Update systems, in-vehicle devices, and servers

Abstract

To update a learned model in a short period of time.SOLUTION: An update system includes an on-vehicle device and a server. The on-vehicle device includes: a first learned model which uses a first vehicle value transmitted through an on-vehicle network to which the on-vehicle device is connected as input data and outputs an estimation value correlated with the first vehicle value; and a first determination unit which determines whether or not the first learned model matches the vehicle by comparing the estimation value output from the first learned model with a second vehicle value. The server includes: a selection unit which selects a second learned model for updating the first learned model when it is determined that the first learned model does not match the vehicle; and a transmission unit which transmits the selected second learned model to the on-vehicle device. The on-vehicle device includes: a reception unit which receives the second learned model; and an update unit which updates the first learned model to the second learned model.SELECTED DRAWING: Figure 6

Description

Technical Field

[0001] The present disclosure relates to an update system, an in-vehicle device, and a server.

Background Art

[0002] A vehicle is equipped with various types of in-vehicle devices, including: control-system ECUs (Electronic Control Units) that control an engine, transmission, and the like; body-system ECUs that control headlights, power windows, and the like; and information-system ECUs for navigation devices, multimedia devices, and the like. Each in-vehicle device is connected to an in-vehicle network and can communicate with each other.

[0003] A problem has been posed that an unauthorized in-vehicle device may connect to an in-vehicle network by impersonating a legitimate in-vehicle device, and transmit an unauthorized frame to the in-vehicle network from the unauthorized in-vehicle device, thereby causing the vehicle to be improperly controlled. For this reason, techniques for detecting an unauthorized frame in an in-vehicle network have been proposed (e.g., Patent Documents 1 to 3).

[0004] When detecting an unauthorized frame using a trained model generated by machine learning, if the relationship between the input value and the output value of the trained model changes due to aged deterioration of the vehicle or the like, it becomes impossible to accurately detect an unauthorized frame. Patent Document 2 discloses an apparatus that retrains a trained model when the relationship between a first vehicle value and a second vehicle value acquired from a sensor mounted on a vehicle changes due to deterioration of an in-vehicle device.

Prior Art Literature

Patent Literature

[0005]

Patent Document 1

Patent Document 2

Patent Document 3

[0006] However, the device disclosed in Patent Document 2 has the problem of long waiting times because it is necessary to record the first and second vehicle values ​​acquired from the sensor as logs in order to retrain the trained model. [Means for solving the problem]

[0007] An update system according to one aspect of the present disclosure includes an in-vehicle device and a server, wherein the in-vehicle device includes a first trained model that takes a first vehicle value transmitted over an in-vehicle network to which the in-vehicle device is connected as input data and outputs an estimated value correlated with the first vehicle value, and a first determination unit that compares the estimated value output from the first trained model with a second vehicle value transmitted over the in-vehicle network to determine whether the first trained model is suitable for the vehicle, the server includes a selection unit that selects a second trained model for updating the first trained model when the first determination unit determines that the first trained model is not suitable for the vehicle, and a transmission unit that transmits the second trained model selected by the selection unit to the in-vehicle device, the in-vehicle device includes a receiving unit that receives the second trained model transmitted from the server, and an update unit that updates the first trained model with the second trained model received by the receiving unit. [Effects of the Invention]

[0008] According to this disclosure, trained models can be updated in a short period of time. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 is a block diagram showing an example of the configuration of the update system according to the embodiment. [Figure 2]Figure 2 is a block diagram showing an example of the hardware configuration of a relay ECU according to the present invention. [Figure 3] Figure 3 is a block diagram showing an example of the server hardware configuration according to the embodiment. [Figure 4] Figure 4 is a schematic diagram showing an example of the configuration of a trained model according to the embodiment. [Figure 5] Figure 5 shows an example of the configuration of a pre-trained model database. [Figure 6] Figure 6 is a functional block diagram showing an example of the functions of the relay ECU according to the embodiment. [Figure 7] Figure 7 is a functional block diagram showing an example of the server's functions according to this embodiment. [Figure 8] Figure 8 is a flowchart showing an example of the operation of the relay ECU according to the embodiment. [Figure 9] Figure 9 is a flowchart showing an example of the process for detecting invalid frames. [Figure 10A] Figure 10A is the first part of a flowchart illustrating an example of an update process. [Figure 10B] Figure 10B is the latter part of a flowchart illustrating an example of an update process. [Figure 11] Figure 11 is a flowchart showing an example of the operation of the server according to the embodiment. [Figure 12] Figure 12 is a flowchart showing an example of the model selection process. [Figure 13] Figure 13 is a sequence diagram showing an example of the operation of the update system according to the embodiment. [Modes for carrying out the invention]

[0010] <Summary of the embodiments of this disclosure> The embodiments of this disclosure are outlined below.

[0011] (1) According to this embodiment updateThe system comprises an in-vehicle device and a server, wherein the in-vehicle device includes: a first trained model that takes, as input data, a first vehicle value transmitted via an in-vehicle network to which the in-vehicle device is connected, and outputs an estimated value correlated with the first vehicle value; and a first determination unit that compares the estimated value output from the first trained model with a second vehicle value transmitted via the in-vehicle network, and determines whether the first trained model is compatible with a vehicle. The server includes: a selection unit that selects a second trained model for updating the first trained model when the first determination unit determines that the first trained model is not compatible with the vehicle; and a transmission unit that transmits the second trained model selected by the selection unit to the in-vehicle device. The in-vehicle device includes: a reception unit that receives the second trained model transmitted from the server; and an update unit that updates the first trained model to the second trained model received by the reception unit. Accordingly, there is no need to perform retraining in the in-vehicle device, and the trained model can be updated in a short period of time.

[0012] (2) In the above (1), the in-vehicle device further includes a storage unit that stores the first vehicle value and the second vehicle value transmitted via the in-vehicle network in the past, and the first determination unit may obtain the estimated value output from the first trained model by inputting the first vehicle value stored in the storage unit into the first trained model, compare the estimated value with the second vehicle value stored in the storage unit, and determine whether the first trained model is compatible with the vehicle. Accordingly, by using the first vehicle value and the second vehicle value which are actual values stored in the storage unit, it is possible to accurately determine whether the first trained model is compatible with the vehicle.

[0013] (3) In the above (2), the first determination unit may determine whether the first trained model is compatible with the vehicle while the vehicle is stopped. Accordingly, the determination of whether the first trained model is compatible with the vehicle can be performed while the vehicle is stopped, when there is no need to perform travel control of the vehicle.

[0014] (4) In (2) or (3) above, the in-vehicle device further includes a mode setting unit that sets the operating mode to either a normal mode in which the vehicle is driven or a maintenance mode for performing maintenance on the vehicle, and the first determination unit may determine whether the first learned model is suitable for the vehicle when the operating mode is set to the maintenance mode. This makes it possible to determine whether the first learned model is suitable for the vehicle while the operating mode is set to the maintenance mode.

[0015] (5) In (4) above, the in-vehicle device may further include a second determination unit that, when the operating mode is set to the normal mode, compares the estimated value output from the first trained model with a second vehicle value transmitted through the in-vehicle network to determine whether or not a frame containing the second vehicle value is an invalid frame. This allows for the detection of invalid frames using the first trained model while the operating mode is in normal mode.

[0016] (6) In any one of (1) to (5) above, the selection unit may select the second trained model based on vehicle information relating to the vehicle. This makes it possible to provide the in-vehicle device with a second trained model corresponding to the vehicle.

[0017] (7) In (6) above, the vehicle information may include the vehicle type. This makes it possible to provide the in-vehicle device with a second trained model corresponding to the vehicle type.

