JP5997740B2 - Online update method for in-vehicle devices - Google Patents

Description

  The present invention relates to an on-line device online update method.

  Conventional in-vehicle devices that do not have an on-line software update function are difficult to update software functions and correct defects once they are on the market. Specifically, the function update of the conventional in-vehicle device sells and distributes update CDs and SD memory cards, so it does not reach users who are not registered or who are using a used car There was a problem. Also, it took time to notify us of updates by mail and to deliver CDs and SD memory cards.

  As a method for solving these problems, there is a method called online update in which a program is downloaded via a network and the program is updated. For example, when an online update mechanism such as that disclosed in Japanese Patent Application Laid-Open No. 2003-122575 (Patent Document 1) is used, all on-vehicle devices connected to the network via the network are updated by the on-vehicle device having the online update function. Can be notified. Furthermore, if the user of the in-vehicle device that has received the notification requests an update, the update can be started immediately and the notification and delivery do not take time. Thus, in-vehicle devices having an online update function for downloading and updating programs and data can be easily updated without having to select the time and place for updating programs and data.

JP 2003-122575 A (paragraphs 0002 to 0011)

  Patent Document 1 describes a mechanism for downloading and updating a firmware application. If an on-vehicle device is equipped with an online update function such as that of Patent Document 1, the update is facilitated regardless of time and place. However, the period during which the in-vehicle device cannot perform its original function, such as restart of the in-vehicle device related to the update, increases, and the opportunity for waiting for the user increases.

  For example, if the checksum of the firmware to be activated is verified before activation, the program that provides the service to the user is not activated during the verification period, and the user is kept waiting. Furthermore, when updating is started after verification, the user must wait for the completion of the processing even during the updating period.

  Moreover, the electric power supplied to the vehicle-mounted device is unstable. If the supply of power is stopped during download or update, invalid data remains, so that a check and recovery process is required during the startup process, and the period of waiting for the user increases.

  A large-capacity storage device has a large writing unit, and if the writing fails, the penalty is large. For example, a hard disk handles data in units of 512 bytes to 4 Kbytes. In a non-volatile memory such as a flash memory, the unit tends to increase year by year. Especially in a flash memory that stores multiple values, memory cells that store multiple values are shared by multiple addresses, so a write failure to a write unit block at one address destroys data in another block. May end up. For this reason, a write failure results in a loss of a lot of data. For example, if writing of download data fails and data of a 128 Kbyte block is lost, a retransmission process of at least 16 seconds is required on a 64 Kbps line.

  In addition, when updating data used by an operating program or a program, the vehicle-mounted device may need to be restarted.

  This is because inconsistency occurs between the program being operated by the update and the program or data in the storage device to be updated. If this update process that needs to be restarted is executed immediately after the download or update pre-processing is completed, the vehicle-mounted device is temporarily stopped, and a period during which the service that the vehicle-mounted device cannot provide cannot be provided. There is also a method of executing an update process that needs to be restarted at startup. However, this method requires a long time until the program that provides the service of the in-vehicle device is activated, and makes the user wait.

  Therefore, the present specification discloses a mechanism in which the update proceeds steadily by selecting a period during which the power supply voltage is stable without waiting for the user.

  One example disclosed in this specification is control of suspension and resumption of download or update processing described below. That is, the arrival of an unstable period of the power supply is predicted, and the download and update processing is interrupted. Then, the download and update processing are performed during the period when the power source is stable by resuming the processing interrupted at the timing when the continuation of the stable period of the power source can be predicted.

  The state of the car's power supply is that the engine is not running, a security device that operates with a slight current, an in-vehicle device that requires learning, an ACC_OFF state that only energizes the ECU (Electronic Control Unit), audio that is not directly required for driving The ACC_ON state in which the accessory device is energized, the START state in which the auxiliary motor is energized to start the engine, and the ON state in which the engine is moved from the generator and charged with the battery are classified.

  In addition, ACC means the power supply by which ON / OFF is controlled by the state of an engine key or an engine start button. Note that there is a power source called + B as a power source for supplying power regardless of the state of the engine key or the engine start button.

  Among these four states, the period during which the power supply of the in-vehicle device is unstable is a period of the START state in which the power supply voltage decreases because the auxiliary motor that starts the engine rotates. This period is predicted by the voltage drop prediction means, and the timing for restarting the interruption is determined. Specifically, the ACC_ON and ACC_OFF periods after running and stopping are determined as periods when the power source is stable, detects that the vehicle speed is zero and the braking brake is operating, and enters the START state to start the engine. Predict the transition.

  Downloading is performed during driving and during ACC_ON and ACC_OFF periods after stopping, and if braking brake operation is detected when the vehicle is stopped, downloading is interrupted and writing during processing is completed before entering the START period during which the power supply voltage drops To do. When the download is complete, the update process starts.

