Central ECU and method for controlling central ECU

Abstract

To prevent or reduce troubles or problems of electronic equipment due to installation of new software for controlling the electronic equipment, and realize an appropriate use of the electronic equipment.SOLUTION: A controller comprises: a program management unit which manages a process of installing a program for operating electronic equipment onto a program execution unit for executing the program and the execution of the program by the program execution unit; and a detection unit which detects a use state of the electronic equipment. The program management unit executes, based upon the use state of the electronic equipment detected by the detection unit, a restriction operation at least either when the program is installed or when the program is executed, and the restriction operation includes any one of outputting of a notification, restricting the installation of the program, and restricting the execution of the program.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention provides Central ECU , and Central ECU It relates to a control method. [Background technology]

[0002] In recent years, the functionality of software installed in vehicles has been evolving with the aim of improving traffic safety and vehicle comfort. This type of software is built into the on-board equipment when the vehicle is manufactured, but it is also anticipated that new software will be installed in vehicles that are in use. For example, Patent Document 1 discloses a method for avoiding interference with the operation of existing programs when downloading a new program from a server to an on-board device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-113394 Summary of the Invention [Problem to be solved by the invention]

[0004] However, when new software is introduced to control electronic devices, it is impossible to predict in advance how the software will operate the electronic device. Therefore, the introduction of new software may result in the electronic device being subjected to loads that were not anticipated at the time of its manufacture. In such cases, the lifespan of the electronic device may be shorter than expected, or unexpected malfunctions may occur. For example, unintended breakdowns or malfunctions in electronic devices installed in vehicles may hinder improvements in vehicle safety and comfort. The present invention has been made in light of this background, and aims to prevent or reduce breakdowns and malfunctions of electronic devices that occur when new software that controls electronic devices is introduced, enable the appropriate use of electronic devices, and ultimately contribute to the development of sustainable transportation systems. [Means for solving the problem]

[0005] In one aspect of the present invention, a program for operating an electronic device is provided. ECU and the process of installing the ECU a program management unit that manages execution of the program by the electronic device; and a detection unit that detects a usage state of the electronic device, The program management unit stores restriction information including information indicating a program that is a target of a restriction operation among the programs, and when the program management unit receives a request to install the program, the program management unit determines whether the program requested to be installed is a program specified by the restriction information, and if it determines that the program is a program specified by the restriction information, The program management unit, based on the usage state of the electronic device detected by the detection unit, at least one of when the program is installed and when the program is executed, The aforementioned performing a restriction action, the restriction action including outputting a notification, restricting installation of the program, and restricting execution of the program; Central ECU is. [Effects of the Invention]

[0006] According to the above configuration, when a program that operates an electronic device is installed or executed, restrictions can be imposed depending on the usage status of the electronic device by the new program. This restricts the installation or execution of a program that places an inappropriate load on the electronic device, prevents or reduces unexpected malfunctions of the electronic device, and extends the life of the electronic device. For example, this allows for the appropriate use of electronic devices installed in a vehicle, thereby improving the safety and comfort of the vehicle. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram of a vehicle control system. [Figure 2] FIG. 1 is a diagram showing a schematic configuration of a management system. [Figure 3] FIG. 2 is a block diagram showing the configuration of a main part of the control system. [Figure 4] 4 is a flowchart showing the operation of the central ECU. [Figure 5] 4 is a flowchart showing the operation of the central ECU. [Figure 6] 4 is a flowchart showing the operation of the central ECU. DETAILED DESCRIPTION OF THE INVENTION

[0008] FIG. 1 is a diagram showing a control system 1 for a vehicle. The control system 1 includes a central ECU 2 that performs overall control and information processing of the vehicle. The central ECU 2 is connected to communication lines including a first communication line 3 and a second communication line 4. The central ECU 2 functions as a gateway that manages the exchange of communication data between these communication lines. The central ECU 2 also performs OTA (Over The Air) management. The OTA management includes control over the process of downloading update programs for the on-board devices of the vehicle from a server outside the vehicle and the process of applying the downloaded update programs to the on-board devices.

[0009] The first communication line 3 and the second communication line 4 are configured as buses for communication conforming to standards such as CAN or Ethernet (registered trademark), or communication lines for P2P (Peer to Peer) communication. The first communication line 3 may be configured as a single communication line, or may be configured as multiple communication lines for communication conforming to the same standard, or may be configured as multiple communication lines for communication conforming to different standards. The same applies to the second communication line 4.