[0018] (8) In (6) or (7) above, the vehicle information may include the year of manufacture of the vehicle. This makes it possible to provide the in-vehicle device with a second trained model corresponding to the year of manufacture of the vehicle.

[0019] (9) In any one of (6) to (8) above, the vehicle information may include the total mileage of the vehicle. This makes it possible to provide the in-vehicle device with a second trained model corresponding to the total mileage of the vehicle.

[0020] (10) In (6) above, the vehicle information includes the vehicle type, year of manufacture, and total mileage, and the selection unit selects the second learned model corresponding to the vehicle type and year of manufacture included in the vehicle information. If there are multiple second learned models corresponding to the vehicle type and year of manufacture included in the vehicle information, the selection unit may select one of the multiple second learned models based on the total mileage included in the vehicle information. This makes it possible to select a second learned model corresponding to the vehicle type and year of manufacture. Furthermore, if there are multiple second learned models corresponding to the vehicle type and year of manufacture, an appropriate second learned model can be selected based on the total mileage.

[0021] (11) In any one of (1) to (10) above, the selection unit may select the second trained model from a storage unit that stores multiple trained models. This makes it possible to select a trained model suitable for the vehicle from among various trained models as the second trained model.

[0022] (12) In any one of (1) to (11) above, the in-vehicle device further includes: a third determination unit that compares an estimated value output from the second trained model with a second vehicle value transmitted through the in-vehicle network to determine whether the second trained model is suitable for the vehicle; and a learning unit that, if the third determination unit determines that the second trained model is not suitable for the vehicle, generates a third trained model by performing supervised learning using the first vehicle value and the second vehicle value transmitted through the in-vehicle network as training data, wherein the update unit may update the first trained model with the third trained model generated by the learning unit.

[0023] (13) In the above (12), the in-vehicle device may further include a storage control unit that stores the third trained model generated by the learning unit in a storage unit that stores a plurality of trained models usable in a plurality of vehicles. This makes it possible to use the generated third trained model in other vehicles.

[0024] (14) In any one of (1) to (13) above, the in-vehicle device may be a relay device connected to multiple communication lines included in the in-vehicle network and relaying frames between multiple in-vehicle devices. This makes it possible to update the learning model in the relay device that relays frames between multiple in-vehicle devices.

[0025] (15) The in-vehicle device according to this embodiment is an in-vehicle device connected to an in-vehicle network and includes: a first trained model that takes a first vehicle value transmitted through the in-vehicle network as input data and outputs an estimated value correlated with the first vehicle value; a first determination unit that compares the estimated value output from the first trained model with a second vehicle value transmitted through the in-vehicle network to determine whether the first trained model is suitable for the vehicle; a receiving unit that receives a second trained model for updating the first trained model from a server if the first determination unit determines that the first trained model is not suitable for the vehicle; and an update unit that updates the first trained model with the second trained model received by the receiving unit. This eliminates the need for retraining in the in-vehicle device and allows for updating of the trained model in a short period of time.

[0026] (16) The server according to this embodiment is a server capable of communicating with an in-vehicle device, and includes a selection unit that takes a first vehicle value transmitted over an in-vehicle network to which the in-vehicle device is connected as input data, and compares the estimated value output from a first trained model that outputs an estimated value correlated with the first vehicle value with a second vehicle value transmitted over the in-vehicle network, and if it is determined that the first trained model is not suitable for the vehicle, selects a second trained model for updating the first trained model, and a transmission unit that transmits the second trained model selected by the selection unit to the in-vehicle device. This eliminates the need for the in-vehicle device to retrain, and allows for updating the trained model in a short period of time.

[0027] This disclosure can be implemented not only as an update system having the characteristic configuration described above, an in-vehicle device included in the update system, and a server included in the update system, but also as an update method in which characteristic processing in the in-vehicle device is performed in steps, as a program for causing the in-vehicle device to perform characteristic processing, or as part or all of the relay device being implemented as a semiconductor integrated circuit. Furthermore, this disclosure can also be implemented as a method in which characteristic processing in the server is performed in steps, as a program for causing the server to perform characteristic processing, or as part or all of the server being implemented as a semiconductor integrated circuit.

[0028] <Details of the embodiments of this disclosure> The embodiments of the present invention will be described in detail below with reference to the drawings. At least some of the embodiments described below may be combined in any way.

[0029] [1. Update System] Figure 1 is a block diagram showing an example of the configuration of the update system according to this embodiment. The update system 10 includes a relay ECU 200 mounted on the vehicle and a server 500 located outside the vehicle.

[0030] The vehicle has an in-vehicle system 100. The in-vehicle system 100 includes a relay ECU 200 and ECUs 300A, 300B, 300C, 300D, and 300E. The in-vehicle system 100 is an in-vehicle network consisting of the relay ECU 200, ECUs 300A, 300B, 300C, 300D, and 300E, and communication lines (communication buses) connecting them.

[0031] Multiple ECUs, including ECU300A, 300B, 300C, 300D, and 300E, are positioned in various parts of the vehicle. These ECUs individually control the hardware of each part of the vehicle and monitor the status of the hardware in each part. For example, ECU300A, 300B, 300C, 300D, and 300E are the control system, body system, and information system ECUs, respectively. In the following explanation, ECU300A, 300B, 300C, and 300D will be collectively referred to as "ECU300".

[0032] ECU300A, 300B, 300C, and 300D are connected to sensors. These sensors detect physical quantities related to the vehicle. For example, ECU300A is connected to sensor 310A, which detects engine speed. For example, ECU300B is connected to sensor 310B, which detects the amount the accelerator pedal is pressed, i.e., the throttle opening. For example, ECU300C is connected to sensor 310C, which detects the gear position in the vehicle's transmission mechanism. For example, ECU300D is connected to sensor 310D, which detects the rotational speed of the wheels, i.e., the vehicle speed. Engine speed, throttle opening, gear position, and vehicle speed are examples of "vehicle values".

[0033] The relay ECU 200 is connected to ECUs 300A, 300B, 300C, 300D, and 300E respectively via communication buses 400A, 400B, and 400C, which are similar to a CAN (Controller Area Network) bus. Specifically, ECUs 300A and 300B are connected to bus 400A. ECUs 300C and 300D are connected to bus 400B. ECU 300E is connected to bus 400C. The relay ECU 200 can communicate with each of the ECUs 300A, 300B, 300C, 300D, and 300E. The relay ECU 200, ECUs 300A, 300B, 300C, 300D, and 300E are examples of "in-vehicle equipment".

[0034] The relay ECUs 200 and 300 use a communication protocol for sending and receiving messages periodically or aperiodically. The communication protocol is, for example, CAN or CAN FD (CAN with Flexible Data Rate). In another example, the protocol is Ethernet®.

[0035] The relay ECU 200 functions as a gateway that relays communication between multiple ECUs 300. Each ECU 300 can transmit frames. These frames are messages conforming to the communication protocol described above. The relay ECU 200 relays frames between ECUs connected to different buses. For example, the relay ECU 200 can relay frames between ECU 300A, connected to bus 400A, and ECU 300C, connected to bus 400B.

[0036] ECU300A, 300B, 300C, and 300D can transmit frames containing the vehicle values ​​mentioned above. ECU300A, 300B, 300C, 300D, and 300E, upon receiving a frame, can retrieve the vehicle values ​​from the received frame.

[0037] The relay ECU 200 is connected to the external communication device 350 via bus 400C. The external communication device 350 is, for example, a TCU (Telematics Control Unit) and can communicate with devices outside the vehicle. The external communication device 350 is equipped with a wireless communication interface for a mobile communication system such as a fifth-generation mobile communication system (5G) or a fourth-generation mobile communication system (4G). The external communication device 350 can send and receive TCP / IP (Transmission Control Protocol / Internet Protocol) packets, for example. The external communication device 350 is connected to a base station (not shown) of a mobile communication network and can communicate with devices connected to the Internet via the base station. Specifically, the external communication device 350 can communicate with the server 500. The external communication device 350 relays communication between the relay ECU 200 and the server 500.