  In the case of an update process that requires a restart, a restart for executing an update program that writes the downloaded program data to the nonvolatile storage device is performed during the ACC_OFF period after the vehicle is stopped, and the brake for braking is operated. If detected, the update is interrupted, and the write in process is completed before the START period in which the power supply voltage decreases. In the ON period after START, the normal program is executed, and when the ACC_OFF period after stopping again is entered, the update program is started and the update process is resumed.

  According to the present invention, it is possible to provide a mechanism in which the update proceeds steadily by selecting a period during which the power supply voltage is stable without waiting for the user.

  Problems, configurations, and effects other than those described above will become apparent from the following description of embodiments.

It is an example of the block diagram of the online update system of a vehicle equipment. It is an example of the power supply state transition diagram of a vehicle equipment. It is an example of the explanatory view of the power supply state of an in-vehicle machine, and supply voltage. It is an example of the flowchart explaining operation | movement of an update process part. It is an example of explanatory drawing of an update progress data structure. It is an example of the flowchart explaining operation | movement of the interruption resumption detection part. It is an example of the block diagram of the online update system of the vehicle equipment including a restart process. It is an example of the flowchart explaining operation | movement of the update process part containing a restart process. It is an example of an explanatory view of an update progress data configuration in consideration of an update process including a restart update. It is an example of the explanatory view of the power supply state of an in-vehicle device, a supply voltage situation, and load variation of an in-vehicle device. It is an example of the flowchart explaining operation | movement of the interruption resumption detection part in consideration of processor load.

  Hereinafter, examples will be described with reference to the drawings.

  In this embodiment, an example of a system that performs online update of an in-vehicle device will be described.

  FIG. 1 is an example of a configuration diagram of the online update system of the present embodiment.

  The online update system of the present embodiment includes an in-vehicle device 100, a car 101 in which the in-vehicle device 100 is mounted, a center terminal 102 that distributes an in-vehicle device update program, and a network 103 that connects the center terminal 102 and the in-vehicle device 100.

  The in-vehicle device 100 includes a processor 104, a memory 105, a non-volatile storage device 106, a communication interface 107 that transmits / receives data to / from other terminals through communication, and an input / output device 108 that controls input / output with a viewer, an operator, and the like. Speaker, touch panel, key, etc.), vehicle state acquisition interface 109, and power interface 110, which are connected by a communication line 111 such as a bus.

  The processor 104 performs various processes by reading the program 112 stored in the storage device 106 into the memory 105 and executing it. These programs and data may be stored in the storage device 106 in advance, may be input from a storage medium such as a CD-ROM, or may be downloaded from another device via a network. The functions realized by the program may be realized by dedicated hardware.

  The nonvolatile storage device 106 includes an activation flag 113, a service program A (hereinafter referred to as program A) storage area address 114, a service program B (hereinafter referred to as program B) storage area address 115, an update flag 116, an update progress 117, The interruption flag 118, program A119, program B120, and update program 121 are stored. The storage device 106 includes not only fixed ROM flash memory and storage flash memory, but also portable memory (SD memory / USB memory), portable HDD, CD, DVD, BD disk, etc. The machine 100 may select and refer to a single storage area or a plurality of storage areas from the storage area at the time of startup. That is, the storage area may be composed of a plurality of storage devices.

  The functions described below are realized by the processor 104 executing the above programs, but for convenience of description, each program will be described as an execution subject.

  The activation flag 113 indicates a program to be read by the processor 104 at startup and a program to be updated. Specifically, when used for startup, the processor 104 instructs whether to read and execute the program A119 or to read and execute the program B120. Also, the update method of this embodiment rewrites and renews the area where programs that are not used for activation are stored. That is, if the activation flag 113 indicates the program A119, the area where the program B120 is stored is rewritten and updated, and if the activation flag 113 indicates the program B120, the area where the program A119 is stored is updated and updated.

  The program A storage area address 114 indicates an address where the program A 119 is stored. When the in-vehicle device 100 is activated, if the activation flag 113 indicates the program A 119, the processor 104 reads the program A 119 from the address indicated by the program A storage area address 114, stores it in the memory 105, and executes it. To do. When the in-vehicle device 100 is updated, if the activation flag 113 indicates the program B120, the update program 121 executed by the processor 104 is the program at the address indicated by the program A storage area address 114, and Rewrite and update data.

  The program B storage area address 115 indicates an address for storing the program B120. When the in-vehicle device 100 is activated, if the activation flag 113 indicates the program B120, the processor 104 reads the program B120 from the address indicated by the program B storage area address 115, stores it in the memory 105, and executes it. To do. Further, when the in-vehicle device 100 is updated, if the activation flag 113 indicates the program A 119, the update program 121 executed by the processor 104 is the program at the address indicated by the program B storage area address 115, and Rewrite and update data.