[0010] An infotainment control box (ICB) 6, a rear camera 7, a speaker 8, a microphone 9, a meter panel 10, and a steering switch 11 are connected to the first communication line 3 via an in-vehicle connection link 5. The rear camera 7 is a camera that captures images of the area behind the vehicle. The meter panel 10 displays information about the operating status of the vehicle, including the vehicle speed. Also connected to the in-vehicle connection link 5 are a TCU (Telematics Control Unit) 12, a V2X (Vehicle to Everything) communication device 13, a GNSS (Global Navigation Satellite System) sensor 14, and a touch panel 15. The TCU 12 is a wireless communication device that complies with the communication standards of a mobile communication system. The V2X communication device 13 performs vehicle-to-vehicle communication and / or road-to-vehicle communication. The touch panel 15 includes a display 16 and a touch sensor 17.

[0011] The ICB 6 is an IVI (In-Vehicle Infotainment) ECU that provides various information and entertainment to vehicle occupants using a speaker 8, a microphone 9, a GNSS sensor 14, a touch panel 15, and the like. The in-vehicle connection link 5 is configured by a plurality of communication transmission paths conforming to various communication standards. The in-vehicle connection link 5 may include, for example, a plurality of network transmission paths. In this case, the plurality of network transmission paths may be connected to each other via a device having a gateway function or the like. The in-vehicle connection link 5 may also include a transmission path for P2P communication. The network transmission path may employ various communication buses that perform network communication conforming to various standards. Examples of such standards include CAN, Ethernet, USB (Universal Serial Bus), LIN (Local Interconnect Network), and LVDS (Low Voltage Differential Signaling), but other standards may also be used.

[0012] A zone A-ECU 29 is connected to the second communication line 4. The zone A-ECU 29 is connected to a lamp 30 and a window motor 31. The lamp 30 includes, for example, a headlamp, a tail lamp, and a turn signal lamp. The window motor 31 opens and closes the vehicle windows. The zone A-ECU 29 is also connected to a door sensor 32, a door lock mechanism 33, an ESL (Electronic Steering Lock) 34, and an air conditioner 35. The door sensor 32 detects operation on the vehicle doors. The door lock mechanism 33 locks and unlocks the vehicle doors. An entry ECU 36 is connected to the zone A-ECU 29. The entry ECU 36 is connected to an LF / RF antenna 37 that wirelessly communicates with the vehicle's electronic key. The electronic key is an electronic device with wireless communication capabilities and is also called a smart key or FOB key. The entry ECU 36 cooperates with other vehicle-mounted ECUs to process user access to the control system 1 from outside the vehicle, and realizes the so-called smart entry operation. Additionally, an engine 38 and a drive motor 39 are connected to the zone A-ECU 29. The engine 38 and the drive motor 39 are drive sources that drive the vehicle V on which the control system 1 is mounted. The vehicle V is equipped with either the engine 38 or the drive motor 39, or both. The drive motor 39 may be configured to include multiple motors.

[0013] FIG. 2 is a diagram showing a schematic configuration of the management system 100. As shown in FIG. The management system 100 is a system that enables updating of programs executed by various ECUs that constitute the control system 1. The management system 100 also includes a server 110.

[0014] The server 110 is connected to the control system 1 via a communication network N. The communication network N includes, for example, a cellular communication network, a Wi-Fi (registered trademark) network, Bluetooth (registered trademark), the Internet, a wide area network (WAN), a local area network (LAN), a public line, a provider device, a dedicated line, a base station, etc., and a base station B is illustrated in Fig. 2. The TCU 12 included in the control system 1 performs cellular communication with the base station B, thereby performing data communication with an external device through the communication network N.

[0015] The control system 1 can download update data for updating programs executed by various ECUs of the control system 1 from the server 110 by communicating with the server 110 via the TCU 12. The means by which the control system 1 downloads update data from the server 110 and updates the programs corresponds to the above-mentioned OTA. The server 110 can be considered an external device of the control system 1. The TCU 12 can be called a communication unit.

[0016] The control system 1 can download an application program to be executed by an ECU included in the control system 1 from the server 110 and install it in the ECU. In this case, the control system 1 may download the application program from a server device different from the server 110 that provides the control program for the ECU.

[0017] Fig. 3 is a block diagram showing the configuration of the main parts of the control system 1 in the first embodiment. Fig. 3 shows part of the configuration related to program updates in the control system 1, and does not prevent the control system 1 from having configurations not shown in Fig. 3.

[0018] In the control system 1, the central ECU 2 includes a processor 210 and a memory 220. The processor 210 is configured, for example, by a central processing unit (CPU), a microcontroller unit (MCU), or a microprocessor unit (MPU). The memory 220 stores programs executed by the processor 210 and data processed by the processor 210 in a non-volatile manner. The memory 220 is configured, for example, by a read-only memory (ROM). The memory 220 may also include a random access memory (RAM) that forms a work area for temporarily storing programs and data. In the present disclosure, the central ECU 2 corresponds to an example of a control device. The central ECU 2 may be configured as an integrated circuit that integrally includes the processor 210 and the memory 220. Alternatively, the central ECU 2 may be configured such that the processor 210, the memory 220, and other circuits are each provided as independent hardware.

