JP2006323776A - Information processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To secure safe and accurate program update even when any error is generated during program update in a device where a program for shifting to a rewrite mode is recorded so as to be rewritable. <P>SOLUTION: This information processor is configured to judge whether or not rewrite conditions are satisfied from an application (rewrite condition decision) program stored in a flash ROM so as to be rewritable, and to judge that rewrite conditions are satisfied when a vehicle status or peripheral environment is put in a predetermined status, and to perform a rewrite program, and to update an application program in an ROM. Also, the sum value of a rewrite condition decision program is calculated (S130), and compared with a specific value, and whether or not the write condition decision program is correct is judged before the performation of the rewrite condition decision program (S140), and when it is judged that the rewrite condition decision program is not correct, a warning light 3 is turned on (S150) under the control of a boot program. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information processing apparatus that stores a program in a rewritable nonvolatile memory.

  2. Description of the Related Art Conventionally, an information processing apparatus that records a program in a rewritable nonvolatile memory such as a flash ROM in order to easily update the program is known. This type of technology is also applied to an electronic control device for a vehicle. As a conventional technology, for example, as an engine control device for controlling an engine of an automobile, a nonvolatile memory capable of erasing and writing data is used. A recording engine control program is known (see Patent Document 1).

  Also, in an information processing apparatus that records a program in a nonvolatile memory and updates it as necessary, an error may occur when the program is updated (rewritten), so that the program is updated normally. Judgment is made whether or not.

For example, in the above-described engine control device, when the program update is completed, the end data is written at the end of the program, thereby recording in the nonvolatile memory that the program has been updated to the end. Then, it is determined whether or not the end data has been written in the nonvolatile memory before the execution of the control program. If the end data has not been written, it is determined that the control program is not normal and the control program Do not execute.
JP-A-9-128229

  By the way, in an electronic control device for a vehicle, for the purpose of preventing an error when updating a program, or for the purpose of ensuring vehicle safety, the vehicle is stopped, the inside of the vehicle is at an appropriate temperature, etc. After confirming the predetermined condition, a transition to the rewrite mode is performed. In addition, a program for determining a condition for shifting to the rewrite mode is recorded in a non-volatile memory together with a control program so as to be rewritable.

  However, with the method of writing the end data to the nonvolatile memory at the end of the program update described above, even if a part of the application program including the migration condition is erroneously described due to an error, the user must discover this. There was a problem that could not.

  In a device that records a program for switching to the rewrite mode in a rewritable manner in a non-volatile memory, if an error occurs when the program is updated in the past and the conditions for shifting to the rewrite mode are described incorrectly, the environment is not appropriate. Thus, the device shifts to the rewrite mode. Therefore, if the user does not recognize such an error, a problem arises in the safety of the vehicle at the time of program update and the normal update of the program.

  Of course, such a problem can be solved by recording the program for shifting to the rewrite mode in a non-rewritable memory. However, if the program for shifting to the rewrite mode is recorded so as not to be rewritable, it will not be possible to perform a significant program update that requires changing the transition conditions in accordance with the change of the control program, which is inconvenient. is there.

  The present invention has been made in view of these problems, and in an information processing apparatus that records a program for shifting to a rewrite mode in a rewritable nonvolatile memory, even if an error occurs when the program is updated, the present invention is safe. The primary purpose is to ensure that

  Further, in the above apparatus, when the transition condition becomes an unrealizable condition due to an error, there arises a problem that the program cannot be rewritten again, and the present invention makes it possible to realize the program update again. Second purpose.

  The information processing apparatus according to claim 1, which is made to achieve the above object, stores an application program in a rewritable manner in a nonvolatile memory, and reads and executes the application program from the nonvolatile memory by a computer. In addition, based on input data from the external device, the application program stored in the nonvolatile memory so as to be rewritable is updated by the updating means.

  Further, the nonvolatile memory determines whether or not a predetermined update condition is satisfied, and when the update condition is satisfied, an update determination program for causing the computer to execute a procedure for starting the update means , And the information processing apparatus executes whether the update determination program stored in the nonvolatile memory is rewritable or not by executing a computer-based update determination program. Prior to the determination by the diagnosis means, if the update determination program is not correct, the output means outputs error information.