  The update flag 116 indicates an update state during update or update completion. When the update flag 116 is turned on, it indicates that the vehicle-mounted device 100 is being updated, and when it is turned off, it indicates that the update has been completed. The vehicle-mounted device 100 confirms this flag when activated. If the update flag 116 is turned on, it can be seen that when the vehicle-mounted device 100 was stopped last time, the update process is interrupted and there remains an update process to be processed. That is, by checking the update flag 116, it is possible to determine whether or not there is an interrupted update.

The update progress 117 is a record of the progress of the update process of the online update system.
The update program 121 proceeds with the update progress 117 while recording the progress of the process. For this reason, even if the update process is interrupted, the update process can be resumed by referring to the update progress 117. The processing of the update processing unit 122 of the update program 121 of the present embodiment is roughly divided into two processes: download processing and program update processing. Accordingly, as shown in the example of the update progress data configuration in FIG. 5, the update progress 117 is information on the in-execution update process 117-10, the download process progress 117-20, and the program update process progress 117-30. Record.

  The in-execution update process 117-10 indicates whether the update process being executed is a download process or a program update process.

  The download process progress 117-20 includes information of a download server 117-21, a download file 117-22, and a download file write completion byte count 117-23. The download server 117-21 records the address of the center terminal 102 that is a server that distributes the update file. The download file 117-22 is distributed from the center terminal 102 and records download file information downloaded by the in-vehicle device 100. The download file write completion byte number 117-23 records the number of bytes that the in-vehicle device 100 has downloaded the file indicated by the download file 117-22 and written to the storage device 106.

  The program update process progress 117-30 includes a program update file 117-31 and a program update file write completion byte count 117-32. The program update file 117-31 records a processing target file to be written in the storage device 106 as an executable program. As the program update file write completion byte number 117-32, update data is extracted from the download file, and the number of bytes written to the storage device 106 as an executable program is recorded.

  The interruption flag 118 records an interruption / resumption instruction from the interruption / resumption detection unit 123 of the update program 121 to the update processing unit. When the interruption flag 118 is on, it indicates that an interruption instruction has been issued from the interruption / resumption detection unit 123 to the update processing unit 122. When the interruption flag 118 is turned off, it indicates that a resumption instruction is issued from the interruption resumption detection unit 123 to the update processing unit 122.

  The program A119 is a program that realizes the functions of the in-vehicle device 100 such as firmware, OS, driver, and application program of the in-vehicle device 100. When the in-vehicle device 100 is activated, if the activation flag 113 indicates the program A, the program A119 is executed. Further, when the in-vehicle device 100 is updated, when the activation flag 113 indicates the program B, the update program 121 updates the program A119.

  The program B120 is a program that realizes functions of the in-vehicle device 100 such as firmware, OS, driver, and application program of the in-vehicle device 100. When the in-vehicle device 100 is activated, if the activation flag 113 indicates the program B, the program B120 is executed. When updating the vehicle-mounted device 100, if the activation flag 113 indicates the program A, the update program 121 updates the program B120.

  The update program 121 is a program for updating the in-vehicle device 100 and includes an update processing unit 122 and an interruption / resumption detection unit 123.

  According to the operation of the update processing unit 122, the update file is downloaded from the center terminal 102 via the communication interface 107 and the network 103 according to the flowchart of FIG. Further, the update processing unit 122 updates the program A 119 or the program B 120 while referring to information recorded in the storage device 106. The update processing unit 122 proceeds with processing while confirming the interruption flag 118 that is updated by the interruption / resumption detecting unit 123. When the interruption flag 118 is turned on, writing of data being processed and update progress 117 are performed. After completing the update, the process is interrupted. As a result, it is possible to perform control without performing update processing during a period when the power supply voltage is unstable or during a period where the user waits. Next, when the interruption flag 118 is turned off during the operation of the vehicle-mounted device 100, the continuation of the process recorded in the update progress 117 is resumed. Even when the in-vehicle device 100 is restarted, the update progress 117 is similarly referred to and the continuation of the interrupted process is resumed. As described above, the online update system according to the present embodiment proceeds with the update process while repeating the interruption and the restart so that the data being written is not lost due to the interruption.

  The suspension / resumption detecting unit 123 acquires a braking brake state and a vehicle speed and / or a parking (parking) brake state from the vehicle state acquisition interface 109 according to the flowchart of FIG. get. From the acquisition result, the interruption flag 118 is turned on when a state where the supply power is likely to become unstable is detected, and the interruption is detected when a state where the supply power is likely to be stable and the possibility of waiting the user is low is detected. The flag 118 is turned off.

  The communication interface 107 is an interface for communicating with a server outside the in-vehicle device and other terminals. The communication interface 107 may be a wireless communication interface or a wired communication interface. You may use both depending on the situation. For example, a wired communication interface is used while the vehicle is stopped, and a wireless communication interface is used while traveling. In general, a wired communication interface is faster than a wireless communication interface. For this reason, the download time can be shortened by using the wired communication interface.