[0019] The memory 220 stores a control program 221, device information 222, history information 223, and restriction information 224.

[0020] The processor 210 executes a control program 221 to control each part of the central ECU 2 and devices constituting the control system 1. The processor 210 has a program management unit 211 and a detection unit 212 as functional units related to application programs executed by ECUs included in the control system 1.

[0021] The program management unit 211 manages the installation and execution of programs in the control system 1. The programs managed by the program management unit 211 are one aspect of software, and in this embodiment, the objects managed by the program management unit 211 are application programs.

[0022] The various ECUs included in the control system 1 have programs for controlling devices mounted on the vehicle V, and control the devices by executing the programs. This type of program is called firmware, middleware, or a control program. The application programs managed by the program management unit 211 may include the basic control program. In this embodiment, the program management unit 211 manages application programs that are executed in addition to the basic functions of the ECU. These application programs are distinguished from control programs. That is, the programs executed by the ECU are provided by a business that manufactures or sells the vehicle V and are downloaded to the vehicle V from a server 110 managed by the business via the communication network N. Alternatively, the programs executed by the ECU are downloaded to the vehicle V from a diagnostic device (not shown) installed at a dealer or repair shop for the vehicle V by connecting the diagnostic device to the control system 1. In contrast, application programs may be developed or provided by third parties unrelated to the manufacturer or seller of the vehicle V. This type of application program is downloaded to the vehicle V via the communication network N from a server computer different from the server 110.

[0023] When an application program is downloaded and installed in an ECU to be managed, the program management unit 211 makes a determination about the application program. Specifically, the program management unit 211 determines whether execution of the application program by the ECU will impose a high load on the electronic devices installed in the vehicle V. The program management unit 211 executes a restriction operation on an application program that is determined to impose a high load on the electronic devices.

[0024] The restriction operation includes at least one of restricting or prohibiting the installation of an application program, restricting or prohibiting the execution of an application program, and notifying the user that the application program imposes a high load. Here, restriction includes allowing execution under certain conditions. The notification may be, for example, a display on the touch panel 15 or a sound output from the speaker 8.

[0025] The detection unit 212 detects the usage status of various electronic devices included in the control system 1 and electronic devices mounted on the vehicle V and controlled by the control system 1. Here, the electronic devices include, for example, the lamp body 30, the window motor 31, the door sensor 32, the door lock mechanism 33, and the ESL 34 shown in FIG. 1 . The rear camera 7, the speaker 8, the microphone 9, the meter panel 10, the steering switch 11, the touch panel 15, the air conditioner 35, and the like. The electronic devices controlled by the control system 1 may also include devices not shown in FIG. 1 . For example, the electronic devices controlled by the zone A-ECU 29 include a wiper motor that operates the wipers of the vehicle V and a windshield washer motor that drives a windshield washer pump. The electronic devices may also include a seat heater, a horn, and the like mounted on the vehicle V. The electronic devices may also include a drive battery that drives the drive motor 39. The detection unit 212 can detect electronic devices controlled by ECUs or control devices that can communicate via the first communication line 3 or the second communication line 4. There is no limit to the number and types of electronic devices that the detection unit 212 can detect.

[0026] For example, the detection unit 212 constantly detects the usage state of each electronic device included in the control system 1 while the control system 1 is in operation, and updates the history information 223.

[0027] In FIG. 3 and the following description, a light fixture 30 is taken as an example of an electronic device, and an example in which the detection unit 212 detects the use state of the light fixture 30 will be described.

[0028] The device information 222 stored in the memory 220 includes information about the electronic device to be detected by the detection unit 212. For example, the device information 222 includes the type of electronic device, information for identifying the ECU that controls the electronic device, the manufacturing date of the electronic device, the useful life or operation guarantee period of the electronic device, a serial number unique to the electronic device, and the like.

[0029] The history information 223 includes information related to the operation history of the electronic device. For example, the history information 223 includes the time elapsed since the electronic device was first used, the number of times the electronic device has operated, and the operating time of the electronic device. Furthermore, if the electronic device includes a semiconductor memory element such as a flash ROM, the history information 223 may include the number of times the semiconductor memory element has been rewritten. These pieces of information may be cumulative values ​​starting from the time the vehicle V was shipped from the factory.

[0030] The memory 220 can store device information 222 and history information 223 for each electronic device. There is no limit to the number of pieces of device information 222 and history information 223 that the memory 220 can store. Furthermore, the types of information included in the device information 222 do not have to be standardized. The same applies to the history information 223. For example, the memory 220 may store device information 222 and history information 223 that include different types of information for each electronic device.