  According to the information processing apparatus of the present invention configured as described above, when an error occurs when updating a program and the update determination program does not operate normally, the user is notified that the update determination program is in an abnormal state. Since the notification can be made, it is possible to prevent a safety problem from occurring when the user does not understand this phenomenon. For example, when the information processing device is an information processing device for vehicle control, the vehicle safety problem due to activation of the update means when the update condition is satisfied even though the vehicle speed is not zero. Can be resolved.

Note that the functions as the above-described diagnosis means, output means, and update means can be realized by a computer by a program.
According to a second aspect of the present invention, there is provided an information processing apparatus in which a program for causing a computer to function as a diagnosis unit and an output unit is incorporated in a boot program executed by the computer to read out an application program. The computer in this information processing apparatus executes a program for functioning as diagnostic means prior to execution of the application program by executing a boot program, and the update determination program is not correct according to the execution result of the program. If not, a program for functioning as output means is executed instead of the application program.

  In this way, if the program for realizing the functions of the diagnosis unit and the output unit in the computer is incorporated in the boot program, the update determination program is correct with a simple structure and before the update determination program is executed. It can be determined whether or not there is. Further, since it is not updated, it is not necessary to determine whether or not the diagnostic means and the output means are correct.

  Further, the present invention is preferably applied to an information processing apparatus for vehicle control. An information processing device according to claim 3 is an application program in which an update determination program and a vehicle control program for controlling a predetermined control target device mounted on a vehicle are stored in a nonvolatile memory, and the computer Has an input port for receiving input signals from various sensors mounted on the vehicle and an output port for outputting control signals to the control target device, and by executing a vehicle control program, Based on the input signals from various sensors, it is determined whether or not the update condition is satisfied by outputting a control signal from the output port, controlling the control target device, and executing the update determination program. It has been done.

  According to the present invention, when the program is updated, an error occurs in the update condition. For example, even if the vehicle speed input from the sensor is not zero, the update condition is satisfied and the update unit is activated. Can be prevented. That is, when a condition for ensuring the safety of the vehicle is set as the update condition, it is possible to prevent the safety of the vehicle from being unable to be ensured due to an error during the update.

  In addition, when setting a good program rewriting environment condition as an update condition, it is possible to prevent the program from being updated and causing an error or the like even though the program rewriting environment is not good. Can do.

  In addition, if an error occurs during program update and the update determination program is not correct and normal update determination cannot be performed, the update determination program may not be able to start the update means. The processing device may be provided with an interrupt signal input port.

  5. The information processing apparatus according to claim 4, wherein the computer has an interrupt signal input port used for starting the update means, and when the interrupt signal is input from the interrupt signal input port, the update means It has the function to start.

  According to this information processing apparatus, even if the update unit cannot be started depending on the update determination program, the update unit can be started by a special operation such as inputting an interrupt signal. That is, according to the present invention, it is possible to prevent the application program from being updated due to an abnormality in the update determination program. Therefore, according to the present invention, even when rewriting of the update determination program fails, it is not necessary to dispose of the information processing apparatus, and the economic efficiency is improved.

  Embodiments of the present invention will be described below with reference to the drawings. Needless to say, the embodiments of the present invention are not limited to the following examples, and can take various forms as long as they belong to the technical scope of the present invention.

  FIG. 1 is an explanatory diagram showing the configuration of an electronic control device 1 for a vehicle (automobile) to which the present invention is applied. The electronic control device 1 is mounted on an automobile and performs engine control, and includes a microcomputer 10, an interrupt input circuit 20, and connectors 31 and 32 connected to the microcomputer 10.

  The connector 31 is used to input an output signal of a sensor for detecting a vehicle state necessary for engine control (fuel injection control, ignition timing control, etc.) to the microcomputer 10, and is connected to various sensors.

  Examples of the sensor connected to the connector 31 include an air flow sensor that measures the intake air amount, an intake air temperature sensor 41 that detects the intake air temperature, an intake air pressure sensor 42 that detects the intake air pressure, and a water temperature that detects the temperature of the cooling water. A sensor 43, a throttle sensor that detects the throttle opening, a distributor 44 that detects the rotational speed of the engine, a vehicle speed sensor 45 that detects the vehicle speed, an air-fuel ratio sensor that detects the air-fuel ratio, a starter switch 46 that detects the start operation, and the like. Can be mentioned.

  The connector 32 is a connector for connecting the external tool 5 (vehicle diagnostic tool or program update tool), and is connected to the communication port Ps of the microcomputer 10.

