JP2018163613A - Electronic apparatus, program update method and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the security of vehicle.SOLUTION: An IVI device 12 is configured to receive a new program transmitted from a server 24 for updating existing program. The IVI device 12 is configured so as, when an update instruction is input by an occupant of a vehicle 10, to update the existing program based on the new program. The IVI device 12 is configured so as to, when a series of update processing based on the new program is not completed for a predetermined period from a point when receiving the new program, restrict the travelling function of the vehicle 10.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a data processing technique, and more particularly to an electronic device, a program update method, and a computer program.

  Program update guidance for ECUs (Electronic Control Units) mounted on vehicles is presented only to the right holders who have the authority to change programs, avoiding program updates by persons other than the right holders and improving security A program update system has been proposed.

International Publication No. 2012/001771

  The conventional program update system only prompts the vehicle occupant to update the program, and the security measures for vehicles that have not been updated are insufficient.

  The present invention has been made in view of the above problems, and one object is to improve vehicle security.

  In order to solve the above-described problem, an electronic device according to an aspect of the present invention is an electronic device mounted on a vehicle, and stores a program for executing predetermined data processing, and stores the program in the storage unit. A new program for updating the received program and receiving a new program transmitted from the external device, and a new program received by the receiving unit when an update instruction is input Based on the program, an update unit that updates the program stored in the storage unit, and when the update process based on the new program by the update unit is not completed in a predetermined period from the reception of the new program, the vehicle travels A limiting unit that limits the function.

  Another aspect of the present invention is a program update method. This method is an electronic device mounted on a vehicle, and an electronic device including a storage unit that stores a program for executing predetermined data processing is used for updating a program stored in the storage unit. When a new program that is transmitted from an external device is received and an update instruction is input, the program stored in the storage unit is updated based on the new program, and a new program is received. If the update process based on the new program is not completed within a predetermined period from the reception of the correct program, the traveling function of the vehicle is limited.

  Note that any combination of the above components, the expression of the present invention converted between a computer program, a recording medium on which the computer program is recorded, a vehicle equipped with the present apparatus, and the like are also effective as an aspect of the present invention. It is.

  According to the present invention, the security of a vehicle can be improved.

It is a figure which shows the structure of the vehicle of 1st Example. It is a block diagram which shows the function structure of the IVI apparatus of FIG. It is a flowchart which shows operation | movement of the IVI apparatus of 1st Example. It is a flowchart which shows operation | movement of the server of 1st Example. It is a flowchart which shows operation | movement of the server of 2nd Example. It is a flowchart which shows operation | movement of the vehicle of 2nd Example. It is a flowchart which shows operation | movement of the vehicle of 2nd Example.

[First embodiment]
The vehicle according to the embodiment executes the update of the existing program by the new program received from the server on the condition that the occupant inputs the update instruction. Thereby, reprogramming of the vehicle-mounted device reflecting the occupant's intention can be realized. However, if the occupant does not input the update instruction for a long time, the security of the vehicle may be reduced.

  Therefore, the vehicle of the embodiment restricts the traveling function of the vehicle when the update process of the existing program is not completed even after a certain period of time has elapsed after receiving a new program from the server. Specifically, the vehicle of the embodiment shifts to a state in which normal driving is possible but an automatic driving function (ADAS (Advanced Driver Assistance Systems) or AD (Autonomous Driving)) cannot be used.

  FIG. 1 shows a configuration of a vehicle 10 of the first embodiment. The vehicle 10 includes an IVI (In Vehicle Infotainment) device 12, an automatic driving unit 14, a processing ECU 16, and a gateway ECU 18. These devices are connected to a CAN (Controller Area Network) 20 that is an in-vehicle network, and constitute an in-vehicle network system 22.

  The IVI device 12 is an electronic device including car navigation and car audio functions, and displays various information on a display unit such as a liquid crystal display. The IVI device 12 according to the embodiment is connected to the server 24 via a network (4G network or the like) outside the vehicle 10. The information on the display unit may be displayed in synchronization with the screen of a mobile terminal connected to the IVI device 12 via an external network.