[0031] The restriction information 224 includes information indicating application programs for which the program management unit 211 will perform a restricted operation. In other words, the restriction information 224 includes information indicating application programs that the program management unit 211 has determined to impose a high load on the electronic device. The restriction information 224 may include, for each application program, information indicating the content of the restricted operation that the control program 221 will perform on the application program.

[0032] The objects to be managed by the program management unit 211 are ECUs included in the control system 1, and there are no restrictions on the type or number of ECUs. In Fig. 3 and the following description, an ICB 6 is shown as an example of an ECU to be managed by the program management unit 211.

[0033] The ICB 6 includes a processor 61 and a memory 65. The processor 61 is configured, for example, by a CPU, an MCU, or an MPU. The memory 65 stores in a non-volatile manner the programs executed by the processor 61 and the data processed by the processor 61. The memory 65 is configured, for example, by a ROM. The memory 65 may also include a RAM that forms a work area for temporarily storing the programs and data. The ICB 6 may be configured as an integrated circuit that integrally includes the processor 61 and the memory 65. Alternatively, the ICB 6 may be configured such that the processor 61, the memory 65, and other circuits are each provided as independent hardware.

[0034] The memory 65 stores a control program 66 and an application program 68. The control program 66 is a basic control program executed by the processor 61. By executing the control program 66, the processor 61 controls each part of the ICB 6 and devices controlled by the ICB 6. The controlled objects of the ICB 6 include, for example, the speaker 8, the microphone 9, the GNSS sensor 14, and the touch panel 15.

[0035] The program execution unit 62 is a functional unit configured by the processor 61 executing the control program 66, and is, for example, a software platform that executes the application program 68. The program execution unit 62 may be configured as hardware, or may be a function of the processor 61.

[0036] The program execution unit 62 executes the application program 68 to operate the electronic device that is the control target of the ICB 6. For example, by executing the application program 68, the program execution unit 62 executes functions such as playing video content, playing music, hands-free calling, displaying maps, and searching for information.

[0037] The memory 65 stores application programs 68 corresponding to the functions executed by the program execution unit 62. There is no limit to the number of application programs 68 stored in the memory 65. Furthermore, one application program 68 may be configured to execute multiple functions of the ICB 6.

[0038] 4, 5, and 6 are flowcharts showing the operation of the central ECU 2. Fig. 4 shows the operation when an application program is installed in the ICB 6. As shown in Fig. 1, the ICB 6 is connected to the TCU 12 via the in-vehicle connection link 5, the first communication line 3, and the central ECU 2. Therefore, when an application program is to be installed in the ICB 6, the ICB 6 requests the central ECU 2 to install the application program, and the central ECU 2 downloads the application program via the TCU 12.

[0039] Here, installing an application program in the ICB 6 refers to a series of processes for storing the application program 68 in the memory 65 in a state in which the program execution unit 62 can execute it.

[0040] 4 are executed by the program management unit 211. Step S17 is executed by the program management unit 211 and the detection unit 212.

[0041] When the ICB 6 requests installation of an application program in response to a user's operation on the touch panel 15, the central ECU 2 accepts the installation request (step S11). The central ECU 2 determines whether the application program requested to be installed is an application program subject to a restricted operation (step S12). In step S12, the central ECU 2 determines, for example, whether the application program requested to be installed is a program specified by the restriction information 224.

[0042] If it is determined that the application program is not a target of the restricted operation (step S12; NO), the central ECU 2 requests the server 110 or another server to download the application program (step S13), and executes the download (step S14). Here, the central ECU 2 temporarily stores the downloaded application program in, for example, a RAM.

[0043] The central ECU 2 identifies the electronic devices controlled by the downloaded application program (step S15). The central ECU 2 extracts information about the usage status of the identified electronic devices from the downloaded application program (step S16). In step S16, the central ECU 2 extracts information about the frequency with which the application program operates the electronic devices, the number of times the application program operates the electronic devices, the number of times the semiconductor memory elements are rewritten, the length of time the application program operates, etc. The source of the information is, for example, the application program itself or information added to the application program that can be downloaded together with the application program.

[0044] The central ECU 2 determines whether or not the information was extracted in step S16 (step S17). If the information was successfully extracted (step S17; YES), the central ECU 2 executes a load determination process based on the extracted information (step S18). Step S18 is a process for determining whether or not the application program imposes a high load on the electronic device, and details of this process will be described later with reference to FIG. 5.

[0045] Based on the result of the load determination process in step S18, the central ECU 2 determines whether the downloaded application program imposes a high load on the electronic device (step S19). If it is determined that the downloaded application program does not impose a high load (step S19; NO), the central ECU 2 executes a process of storing the downloaded application program in the ICB 6, i.e., installs the application program (step S20).