[0038] A connector 410 is connected to bus 400C. Connector 410 is a connector compliant with, for example, OBD1 (On-board Diagnostics first generation) or OBD2 (On-board Diagnostics second generation). A diagnostic device 370 for performing vehicle diagnostics can be connected to connector 410. The diagnostic device 370 can communicate with the relay ECU 200 and ECU 300 using the communication protocol described above. For example, the diagnostic device 370 can collect vehicle values ​​detected by sensors, abnormal or warning information previously detected by the ECU 300, etc., from the relay ECU 200 and ECU 300.

[0039] [2. Hardware configuration of the relay ECU] Figure 2 is a block diagram showing an example of the hardware configuration of a relay ECU according to this embodiment. The relay ECU 200 includes a processor 201, a non-volatile memory 202, a volatile memory 203, and communication interfaces (hereinafter also referred to as "communication I / F") 204A, 204B, and 204C. The processor 201, the non-volatile memory 202, the volatile memory 203, and the communication I / F 204 are each connected to each other by a bus 205, which is a communication line. The processor 201, the non-volatile memory 202, the volatile memory 203, and the communication I / F 204 can each transmit data to each other via the bus 205. The relay ECU 200 is an example of a "relay device".

[0040] The volatile memory 203 is a semiconductor memory such as SRAM (Static Random Access Memory) or DRAM (Dynamic Random Access Memory). The non-volatile memory 202 is a flash memory, hard disk, or ROM (Read Only Memory). The non-volatile memory 202 stores the computer programs, namely the malicious frame detection program 210 and the update program 211, as well as the data used to execute the malicious frame detection program 210 and the update program 211. The functions of the relay ECU 200, described later, are performed when the malicious frame detection program 210 and the update program 211 are executed by the processor 201.

[0041] The processor 201 is, for example, a CPU (Central Processing Unit). However, the processor 201 is not limited to a CPU. The processor 201 may also be a GPU (Graphics Processing Unit). In a specific example, the processor 201 is a multi-core processor. The processor 201 may also be a single-core processor. The processor 201 is configured to execute computer programs. However, the processor 201 may also be, for example, an ASIC (Application Specific Integrated Circuit) or a programmable logic device such as an FPGA (Field Programmable Gate Array). In this case, the ASIC or programmable logic device is configured to execute the same functions as the invalid frame detection program 210 and the update program 211.

[0042] Communication interfaces 204A, 204B, and 204C are communication interfaces compliant with the above-mentioned in-vehicle network communication protocols. Communication interfaces 204A, 204B, and 204C are, for example, CAN interfaces. Communication interfaces 204A, 204B, and 204C may also be Ethernet interfaces.

[0043] Communication I / F 204A is connected to bus 400A. Communication I / F 204B is connected to bus 400B. Communication I / F 204C is connected to bus 400C. Relay ECU 200 can communicate with ECUs 300A and 300B via communication I / F 204A. Relay ECU 200 can communicate with ECUs 300C and 300D via communication I / F 204B. Relay ECU 200 can communicate with ECU 300E via communication I / F 204C. Furthermore, relay ECU 200 can communicate with diagnostic device 370 via communication I / F 204C and with server 500 via external communication device 350.

[0044] The non-volatile memory 202 stores a pre-trained model 212 used for detecting invalid frames. The pre-trained model 212 will be described later.

[0045] The non-volatile memory 202 stores log data 213. The log data 213 includes previously detected vehicle values, namely engine speed, throttle opening, gear position, and vehicle speed.

[0046] The non-volatile memory 202 stores vehicle information 214. The vehicle information 214 includes the vehicle type, year of manufacture, and total mileage. For example, the vehicle information 214 may be stored in the non-volatile memory (not shown) of the ECU 300 instead of the non-volatile memory 202 of the relay ECU 200. In this case, the relay ECU 200 can obtain the vehicle information from the ECU 300 by communication.

[0047] [3. Server Hardware Configuration] Figure 3 is a block diagram showing an example of the hardware configuration of a server according to this embodiment. The server 500 includes a processor 501, a non-volatile memory 502, a volatile memory 503, and a communication interface 504. The processor 501, the non-volatile memory 502, the volatile memory 503, and the communication interface 504 are each connected to one another by a bus 505, which is a communication line. The processor 501, the non-volatile memory 502, the volatile memory 503, and the communication interface 504 can each transmit data to one another via the bus 505.

[0048] The volatile memory 503 is, for example, a semiconductor memory such as SRAM or DRAM. The non-volatile memory 502 is, for example, flash memory, a hard disk, or ROM. The non-volatile memory 502 stores the provided program 510, which is a computer program, and the data used to execute the provided program 510. The functions of the server 500, described later, are performed when the provided program 510 is executed by the processor 501.

[0049] The processor 501 is, for example, a CPU. However, the processor 501 is not limited to a CPU. The processor 501 may also be a GPU. In a specific example, the processor 501 is a multi-core processor. The processor 501 may also be a single-core processor. The processor 501 is configured to execute a computer program. However, the processor 501 may also be, for example, an ASIC or a programmable logic device such as an FPGA. In this case, the ASIC or programmable logic device is configured to execute the same functions as the provided program 510.

[0050] Communication I / F504 is, for example, an Ethernet interface ("Ethernet" is a registered trademark). Communication I / F504 is, for example, connected to the Internet. Communication I / F504 can, for example, send and receive TCP / IP packets.

[0051] The non-volatile memory 502 is provided with a trained model database 511 (hereinafter also referred to as the "trained model DB 511"). The trained model DB 511 stores multiple trained models. The trained model DB 511 is an example of a "storage unit". The providing program 510 selects a trained model suitable for the vehicle from the trained model DB 511 in response to a request from the vehicle and provides the selected trained model to the vehicle. The trained model DB 511 will be described later.

[0052] [4. Pre-trained models] The trained model 212 is a computer program that can be executed by the processor 201 and is used to detect invalid frames.

[0053] Figure 4 is a schematic diagram showing an example of the configuration of a trained model according to the embodiment. The trained model 212 is, for example, composed of a neural network and includes an input layer, a hidden layer, and an output layer.

[0054] The trained model 212 is constructed, for example, by a deep neural network. The trained model 212 may be a convolutional neural network, a recurrent neural network, an LSTM (Long Short-Term Memory), or any other type of neural network.

[0055] The input layer receives vehicle values ​​(first vehicle values) contained in the frame detected by the sensor and transmitted from the ECU 300. The input layer 212IN includes one or more nodes. For example, the input layer receives first vehicle values ​​for engine speed, throttle opening, and gear position.

[0056] The hidden layer consists of one or more processing layers. In the example shown in Figure 4, the hidden layer has a three-layer structure. Each layer that makes up the hidden layer has one or more nodes. Each node in the input layer is connected to each node in the second layer by an edge. Individual weights are assigned to the edges. Each node in the second layer is connected to each node in the third layer by an edge. Each node in the third layer is connected to each node in the fourth layer by an edge.

[0057] The output layer contains at least one node. Each of the fourth node in the hidden layer is connected to a node in the output layer by an edge.

[0058] The first vehicle values ​​given to the input layer nodes are weighted by the edge weights and passed to the second layer nodes. The second layer nodes perform the processing assigned to each given data. The data processed by the second layer nodes is weighted by the edge weights and passed to the third layer nodes. The third layer nodes perform the processing assigned to each given data. In the same manner, the data is sequentially passed to the fourth layer and the output layer. The data in the nodes included in the output layer are estimates of the second vehicle values. The second vehicle values ​​are vehicle values ​​that are correlated with the first vehicle values. For example, if the first vehicle values ​​are engine speed, throttle opening, and gear position, then the second vehicle value is vehicle speed.