  The server 24 is a program (hereinafter referred to as “update program”) for updating a program (hereinafter also referred to as “data processing program”) that defines the operation of the IVI device 12, the automatic driving unit 14, the processing ECU 16, or the gateway ECU 18. .) Is an information processing device that provides the vehicle 10 with the information processing device. Moreover, the server 24 performs the process which concerns on provision of the privilege regarding the vehicle 10 which implemented the program update at an early stage. The server 24 may execute a process for giving a privilege to a user (that is, an occupant of the vehicle 10) who has updated the program early. The privilege may be, for example, a discount on automobile insurance premiums, or a discount point for automobile insurance premiums. In addition, the process which provides an update program, and the process which provides a privilege may be distributedly performed by several servers.

  The processing ECU 16 includes a plurality of ECUs connected to sensors (not shown speed sensors, temperature sensors, etc.) or actuators (not shown brakes, steering, etc.). The first processing ECU 16 is connected to a predetermined sensor and transmits the data detected by the sensor to an external data device. The second processing ECU 16 is connected to a predetermined actuator, and controls the actuator based on data received from the external device.

  The automatic driving unit 14 is an electronic device that controls automatic driving of the vehicle 10. For example, the automatic driving unit 14 may determine the traveling mode of the vehicle 10 based on the detection data received from the first processing ECU 16. Further, the automatic driving unit 14 may cause the second processing ECU 16 to control the actuator by transmitting data indicating the determined traveling mode to the second processing ECU 16.

  The gateway ECU 18 relays or routes a frame (also referred to as a CAN message) transmitted from a certain ECU to another ECU. For example, the gateway ECU 18 relays a frame transmitted by one to the other between the automatic operation unit 14 connected to the first bus of the CAN 20 and the processing ECU 16 connected to the second bus of the CAN 20.

  FIG. 2 is a block diagram showing a functional configuration of the IVI device 12 of FIG. Each block shown in the block diagram of the present specification can be realized in terms of hardware by an element such as a CPU / memory of a computer or a mechanical device, and in terms of software, it can be realized by a computer program or the like. Then, the functional block realized by those cooperation is drawn. Those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

  The IVI device 12 includes an external IF 30, a CAN-IF 32, a display unit 34, a display control unit 36, an operation reception unit 38, a program storage unit 40, a data processing unit 42, a program update unit 44, an update notification unit 46, and a restriction unit 48. Including. A computer program including modules corresponding to these blocks may be stored in the memory of the IVI device 12, and the functions of these blocks may be exhibited by the CPU of the IVI device 12 executing the computer program. Moreover, it replaces with the IVI apparatus 12, and the structure provided with these functional blocks in the automatic driving | operation part 14, process ECU16, or gateway ECU18 may be sufficient.

  The program storage unit 40 stores a data processing program that defines the content of data processing by the IVI device 12. The external IF 30 provides a communication function with a network (4G or the like) outside the vehicle 10. The external IF 30 is an update program for updating the data processing program stored in the program storage unit 40, and includes a function of a reception unit that receives the update program transmitted from the server 24. The CAN-IF 32 provides a communication function with the CAN 20.

  The display unit 34 is a device that displays various types of information, and is, for example, a touch panel. The display control unit 36 causes the display unit 34 to display the display data output from the data processing unit 42 or the program update unit 44. For example, the display control unit 36 causes the display unit 34 to display a navigation map image output from the data processing unit 42. Further, the display control unit 36 causes the display unit 34 to display the content (message, image, etc.) prompting the input of the program update instruction output from the program update unit 44.

  The operation receiving unit 38 receives an occupant operation input to the display unit 34. The operation reception unit 38 outputs data indicating the received operation to the data processing unit 42 and the program update unit 44. The data processing unit 42 executes data processing (for example, navigation processing) as the IVI device 12 according to the data processing program stored in the program storage unit 40.

  When an update program is received by the external IF 30, the program update unit 44 temporarily stores the update program together with the reception time. The program update unit 44 causes the display unit 34 to display content that prompts the user to input a program update instruction via the display control unit 36.

  The program update unit 44 updates an existing data processing program stored in the program storage unit 40 based on the update program when an input of a program update instruction is detected by the operation reception unit 38. For example, the program update unit 44 may execute reprogramming by replacing an existing data processing program stored in the program storage unit 40 with an update program. The program update unit 44 derives the elapsed time from the reception of the update program to the completion of the update process, and passes the elapsed time to the update notification unit 46.

  In the embodiment, the data processing program of the IVI device 12 is updated, but the data processing program of other devices (gateway ECU 18, processing ECU 16, etc.) may be updated. In this case, the program update unit 44 may transmit the update command and the update program via the CAN-IF 32 to the in-vehicle device targeted for program update.