  On the other hand, the interrupt input circuit 20 generates an interrupt signal for rewriting mode from a signal input from the connector 31 and inputs the interrupt signal to the microcomputer 10. The interrupt input circuit 20 has a redundant configuration so that an interrupt signal is not generated except by a proper procedure. In this embodiment, by executing the above procedure through the connector 31, an interrupt signal is generated in the interrupt input circuit 20, and the microcomputer 10 is shifted to the rewrite mode.

  FIG. 2 is a block diagram showing the configuration of the interrupt input circuit 20. As shown in FIG. 2, the interrupt input circuit 20 includes AND circuits A1, A2 and A3, and knot circuits N1 and N2. The AND circuit A1 is connected to a line connecting the connection portion C4 of the water temperature sensor 43 in the connector 31 and the microcomputer 10 via the knot circuit N1, and further, the connection portion C3 of the intake temperature sensor 41 in the connector 31 and the microcomputer. 10 is directly connected to the track connecting with 10.

  That is, the interrupt input circuit 20 outputs an H signal from the AND circuit A1 when an L (low) signal is input from the connection portion C4 and an H (high) signal is input from the connection portion C3. In some cases, an L signal is output. The interrupt input circuit 20 is configured in this way in a normal use state of the electronic control device 1 (a state in which the electronic control device 1 is mounted on the vehicle, and the water temperature sensor 43 is connected to the connection portion C4. This is because the L signal is always output from the AND circuit A1 in a state where the intake air temperature sensor 41 is connected to the connection portion C3.

  The AND circuit A2 is connected to a line connecting the connection portion C2 of the intake pressure sensor 42 in the connector 31 and the microcomputer 10 via a knot circuit N2, and further connected to the connection portion C1 of the starter switch 46 in the connector 31. It is directly connected to a line connecting the microcomputer 10.

  That is, the interrupt input circuit 20 outputs an H signal from the AND circuit A2 when an L signal is input from the connection portion C2 and an H signal is input from the connection portion C1, and otherwise the L signal is output. It is configured to output.

  In addition, the AND circuit A3 is connected to the AND circuits A1 and A2, and outputs the H signal as an interrupt signal to the microcomputer 10 only when the H signal is input from both the AND circuits A1 and A2. Has been.

  Therefore, the interrupt input circuit 20 does not input an interrupt signal to the microcomputer 10 in a normal use state of the electronic control device 1 (a state where the sensor is connected to the connector 31 and the device is mounted on the vehicle). When an L signal is input from the connection portions C4 and C2 and an H signal is input from the connection portions C3 and C1 by a user operation, an interrupt signal is input to the microcomputer 10.

  More specifically, in this embodiment, when the device does not normally shift to the rewrite mode, the electronic control device 1 is removed from the vehicle, and the connecting portions C4 and C2 are grounded as shown in FIG. By applying a specific voltage (5 V) to the connection parts C3 and C1, the L signal and the H signal are input to the interrupt input circuit 20, whereby the interrupt signal is input to the microcomputer 10 and the microcomputer 10 is rewritten. Switch to mode.

  Next, the configuration and operation of the microcomputer 10 will be described. As shown in FIG. 1, the microcomputer 10 of this embodiment includes a CPU 11 that performs various arithmetic processes, a rewritable ROM (so-called flash ROM) 13 that stores programs and the like, and a work area that is used when the CPU 11 executes a program. RAM 15, a communication circuit / input / output circuit (not shown), etc., and a communication port Ps for communication with the external tool 5, an interrupt signal input port Pi, and a connector 31 for connection to various sensors , Detection signal input ports P1, P2, P3, P4, P5, P6,..., A control signal output output port Po connected to a control target device such as an igniter or an injector (not shown), and a warning light 3 output port Pk for control.

  The ROM 13 of the microcomputer 10 includes a boot program storage area R1 in a non-rewritable mask area, and an application (application) program storage area R2 in a rewritable area. The boot program storage area R1 records a boot program and a rewrite program that realizes the rewrite processing of the application program storage area R2 in a non-rewritable manner. The application program storage area R2 stores the engine shown in FIG. An application program including an engine control program (including control data) for causing the CPU 11 to execute the control process, a rewrite condition determining program for causing the CPU 11 to perform the rewrite condition determining process shown in FIG. It is recorded so that it can be rewritten.