[0059] For example, if the frame transmitting the second vehicle value, vehicle speed, is a normal frame (hereinafter also referred to as a "normal frame"), the vehicle speed included in the normal frame is a normal value that represents the actual vehicle speed. Therefore, if the input data, namely engine speed, throttle opening, and gear position, are all normal, the estimated vehicle speed output from the trained model 212 will be close to the vehicle speed included in the normal frame. For example, if the frame transmitting the second vehicle value, vehicle speed, is an invalid frame, the vehicle speed included in the invalid frame is an abnormal value that differs from the actual vehicle speed. Therefore, the estimated vehicle speed output from the trained model 212 will be a value that does not approximate the vehicle speed included in the invalid frame.

[0060] Multiple trained models may be stored in the non-volatile memory 202 of the relay ECU 200. For example, a trained model that takes the amount of brake pedal depression as input data and outputs an estimated value of acceleration, and a trained model that takes the rotation angle of the steering wheel as input data and outputs an estimated value of the steering angle of the wheels may be stored in the non-volatile memory 202.

[0061] [5. Pre-trained model database] Figure 5 shows an example of the configuration of the trained model database. The trained model database 511 stores vehicle information in association with trained models. That is, the trained model database 511 stores vehicle information in association with trained models that are suited to the vehicle identified by the vehicle information. Specifically, the vehicle information is the vehicle information of the vehicle from which the corresponding trained model was generated. In the example in Figure 5, trained model M1 is a trained model generated by a vehicle of type "Vehicle A", year "2011", and total mileage "9251km". Trained model M2 is a trained model generated by a vehicle of type "Vehicle A", year "2015", and total mileage "8289km". Trained model M3 is a trained model generated by a vehicle of type "Vehicle A", year "2015", and total mileage "20350km". The learned model M4 is a learned model generated using a vehicle of type "Vehicle Type B", year "2021", and total mileage "563km".

[0062] [6. Functions of the update system] Figure 6 is a functional block diagram showing an example of the functions of the relay ECU according to the embodiment.

[0063] The processor 201 of the relay ECU 200 executes the invalid frame detection program 210 and the update program 211, thereby realizing the functions of the mode setting unit 221, the input unit 231, the frame determination unit 232, the output unit 233, the input unit 241, the first conformance determination unit 242, the request unit 243, the reception unit 244, the input unit 245, the second conformance determination unit 246, the update unit 247, the learning unit 248, and the storage control unit 249.

[0064] The relay ECU200 can be configured with two operating modes: normal mode and maintenance mode. Normal mode is the operating mode set when the vehicle is running. Maintenance mode is the operating mode set when performing maintenance work on the vehicle. In other words, maintenance mode is the operating mode set when the vehicle is not running.

[0065] Refer to Figure 1. For example, maintenance work such as vehicle inspection and repair is performed at a dealership. During maintenance work, the dealership's workers connect the diagnostic device 370 to the connector 410. When the diagnostic device 370 is connected to the in-vehicle system 100, a frame is transmitted from the diagnostic device 370 to the in-vehicle system 100. The relay ECU 200 detects the connection of the diagnostic device 370 by receiving the frame.

[0066] Returning to Figure 6, for example, when the mode setting unit 221 detects the connection of the diagnostic device 370, it switches the operating mode from normal mode to maintenance mode. When the diagnostic device 370 is disconnected from the in-vehicle system 100, the mode setting unit 221 switches from maintenance mode to normal mode. In other words, normal mode is the operating mode set when the diagnostic device 370 is not connected to the in-vehicle system 100. Maintenance mode is the operating mode set when the diagnostic device 370 is connected to the in-vehicle system 100.

[0067] The input unit 231, the frame determination unit 232, and the output unit 233 are functions that are executed in normal mode. The input unit 231, the frame determination unit 232, and the output unit 233 are implemented by the invalid frame detection program 210.

[0068] The input unit 231 inputs the first vehicle value to the learned model 212. In a specific example, the input unit 231 acquires the first vehicle value from a frame received by the relay ECU 200 from the in-vehicle network and inputs the acquired first vehicle value to the learned model 212. That is, the first vehicle value that the input unit 231 inputs to the learned model 212 is the vehicle value most recently detected by sensors 310A, 310B, and 310C, i.e., the current value.

[0069] The trained model 212, upon receiving the input data, the first vehicle value, outputs an estimated value of the second vehicle value. That is, the output data from the trained model 212 is an estimated value of the current value of the second vehicle value obtained from the current value of the first vehicle value, and is an estimated value of the vehicle value most recently detected by the sensor 310D. The trained model 212 stored in the non-volatile memory 202 is an example of the "first trained model".

[0070] The frame determination unit 232 compares the estimated value output from the trained model 212 with the second vehicle value transmitted through the in-vehicle network to determine whether a frame containing the second vehicle value is an invalid frame. The frame determination unit 232 is an example of a "second determination unit". In a specific example, the frame determination unit 232 obtains the current value of the second vehicle value from a frame received by the relay ECU 200 from the in-vehicle network. The frame determination unit 232 compares the estimated value output from the trained model 212 with the current value of the second vehicle value. For example, the frame determination unit 232 calculates the difference between the estimated value output from the trained model 212 and the current value of the second vehicle value and determines whether the difference is greater than or equal to a threshold. If the difference is less than the threshold, the frame determination unit 232 determines that the frame containing the second vehicle value is a normal frame. If the difference is greater than or equal to the threshold, the frame determination unit 232 determines that the frame containing the second vehicle value is an invalid frame.

[0071] If the frame detection unit 232 detects an invalid frame, the output unit 233 outputs notification data to notify the user of the detection of the invalid frame. For example, the output unit 233 generates a notification frame to notify the user of the detection of an invalid frame and transmits the generated notification frame to the in-vehicle network. For example, a user interface device (hereinafter also referred to as "UI device") is connected to the in-vehicle system (not shown). The UI device is one of the in-vehicle devices mounted in the vehicle. The UI device is used by the vehicle driver. The UI device includes an input device and a display device, and can receive input from the driver and display information to be provided to the driver. The UI device receives a notification frame transmitted from the relay ECU 200 and displays a screen to notify the detection of an invalid frame. This notifies the driver of the detection of an invalid frame.

[0072] The input unit 241, the first conformity determination unit 242, the request unit 243, the receiving unit 244, the input unit 245, the second conformity determination unit 246, the update unit 247, the learning unit 248, and the storage control unit 249 are functions that are executed in maintenance mode. The input unit 231, the input unit 241, the first conformity determination unit 242, the request unit 243, the receiving unit 244, the input unit 245, the second conformity determination unit 246, the update unit 247, the learning unit 248, and the storage control unit 249 are implemented by the update program 211.

[0073] The input unit 241 inputs the first vehicle value into the trained model 212. In a specific example, the input unit 241 reads the first vehicle value from the log data 213 and inputs the read first vehicle value into the trained model 212. In other words, the first vehicle value that the input unit 241 inputs into the trained model 212 is the vehicle value previously detected by sensors 310A, 310B, and 310C, i.e., a past value (actual value).

[0074] When the trained model 212 receives the input data, which is the first vehicle value, it outputs an estimated value of the second vehicle value. In other words, the output data from the trained model 212 is an estimated past value of the second vehicle value obtained from the past value of the first vehicle value, and is an estimated value of the vehicle value that the sensor 310D has detected in the past.