[0046] If the central ECU 2 determines that the application program places a high load on the electronic device (step S19; YES), the central ECU 2 sets the downloaded application program as a restriction target (step S21). As a result, information about the application program downloaded in step S14 is added to the restriction information 224.

[0047] The central ECU 2 executes a restriction operation on the application program (step S22). For example, the central ECU 2 prohibits installation of the application program downloaded in step S14 and erases the downloaded application program. In addition, in step S22, the central ECU 2 notifies the electronic device that the application program downloaded in step S14 will impose a high load on the electronic device. In this case, after the notification, the central ECU 2 may proceed to step S20 and install the application program.

[0048] Furthermore, when it is determined that the application program requested to be installed by the ICB 6 is a target of the restriction operation (step S12; YES), the central ECU 2 executes the restriction operation (step S23). If the restriction operation in step S23 is a notification, the central ECU 2 may proceed to step S14 after the notification.

[0049] FIG. 5 shows an example of the load determination process shown in step S18 of FIG. The central ECU 2 counts the number of operations of the electronic device identified in step S15 (step S31). The number of operations counted in step S31 is the cumulative number of operations of the electronic device, and is included in, for example, the history information 223. The number of operations may include the number of times the semiconductor memory element is rewritten.

[0050] The central ECU2 calculates the period since the electronic device began to be used (step S32) and acquires the useful life of the electronic device from the history information 223 (step S33). The central ECU2 calculates the number of operations of the electronic device until the end of its useful life based on the number of operations counted in step S31, the period since the electronic device began to be used, and the useful life of the electronic device (step S34). For example, the central ECU2 calculates the average number of operations per unit period from the number of operations counted in step S31 and the period since the electronic device began to be used. Then, the central ECU2 calculates the number of operations in the useful life of the electronic device from the average number of operations per unit period. The number of operations calculated in step S34 is the number of times the electronic device is expected to operate during its useful life, and is called the expected number of operations.

[0051] The central ECU 2 determines an allowable range of the expected number of operations by adding a margin to the expected number of operations (step S35). In the example of Fig. 5, the allowable range is a range whose upper limit is the number of operations obtained by adding the margin to the expected number of operations.

[0052] The central ECU 2 sets the execution frequency of the application program to be judged (step S36). The execution frequency of the application program is an assumed frequency that is set based on, for example, the history of the ICB 6 executing similar application programs 68. The central ECU 2 estimates the number of times the electronic device will operate in conjunction with the execution of the application program (step S37). In step S37, the central ECU 2 estimates the number of times the electronic device will operate based on the frequency with which the application program operates the electronic device and the number of times each operation occurs. For example, if the turn signal lights of the vehicle V flash 10 times each time the application program to be judged is executed, the number of times the turn signal lights will operate is 10 times per execution of the application program. The number of times the electronic device will operate can be estimated by multiplying this by the execution frequency of the application program and the remaining useful life of the electronic device.

[0053] The central ECU 2 calculates the sum of the estimated number of operations and the number of operations counted in step S31 (step S38), and determines whether the calculated sum deviates from the allowable range (step S39). That is, it determines whether the sum calculated in step S38 exceeds the upper limit of the allowable range.

[0054] If it is determined that the load exceeds the allowable range (step S39; YES), the central ECU 2 determines that the load imposed by the application program on the electronic device is high (step S40).If it is determined that the load does not exceed the allowable range (step S39; NO), the central ECU 2 determines that the load imposed by the application program on the electronic device is not high (step S41).

[0055] 6 shows the operation of the central ECU 2 when an application program is executed, specifically, when the program execution unit 62 executes an application program 68 installed in the ICB 6.

[0056] 6 are executed by the program management unit 211. Step S55 is executed by the program management unit 211 and the detection unit 212.

[0057] When the program execution unit 62 of the ICB 6 starts executing the application program 68 in response to a user operation on the touch panel 15, the central ECU 2 detects this (step S51). The central ECU 2 determines whether the application program 68 being executed is an application program subject to a restricted operation (step S52). In step S52, the central ECU 2 determines, for example, whether the application program 68 being executed by the ICB 6 is a program specified by the restriction information 224.

[0058] If it is determined that the application program 68 is not a target of the restricted operation (step S52; NO), the central ECU 2 identifies the electronic device controlled by the application program 68 (step S53). The central ECU 2 acquires information about the usage state of the electronic device when the application program 68 is executed (step S54). The information acquired by the central ECU 2 in step S54 includes, for example, the number of times the electronic device operates when the application program 68 is executed. That is, in step S54, the central ECU 2 acquires, from the history information 223, the usage state of the electronic device detected by the detection unit 212 when the application program 68 was executed in the past.