  FIG. 3 is an explanatory diagram showing the data structure in the ROM 13. FIG. 4 is a flowchart showing a procedure of processing executed immediately after the CPU 11 of the microcomputer 10 is activated. The CPU 11 of this embodiment reads the boot program stored in the boot program storage area R1 immediately after startup from the ROM 13 and executes it.

  When the CPU 11 starts executing the boot program, the CPU 11 executes predetermined initial processing such as initial setting of a register (not shown) (S110), and then refers to the area in which the authentication code of the application program is described. It is determined whether or not the code matches a predetermined authentication code described in the boot program, whereby the application program is a legitimate program suitable for the electronic control device 1 created by a manufacturer or the like. Whether or not (S120). If it is determined that the authentication codes do not match (No in S120), the process proceeds to S150, and a warning light 3 (for example, a warning light in the meter panel) mounted on the vehicle is turned on. Thereafter, the boot program is terminated without reading the application program.

  On the other hand, if it is determined that the authentication codes match (Yes in S120), whether or not the rewrite condition determination program recorded in a predetermined area in the application program storage area R2 is correct by the checksum method. to decide. Specifically, the sum value of the rewrite condition determination program recorded in a predetermined area in the application program storage area R2 is calculated (S130), and this sum value is a predetermined value described in the boot program in advance. It is determined whether or not there is (S140). If it is determined that the thumb value is not the specified value (No in S140), the process proceeds to S150, the warning lamp 3 mounted on the vehicle is turned on, and then the boot program is terminated without reading the application program. .

  In the present embodiment, the above steps are executed on the assumption that the rewrite condition determination program is designed so that the sum value becomes the specified value. In other words, in this embodiment, a rewrite condition determination program storage area is prepared redundantly, and the rewrite condition determination program is designed so that the sum value becomes a specified value using this redundant area.

  Therefore, the state where the sum value is not the specified value means that some error has occurred during the update of the application program, and the application program has an error. In this embodiment, in this case, a warning lamp 3 is turned on (S150) to notify the user of the abnormality.

  On the other hand, if it is determined that the sum value of the rewrite condition determination program is the specified value (Yes in S140), the CPU 11 reads the application program stored in the application program storage area R2 (S160) and executes it. (S170-S190).

  When the application program is executed, the CPU 11 first performs initialization and resets the reception history flag prepared in the RAM (S170), and then executes the engine control program included in the application program, Based on the input signal, a control signal corresponding to the vehicle state is output from the output port Po to a control target device such as an injector or an igniter. Thereby, well-known engine control is performed for one unit (S180).

  When engine control for one unit is completed, it is determined whether or not a rewrite request signal is input from the external tool 5 via the connector 32 and the communication port Ps (S185), and the rewrite request signal is input. If it is determined that it is not (No in S185), engine control for one unit is performed again (S180).

  On the other hand, when determining that the rewrite request signal is input (Yes in S185), the CPU 11 executes the rewrite condition determination program included in the application program (S190). FIG. 5 is a flowchart showing a rewrite condition determination process realized by the CPU 11 by executing the rewrite condition determination program.

  When the rewrite condition determination program is executed, the CPU 11 first determines whether or not the reception history flag is set in S210, and determines that the reception history flag is not set (that is, is in a reset state) ( After setting the reception history flag (S220), it is determined whether or not the application program rewrite conditions are satisfied (S230).

  In the present embodiment, the rewrite conditions are directly described in the rewrite condition determination program. Specifically, the rewrite conditions of the application program are set by the designer from the viewpoint of ensuring vehicle safety and described in the rewrite condition determination program. For example, from the viewpoint of ensuring vehicle safety, the fact that the vehicle is stopped is set as a rewrite condition, and this condition is described in the rewrite condition determination program.

  For example, based on the input signal of the vehicle speed sensor 45, the rewrite condition determination program is designed so that the rewrite condition is satisfied only when the vehicle speed is zero (Yes in S230) and the rewrite program is read and executed. By doing so, it is set as a rewriting condition that the vehicle is stopped.

  In addition, from the viewpoint of ensuring vehicle safety, a condition for engine speed can be set as the rewriting condition. Specifically, based on the input signal of the distributor 44, if the engine speed is equal to or less than the specified value, the rewrite condition is determined to be satisfied (Yes in S230), and the rewrite program is read and executed. By designing the program, it can be set as a rewrite condition that the engine speed is equal to or less than a specified value. When a plurality of rewrite conditions are set, the rewrite condition determination program is designed so that only when all the rewrite conditions are satisfied, it is determined Yes in S230 and the rewrite program is read and executed. Good.