[0075] Vehicles change in their mechanical properties due to aging. When mechanical properties change, the correlation between the first vehicle value and the second vehicle value changes. For this reason, a trained model 212 that previously correctly reflected the relationship between the first and second vehicle values ​​may no longer correctly reflect the relationship between the first and second vehicle values ​​due to the aging of the vehicle.

[0076] The first conformance determination unit 242 compares the estimated value output from the trained model 212 with the second vehicle value transmitted through the in-vehicle network to determine whether the trained model 212 is compatible with the vehicle. The first conformance determination unit 242 is an example of the "first determination unit". In a specific example, the first conformance determination unit 242 reads the second vehicle value from the log data 213. The second vehicle value recorded in the log data 213 is a past value of the second vehicle value. The first conformance determination unit 242 compares the estimated value output from the trained model 212 with the second vehicle value read from the log data 213. The second vehicle value used for comparison with the estimated value is the second vehicle value detected at the time the first vehicle value input to the trained model 212 was detected, or at a time close to the time the first vehicle value was detected.

[0077] For example, the first suitability determination unit 242 calculates the difference between the estimated value output from the trained model 212 and the past value of the second vehicle value, and determines whether the difference is greater than or equal to a threshold. If the difference is less than the threshold, the first suitability determination unit 242 determines that the trained model 212 is suitable for the vehicle. If the difference is greater than or equal to the threshold, the first suitability determination unit 242 determines that the trained model 212 is not suitable for the vehicle.

[0078] If the first conformity determination unit 242 determines that the learned model 212 is compatible with the vehicle, the learned model 212 is not updated and continues to be used for detecting invalid frames.

[0079] The input-output relationships in the pre-trained model 212, which is not adapted to the vehicle, deviate from the actual correlation between the first vehicle value and the second vehicle value. Therefore, using the pre-trained model 212, which is not adapted to the vehicle, for detecting invalid frames may result in false detections of invalid frames or failure to detect invalid frames at all. Accordingly, if the pre-trained model 212 is not adapted to the vehicle, it is necessary to update the pre-trained model 212 to a pre-trained model that correctly reflects the correlation between the first vehicle value and the second vehicle value.

[0080] If the first conformity determination unit 242 determines that the trained model 212 is not suitable for the vehicle, the request unit 243 requests a new trained model from the server 500. In a specific example, the request unit 243 generates a request frame to request a new trained model and sends the request frame to the in-vehicle network.

[0081] The request frame contains vehicle information. Specifically, the request unit 243 reads vehicle information 214 from the non-volatile memory 202 and generates a request frame containing the read vehicle information 214. The request frame transmitted by the request unit 243 is received by the external communication device 350. Upon receiving the request frame, the external communication device 350 performs necessary processing such as protocol conversion and transmits the request frame to the server 500.

[0082] Figure 7 is a functional block diagram showing an example of the server's functions according to this embodiment.

[0083] The processor 501 of the server 500 executes the provided program 510, thereby realizing the functions of the receiving unit 521, the selection unit 522, and the transmitting unit 523.

[0084] The receiving unit 521 receives the request frame transmitted from the vehicle.

[0085] When the receiving unit 521 receives a request frame, the selection unit 522 selects a trained model for update from the trained model DB 511.

[0086] In a specific example, the selection unit 522 selects a trained model for updating from among multiple trained models stored in the trained model DB 511, based on the vehicle information included in the request frame.

[0087] For example, the selection unit 522 can select a trained model that corresponds to the same vehicle model as the vehicle model included in the request frame. It can be estimated that the mechanical characteristics of vehicles of the same vehicle model are similar. Therefore, for vehicles of the same vehicle model, it is estimated that the relationship between the first vehicle value and the second vehicle value is similar. Consequently, a trained model for a vehicle of the same vehicle model as the vehicle requesting the trained model is likely to be a good fit for the vehicle requesting the model.

[0088] Vehicles of different make and model are likely to have different in-vehicle network configurations. For example, vehicle values ​​used in one in-vehicle network may not be used in the second. In contrast, vehicles of the same make and model are likely to have common in-vehicle network configurations. From this perspective, a pre-trained model for a vehicle of the same make and model as the vehicle requesting the pre-trained model is likely to be suitable for the requesting vehicle.

[0089] For example, the selection unit 522 can select a trained model that corresponds to a model year close to the model year included in the request frame. It can be estimated that the degree of deterioration due to aging is similar for vehicles with similar model years. Therefore, it is estimated that the relationship between the first vehicle value and the second vehicle value is similar for vehicles with similar model years. Consequently, it is considered that a trained model for a vehicle with a model year similar to the vehicle that requested the trained model is likely to be suitable for the vehicle that requested the trained model.

[0090] For example, if the learned model DB 511 contains multiple learned models corresponding to the same vehicle model as the requested frame, the selection unit 522 can select the learned model that corresponds to the year closest to the year of manufacture included in the requested frame.

[0091] For example, the selection unit 522 can select a trained model that corresponds to a total mileage close to the total mileage included in the request frame. It can be estimated that the deterioration of vehicles with similar total mileage is similar. Therefore, it is estimated that the relationship between the first vehicle value and the second vehicle value is similar for vehicles with similar total mileage. Consequently, it is considered that a trained model for a vehicle with a total mileage similar to the vehicle that requested the trained model is likely to be a good fit for the vehicle that requested the trained model.

[0092] For example, the selection unit 522 can select a learned model that corresponds to the vehicle type and year included in the vehicle information. If there are multiple learned models that correspond to the vehicle type and year included in the vehicle information, the selection unit 522 can select one of the multiple learned models based on the total mileage included in the vehicle information. In a specific example, if multiple learned models corresponding to the same vehicle type and year included in the request frame are stored in the learned model DB 511, the selection unit 522 can select the learned model that corresponds to the total mileage closest to the total mileage included in the request frame.

[0093] The transmitting unit 523 transmits the learned model for updating, selected by the selection unit 522, to the requesting vehicle.

[0094] Returning to Figure 6, the trained model transmitted from the server 500 is received by the external communication device 350. The external communication device 350 divides the received trained model into, for example, multiple frames and transmits them to the relay ECU 200. The receiving unit 244 receives the frames transmitted from the external communication device 350, i.e., the trained model for updating.

[0095] The input unit 245 inputs the first vehicle value to the received pre-trained model for updating (hereinafter also referred to as the "update model"). The update model is an example of the "second pre-trained model". In a specific example, the input unit 231 reads the first vehicle value from the log data 213 and inputs the read first vehicle value to the update model. That is, the first vehicle value that the input unit 231 inputs to the update model is the vehicle value previously detected by sensors 310A, 310B, and 310C, i.e., a past value (actual value).

[0096] The update model, upon receiving the input data, which is the first vehicle value, outputs an estimated value of the second vehicle value. In other words, the output data from the update model is an estimated past value of the second vehicle value obtained from the past value of the first vehicle value, and is an estimated value of the vehicle value previously detected by sensor 310D.

[0097] The second conformity determination unit 246 compares the estimated value output from the update model with the second vehicle value transmitted through the in-vehicle network to determine whether the update model is compatible with the vehicle. The second conformity determination unit 246 is an example of the "third determination unit". In a specific example, the second conformity determination unit 246 reads the second vehicle value from the log data 213. The second vehicle value recorded in the log data 213 is a past value of the second vehicle value. The second conformity determination unit 246 compares the estimated value output from the update model with the second vehicle value read from the log data 213. The second vehicle value used for comparison with the estimated value is the second vehicle value detected at the time the first vehicle value input to the update model was detected, or at a time close to the time the first vehicle value was detected.

[0098] For example, the second conformity determination unit 246 calculates the difference between the estimated value output from the update model and the past value of the second vehicle value, and determines whether the difference is greater than or equal to a threshold. If the difference is less than the threshold, the second conformity determination unit 246 determines that the update model is compatible with the vehicle. If the difference is greater than or equal to the threshold, the second conformity determination unit 246 determines that the update model is not compatible with the vehicle.