  The update notification unit 46, when the program update unit 44 completes the update processing of the data processing program based on the update program, data indicating the completion of the program update processing (hereinafter referred to as “update completion notification”). To the server 24 via In the first embodiment, the update notification unit 46 sends an update completion notification to the server when the update process is completed before a predetermined period (referred to as “time Ta1”, for example, 24 hours) elapses from the reception of the update program. 24. In other words, the update notification unit 46 transmits an update completion notification to the server 24 on the condition that the elapsed time from the reception of the update program is equal to or less than the time Ta1.

  Time Ta1 can be said to be an update notification deadline to the server 24, and can also be said to be an update time threshold value for granting an early update privilege. The time Ta1 may be determined in advance in the IVI device 12, or may be included in the update program. In the latter case, the time Ta1 may be set shorter as the importance of update by the update program is higher.

  The restricting unit 48 executes a process for restricting the traveling function of the vehicle 10, in other words, a process for restricting the traveling mode of the vehicle 10 to a part. In the embodiment, the restriction unit 48 controls the external devices (the automatic driving unit 14, the gateway ECU 18 and the like) so that the vehicle cannot be automatically driven.

  For example, the restriction unit 48 may transmit data that instructs the automatic driving unit 14 to stop or prohibit the automatic driving. Further, the restriction unit 48 may update the control program of the automatic driving unit 14 so that the automatic driving is stopped or prohibited. The restriction unit 48 stops at least one of relay of detection information transmitted from the first processing ECU 16 to the automatic operation unit 14 and relay of control information transmitted from the automatic operation unit 14 to the second processing ECU 16. Alternatively, data instructing prohibition may be transmitted to the gateway ECU 18. Further, the restriction unit 48 may update the control program of the gateway ECU 18 so that those relays are stopped or prohibited.

  As a modification, the restriction unit 48 may restrict other travel functions. For example, the limiting unit 48 may instruct the processing ECU 16 that controls the engine to limit the traveling speed of the vehicle 10 (for example, to limit the upper limit of the traveling speed to 60 kilometers per hour).

  The program update unit 44 causes the restriction unit 48 to execute the process when the update process is not completed before a predetermined period (referred to as “time Ta2”, for example, 72 hours) elapses from the reception of the update program. In other words, the program update unit 44 causes the restriction unit 48 to execute the process when the elapsed time from the reception of the update program exceeds the time Ta2. For example, the program update unit 44 may cause the function of the restriction unit 48 to be exhibited by causing the CPU to start executing a program in which the function of the restriction unit 48 is implemented.

  The time Ta2 can be said to be a threshold value of the non-update period to which a penalty is given, and is set longer than the time Ta1. The time Ta2 may be predetermined in the IVI device 12 and may be included in the update program. In the latter case, the time Ta2 may be set shorter as the importance of update by the update program is higher.

The operation of the above configuration will be described.
FIG. 3 is a flowchart showing the operation of the IVI device 12 of the first embodiment, and particularly showing the operation related to program update. The IVI device 12 of the first embodiment measures the elapsed time from the reception of the update program by its own device. In addition, the IVI device 12 stores in advance a restriction program in which a process for restricting the traveling function of the vehicle 10 is implemented. The IVI device 12 repeats the operation shown in FIG. 3 while the power is on. When the automatic driving unit 14, the processing ECU 16, and the gateway ECU 18 include the functional blocks shown in FIG. 2, the operations of the automatic driving unit 14, the processing ECU 16, and the gateway ECU 18 are also the operations shown in FIG.

  When the external IF 30 receives the update program transmitted from the server 24 (Y in S10), the program update unit 44 causes the display unit 34 to display content that prompts program update (in other words, content that prompts input of a program update instruction). (S12). When the operation receiving unit 38 detects that a program update instruction has been input to the display unit 34 (Y in S14), the program update unit 44 updates the data processing program in the program storage unit 40 based on the update program. (S16). If the elapsed time from the reception of the update program to the completion of the update is within the time Ta1 (Y in S18), the update notification unit 46 transmits an update completion notification to the server 24 (S20). If the elapsed time until the update is completed exceeds the time Ta1 (N in S18), S20 is skipped.