  In order to set the operation guarantee condition at the time of ROM rewriting as the rewriting condition, for example, when the ambient temperature of the electronic control device 1 is not more than a specified value, the rewriting condition is satisfied (Yes in S230), The rewrite condition determination program can be designed to read and execute the rewrite program. If the operation guarantee condition is set as the rewrite condition by such a method, the occurrence of an error can be prevented when the application program is executed.

  Returning to the description, if it is determined in S230 that the rewrite condition of the application program is not satisfied (No in S230), the CPU 11 prohibits the external tool 5 connected to the connector 32 from rewriting the program. A rewrite prohibition notification signal is output (S240). Thereafter, the rewrite condition determination process is terminated without reading the rewrite program. In addition, after the process of S240, it may transfer to S180 again and may perform engine control, and may transfer to a dormant state without performing engine control again.

  On the other hand, if it is determined in S230 that the rewrite condition of the application program is satisfied (Yes in S230), the CPU 11 reads the rewrite program from the boot program storage area R1 of the ROM 13 (S250) and executes it (S260). . Note that the electronic control device 1 shifts to the rewrite mode by executing the rewrite program.

  That is, in the rewrite process realized by the CPU 11 executing the rewrite program, update data (all new application programs or difference data, etc.) is received from the external tool 5 through communication with the external tool 5, Based on the update data, the data in the application program storage area R2 is rewritten, and the application program in the ROM 13 is updated. When this rewriting process is completed, the process shifts to a sleep state, and then the boot program is restarted.

  Further, in the microcomputer 10 of the electronic control device 1 of this embodiment, the input signal from the interrupt input circuit 20 (in other words, the input signal from the port Pi) is constantly monitored, and the interrupt signal (H signal) is input. If so, the rewriting program is executed. FIG. 6 is a flowchart showing an interrupt control process executed by the CPU 11 when an interrupt occurs.

When the CPU 11 receives an interrupt signal from the port Pi and determines that the interrupt signal is input, the CPU 11 reads the rewrite program (S320) and executes it (S330).
Therefore, in this embodiment, when the device does not normally shift to the rewrite mode (when it is determined Yes in S230 and the rewrite program cannot be read and executed), the electronic control device 1 is removed from the vehicle. 2, if a combination of L and H signals that cannot be generated when the sensor is connected is generated through the connector 31, as shown in FIG. 2, an interrupt signal is generated and the microcomputer 10 is shifted to the rewrite mode. be able to.

  The electronic control device 1 according to the present embodiment has been described above. In the electronic control device 1, the rewrite condition (corresponding to the update condition of the present invention) is based on the detection signal of the sensor input from the connector 31 by the application program. Is satisfied (S230), and only when the vehicle state and the surrounding environment are in a predetermined state, the rewriting condition is satisfied (Yes in S230), and the rewriting program is started (this This is executed (corresponding to a procedure for starting the update means of the invention), and is executed (S260), and the application program recorded in the ROM 13 so as to be rewritable is updated (update means).

  Therefore, if the update of the application program has failed once and the rewrite conditions have changed, the rewrite request signal is input from the external tool 5 even though the vehicle state and the surrounding environment are not in an appropriate state. As a result, the electronic control device 1 shifts to the rewrite mode. For example, although the vehicle is not stopped, the electronic control device 1 may shift to the rewrite mode. In order to cope with this, the boot program calculates the sum value of the area in which the rewrite condition determination program (corresponding to the update determination program of the present invention) in the application program storage area R2 is stored, and compares this with the specified value. Whether the rewrite condition determination program is correct is determined before executing the rewrite condition determination program (in S130 and S140). If the rewrite condition determination program is not correct (the sum value is not a specified value), control is performed to turn on the warning lamp 3 instead of executing the application program (S150). The process is equivalent to the output means) to ensure the safety of the vehicle.

  As described above, according to the electronic control device 1 of the present embodiment, when an error occurs when the application program is updated and the rewrite condition determination program does not operate normally, the rewrite condition determination program is in an abnormal state. Since the user is not aware of this phenomenon, it is possible to prevent a problem in terms of vehicle safety or program update from occurring.

  Further, according to the present embodiment, the CPU 11 executes a program for causing the CPU 11 to execute a procedure for diagnosing the rewrite condition determination program and a procedure for turning on the warning lamp 3 when the rewrite condition determination program is abnormal. The program for this is built into the boot program, so with a simple program configuration, the rewrite condition determination program is reliably diagnosed prior to the execution of the application program, and if there is an abnormality, the user is notified of that fact. Can be notified.

