This combination pattern No. 1 is guaranteed to work. Information on combination patterns of versions for which the operation of each software module has been verified is provided by the software module developers.

[0023] Figure 4 is a table showing combinations of software module versions that have a proven track record of working in other in-vehicle devices 110.

[0024] As shown in Figure 4, the Judgment Information Management Unit 102 maintains and manages information on combination patterns of versions of each software module that have a proven track record of operation in other in-vehicle devices 110. In the example in Figure 4, combination pattern No. 1, where the versions of "App A," "App B," "App C," "Middleware," and "Driver" are "Ver1," "Ver1," "Ver1," "Ver1," and "Ver1," respectively, indicates that each software module has a proven track record of operation in other in-vehicle devices 110. Other in-vehicle devices 110 are, for example, in-vehicle devices 110 installed in other vehicles that have been shipped to the market. Information on combination patterns of versions of each software module that have a proven track record of operation is collected from those other vehicles via the wireless communication network 130. One trigger for the Judgment Information Management Unit 102 to collect this information from those other vehicles is, for example, the occurrence of an opportunity to update the software modules. It is also possible for the administrator of the distribution center 120 to directly register, modify, and delete each element of the table shown in Figure 4.

[0025] Figure 5 is a flowchart showing the processing of the determination unit 101 shown in Figure 1.

[0026] When a trigger for a software module update occurs, the in-vehicle device 110 transmits information about the current combination patterns of software module versions installed in the in-vehicle device 110 to the distribution center 120. The determination unit 101 of the distribution center 120 then starts the process shown in Figure 5.

[0027] In step S1, the determination unit 101 acquires information on the current version of each software module provided in the in-vehicle device 110.

[0028] In step S2, the determination unit 101 searches for the software modules to be updated. Specifically, the determination unit 101 compares the current combination of software module versions obtained in step S1 with the latest combination of software module versions held by the distribution center 120. The determination unit 101 then searches for software modules that have a difference between the two versions to be updated. However, the search may also be performed by specifying the software modules to be updated by the user.

[0029] In step S3, the determination unit 101 determines whether the software module to be updated is related to vehicle control. Specifically, the determination unit 101 determines whether the operation of the software module to be updated affects vehicle control based on the table shown in Figure 2, which is held in the determination information management unit 102. If the operation of the software module to be updated affects vehicle control, the determination unit 101 proceeds to step S4. If the operation of the software module to be updated does not affect vehicle control, the determination unit 101 proceeds to step S5.

[0030] In step S4, the determination unit 101 determines whether the combination of the software module to be updated and other software modules after the update is a combination whose operation of each software module has been verified. Specifically, the determination unit 101 determines, based on the table shown in Figure 3 held in the determination information management unit 102, whether the combination pattern of the version of the software module to be updated and the versions of other software modules after the update is a combination pattern of versions whose operation of each software module has been verified. If the combination pattern of updated versions is a combination pattern of versions whose operation has been verified, the determination unit 101 proceeds to step S6. If the combination pattern of updated versions is not a combination pattern of versions whose operation has been verified, the determination unit 101 proceeds to step S7.

[0031] In step S5, the determination unit 101 determines whether the combination of the software module to be updated and other software modules after the update is a combination that has a proven track record of operation in other in-vehicle devices 110. Specifically, the determination unit 101 determines, based on the table shown in Figure 4 held in the determination information management unit 102, whether the combination pattern of the version of the software module to be updated and the version of other software modules after the update is a combination pattern of versions that has a proven track record of operation in other in-vehicle devices 110. If the combination pattern of versions after the update is a combination pattern of versions that has a proven track record of operation in other in-vehicle devices 110, the determination unit 101 proceeds to step S6. If the combination pattern of versions after the update is not a combination pattern of versions that has a proven track record of operation in other in-vehicle devices 110, the determination unit 101 proceeds to step S7.

[0032] In step S6, the determination unit 101 determines that the update execution unit 112 of the in-vehicle device 110 will perform SOTA. That is, the determination unit 101 determines that the software module to be updated is within the scope of this update. The determination unit 101 notifies the distribution unit 122 of the information of the software module determined to be within the scope of this update (information of the software module to be updated), and terminates the process shown in Figure 5. The distribution unit 122 distributes the software module (software module to be updated) notified by the determination unit 101 to the in-vehicle device 110. The update execution unit 112 of the in-vehicle device 110 performs the update of the software module (software module to be updated) distributed from the distribution center 120. With this method, the update system 1 can update only some of the software modules provided in the in-vehicle device 110, but the method of updating only some of the software modules is not limited to this method.