  When the program update instruction is not input (N in S14) and the non-update time starting from reception of the update program exceeds the time Ta2 (Y in S22), the limiting unit 48 performs automatic operation by the automatic operation unit 14. (S24). If the unupdate time is equal to or shorter than the time Ta2 (N in S22), the process returns to S12. If an update program has not been received (N in S10), the subsequent processing is skipped and the flow of this figure is terminated.

  FIG. 4 is a flowchart showing the operation of the server 24 of the first embodiment. The server 24 repeats the operation shown in FIG. 4 while the power is on. When the distribution condition of the predetermined update program is satisfied (Y in S30), the server 24 transmits the update program to the vehicle 10 (S32). The distribution condition of the update program may be that a new update program is stored in a predetermined storage area. Further, a command for instructing distribution of the update program may be input from the administrator. If the distribution conditions for the update program are not satisfied (N in S30), S32 is skipped.

  When the update completion notification transmitted from the vehicle 10 is received (Y in S34), the server 24 executes predetermined data processing for granting a privilege to the passenger of the vehicle 10 (S36). For example, the server 24 may increase the discount rate of the car insurance contracted by the passenger of the vehicle 10 in cooperation with an insurance company device. If an update completion notification has not been received (N in S34), S36 is skipped.

  According to the vehicle 10 of the first embodiment, if the update of the existing program by the update program provided from the server 24 is not performed for a predetermined period (time Ta2), the program for passengers is prohibited by prohibiting the automatic operation of the vehicle 10. Can prompt for an update. In addition, according to the vehicle 10 of the first embodiment, if the program is updated early (before the time Ta1) from the provision of the update program, a privilege is provided to the occupant, thereby providing an incentive for early program update. Can be given to.

[Second Embodiment]
The configuration of the vehicle 10 of the second embodiment is the same as that of the first embodiment (FIG. 1). Also in the vehicle 10 of the second embodiment, the IVI device 12 executes the program update process. The functional configuration of the IVI device 12 is the same as that of the first embodiment (FIG. 2). Hereinafter, the contents already described in the first embodiment will be omitted as appropriate, and differences from the first embodiment will be mainly described.

  In the first embodiment, the IVI device 12 stores the restriction program in advance. However, in the second embodiment, the server 24 dynamically updates the restriction program according to the reception status of the update completion notification from the vehicle 10. To provide. The configuration of the second embodiment also has the same effect as the first embodiment.

  Specifically, the server 24 stores the date and time when the update program is transmitted to the vehicle 10 or the date and time when the vehicle 10 downloads the update program, and measures the elapsed time since the update program is transmitted to the vehicle 10. . When the server 24 receives an update completion notification from the vehicle 10, if the elapsed time up to that time is equal to or less than a predetermined time (referred to as “time Tb1”, for example, 24 hours), the server 24 occupies a predetermined privilege. Execute the process for granting.

  Further, the server 24 restricts when an update completion notification is not received from the vehicle 10 until a predetermined time (referred to as “time Tb2”, for example, 60 hours) elapses after the update program is transmitted to the vehicle 10. The program is transmitted to the vehicle 10. Time Tb2 is set longer than time Tb1.

  The external IF 30 of the vehicle 10 receives the restriction program transmitted from the server 24. The CPU of the vehicle 10 executes the restriction program if the update process based on the update program is not completed before a predetermined time (hereinafter referred to as “restricted grace period”, for example, 12 hours) elapses from the reception of the restriction program. By doing so, the function of the restriction part 48 is exhibited. The restriction unit 48 executes a process for restricting the traveling function of the vehicle 10 as in the first embodiment.

  FIG. 5 is a flowchart showing the operation of the server 24 of the second embodiment. The server 24 repeats the operation shown in FIG. 5 while the power is on. S40 and S42 in the figure are the same as S30 and S32 in FIG.

  When the update completion notification transmitted from the vehicle 10 is received (Y in S44), and when the update completion notification is received before the time Tb1 has elapsed since the update program was transmitted to the vehicle 10 (in S46) Y) The server 24 executes data processing for giving a privilege to the passenger of the vehicle 10 (S48). For example, the server 24 may execute a process for discounting a car insurance premium contracted by an occupant of the vehicle 10 in cooperation with an insurance company device. When an update completion notification is received after the elapse of time Tb1 since the update program was transmitted to the vehicle 10 (N of S46), S48 is skipped and the flow of this figure is ended.