[0099] If the second conformity determination unit 246 determines that the update model is compatible with the vehicle, the update unit 247 updates the learned model 212 stored in the non-volatile memory 202 with the update model. In other words, the update unit 247 overwrites the learned model 212 stored in the non-volatile memory 202 with the update model.

[0100] If the second conformity determination unit 246 determines that the update model is not compatible with the vehicle, the learning unit 248 generates a new trained model (hereinafter also referred to as the "new model") by performing supervised learning using the first vehicle value and the second vehicle value transmitted over the in-vehicle network as training data. The new model is an example of the "third trained model".

[0101] In a specific example, the learning unit 248 reads the first vehicle value and the second vehicle value from the log data 213 and creates training data from the read first vehicle value and the second vehicle value. For example, the log data 213 contains a sufficient amount of first vehicle value and second vehicle value data necessary for supervised learning. Specifically, the log data 213 stores first vehicle value and second vehicle value detected over a certain period. For example, when the relay ECU 200 receives new first vehicle value and second vehicle value, the received first vehicle value and second vehicle value are added to the log data 213. For example, if new first vehicle value and second vehicle value are added to the log data 213, the oldest first vehicle value and second vehicle value may be deleted from the log data 213. For example, the learning unit 248 can create training data from all first vehicle value and second vehicle value contained in the log data 213.

[0102] The learning unit 248 generates a trained model based on the training data, taking the first vehicle value as input and outputting the second vehicle value. In other words, the learning unit 248 performs machine learning using the training data and constructs a trained model.

[0103] The learning unit 248 provides the neural network with training data and performs supervised learning. In supervised learning, the first vehicle value in the training data is given to the neural network as input, and learning is performed so that the output is the same as the second vehicle value. Such machine learning is repeated using multiple datasets that combine the first and second vehicle values. Existing learning algorithms such as backpropagation and gradient descent may be used in machine learning. Through machine learning, the weights of the neural network are adjusted and a trained model is constructed.

[0104] The update unit 247 can update the trained model 212 stored in the non-volatile memory 202 with a new model generated by the learning unit 248.

[0105] The storage control unit 249 stores the new model generated by the learning unit 248 in the learned model DB 511. In a specific example, the storage control unit 249 sends a registration request that includes the new model generated by the learning unit 248 and vehicle information 214. The registration request is sent to the external communication device 350, for example, divided into multiple frames. When the external communication device 350 receives the registration request, it performs necessary processing such as protocol conversion and sends the registration request to the server 500.

[0106] When server 500 receives a registration request, it registers the vehicle information and the new model included in the registration request with the learned model 511. This makes the new model available for use in multiple vehicles.

[0107] [7. Operation of the update system] The operation of the in-vehicle system according to this embodiment will be described below.

[0108] Figure 8 is a flowchart showing an example of the operation of the relay ECU according to the embodiment.

[0109] The default operating mode of the relay ECU200 is normal mode. In other words, the relay ECU200 is set to normal mode when it starts up.

[0110] When the diagnostic device 370 is connected to the in-vehicle network, the diagnostic device 370 transmits a frame. The processor 201 of the relay ECU 200 detects the connection of the diagnostic device 370 by receiving the frame. The processor 201 determines whether or not the diagnostic device 370 is connected to the in-vehicle network (step S101).

[0111] If the diagnostic device 370 is not connected to the in-vehicle network (NO in step S101), the processor 201 maintains normal mode and performs the invalid frame detection process (step S102).

[0112] Figure 9 is a flowchart showing an example of the process for detecting invalid frames.

[0113] In the invalid frame detection process, the processor 201 receives frames containing a first vehicle value and frames containing a second vehicle value (step S201). For example, in CAN, a CAN ID is assigned that indicates the source ECU 300. The processor 201 identifies the source by the CAN ID of the frame, thereby determining whether the frame contains a first vehicle value, a second vehicle value, or any other type of frame.

[0114] The processor 201 obtains the first vehicle value from the received frame and inputs the obtained first vehicle value into the trained model 212. The trained model 212 outputs an estimated value of the second vehicle value (step S202).

[0115] The processor 201 obtains the current value of the second vehicle value from the frame received in step S201 and calculates the difference between the obtained current value of the second vehicle value and the estimated value of the second vehicle value (step S203).

[0116] The processor 201 compares the calculated difference with the threshold (step S204). If the difference is less than the threshold (NO in step S204), the processor 201 terminates the invalid frame detection process.

[0117] If the difference is greater than or equal to a threshold (YES in step S204), the processor 201 determines that the received frame is an invalid frame and sends a notification frame to notify the user of the detection of the invalid frame (step S205). The UI device receives the notification frame and displays a screen to notify the user of the detection of the invalid frame. This completes the invalid frame detection process.

[0118] Returning to Figure 8, once the invalid frame detection process is complete, the operation of the relay ECU 200 ends. The relay ECU 200 repeatedly performs the operation shown in Figure 8 at predetermined intervals.

[0119] If the diagnostic device 370 is connected to the in-vehicle network (YES in step S101), the processor 201 sets the operating mode to maintenance mode (step S103).

[0120] Processor 201 performs the update process (step S104).

[0121] Figures 10A and 10B are flowcharts illustrating an example of an update process.

[0122] Referring to Figure 10A, during the update process, the processor 201 reads past values ​​of the first vehicle value and the second vehicle value from the log data 213 (step S301).

[0123] The processor 201 inputs the first vehicle value read from the log data 213 into the trained model 212. The trained model 212 outputs an estimated value of the second vehicle value (step S302).

[0124] The processor 201 calculates the difference between the past value of the second vehicle value read from the log data 213 and the estimated value of the second vehicle value (step S303).

[0125] The processor 201 compares the calculated difference with the threshold (step S304). If the difference is less than the threshold (NO in step S304), the processor 201 determines that the trained model 212 is suitable for the vehicle and terminates the update process.

[0126] If the difference is greater than or equal to a threshold (YES in step S304), the processor 201 determines that the trained model 212 is not suitable for the vehicle. The processor 201 sends a request frame to the server 500 to request an updated model. The request frame includes vehicle information 214. The request frame is received by the external communication device 350, and the external communication device 350 forwards the request frame to the server 500.

[0127] Figure 11 is a flowchart showing an example of the operation of the server according to the embodiment.

[0128] Server 500 receives the request frame (step S401). As a result, the processor 501 of server 500 accepts the request for the update model.

[0129] The processor 501 performs a model selection process to select an update model from the learned model DB 511 based on the vehicle information included in the request frame (step S402).

[0130] Figure 12 is a flowchart showing an example of the model selection process.

[0131] In the model selection process, the processor 501 searches the learned model DB 511 for a learned model that corresponds to the vehicle type and year included in the vehicle information (step S501).

[0132] The processor 501 determines whether multiple learned models corresponding to the vehicle make and model year included in the vehicle information have been obtained as search results (step S502). If only one learned model corresponding to the vehicle make and model year included in the vehicle information has been obtained (NO in step S502), the processor 501 selects that learned model as the update model (step S503).

[0133] If multiple learned models corresponding to the vehicle type and year included in the vehicle information are obtained (YES in step S502), the processor 501 selects from these learned models the learned model corresponding to the total mileage closest to the total mileage included in the vehicle information as the update model (step S504). This completes the model selection process.

[0134] Returning to Figure 11, the processor 501 sends the selected update model to the requesting vehicle (external communication device 350) (step S403). This completes the operation of the server 500.

[0135] Returning to Figure 10A, the external communication device 350 receives the update model transmitted from the server 500, performs necessary processing such as protocol conversion, and transmits the update model to the relay ECU 200. The relay ECU 200 receives the update model (step S306).