  The input / output device 108 is a pointing device such as a key, a touch panel, or a trackball that receives input from the user, viewer, or operator of the in-vehicle device, and a display that outputs to the user, viewer, operator, speaker, LED, etc. Including lights. With the input / output device 108, the user of the in-vehicle device 100 can give an instruction to operate the update program 121 and the like, and can confirm the progress of the update process of the update program 121.

  The vehicle state acquisition interface 109 is an interface that receives a braking brake state, a vehicle speed, and a parking brake state from the vehicle 101.

The power interface 110 receives two types of power signals ACC and + B from the car 101 and supplies power to the in-vehicle device 100.
The power supply takes four states shown in FIG. 2, and the power supply interface 110 detects the ACC_OFF state among the four states.

  A car 101 is a car on which the in-vehicle device 100 is mounted. For example, there are gasoline cars, electric cars, diesel cars, fuel cell cars, motorcycles, tricycles, powered bicycles, and the like. The vehicle 101 includes a power source that supplies power to the in-vehicle device 100, and includes a device that acquires the state of the vehicle 101 such as a brake state, a vehicle speed, and a parking brake state and notifies the in-vehicle device 100.

  The center terminal 102 is a server that distributes an update program to the in-vehicle device 100. The update file is transmitted to the in-vehicle device 100 according to the notification of the updatable program and the download request from the in-vehicle device 100.

  The network 103 is a network that connects the in-vehicle device 100 and the center terminal 102. Whether it is a mobile phone network, wireless communication using IEEE 802.11 series / wireless communication using IEEE 802.16 series / wireless communication using IEEE 802.15 series / wireless communication network such as UWB, wired communication network It may be a network that combines.

  FIG. 2 is an example of a power state transition diagram of the in-vehicle device of the present embodiment. The state of the power supplied from the car 101 to the in-vehicle device 100 takes four states: ACC_OFF200, ACC_ON201, START202, and ON203. The transition of the power state includes ACC_OFF 200 to ACC_ON 201, ACC_ON 201 to START 202, ACC_OFF 200, START 202 to ON 203, and ON 203 to ACC_ON 201.

  ACC_OFF 200 is a state in which the engine of the car 101 is stopped and power is not supplied to the in-vehicle device 100. In the state of ACC_OFF200, the in-vehicle device 100 does not provide services such as route guidance to the destination to the user. In the state of ACC_OFF200, since the engine of the vehicle 100 is stopped, power is not generated and about 12V that is the battery voltage is supplied to + B.

  ACC_ON 201 is a state in which the engine of the car 101 is stopped and electric power is supplied to the in-vehicle device 100. In the state of ACC_ON 201, the in-vehicle device 100 provides a service to the user. In the state of ACC_ON201, since the engine of the vehicle 100 is stopped, power is not generated, and about 12V as the battery voltage is supplied to + B and ACC.

  Since the starter that starts the engine of the car 101 moves in the START 202, the power supplied to the in-vehicle device 100 is unstable. Depending on the situation, the power supply voltage supplied to ACC, + B drops from about 6V to about 5V.

  ON 203 is a state in which the engine of the car 101 moves and power is supplied to the in-vehicle device 100. In the state of ON 203, the in-vehicle device 100 provides a service to the user. In the state of ON 203, since the engine of the car 100 is operating, approximately 13V that is a charging voltage from the generator to the battery is supplied to ACC and + B.

  When the user gets into the car 101 and activates the vehicle-mounted device 100, there are many cases in which the user transitions to ACC_OFF200, ACC_ON201, START202, and ON203. In this case, the period for taking the state of ACC_ON 201 and the state of START 202 is often short. For this reason, the in-vehicle device 100 starts to be activated in the ACC_ON201 state, and in the middle of the activation, the power state becomes unstable at the START 202 and may stop, and may be activated again at the ON203.

  Further, when the user stops the vehicle 101 and is away from the vehicle 101, the vehicle often transitions to ON 203, ACC_ON 201, and ACC_OFF 200 when the vehicle-mounted device 100 is stopped. In this case, the period for taking ACC_ON 201 is often short. However, the transition that can be taken from ACC_ON 201 is not only ACC_OFF 200 but also START 202. In order to start the engine once stopped by the user, a transition is made from ACC_ON 201 to START 202 in a short time, so the power supplied to the in-vehicle device 100 becomes unstable.

  Since the in-vehicle device 100 does not provide a predetermined service during the period of the ACC_OFF 200 state, it does not cause the user to wait even if processing such as update is performed, but is supplied when a transition to the START 202 occurs during the update processing. Therefore, there is a problem that a situation occurs in which the power to be unstable becomes unstable and writing to the storage device 106 cannot be performed normally. Similarly, updating in parallel with service provision to the user in the state of ACC_ON 201 can be considered, but there is a problem that writing to the storage device 106 cannot be performed normally and the update does not proceed at the transition to START 202. .