  If the update completion notification has not been received (N in S44) and the elapsed time since the transmission of the update program has exceeded the time Tb2 (Y in S50), the server 24 executes the restriction program. It transmits to the vehicle 10 (S52). If the elapsed time since the transmission of the update program is less than or equal to time Tb2 (N in S50), S52 is skipped and the flow of this figure is terminated.

  FIG. 6 is a flowchart showing the operation of the vehicle 10 of the second embodiment. This figure shows the operation related to the reception of the update program. The vehicle 10 repeats the operation shown in FIG. 6 while the power is on. When the automatic driving unit 14, the processing ECU 16, and the gateway ECU 18 include the functional blocks shown in FIG. 2, the operations of the automatic driving unit 14, the processing ECU 16, and the gateway ECU 18 are also the operations shown in FIG. The same applies to FIG. 7 described later.

  Since S60 and S62 in FIG. 6 are the same as S10 and S12 in FIG. 3, description thereof is omitted. When the operation receiving unit 38 detects that a program update instruction has been input to the display unit 34 (Y in S64), the program update unit 44 uses a program storage unit based on the update program provided in advance from the server 24. The 40 data processing programs are updated (S66). The update notification unit 46 transmits an update completion notification to the server 24 (S68). If no program update instruction has been input (N in S64), the process returns to S62.

  FIG. 7 is also a flowchart showing the operation of the vehicle 10 of the second embodiment. This figure shows the operation related to reception of the restriction program. When the external IF 30 receives the restriction program transmitted from the server 24 (Y in S70), the program update unit 44 displays a notice that the traveling function is restricted if the program is not updated via the display control unit 36. It is displayed on the part 34 (S72).

  If the predetermined grace period has not elapsed since the reception of the restriction program (N in S74), the display control unit 36 displays the updated notice on the display unit 34 (S76), and returns to S74. For example, the display control unit 36 may update the notice to indicate that the remaining time until the travel function is limited, such as blinking a part of the navigation screen. In addition, the display control unit 36 may update the notice to indicate a stronger warning as the remaining time limit is shortened.

  When the restriction grace time elapses after receiving the restriction program (Y in S74), the CPU of the IVI device 12 exhibits the function of the restriction unit 48 similar to that in the first embodiment by executing the restriction program (S78). . The update notification unit 46 or the restriction unit 48 is information indicating that the traveling function of the vehicle 10 is restricted, and for example, transmits information indicating that automatic driving is prohibited to the server 24 (S80). If the restriction program has not been received (N in S70), the processes in S72 and subsequent steps are skipped, and the flow of FIG.

  The present invention has been described based on the first and second embodiments. Those skilled in the art will understand that these embodiments are exemplifications, and that various modifications can be made to each component or combination of each treatment process, and such modifications are within the scope of the present invention. is there.