[0059] The central ECU 2 executes the load determination process based on the information acquired in step S54 (step S55). The load determination process in step S54 is, for example, the process described with reference to FIG.

[0060] Based on the result of the load determination process in step S55, the central ECU 2 determines whether the application program 68 imposes a high load on the electronic device (step S56). If it is determined that the application program 68 does not impose a high load (step S56; NO), the central ECU 2 does not restrict the execution of the application program 68 and proceeds to step S59, which will be described later. As a result, the ICB 6 executes the application program 68.

[0061] When the central ECU 2 determines that the application program 68 places a high load on the electronic device (step S56; YES), the central ECU 2 sets the application program 68 that the ICB 6 has started to execute as a restriction target (step S57). As a result, information about the application program 68 is added to the restriction information 224.

[0062] The central ECU 2 executes a restriction operation on the application program 68 (step S57). For example, the central ECU 2 controls the ICB 6 to stop the execution of the application program 68. In addition, in step S57, the central ECU 2 notifies the ICB 6 that the application program 68 executed by the ICB 6 places a high load on the electronic device. In this case, after the notification, the central ECU 2 may cause the ICB 6 to execute the application program 68.

[0063] Next, the central ECU 2 transmits information regarding the usage state of the electronic devices accompanying the execution of the application program 68 to the server 110 (step S59). In step S59, the central ECU 2 transmits the information acquired in step S54 to the server 110. Furthermore, when the central ECU 2 causes the application program 68 to be executed by the ICB 6, the central ECU 2 may transmit to the server 110 the usage state of the electronic devices detected by the detection unit 212 during the execution of the application program 68. In this case, the central ECU 2 transmits the information to the server 110 after the execution of the application program 68 has ended or during the execution of the application program 68.

[0064] Furthermore, when it is determined that the application program 68 executed by the ICB 6 is a target for the restriction operation (step S52; YES), the central ECU 2 executes the restriction operation (step S60). The restriction operation includes, as in step S58, controlling the ICB 6 to stop the execution of the application program 68 or notifying the ICB 6 that the application program 68 places a high load on the electronic device. When the central ECU 2 issues a notification as a restriction operation in step S60, it may cause the ICB 6 to execute the application program 68 after the notification. After the restriction operation in step S60, the central ECU 2 proceeds to step S59.

[0065] The information transmitted to the server 110 in step S59 is accumulated by the server 110. This allows the server 110 to obtain, for each application program, information regarding the manner in which the application program operates the electronic devices of the vehicle V.

[0066] After the application program 68 starts to run, the central ECU 2 may execute steps S54 to S60 in FIG. 6 while the application program 68 is running. For example, the central ECU 2 detects the usage status of the electronic device using the detection unit 212, either continuously or at predetermined intervals, and updates the history information 223. Then, the central ECU 2 acquires information from the updated history information 223 in step S54 and makes the determination in step S55. In this case, the central ECU 2 can restrict the application program 68 being executed based on the usage status of the electronic device while the application program 68 is running. For example, the central ECU 2 can notify the user, restrict the execution of the application program 68, or stop the application program 68. This allows the central ECU 2 to restrict the application program 68 without waiting for the application program 68 to finish if it is determined that the application program 68 being executed by the ICB 6 places a heavy load on the electronic device. This is effective, for example, for an application program 68 that runs continuously for a long period of time.

[0067] The above embodiment shows a specific example to which the present invention is applied, and does not limit the form to which the invention is applied.

[0068] In the above embodiment, specific examples of the restrictive action performed by the program management unit 211 include prohibiting installation of an application program, stopping execution of the application program, and issuing a notification. This is merely an example, and the restrictive action may also be, for example, limiting the execution of an application program. Specifically, the program management unit 211 may set a limit on the number of times each application program can be executed within a predetermined period, and prohibit the application program from being executed beyond the limit. The predetermined period may be an appropriate period such as one day, one week, or one month. The program management unit 211 may calculate the limit on the number of executions so that the sum of the number of operations of the electronic device obtained by the process of FIG. 5 and the estimated number of operations does not exceed an allowable range. The central ECU 2 may determine the number of executions, for example, when installing the application program or when the application program is executed for the first time.

[0069] Furthermore, limiting the execution of an application program may be, for example, a time limit for executing the application program. Specifically, the program management unit 211 sets a time limit from the start of execution of each application program, and terminates the application program when the time limit is reached. The time limit may be calculated by the program management unit 211, for example, so that the sum of the number of operations of the electronic device obtained by the processing of FIG. 5 and the estimated number of operations does not deviate from an allowable range. The program management unit 211 may determine the time limit, for example, when installing the application program or when the application program is executed for the first time. Furthermore, the program management unit 211 may combine a time limit and a limit on the number of executions within a predetermined period for the execution of an application program.