  FIG. 3 is an example of an explanatory diagram of the power supply state and the supplied voltage of the vehicle-mounted device of the present embodiment. This shows a change in the power supply voltage when the user gets into the stopped vehicle 101, starts the engine, moves, stops, then stops the engine and gets off the vehicle 101. The power supply state transitions in the order of ACC_OFF200, ACC_ON201, START202, ON203, ACC_ON201, and ACC_OFF200. In this case, the period between ACC_ON 301 and ACC_ON 304 is often short.

  The period of ACC_OFF300 and ACC_OFF305 is in the state of ACC_OFF200, and about 12V is supplied to + B and not supplied to ACC. The period of ACC_ON301 and ACC_ON304 is the state of ACC_ON201, and about 12V is supplied to both + B and ACC. The period of START 302 is the state of START 202, and the supplied power is unstable, and + B and ACC are supplied from about 6V to 5V.

  FIG. 4 is an example of a flowchart for explaining the operation of the update processing unit 122. The update processing unit 122 and the interruption / resumption detection unit 123 of the update program 121 are executed in parallel with the program A 119 or the program B 120 that provides the service of the in-vehicle device 100 after the in-vehicle device 100 is activated. The update program 121 is connected to the center terminal 102 via the communication interface 107 and the network 103 and confirms the presence or absence of the update program. If there is an update program, the initial values of the update process 117-10, download process progress 117-20, and program update process progress 117-30 are set, the update flag 116 is set (turned on), and the update program is updated. In a state indicating “inside”, the processing of the update processing unit 122 is started.

  First, in step 401, the update flag 116 is confirmed. If the update flag 116 is on and indicates an update, the process proceeds to step 402. If the update flag is off and there is no new update, the process ends.

  In step 402, update processing 117-10 during execution of update progress 117 is confirmed. If download processing is in progress, the process proceeds to step 403. If program update processing is in progress, the process proceeds to step 408.

  In step 403, the interruption flag 118 is checked. If the interruption flag 118 is on and an interruption is instructed, the interruption flag 118 is continuously checked in step 403 until the interruption is released. If the interruption flag 118 is off and the interruption is released, the process proceeds to step 404.

  In Step 404, one block of the file indicated by the download file 117-22 is requested and received from the server indicated by the download server 117-21 of the download progress 117-20 of the update progress 117. When reception of one block is completed, the process proceeds to step 405.

  In step 405, the data of one block received in step 404 is written in the write location of the storage device 106 indicated by the download progress write 117-17 of the update progress 117 and the download file write completion byte number 117-23. This location is a location advanced by the number of bytes indicated by the download file writing completion byte number 117-23 in the area where the program B 120 is stored when the activation flag 113 indicates the program A. When the writing is completed, the process proceeds to step 406.

  In step 406, the download file write completion byte number 117-23 of the download processing progress 117-20 is updated, and the download file of the file indicated by the download file 117-22 is also downloaded from the server indicated by the download server 117-21 even when interrupted. It is possible to request data at a position advanced by the write completion byte number 117-23.

  In step 407, the size of the file indicated by the download file 117-21 is compared with the download file write byte count 117-23 to confirm the completion of the download. If not completed, the process returns to step 403 to continue the download process. If completed, the running update process 117-10 is changed to the program update process, and the process proceeds to step 408 to start the program update process.

  In step 408, the interruption flag 118 is confirmed. If the interruption flag 118 is turned on and an interruption is instructed, the confirmation of the interruption flag 118 is continued in step 408 until the interruption is released. If the interruption flag 118 is off and the interruption is released, the process proceeds to step 409.

  In step 409, an executable program is constructed from one block of the file indicated by the program update file 117-31 of the program update process progress 117-30 of the update progress 117. When the construction of one block is completed, the process proceeds to step 410.

  In step 410, the data of one block of the program constructed in step 409 is written in the write location of the storage device 106 indicated by the program update file write completion byte number 117-32 of the program update process progress 117-30 of the update progress 117. . When the activation flag 113 indicates the program A, this location is a location advanced by the number of bytes indicated by the program update file write completion byte count 117-32 in the area where the program B120 is stored. When the writing is completed, the process proceeds to step 411.

  In step 411, the program update file write completion byte number 117-32 of the program update process progress 117-30 is updated, and the program update file write completion byte number of the file indicated by the program update file 117-31 is interrupted. It is possible to resume from the construction of data at a position advanced by 117 to 32 minutes.

  In step 412, the program update file 117-31 and the program update file write completion byte count 117-32 are compared to confirm the completion of the program update process. If not completed, the process returns to step 408 to continue the program update process, and if completed, the process ends.

  FIG. 6 is an example of a flowchart for explaining the operation of the interruption / resumption detecting unit 123. This flowchart starts at the start of the program update process and ends with the completion of the program update process as a condition.

In step 501, the power state is acquired from the power interface 110. Next, in step 502, the braking state, vehicle speed, and parking brake state are acquired from the vehicle state acquisition interface 109. In step 503, it is determined whether or not the next interruption condition 1 is satisfied from the power supply state and the vehicle state acquired in step 501 and step 502. Interruption condition 1: The vehicle speed is zero and the braking brake is operating.
If the interruption condition is satisfied, the interruption flag 118 is set in step 504. If not, the interruption flag is cleared in step 505, and the process proceeds to step 506. In step 506, the update flag 116 is checked. If the update process is completed, the process is terminated.