[0033] In step S7, the determination unit 101 determines that the update execution unit 112 of the in-vehicle device 110 will perform FOTA (Firmware updates Over The Air). That is, the determination unit 101 determines that all of the multiple software modules provided in the in-vehicle device 110 are within the scope of this update. The determination unit 101 notifies the distribution unit 122 of the information of the software modules determined to be within the scope of this update (information of all software modules provided in the in-vehicle device 110), and terminates the process shown in Figure 5. The distribution unit 122 distributes the software modules notified by the determination unit 101 to the in-vehicle device 110. At this time, the distribution unit 122 distributes all the software modules provided in the in-vehicle device 110 to the in-vehicle device 110 in the latest version combination. The update execution unit 112 of the in-vehicle device 110 performs the update of the software modules distributed from the distribution center 120.

[0034] As described above, the information processing device 100 of the update system 1 according to Embodiment 1 is a device for updating a software module to be updated, which is part of a plurality of software modules provided in the in-vehicle device 110. The information processing device 100 of the update system 1 includes a determination unit 101 for determining the update range of the software modules in the plurality of software modules. The determination unit 101 determines the update range based on whether the combination of the software module to be updated and other software modules after the update of the software module to be updated is a combination whose operation of each software module has been verified.

[0035] As a result, the information processing device 100 according to Embodiment 1 can determine the update scope to update only some of the software modules if the updated software module combination is a combination that has been verified for operation. In this case, it is not necessary to perform operation verification on all combinations with other software modules after updating some of the software modules. Furthermore, if the updated software module combination is not a combination that has been verified for operation in advance, the information processing device 100 according to Embodiment 1 can determine the update scope to update all software modules provided in the in-vehicle device 110. In this case, the latest software module combination to be updated has been verified for operation by the software module developer, and it is not necessary to perform operation verification on the information processing device 100 or the in-vehicle device 110. Therefore, the information processing device 100 according to Embodiment 1 can guarantee the operation of the updated software modules while not needing to perform operation verification on the updated software module combination, thereby shortening the update time. Thus, the information processing device 100 according to Embodiment 1 can efficiently update some of the software modules provided in the in-vehicle device 110 by state-of-the-art while guaranteeing the operation of the updated software modules.

[0036] Furthermore, in the information processing device 100 according to Embodiment 1, the determination unit 101 determines the update range based on whether or not the software module to be updated is related to vehicle control.

[0037] As a result, the information processing device 100 according to Embodiment 1 can determine the scope of updates while considering the impact on vehicle control, for example, by not updating the software module to be updated while the vehicle is running if the software module to be updated is related to vehicle control. Therefore, the information processing device 100 according to Embodiment 1 can efficiently update some of the software modules provided in the in-vehicle device 110 by state-of-the-art (SOTA) while guaranteeing the operation of the updated software modules and without interfering with vehicle control.

[0038] Furthermore, in the information processing device 100 according to Embodiment 1, the determination unit 101 determines the update range based on whether the updated software module combination is a combination that has a proven track record of working in other in-vehicle devices 110.

[0039] As a result, the information processing device 100 according to Embodiment 1 can determine the update scope to update only some of the software modules, even if the combination of software modules after the update has a proven track record of operation in other in-vehicle devices 110, even if the operation has not been verified. Furthermore, if the combination of software modules after the update has not a proven track record of operation in other in-vehicle devices 110, the information processing device 100 according to Embodiment 1 can determine the update scope to update all the software modules provided in the in-vehicle device 110. Therefore, the information processing device 100 according to Embodiment 1 can shorten the update time while guaranteeing the operation of the updated software modules. Thus, the information processing device 100 according to Embodiment 1 can further efficiently update some of the software modules provided in the in-vehicle device 110 by state-of-the-art while guaranteeing the operation of the updated software modules.