[0070] The central ECU 2 may also determine the content of the restriction operation based on the usage state of the electronic device by the application program. For example, the central ECU 2 may execute a notification as a restriction operation when the usage state of the electronic device indicates a high load on the electronic device, and may prohibit the execution of the application program as a restriction operation when the load on the electronic device is even higher.

[0071] In the above embodiment, an example has been described in which the program management unit 211 executes the load determination process (step S18) after downloading an application program. This is just one example, and the program management unit 211 may, for example, acquire information about the application program from the server before downloading the application program and execute the processes of steps S15 to S19. In this case, the program management unit 211 may download the application program in step S20.

[0072] Furthermore, in the above embodiment, the program management unit 211 may acquire information about the application program from a server different from the server from which the application program is downloaded, and execute the processes of steps S15 to S19. This type of server may be, for example, a server that has information about evaluations of the application program, a server that collects information about the application program from users, or a server provided by a manufacturer or distributor of the vehicle V. These servers are not limited to a single server computer, and may be cloud servers.

[0073] In the above embodiment, the processing target of the program management unit 211 is the application program 68 executed by the ICB 6. This is just one example, and the processing target of the program management unit 211 may be an application program executed by another ECU. In addition, the configuration of the control system 1 shown in the above embodiment is just one example, and the type of ECUs included in the control system 1, the number of ECUs, and the configuration of electronic devices controlled by the ECUs can be changed in various ways.

[0074] 1 and 3 are diagrams showing a schematic configuration in which the functional configuration of each device in the management system 100 is divided according to the main processing content in order to facilitate understanding of the present invention, and are not intended to limit the configuration of the devices. Each process shown in Figs. 4 to 6 may be executed by one program or by multiple programs.

[0075] Furthermore, the vehicle V is, for example, a four-wheeled vehicle, but the type of vehicle V is not particularly limited and may be a large automobile, a commercial vehicle, a two-wheeled vehicle, a three-wheeled vehicle, etc. Furthermore, the configuration of each part in the control system 1 can be changed as desired.

[0076] The above embodiment supports the following configurations.

[0077] (Configuration 1) A control device comprising: a process of installing a program that operates an electronic device into a program execution unit that executes the program; a program management unit that manages the execution of the program by the program execution unit; and a detection unit that detects the usage status of the electronic device, wherein the program management unit performs a restriction action at least when the program is installed and when the program is executed based on the usage status of the electronic device detected by the detection unit, and the restriction action includes outputting a notification, restricting the installation of the program, and restricting the execution of the program. According to the control device of configuration 1, when a program that operates an electronic device is installed or executed, restrictions can be imposed depending on the usage status of the electronic device due to the new program. This makes it possible to restrict the installation or execution of programs that impose an inappropriate load on the electronic device or a heavy load on the electronic device. This prevents or reduces unexpected malfunctions of the electronic device, and can extend or prevent shortening of the electronic device's lifespan. For example, this can realize appropriate use of electronic devices installed in a vehicle, improving the safety and comfort of the vehicle.

[0078] (Configuration 2) The control device described in Configuration 1, wherein the program management unit, when the program is installed, obtains information from the program that identifies the electronic device to be operated by the program, and executes the restriction operation based on the obtained information. The control device of configuration 2 can restrict the installation of programs that place an inappropriate or excessive load on the electronic device, thereby protecting the electronic device and extending its lifespan or preventing its shortening.

[0079] (Configuration 3) A control device according to configuration 1 or 2, wherein the program management unit determines the load on the electronic device based on the usage state of the electronic device while the program is being executed, and executes the restriction operation when the load on the electronic device corresponds to a high load. According to the control device of configuration 3, it is possible to appropriately determine whether a program places an inappropriate or excessive load on an electronic device based on the usage state of the electronic device while the program is running, thereby more reliably protecting the electronic device.

[0080] (Configuration 4) The control device according to Configuration 3, wherein the program management unit outputs the notification when the load on the electronic device during execution of the program corresponds to a high load. According to the control device of configuration 4, when a program operating an electronic device places a heavy load on the electronic device, the control device can alert the user by notifying the user, thereby encouraging the user to use the program appropriately and achieving both user convenience and protection of the electronic device.

[0081] (Configuration 5) A control device described in Configuration 3 or Configuration 4, wherein the program management unit prohibits at least one of installing the program and executing the program when the load on the electronic device during execution of the program is high. According to the control device of configuration 5, when the load imposed on the electronic device by the program operating the electronic device is high, at least one of installation and execution of the program can be prohibited, thereby realizing protection of the electronic device and enabling the lifespan of the electronic device to be extended or prevented from being shortened.