  When the user changes the power supply state of the vehicle-mounted device 100 to START 202, in normal operation, the car 101 is stopped and the user operates the brake after operating the brake for braking. For this reason, if the update process is interrupted under the interrupt condition 1, the update process can be interrupted by completing the writing in the storage device 106 before the transition to the START 202. Further, when the state becomes ON 203, the user removes his / her foot from the brake for braking. That is, since the interruption condition 1 does not hold after exiting the state of the START 202, the update process is steadily advanced using the periods of the ACC_OFF 300, ACC_ON 301, ON 303, ACC_ON 304, and ACC_OFF 305, which are periods in which the power supply is stable. In addition, the reprocessing due to a failure in writing to the recording device 106 increases the update time and makes the user not wait. Since this interruption condition 1 works in the same way when stopping by a signal and stopping idling, it is also effective for idling stopping.

Even if the interruption condition 1 is changed to the following determination condition, the same effect can be obtained.
Interruption condition 2: The parking brake is applied and the braking brake is operating.
Interruption condition 3: The power supply state is either the ACC_OFF200 state or the ACC_ON201 state, and the brake for braking is operating.

  Further, the condition that any one of the interruption condition 1, the interruption condition 2, and the interruption condition 3 is satisfied may be set as the interruption condition.

  During the period of ACC_ON301, the period of ON303, and the period of ACC_ON304, updating is performed in parallel with the service provided by the in-vehicle device 100, and therefore the execution speed of the program A119 or program B120 that provides the service may decrease.

In such a case, if the next interruption condition 4 is switched, the update process is executed in the periods of ACC_OFF 305 and ACC_OFF 300 except for the above period, so that the performance of the service provided by the in-vehicle device 100 is not affected. Disappear.
Interruption condition 4: The power supply is not in the ACC_OFF200 state In this embodiment, the update data is acquired from the communication interface 107 and the center terminal 102 and the program in the storage device 106 is updated. The same applies when update data is acquired from a portable memory (SD memory / USB memory), a portable HDD, CD, DVD, BD disk, or the like.

  Further, the activation flag 113 may be selected from an arbitrary number of activation programs instead of the two programs A119 and B120. In this way, multiple versions of the program can be saved. It is also possible to select a plurality of programs having different uses.

  Furthermore, the update program 121 may be included in the contents of the programs A119 and B120. In this way, the update program 121 can be updated.

  In the present embodiment, an example of a system that performs online update including restart processing will be described.

  FIG. 7 is an example of a configuration diagram of an on-line machine online update system including a restart process according to the second embodiment. In the on-line update system for the in-vehicle device in FIG. 1, the description of the components having the same functions as those already described with reference to FIG. 1 is omitted.

  The activation flag 113 can select the update program 121 in addition to the program A 119 and the program B 120. The update program storage area address 601 indicates the address where the update program 121 is stored. In this way, when the activation flag 113 points to the update program 121 at the time of restart, the update program 121 can be executed with reference to the update program storage area address 601.

  In order to record the progress of the restart update process in the update progress 117, the in-execution update process 117-10 is shown in the example of the explanatory diagram of the update progress data configuration in consideration of the update process including the restart update in FIG. Similarly, in addition to download processing and program update processing, restart update processing is also shown. In addition, the restart update process progress 117-40 is added to the update progress 117. The information on the restart update process progress 117-40 includes a restart update file 117-41 and a restart update file write completion byte count 117-42.

  FIG. 8 is an example of a flowchart for explaining the operation of the update processing unit including the restart process according to the second embodiment. In the flowchart for explaining the operation of the update processing unit in FIG. 4, the description of the steps having the same functions as the steps denoted by the same reference numerals shown in FIG.

  In step 402, the executing update process 117-10 is confirmed. If the ongoing update process 117-10 is a restart update process, step 701 is executed. If the completion of the program update process is confirmed in step 412, step 701 is executed with the executing update process 117-10 as the restart update process.

  In step 701, the interruption flag 118 is confirmed. If the interruption flag 118 is on and an interruption is instructed, the interruption flag 118 is continuously checked in step 701 until the interruption is released. If the interruption flag 118 is off and the interruption is released, the process proceeds to step 702.

  In step 702, data of a program that cannot be updated without restarting is constructed from the file indicated by the restart update file 117-41 of the restart update process progress 117-40 of the update progress 117. When one block of data is constructed, the process proceeds to step 703.

  In step 703, the data of one block constructed in step 702 is written in the write location of the storage device 106 indicated by the restart update file write completion byte number 117-42 of the restart update process progress 117-40 of the update progress 117. . This location is a location advanced by the number of bytes indicated by the download file writing completion byte number 117-23 in the area where the program B 120 is stored when the activation flag 113 indicates the program A. When the writing is completed, the process proceeds to step 704.