The technologies described in the examples and the modifications may be specified by the following items.
[Item 1]
An electronic device mounted on a vehicle,
A storage unit for storing a program for executing predetermined data processing;
A new program for updating the program stored in the storage unit, and a receiving unit that receives the new program transmitted from the external device;
An update unit that updates a program stored in the storage unit based on a new program received by the reception unit when an update instruction is input;
An electronic device comprising: a restriction unit that restricts a traveling function of the vehicle when an update process based on the new program by the update unit is not completed in a predetermined period from the reception of the new program.
According to this electronic device, if the program update has not been executed for a predetermined period from the reception of the update program, it is possible to prompt the vehicle occupant to update the program by limiting the traveling function of the vehicle. Vehicle security and safety can be increased.
[Item 2]
The electronic device according to item 1, further comprising a notification unit that notifies the external device that the update process is completed when the update process is completed before the first time has elapsed since the reception of the new program. .
According to this aspect, it is possible to notify the external device that the program update has been completed relatively early. For example, it is possible to cause the external device to execute data processing based on the fact that the program update has been completed relatively early in the vehicle.
[Item 3]
The electronic device according to item 2, wherein the notifying unit notifies the external device that the update process has been completed, thereby causing the external device to execute a process related to granting a privilege related to the vehicle.
According to this aspect, a privilege for updating the program can be given to the occupant.
[Item 4]
The said restriction | limiting part restrict | limits the driving | running | working function of the said vehicle, when the said update process is incomplete before the 2nd time longer than the said 1st time passes since reception of the said new program. Electronics.
According to this aspect, if the program is updated early, a privilege is granted, and if the program is not updated for a long period of time, the traveling function of the vehicle is restricted, thereby prompting the occupant to update the program. .
[Item 5]
The external device is configured to limit the travel function of the vehicle when the update processing completion notification has not been received from the vehicle before the first time has elapsed since the transmission of the new program to the vehicle. Send the program to the vehicle,
The receiving unit receives a restriction program transmitted from the external device,
The electronic device according to item 1, wherein the restriction unit restricts a traveling function of the vehicle based on the restriction program when the update process is not completed before the second time elapses from reception of the restriction program. .
According to this aspect, it is not necessary for the vehicle to always store the restriction program. Further, when a restriction program is provided from the outside, the traveling function of the vehicle can be restricted at an appropriate timing.
[Item 6]
An electronic device that is mounted on a vehicle and includes a storage unit that stores a program for executing predetermined data processing.
A new program for updating the program stored in the storage unit, and receiving a new program transmitted from an external device,
When an update instruction is input from an occupant, the program stored in the storage unit is updated based on the new program,
A program update method for restricting a traveling function of the vehicle when an update process based on the new program is not completed in a predetermined period from reception of the new program.
According to this program update method, if the program update has not been executed for a predetermined period from the reception of the update program, it is possible to urge the vehicle occupant to update the program by limiting the traveling function of the vehicle. , Can enhance the security and safety of the vehicle.
[Item 7]
An electronic device that is mounted on a vehicle and that includes a storage unit that stores a program for executing predetermined data processing.
A new program for updating the program stored in the storage unit, and receiving a new program transmitted from an external device,
When an update instruction is input from an occupant, the program stored in the storage unit is updated based on the new program,
A computer program for executing a restriction of a traveling function of the vehicle when an update process based on the new program is not completed in a predetermined period from the reception of the new program.
According to this computer program, if the program update has not been executed for a predetermined period from the reception of the update program, it is possible to prompt the vehicle occupant to update the program by limiting the traveling function of the vehicle. Vehicle security and safety can be increased.

  Any combination of the above-described embodiments and modifications is also useful as an embodiment of the present invention. The new embodiment resulting from the combination has the effects of the combined example and modification. Further, it should be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and the modified examples or by their cooperation.

  10 vehicles, 12 IVI devices, 20 CAN, 24 servers, 40 program storage units, 44 program update units, 46 update notification units, 48 limit units.

Claims (7)

An electronic device mounted on a vehicle,
A storage unit for storing a program for executing predetermined data processing;
A new program for updating the program stored in the storage unit, and a receiving unit that receives the new program transmitted from the external device;
An update unit that updates a program stored in the storage unit based on a new program received by the reception unit when an update instruction is input;
In a predetermined period from the reception of the new program, when the update process based on the new program by the update unit is not completed, a limiting unit that limits the traveling function of the vehicle;
Electronic equipment comprising. A notification unit that notifies the external device that the update process is completed when the update process is completed before the first time has elapsed since the reception of the new program;
The electronic device according to claim 1. The notification unit notifies the external device that the update process has been completed, thereby causing the external device to execute a process related to granting a privilege related to the vehicle.
The electronic device according to claim 2. The restriction unit restricts a traveling function of the vehicle when the update process is not completed before a second time longer than the first time elapses from reception of the new program.
The electronic device according to claim 2 or 3. The external device is configured to limit the travel function of the vehicle when the update processing completion notification has not been received from the vehicle before the first time has elapsed since the transmission of the new program to the vehicle. Send the program to the vehicle,
The receiving unit receives a restriction program transmitted from the external device,
The restriction unit restricts the traveling function of the vehicle based on the restriction program when the update process is not completed before the second time elapses from reception of the restriction program.
The electronic device according to claim 1. An electronic device that is mounted on a vehicle and includes a storage unit that stores a program for executing predetermined data processing.
A new program for updating the program stored in the storage unit, and receiving a new program transmitted from an external device,
When an update instruction is input, the program stored in the storage unit is updated based on the new program,
When the update process based on the new program is not completed in a predetermined period from the reception of the new program, the travel function of the vehicle is limited.
Program update method. An electronic device that is mounted on a vehicle and that includes a storage unit that stores a program for executing predetermined data processing.
A new program for updating the program stored in the storage unit, and receiving a new program transmitted from an external device,
When an update instruction is input, the program stored in the storage unit is updated based on the new program,
When the update process based on the new program is not completed in a predetermined period from the reception of the new program, the travel function of the vehicle is limited.
A computer program that causes things to be executed.

Images