[0136] The processor 201 reads past values ​​of the first vehicle value and the second vehicle value from the log data 213 (step S307).

[0137] The processor 201 inputs the first vehicle value read from the log data 213 into the update model. The update model outputs an estimated value of the second vehicle value (step S308).

[0138] The processor 201 calculates the difference between the historical value of the second vehicle value read from the log data 213 and the estimated value of the second vehicle value output from the update model (step S309).

[0139] The processor 201 compares the calculated difference with a threshold (step S310). If the difference is less than the threshold (NO in step S310), the processor 201 determines that the update model is suitable for the vehicle and updates the trained model 212 stored in the non-volatile memory 202 with the update model (step S311).

[0140] If the difference is greater than or equal to a threshold (YES in step S310), the processor 201 determines that the update model is not compatible with the vehicle.

[0141] Referring to Figure 10B, the processor 201 reads past values ​​of the first vehicle value and the second vehicle value from the log data 213 (step S312). The processor 201 creates training data from the read first vehicle value and second vehicle value (step S313).

[0142] The processor 201 provides training data to the neural network and performs the learning process (step S314). This generates a new model.

[0143] The processor 201 updates the trained model 212 stored in the non-volatile memory 202 with a new model (step S315).

[0144] The processor 201 sends a registration request containing the newly generated model and vehicle information. The registration request is sent (uploaded) to the server 500 by the external communication device 350. Upon receiving the registration request, the server 500 registers the vehicle information and the new model included in the registration request into the learned model DB 511. This completes the update process.

[0145] Figure 13 is a flowchart showing an example of the operation of the update system according to the embodiment. Figure 13 shows the operation of the update system when the operating mode of the relay ECU 200 is maintenance mode.

[0146] When the diagnostic device 370 is connected to the in-vehicle network, the processor 201 of the relay ECU 200 sets its operating mode to maintenance mode. The processor 201 then executes the update process.

[0147] The processor 201 inputs the first vehicle value contained in the log data 213 into the trained model 212. The processor 201 obtains the estimated value output from the trained model 212. The processor 201 compares the second vehicle value contained in the log data 213 with the estimated value output from the trained model 212 to determine whether the trained model 212 is a good fit for the vehicle (step S11).

[0148] If the programmed model 212 is determined to be suitable for the vehicle, the processor 201 terminates processing. In this case, the programmed model 212 is not updated.

[0149] If it is determined that the trained model 212 is not suitable for the vehicle, the processor 201 reads the vehicle information 214 from the non-volatile memory 202 and sends a request frame containing the vehicle information 214 (step S12). The external communication device 350 receives the request frame, performs necessary processing such as protocol conversion on the received request frame, and then sends it to the server 500 (step S13).

[0150] When the server 500 receives the request frame, the processor 501 selects a trained model for update from the trained model DB 511 based on the vehicle information contained in the request frame (step S14).

[0151] The processor 501 transmits the selected learned model, which is the update model (step S15). The external communication device 350 receives the update model, performs necessary processing such as protocol conversion on the received update model, and then transmits it to the relay ECU 200 (step S16).

[0152] The relay ECU 200 receives the update model. The processor 201 inputs the first vehicle value contained in the log data 213 into the update model. The processor 201 obtains the estimated value output from the update model. The processor 201 compares the second vehicle value contained in the log data 213 with the estimated value output from the update model to determine whether the update model is suitable for the vehicle (step S17).

[0153] If the update model is determined to be compatible with the vehicle, the processor 201 updates the learned model 212 with the update model.

[0154] If the update model is determined to be incompatible with the vehicle, the processor 201 creates training data from the log data 213 and performs machine learning using the created training data (step S18). The processor 201 updates the trained model 212 with the new model, which is the trained model generated by machine learning (step S19). Figure 13 shows an example of the operation of the update system when the update model is incompatible with the vehicle.

[0155] The processor 201 transmits a registration request including the newly generated model and vehicle information 214 (step S20). The external communication device 350 receives the registration request, performs necessary processing such as protocol conversion on the received registration request, and then transmits it to the server 500 (step S21).

[0156] When the server 500 receives a registration request, the processor 501 registers the vehicle information 214 and the new model included in the registration request in the learned model DB 511 (step S22).

[0157] [8. Variation] In the embodiment described above, the trained model DB511 is provided on the server 500, but the embodiment is not limited to this. For example, a database server containing the same database as the trained model DB511 may be provided separately from the server 500. In this case, for example, the server 500 may access the database server and select an update model that matches the vehicle information.

[0158] In the embodiment described above, multiple trained models were stored in the trained model DB 511, but the embodiment is not limited to this. For example, multiple trained models may be stored in the file system. In this case, the server 500 stores a table that stores the storage locations (directories) of trained models in association with vehicle information, and can refer to the table to identify the storage location of a trained model that matches the vehicle information. The server 500 can retrieve the trained model from the identified storage location and download the retrieved trained model to the vehicle. In another example, the server 500 can send the storage location of the trained model to the external communication device 350 in response to a request. The external communication device 350 can download the trained model from the received storage location, for example by FTP (File Transfer Protocol), and transfer the downloaded trained model to the relay ECU 200.

[0159] In the embodiments described above, a pre-trained model for updating was selected based on the vehicle's make, model year, and total mileage, but this is not limited to these. In addition to the vehicle information described above, or instead of at least one of these, a pre-trained model for updating may be selected based on the country or region where the vehicle is registered. Climates vary from country to country or region to region, and the rate of vehicle deterioration differs depending on the climate. Therefore, a pre-trained model corresponding to the same country or region as the requested vehicle is likely to be suitable for the requested vehicle.

[0160] In the embodiments described above, the trained model 212 was a neural network model, but it is not limited to this. Trained models generated by supervised machine learning algorithms other than neural networks, such as decision trees and support vector machines, may also be used.

[0161] In the embodiment described above, the relay ECU 200 stores the learned model 212 and determines whether the learned model 212 is compatible with the vehicle, but the embodiment is not limited to this. The ECU 300 may store the learned model 212 and determine whether the learned model 212 is compatible with the vehicle.

[0162] [9. Addendum] [Note 1] A method for updating a trained model used for detecting fraudulent frames in an in-vehicle device, The in-vehicle device takes a first vehicle value transmitted over the in-vehicle network to which it is connected as input data, inputs the first vehicle value to a first trained model that outputs an estimated value correlated with the first vehicle value, and the in-vehicle device acquires the estimated value output from the first trained model. The in-vehicle device compares the acquired estimated value with a second vehicle value transmitted through the in-vehicle network to determine whether the first trained model is suitable for the vehicle. If it is determined that the first trained model is not suitable for the vehicle, the server selects a second trained model to update the first trained model. The server transmits the selected second trained model to the in-vehicle device. The in-vehicle device receives the second trained model transmitted from the server, The in-vehicle device updates the first learned model with the received second learned model, including, How to update.

[0163] [Note 2] A method for updating a trained model used for detecting fraudulent frames in an in-vehicle device connected to an in-vehicle network, the in-vehicle device updating the trained model, The steps include: inputting the first vehicle value, which is transmitted via the in-vehicle network, into a first trained model that outputs an estimated value correlated with the first vehicle value; and obtaining the estimated value output from the first trained model. The steps include comparing the estimated value output from the first trained model with the second vehicle value transmitted through the in-vehicle network to determine whether the first trained model is suitable for the vehicle, If it is determined that the first trained model is not suitable for the vehicle, the process includes receiving a second trained model from the server for updating the first trained model, The steps include updating the aforementioned first trained model with the received aforementioned second trained model, including, How to update.