  In step 704, the restart update file write completion byte count 117-42 of the restart update process progress 117-40 is updated so that the update process that needs to be restarted can be resumed even when interrupted.

  In step 705, the file size indicated by the restart update file 117-41 is compared with the restart update file write completion byte count 117-42 to confirm the completion of the restart update process. If not completed, the process returns to step 701 to continue the restart update process, and if completed, the update process is terminated.

  This makes it possible to perform update processing that cannot be executed in parallel with the execution of other programs.

  If the download process and the program update process use the interruption condition 1, and the restart update process uses the interruption condition 4, the download process and the program update process are performed with ON303, ACC_ON304, ACC_OFF305, ACC_OFF300, and ACC_ON301. The update is advanced using the period, and the restart update process is executed using the period of ACC_OFF 305 and ACC_OFF 300. Rebooting during the period of ACC_ON301, ON303, and ACC_ON304, during the rebooting, the service that the vehicle-mounted device 100 should provide cannot be provided, causing the user to wait. However, by using the interruption condition 4 as the interruption condition for the restart update process, the update process can be performed without generating such a period of waiting for the user.

  In this embodiment, an example of an online update system capable of interrupting update processing not only during an unstable power supply period but also during a period when the processing load on the processor 104 is high will be described.

  FIG. 10 is an example of a diagram that is explained by adding the load fluctuation of the in-vehicle device to FIG. The description of the parts denoted by the same reference numerals shown in FIG. 3 already described is omitted.

  Since the service of the in-vehicle device 100 is provided from the period of ACC_ON301, the service is started at a timing when the ACC_OFF300 is changed to ACC_ON301. For this reason, a load becomes high during the period of ACC_ON301. Since the power supply state is unstable during the START 302 period, the vehicle-mounted device 100 may stop when the START 302 period is entered during the startup process.

  FIG. 10 shows an example in which the in-vehicle device 100 is stopped during the period of START302. When the period of START 302 ends and the process moves to ON 303 where the power supply is stable, when the vehicle-mounted device 100 stops during the period of START 302, the period 801 where the load is high and the load is high starts. When the startup is completed, a period 802 in which the load is stable is entered. The period of ACC_ON 304 is a low processing load unless otherwise instructed by the user. If it changes from ACC_ON304 to ACC_OFF305, the onboard equipment 100 will stop, if an update process does not remain.

  The start-up time in the in-vehicle device 100 is a main time that makes the user wait. If the update process is executed in parallel during this period, the user may be kept waiting. In many cases, a user is kept waiting during a period when processing of a service provided by the vehicle-mounted device 100 is being executed and the processing load is high.

  FIG. 11 is an example of a flowchart for explaining the operation of the interruption / resumption detecting unit in consideration of the processor load according to the third embodiment. In the flowchart for explaining the operation of the interruption / resumption detecting unit in FIG. 6, the description of the steps having the same functions as those in FIG.

Step 901 is a step of acquiring the processing load of the processor 104 of the in-vehicle device 100. In step 503, it is determined whether the next interruption condition 5 is satisfied based on the power supply state and vehicle state acquired in steps 501 and 502 and the load of the processor 104 acquired in step 901.
Interruption condition 5: Processor load is 60% or more, or interruption condition 1
If the interruption condition 5 is satisfied, the interruption flag 118 is turned on in step 504. If not, the interruption flag is turned off in step 505, and the process proceeds to step 506. In step 506, the update flag 116 is checked. If the update process is completed, the process is terminated.

Even if the interruption condition 5 is changed to the following determination condition, the same effect can be obtained.
Interruption condition 6: Processor load is 60% or more, or interruption condition 2
Interruption condition 7: Processor load is 60% or more, or interruption condition 3
Further, the interruption condition 5, the interruption condition 6, and the interruption condition 7 may be determined in combination.

  The value of the processor load for interrupting the update is 60% in this example, but may be a value appropriate for the target in-vehicle device 100. This value may be set by the user using the input / output device 108. This value may be sent from the center terminal 102 to the in-vehicle device 100.

  If the interruption / resumption process of the present embodiment is used in the update process of the first embodiment, a period 802 in which the processing load of the processor 104 is stable, ACC_ON304, ACC_OFF305, ACC_OFF300, in which the power supply is stable and the processing load on the processor 104 is low. Download processing and program update processing can be executed using the period of ACC_ON301.

  If the interruption / resumption process of the present embodiment is used in the update process of the second embodiment, a period 802 in which the processing load of the processor 104 is stable, an ACC_ON304, an ACC_OFF305, an ACC_OFF300 in which the power supply is stable and the processing load on the processor 104 is low. Download processing and program update processing can be executed using the period of ACC_ON301. The restart update process can be executed during a period in which ACC_OFF 305 and ACC_OFF 300 do not cause the user to wait due to restart under the interruption condition 4.