[0082] (Configuration 6) The control device according to any one of configurations 1 to 5, wherein the electronic device is mounted on a vehicle, and the program is executed by the program execution unit provided in the vehicle-mounted device. According to the control device of configuration 6, it is possible to restrict the program depending on the usage state of the electronic device by the program executed by the device installed in the vehicle, thereby realizing appropriate use of the electronic device installed in the vehicle and improving the safety and comfort of the vehicle.

[0083] (Configuration 7) The control device according to any one of configurations 1 to 6, wherein the detection unit detects at least one of the number of times the electronic device is operated, the operating time, and the period of time elapsed since manufacture as the usage status of the electronic device. According to the control device of configuration 7, the load that a program places on an electronic device can be evaluated based on at least one of the number of times the electronic device operates, the operating time, and the period of time that has elapsed since the manufacture of the electronic device. This makes it possible to prevent or reduce unexpected malfunctions in the electronic device, and to extend the lifespan of the electronic device or prevent a shortening of its lifespan.

[0084] (Configuration 8) A control method that includes a process of installing a program that operates an electronic device into a program execution unit that executes the program, managing the execution of the program by the program execution unit, detecting the usage status of the electronic device, and, based on the usage status of the electronic device, performing a restriction action including outputting a notification, restricting the installation of the program, and restricting the execution of the program at least when the program is installed and when the program is executed. According to the control method of configuration 8, when a program that operates an electronic device is installed or executed, restrictions can be imposed depending on the usage status of the electronic device by the new program. This makes it possible to restrict the installation or execution of programs that impose an inappropriate load on the electronic device or a heavy load on the electronic device. This prevents or reduces unexpected malfunctions in the electronic device, and can extend or prevent shortening of the lifespan of the electronic device. For example, this can realize appropriate use of electronic devices installed in a vehicle, improving the safety and comfort of the vehicle. [Explanation of symbols]

[0085] 1...control system, 2...central ECU (control device), 3...first communication line, 4...second communication line, 5...in-vehicle connection link, 6...ICB, 29...zone A-ECU, 30...light body, 61...processor, 62...program execution unit, 65...memory, 66...control program, 68...application program, 100...management system, 110...server, 210...processor, 211...program management unit, 212...detection unit, 220...memory, 221...control program, 222...device information, 223...history information, 224...restriction information, B...base station, N...communication network, V...vehicle.

Claims

1. a program management unit that manages a process of installing a program for operating an electronic device into an ECU that executes the program, and that manages the execution of the program by the ECU; a detection unit that detects a usage state of the electronic device, storing restriction information including information indicating a program that is a target of a restriction operation to be performed by the program management unit among the programs; When the program management unit receives a request to install the program, it determines whether the program requested to be installed is a program specified by the restriction information; When it is determined that the program is one of those specified by the restriction information, the program management unit executes the restriction operation at least when the program is installed and when the program is executed, based on the usage state of the electronic device detected by the detection unit; The central ECU, wherein the restricting action includes outputting a notification, restricting installation of the program, and restricting execution of the program.

2. 2. The central ECU according to claim 1, wherein the program management unit acquires, from the program when the program is installed, information that identifies the electronic device operated by the program, and executes the restriction operation based on the acquired information.

3. 3. The central ECU according to claim 1, wherein the program management unit determines the load of the electronic device based on the usage state of the electronic device while the program is being executed, and executes the restriction operation when the load of the electronic device corresponds to a high load.

4. The central ECU according to claim 3 , wherein the program management unit outputs the notification when a load on the electronic device during execution of the program corresponds to a high load.

5. 5. The central ECU according to claim 3, wherein the program management unit prohibits at least one of installation of the program and execution of the program when a load on the electronic device during execution of the program corresponds to a high load.

6. 6. The central ECU according to claim 1, wherein the electronic device is mounted on a vehicle, and the program is executed by the ECU provided in the vehicle-mounted device.

7. 7. The central ECU according to claim 1, wherein the detection unit detects at least one of the number of operations, the operation time, and the period of time elapsed since manufacture of the electronic device as the usage state of the electronic device.

8. A process of installing a program for operating an electronic device into an ECU that executes the program, and managing the execution of the program by the ECU; Detecting the usage state of the electronic device; storing restriction information including information indicating a program that is a target of a restricted operation among the programs; When a request for installing the program is received, it is determined whether the program requested for installation is a program specified by the restriction information; A control method for a central ECU, which, when it is determined that the program is specified by the restriction information, executes the restriction operation, including outputting a notification, restricting the installation of the program, and restricting the execution of the program, at least when the program is installed and when the program is executed, based on the usage state of the electronic device.

Images