[0040] Furthermore, in the information processing device 100 according to Embodiment 1, the determination unit 101 determines that the software module to be updated is within the update range if the software module to be updated is related to vehicle control and the combination of software modules after the update is a combination whose operation has been verified. If the software module to be updated is related to vehicle control and the combination of software modules after the update is not a combination whose operation has been verified, the determination unit 101 determines that the entire set of software modules is within the update range.

[0041] As a result, the information processing device 100 according to Embodiment 1 can efficiently and reliably update some of the software modules provided in the in-vehicle device 110 in state-of-the-art (SOTA) manner, while ensuring that the updated software modules function correctly and without interfering with vehicle control.

[0042] Furthermore, in the information processing device 100 according to Embodiment 1, the determination unit 101 determines that the software module to be updated is within the update range if the software module to be updated is not related to vehicle control and the combination of software modules after the update is a combination that has a proven track record of operation. The determination unit 101 determines that the entire set of software modules is within the update range if the software module to be updated is not related to vehicle control and the combination of software modules after the update is not a combination that has a proven track record of operation.

[0043] As a result, the information processing device 100 according to Embodiment 1 can efficiently and reliably update some of the software modules provided in the in-vehicle device 110 in state-of-the-art (SOTA) manner, while ensuring that the updated software modules function correctly and without interfering with vehicle control.

[0044] Furthermore, in the information processing device 100 according to Embodiment 1, the determination unit 101 determines whether the updated software module combination is a combination whose operation has been verified, based on the combination pattern of software module versions. The determination unit 101 determines whether the updated software module combination is a combination with a proven track record of operation, based on the combination pattern of software module versions collected from other in-vehicle devices 110.

[0045] As a result, the information processing device 100 according to Embodiment 1 can determine the update scope by utilizing an existing function for collecting information on the version of the software module. Therefore, the information processing device 100 according to Embodiment 1 can efficiently and easily update some of the software modules provided in the in-vehicle device 110 in state-of-the-art while guaranteeing the operation of the updated software modules.

[0046] [Embodiment 2] The information processing device 100 of the update system 1 according to Embodiment 2 will be described using Figure 6. The same configuration and operation as in Embodiment 1 will not be described in the information processing device 100 of the update system 1 according to Embodiment 2.

[0047] Figure 6 is a diagram showing the configuration of the update system 1 according to Embodiment 2.

[0048] The information processing device 100 of the update system 1 according to Embodiment 2 may be located in the in-vehicle device 110 instead of the distribution center 120. In this case, the determination information management unit 102 of the information processing device 100 may be located in the in-vehicle device 110 by being transmitted from the distribution center 120 to the in-vehicle device 110.

[0049] In Embodiment 2, when the in-vehicle device 110 determines that an update trigger has occurred, it transmits information used for determination by the determination unit 101 to the distribution center 120. Examples of information transmitted from the in-vehicle device 110 to the distribution center 120 include information on combination patterns of the versions of the multiple software modules currently installed in the in-vehicle device 110. The distribution center 120 distributes all the software modules installed in the in-vehicle device 110 to the in-vehicle device 110 in the latest version combination according to the combination pattern information transmitted from the in-vehicle device 110. The in-vehicle device 110 uses the combination pattern information and the information managed by the determination information management unit 102 to determine the update range for the multiple software modules installed in the in-vehicle device 110. The in-vehicle device 110 then performs the update of the software modules determined to be within the update range.

[0050] Thus, even when the information processing device 100 according to Embodiment 2 is installed in an in-vehicle device 110, it can efficiently update some of the software modules installed in the in-vehicle device 110 by state-of-the-art (SOTA) while guaranteeing the operation of the updated software modules, similar to Embodiment 1.

[0051] [Embodiment 3] The information processing device 100 of the update system 1 according to Embodiment 3 will be described using Figure 7. The same configuration and operation as in Embodiment 1 will not be explained in the information processing device 100 of the update system 1 according to Embodiment 3.

[0052] Figure 7 is a flowchart showing the processing of the determination unit 101 included in the information processing device 100 of the update system 1 according to Embodiment 3.

[0053] In steps S11 and S12, the determination unit 101 performs the same processing as in steps S1 and S2 shown in Figure 5.