[0164] [Note 3] An update program for updating a trained model used to detect fraudulent frames in an in-vehicle device connected to an in-vehicle network, On the computer, The steps include: inputting the first vehicle value, which is transmitted via the in-vehicle network, into a first trained model that outputs an estimated value correlated with the first vehicle value; and obtaining the estimated value output from the first trained model. The steps include comparing the estimated value output from the first trained model with the second vehicle value transmitted through the in-vehicle network to determine whether the first trained model is suitable for the vehicle, If it is determined that the first trained model is not suitable for the vehicle, the process includes receiving a second trained model from the server for updating the first trained model, The steps include updating the aforementioned first trained model with the received aforementioned second trained model, To execute Update.

[0165] [Note 4] A method for providing a trained model used for detecting fraudulent frames in an in-vehicle device connected to an in-vehicle network to the said in-vehicle device, The steps include: selecting a second trained model for updating the first trained model if it is determined that the first trained model is not suitable for the vehicle by comparing the estimated value output from a first trained model that takes a first vehicle value transmitted via the in-vehicle network as input data and outputs an estimated value correlated with the first vehicle value with a second vehicle value transmitted via the in-vehicle network; The steps include transmitting the selected second trained model to the in-vehicle device, including, How it is provided.

[0166] [Note 5] A program for providing a trained model used for detecting fraudulent frames in an in-vehicle device connected to an in-vehicle network to the said in-vehicle device, On the computer, The steps include: selecting a second trained model for updating the first trained model if it is determined that the first trained model is not suitable for the vehicle by comparing the estimated value output from a first trained model that takes a first vehicle value transmitted via the in-vehicle network as input data and outputs an estimated value correlated with the first vehicle value with a second vehicle value transmitted via the in-vehicle network; The steps include transmitting the selected second trained model to the in-vehicle device, To execute Programs offered.

[0167] [10. Supplementary Notes] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is indicated by the claims rather than by the embodiments described above, and includes all modifications within the meaning and scope of the equivalents of the claims. [Explanation of symbols]

[0168] 10 Update System 100 In-vehicle systems 200 Relay ECU (Relay device, In-vehicle device) 201 Processor 202 Non-volatile memory 203 Volatile memory 204A, 204B, 204C Communication Interface (Communication I / F) 210 Malicious Frame Detection Program Update 211 212 Pre-trained Models 213 Log Data 214 Vehicle Information 221 Mode setting section 231 Input section 232 Frame determination unit 233 Output section 241 Input section 242 1st Compatibility Judgment Department 243 Request part 244 Receiving Unit 245 Input section 246 Second Compatibility Determination Section 247 Update Department 248 Learning Department 249 Storage Control Unit 300,300A,300B,300C,300D,300E ECU (vehicle equipment) 310A, 310B, 310C, 310D sensors 350 External communication device 370 Diagnostic devices 400A, 400B, 400C communication bus 410 connector 500 servers 501 Processor 502 Non-volatile memory 503 Volatile memory 504 Communication Interface (Communication I / F) 510 Program Offerings 511 Pre-trained Model Databases 521 Receiving Unit 522 Selection Section 523 Transmitter

Claims

1. In-vehicle equipment and Server and Equipped with, The in-vehicle device is, A first trained model takes a first vehicle value transmitted over the in-vehicle network to which the in-vehicle device is connected as input data and outputs an estimated value correlated with the first vehicle value, A storage unit that stores the first vehicle value and the second vehicle value that have been transmitted via the in-vehicle network in the past, A first determination unit determines whether the first trained model is suitable for a vehicle by inputting the first vehicle value stored in the storage unit into the first trained model and comparing the estimated value output from the first trained model with the second vehicle value stored in the storage unit. Includes, The aforementioned server, If the first determination unit determines that the first learned model is not suitable for the vehicle, the selection unit selects a second learned model for updating the first learned model, A transmission unit that transmits the second learned model selected by the selection unit to the in-vehicle device, Includes, The in-vehicle device is A receiving unit that receives the second trained model transmitted from the server, An update unit updates the first trained model with the second trained model received by the receiving unit, including, Update system.

2. The first determination unit determines whether the first learned model is suitable for the vehicle when the vehicle is stopped. The update system according to claim 1.

3. The in-vehicle device is The system further includes a mode setting unit that sets the operating mode to either a normal mode in which the vehicle is driven or a maintenance mode for performing maintenance on the vehicle. The first determination unit determines whether the first learned model is suitable for the vehicle when the operating mode is set to the maintenance mode. The update system according to claim 1.

4. The in-vehicle device further includes a second determination unit that, when the operating mode is set to the normal mode, compares the estimated value output from the first trained model with a second vehicle value transmitted through the in-vehicle network to determine whether or not a frame containing the second vehicle value is an invalid frame. The update system according to claim 3.

5. The selection unit selects the second learned model based on the vehicle information relating to the vehicle. The update system according to claim 1.

6. The aforementioned vehicle information includes the vehicle type, The update system according to claim 5.

7. The aforementioned vehicle information includes the year of manufacture of the vehicle. The update system according to claim 5.

8. The vehicle information includes the total mileage of the vehicle. The update system according to claim 5.

9. The aforementioned vehicle information includes the vehicle type, year of manufacture, and total mileage. The selection unit selects the second learned model corresponding to the vehicle type and year included in the vehicle information. If there are multiple second learned models corresponding to the vehicle type and year included in the vehicle information, the selection unit selects one of the multiple second learned models based on the total mileage included in the vehicle information. The update system according to claim 5.

10. The selection unit selects the second trained model from the storage unit that stores multiple trained models. The update system according to claim 1.

11. The in-vehicle device is A third determination unit compares the estimated value output from the second trained model with the second vehicle value transmitted through the in-vehicle network to determine whether the second trained model is suitable for the vehicle. If the third determination unit determines that the second trained model is not suitable for the vehicle, the learning unit generates a third trained model by performing supervised learning using the first vehicle value and the second vehicle value transmitted via the in-vehicle network as training data. It further includes, The update unit updates the first trained model with the third trained model generated by the learning unit. The update system according to any one of claims 1 to 10.

12. The in-vehicle device further includes a storage control unit that stores the third trained model generated by the learning unit in a storage unit that stores a plurality of trained models usable in a plurality of vehicles. The update system according to claim 11.

13. The in-vehicle device is a relay device connected to multiple communication lines included in the in-vehicle network, which relays frames between multiple in-vehicle devices. The update system according to claim 1.

14. An in-vehicle device connected to an in-vehicle network, A first trained model takes a first vehicle value transmitted via the in-vehicle network as input data and outputs an estimated value correlated with the first vehicle value, A storage unit that stores the first vehicle value and the second vehicle value that have been transmitted via the in-vehicle network in the past, A first determination unit determines whether the first trained model is suitable for a vehicle by inputting the first vehicle value stored in the storage unit into the first trained model and comparing the estimated value output from the first trained model with the second vehicle value stored in the storage unit. If the first determination unit determines that the first trained model is not suitable for the vehicle, the receiving unit receives a second trained model for updating the first trained model from the server, An update unit updates the first trained model with the second trained model received by the receiving unit, Equipped with, In-vehicle device.

15. A server capable of communicating with in-vehicle devices, A selection unit selects a second trained model for updating the first trained model if it is determined that the first trained model is not suitable for the vehicle, by comparing the estimated value output from a first trained model that outputs an estimated value correlated with the first vehicle value, which is input data that has been transmitted in the past over the in-vehicle network to which the in-vehicle device is connected and stored in the storage unit of the in-vehicle device, with a second vehicle value that has been transmitted in the past over the in-vehicle network and stored in the storage unit of the in-vehicle device, and determining that the first trained model is not suitable for the vehicle. A transmission unit that transmits the second learned model selected by the selection unit to the in-vehicle device, Equipped with, server.

Images