  This mechanism can reduce the influence of the processing time, which increases due to the introduction of online update, on the startup time. As a result, it is possible to reduce the time required for the user to wait and the time required for the program update processing, which are major problems of the in-vehicle device.

DESCRIPTION OF SYMBOLS 100 Vehicle equipment 101 Car 102 Center terminal 103 Network 104 Processor 105 Memory 106 Nonvolatile memory | storage device 107 Communication interface 108 Input / output device 109 Car status acquisition interface 110 Power supply interface 111 Communication line

Claims (8)

In an in-vehicle device that is mounted on a vehicle and includes a processor and a storage device, and the processor executes a program stored in the storage device,
Vehicle state acquisition means for acquiring a vehicle state including a braking brake state and a vehicle speed as the vehicle state;
Update processing means for performing update processing of the program;
Interruption restart detection for detecting whether or not the vehicle state acquired by the vehicle state acquisition unit satisfies a predetermined update processing interruption condition indicating that power supply from the vehicle may become unstable. And
Update data acquisition means for performing an update data acquisition process of the program according to an update data acquisition interruption condition predetermined according to the vehicle state ,
The update processing means includes
When the suspension / resumption detecting unit detects that the vehicle state satisfies the update process interruption condition, the update process of the program is interrupted,
When the update process of the program is interrupted, if the interruption / resumption detecting unit detects that the vehicle state does not satisfy the update process interruption condition, the update process of the program is resumed ,
The update data acquisition means includes
When the vehicle state acquired by the vehicle state acquisition means does not satisfy the update data acquisition interruption condition, an update data acquisition process of the program is performed,
If the vehicle state satisfies the update data acquisition suspension condition, the update data acquisition process of the program is interrupted . In an in-vehicle device that is mounted on a vehicle and includes a processor and a storage device, and the processor executes a program stored in the storage device,
Vehicle state acquisition means for acquiring a vehicle state indicating the state of the vehicle, update processing means for performing update processing of the program, and the vehicle state acquired by the vehicle state acquisition means are predetermined update processing interruption conditions An interruption / resumption detection unit that detects whether or not
The update processing means includes
When the suspension / resumption detecting unit detects that the vehicle state satisfies the update process interruption condition, the update process of the program is interrupted,
When the interruption restart detection unit detects that the vehicle state does not satisfy the update process interruption condition when the program update process is interrupted, the program update process is resumed,
The vehicle state includes a state of a brake for braking,
(1) The vehicle state acquired by the vehicle state acquisition means further includes a vehicle speed, and the update process interruption condition is that the vehicle speed is zero and the brake for braking is operating, or
(2) The state of the vehicle acquired by the vehicle state acquisition means further includes the state of the parking brake, and the update processing interruption condition is that the parking brake is activated and the braking brake is Working or
(3) The vehicle state acquired by the vehicle state acquisition unit further includes a power state of the vehicle, and the update process interruption condition is either the ACC_OFF state or the ACC_ON state, And the braking brake is operating,
In-vehicle device characterized by this. The in-vehicle device according to claim 2 ,
The in-vehicle device further includes update data acquisition means for acquiring update data of the program,
The update data acquisition means includes
When the vehicle state acquired by the vehicle state acquisition means does not satisfy the update data acquisition interruption condition for interrupting the acquisition of the predetermined update data, the update data acquisition process of the program is performed,
When the update data acquisition interruption condition is satisfied, the update data acquisition process of the program is interrupted. A vehicle apparatus according to claim 1 or 3,
Before SL The update data acquisition interruption condition, in the vehicle state in which the vehicle condition acquisition unit has acquired, the vehicle-mounted device that the vehicle speed is zero, and the braking brake is characterized in that it is operating. The in-vehicle device according to any one of claims 1 to 4,
The in-vehicle device further includes restart update processing means for performing restart update processing of the program,
The restart update processing means includes:
If the vehicle state acquired by the vehicle state acquisition means does not satisfy a predetermined restart update process interruption condition, perform a restart update process of the program,
When the restart update process interruption condition is satisfied, the restart update process of the program is interrupted. The in-vehicle device according to claim 5,
The vehicle state acquired by the vehicle state acquisition means further includes a power supply state of the vehicle, and the restart update process interruption condition is that the power supply state is not an ACC_OFF state. The in-vehicle device according to any one of claims 1 to 6,
The in-vehicle device further includes a load acquisition unit of the processor,
The update processing unit performs update processing of the program when the acquired load of the processor is less than a specified value and the vehicle state acquired by the vehicle state acquisition unit does not satisfy the update process interruption condition. Done
The in-vehicle device, wherein the update process of the program is interrupted when the acquired load of the processor is equal to or greater than a predetermined value or satisfies the update process interruption condition. The in-vehicle device according to claim 1 or 3 ,
An in-vehicle device comprising a wireless / wired communication interface or an interface to which a portable memory is connected as the update data acquisition means.

Images