[0054] In step S13, the determination unit 101 determines whether the combination of the software module to be updated and other software modules after the update is a combination whose operation of each software module has been verified. If the combination of software modules after the update is a combination whose operation has been verified, the determination unit 101 proceeds to step S16. If the combination of software modules after the update is not a combination whose operation has been verified, the determination unit 101 proceeds to step S14.

[0055] In step S14, the determination unit 101 determines whether the software module to be updated is related to vehicle control. If the software module to be updated is related to vehicle control, the determination unit 101 proceeds to step S17. If the software module to be updated is not related to vehicle control, the determination unit 101 proceeds to step S15.

[0056] In step S15, the determination unit 101 determines whether the combination of the software module to be updated and other software modules after the update is a combination that has a proven track record of operation in other in-vehicle devices 110. If the combination of software modules after the update is a combination that has a proven track record of operation, the determination unit 101 proceeds to step S16. If the combination of software modules after the update is not a combination that has a proven track record of operation, the determination unit 101 proceeds to step S17.

[0057] In steps S16 and S17, the determination unit 101 performs the same processing as in steps S6 and S7 shown in Figure 5.

[0058] Thus, even if the order of steps S13 to S15 differs from that of Embodiment 1, the information processing device 100 according to Embodiment 3 can efficiently update some of the software modules provided in the in-vehicle device 110 by state-of-the-art while guaranteeing the operation of the updated software modules, just as in Embodiment 1.

[0059] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. Furthermore, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0060] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them, for example, using integrated circuits. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, a recording device such as a hard disk or SSD (solid state drive), or a recording medium such as an IC card, SD card, or DVD.

[0061] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of Symbols]

[0062] 1...Update system, 100...Information processing device, 101...Determination unit, 110...In-vehicle device

Claims

1. An information processing device for an update system for updating a software module to be updated, which is part of a group of software modules provided in an in-vehicle device, The system includes a determination unit that determines the update scope of the software modules in the aforementioned plurality of software modules, The determination unit, If the combination of the software module to be updated and other software modules after the update is a combination whose operation of each software module has been verified, then it is determined that the software module to be updated is within the scope of the update. If the updated combination is not a combination whose operation has been verified, the entire set of software modules is determined to be within the scope of the update. An information processing device for an update system characterized by the following:

2. The determination unit determines that if the updated combination is not a combination whose operation has been verified, and the software module to be updated is related to vehicle control, then the entire set of software modules falls within the update range. An information processing device for the update system according to feature 1.

3. The determination unit, If the updated combination is not a combination whose operation has been verified, and the software module to be updated is not related to the vehicle control, and the updated combination is a combination that has a proven track record of operation in other in-vehicle devices, then it is determined that the software module to be updated is within the update range. If the updated combination is not a combination whose operation has been verified, and the software module to be updated is not related to the vehicle control, and the updated combination is not a combination with a proven track record of operation, then it is determined that the entire set of software modules falls within the scope of the update. An information processing device for an update system as described in feature 2.

4. An information processing device for an update system for updating a software module to be updated, which is part of a group of software modules provided in an in-vehicle device, The system includes a determination unit that determines the update scope of the software modules in the aforementioned plurality of software modules, The determination unit, If the software module to be updated is related to vehicle control, and the combination of the software module to be updated and other software modules after the update is a combination whose operation has been verified, then it is determined that the software module to be updated is within the update range. If the software module to be updated is related to the vehicle control, and the updated combination is not a combination whose operation has been verified, then it is determined that the entire set of software modules falls within the scope of the update. An information processing device for an update system characterized by the following:

5. The determination unit, If the software module to be updated is not related to the vehicle control, and the updated combination is a combination that has a proven track record of working in other in-vehicle devices, then it is determined that the software module to be updated falls within the update range. If the software module to be updated is not related to the vehicle control, and the combination after the update is not a combination that has a proven track record of operation, then it is determined that the entire set of software modules falls within the scope of the update. The information processing device for the update system according to feature 4.

6. The determination unit, Based on the combination patterns of versions of each software module, it is determined whether the updated combination is a combination whose operation has been verified. Based on the combination patterns of the aforementioned versions collected from other in-vehicle devices, it is determined whether the updated combination is a combination with a proven track record of operation. An information processing device for an update system according to claim 3 or 5.

Images