  In addition, in the electronic control device 1 of the present embodiment, the microcomputer 10 has the interrupt signal input port Pi used for starting the rewrite program, and when the interrupt signal is input from the port Pi, the rewrite program Is read and executed (S320, S330). Therefore, according to the present embodiment, even if the rewrite program cannot be started depending on the rewrite condition determination program, a special operation is performed such as generating a signal through the connector 31 that cannot be established when the sensor is connected. The rewrite program can be started by generating a write signal, and even when rewriting of the rewrite condition determination program fails, the program can be updated again, which is advantageous from an economical viewpoint.

  Further, the present invention is not limited to the above-described embodiments, and may be applied to devices other than the electronic control device for vehicle control, for example. In addition, in the above embodiment, whether or not the rewrite condition determination program is correct is determined by the checksum method. However, whether or not the rewrite condition determination program is correct by other methods. You may make it judge.

It is explanatory drawing showing the structure of the electronic control apparatus 1 for vehicles to which this invention was applied. 3 is a block diagram illustrating a configuration of an interrupt input circuit 20. FIG. It is explanatory drawing which showed the data structure in ROM13. It is the flowchart which showed the process which CPU11 performs immediately after starting. It is a flowchart showing the rewriting condition determination process implement | achieved in CPU11 by the rewriting condition determination program. It is a flowchart showing the interrupt control process which CPU11 performs.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Electronic control device, 3 ... Warning light, 5 ... External tool, 10 ... Microcomputer, 11 ... CPU, 13 ... ROM, 15 ... RAM, 20 ... Interrupt input circuit, 31, 32 ... Connector, 41 ... Intake air temperature Sensor, 42 ... Intake pressure sensor, 43 ... Water temperature sensor, 44 ... Distributor, 45 ... Vehicle speed sensor, 46 ... Starter switch, A1, A2, A3 ... AND circuit, N1, N2 ... Knot circuit, C1, C2, C3, C4 , C5, C6... Connection, P1, P2, P3, P4, P5, P6, Pi ... input port, Pk, Po ... output port, Ps ... communication port, R1 ... boot program storage area, R2 ... application program storage area

Claims (4)

A non-volatile memory for storing application programs in a rewritable manner;
A computer that reads the application program stored in the nonvolatile memory from the nonvolatile memory and executes the application program;
Updating means for updating the application program stored in the nonvolatile memory in a rewritable manner based on input data from an external device;
An information processing apparatus comprising:
The nonvolatile memory determines whether or not a predetermined update condition is satisfied, and when the update condition is satisfied, an update determination for causing the computer to execute a procedure for starting the update unit The application program including the program is rewritably stored,
The information processing apparatus further includes:
Diagnostic means for determining whether or not the update determination program stored in the nonvolatile memory so as to be rewritable is correct before the execution of the update determination program by the computer;
When the diagnostic means determines that the update determination program is not correct, output means for outputting error information;
An information processing apparatus comprising: The functions as the diagnostic means and the output means are realized by the computer,
A program for causing the computer to function as the diagnostic unit and the output unit is incorporated in a boot program executed by the computer to start the application program,
Prior to the execution of the application program, the boot program causes the computer to execute a program for causing the computer to function as the diagnostic unit, and if the update determination program is not correct, the execution of the application program The information processing apparatus according to claim 1, further comprising: a configuration for causing the computer to execute a program for causing the computer to function as the output unit. In the non-volatile memory, as the application program, the update determination program and a vehicle control program for controlling a predetermined control target device mounted on the vehicle are stored in a rewritable manner.
The computer has an input port for receiving an input signal from various sensors mounted on a vehicle and an output port for outputting a control signal for the device to be controlled, and the various sensors by executing the vehicle control program. Based on the input signal from the sensor, the control signal is output from the output port, the control target device is controlled, and the update determination program is executed, so that the update condition is satisfied based on the input signal from the various sensors. The information processing apparatus according to claim 1, wherein the information processing apparatus determines whether it has been performed. The computer has an interrupt signal input port used for starting the update means, and has a function of starting the update means when an interrupt signal is input from the interrupt signal input port. The information processing apparatus according to claim 1, wherein the information processing apparatus is an information processing apparatus.

Images