JP4337828B2 - Service provision system - Google Patents

Description

  The present invention makes it possible to provide a specific service via an in-vehicle device by causing the in-vehicle device to acquire an application program such as a billing process by wireless communication with an external management device, and causing the in-vehicle device to execute the acquired application program. It relates to a service providing system.

  Conventionally, in order to alleviate traffic congestion at toll gates on toll roads, to reduce congestion in the ETC (Electronic Toll Collection) system that collects tolls non-stop at toll gates and in specific areas (for example, urban areas) In addition, an ERP (Electronic Road Pricing) system that charges a vehicle entering this specific area is being studied.

  Among these, in the ETC system, DSRC (Dedicated Sort-Range Communication) radio is used for road-to-vehicle communication between a roadside device installed on the toll gate side and an in-vehicle device mounted on each vehicle. The DSRC radio is a two-way narrowband radio communication using millimeter wave (5.8 GHz) radio waves, and is formulated as a standard “ARIB STD-T55” of the Radio Industries Association.

  However, considering that toll collection is performed in the same way as the ETC system in the ERP system, a roadside device (antenna) is installed for each approach route to a specific area for charging (hereinafter referred to as “charging area”). Therefore, when there are many approach routes to the billing area, such as in an urban area, the installation cost of the roadside unit and the labor of maintenance management become enormous. For this reason, for example, as disclosed in Japanese Patent Application Laid-Open No. 11-213192, a roadside device is not provided for each approach route to the charging area, but a GPS (Global Positioning System) receiver installed in the vehicle. A method of performing charging processing by determining whether or not the current position of the vehicle is within the charging area based on the positioning result has been studied.

By the way, in order to realize such an ETC system or ERP system, it is necessary to attach an in-vehicle device corresponding to the system to each vehicle.
However, for these in-vehicle devices, for example, when an IC card is used to specify the billing target, the IC card is not intentionally attached to the IC card reader connected to the in-vehicle device, In addition, when charging processing is performed based on the positioning result of the GPS receiver, it is impossible to determine the charging condition by intentionally disconnecting the signal line from the GPS receiver or stopping the power supply to the GPS receiver. In addition, there is a possibility that various fraudulent acts such as loading an illegal program into an in-vehicle device and executing the fraudulent program, and countermeasures against these fraudulent acts are strongly desired.

  In order to solve the above-described problems, an object of the present invention is to detect fraudulent acts applied to an in-vehicle device and suppress fraudulent acts on the in-vehicle device.

  In the service providing system of the present invention made to achieve the above object, by causing the in-vehicle device to acquire an application program by wireless communication with an external management device, and causing the in-vehicle device to execute the acquired application program, A specific service can be provided via the in-vehicle device.

Then, the in-vehicle device stores the setup log of the application program in the storage unit of the in-vehicle device and detects the abnormal situation that may have occurred due to the fraudulent action applied to the in-vehicle device. Monitoring data indicating this is generated and transmitted to the management apparatus via wireless communication.
On the other hand, the management device registers the in-vehicle device that has executed the download of the application program, stores the setup log of the downloaded application program as user data thereof, and transmits wireless communication via wireless communication at each preset inquiry timing. It reads the setup log stored in the vehicle-mounted device Te, compares the setup logs stored in the management device and read setup logs, the result of this comparison, if there is a differences in both setup log, or from the in-vehicle device When monitoring data is received via wireless communication, a re-setup process is executed for causing the in-vehicle device to re-acquire the application program from the management device.

According to the service providing system of the present invention configured as described above, when an application program acquired from other than the management device is set up in the in-vehicle device, the setup log is different between the in-vehicle device and the management device. By comparing, the management apparatus can confirm the presence or absence of fraud such as falsification of the program. On the management device side, the setup status (equipment configuration, set-up programs, etc.) of each in-vehicle device can be ascertained from the setup log, and maintenance such as program version upgrades can be handled individually for each in-vehicle device. can do.
In the service providing system according to claim 2, the IG switch is not turned off and the state continues for a set time or more even though it is detected that the power supply to the in-vehicle device is interrupted. Is an abnormal situation.
In the service providing system according to claim 3, the in-vehicle device generates a positioning data including a current position and a measured time based on a signal from a GPS satellite, and a communication cable to the position detecting unit. And a main unit that acquires and executes an application program.
When the application program executes ERP processing for charging based on whether the vehicle equipped with the in-vehicle device is located in the charging area based on the positioning data acquired from the position detection unit, the main unit and the position detection are performed. A state where communication with the unit is impossible is regarded as an abnormal situation.
Furthermore, in the service providing system according to claim 4, the main unit can communicate with the position detection unit from the start position of the positioning data acquired last from the position detection unit before the abnormal situation occurs. After returning to the normal state, the positioning data first acquired from the position detection unit is stored as return data, and monitoring data including start data and return data is created at the timing of return from the abnormal situation.

First, a reference example which is a premise for describing an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic configuration diagram of an automatic charging system according to the present reference example, and FIG. 2 is a block diagram showing a configuration of an in-vehicle device used in the system.

  As shown in FIG. 1, in the automatic charging system of this reference example, an in-vehicle device 1 mounted on a vehicle M and having a function of receiving a radio wave from a GPS satellite ST and detecting a current position, And a management center 5 as a management apparatus to which each roadside device 3 is connected via a communication network N.

  The roadside device 3 is configured to perform communication with the in-vehicle device 1 (hereinafter referred to as “road-to-vehicle communication”) by a well-known DSRC radio that forms a limited communication area with a diameter of about 3 to 30 m. In addition to being installed for ETCs that collect non-stop charges from vehicles passing through toll gates that are installed at toll gates on toll roads, there are also many along main roads and places where vehicles stop (gas stations, parking lots, etc.) is set up.

  In addition, the management center 5 is commonly used by each in-vehicle device 1 such as an automatic billing (ETC / ERP) application program downloaded to the in-vehicle device 1 via the roadside device 3, charging area, and charging condition data. The system data management unit 51 that manages the system data to be executed, the user data management unit 52 that manages the user data related to the registered in-vehicle device 1, downloads the system data to the in-vehicle device 1, and the download is performed. It is transmitted by road-to-vehicle communication from the maintenance control unit 53 that controls the registration of the in-vehicle device 1 and the updating (re-downloading) of system data for the registered in-vehicle device 1 and the in-vehicle device 1 that executes the downloaded application program. Billing data for collecting charges and supervision for notification of abnormal situations Based on the data, has actually or implement procedures such as debiting a fee from the account, the fee collection control unit 54 to implement to deal with fraud made to a vehicle apparatus 1.

  That is, the in-vehicle device 1 can communicate with the road-to-vehicle communication and thus with the management center 5 by staying in or passing through the communication area of the roadside device 3. The in-vehicle device 1 acquires an automatic charging application program by downloading from the management center 5 using road-to-vehicle communication, and can execute the acquired application program to provide an automatic charging service. Has been.

  In addition, the management center 5 registers the in-vehicle device 1 that has downloaded the application program, and stores, as user data, a setup log of the downloaded application program, an update history of various data, and the like for each in-vehicle device 1. Has been.

  Next, as shown in FIG. 2, the in-vehicle device 1 includes a main unit 10 and a position detection unit 20 connected to each other via a communication cable C. It is configured to receive power supply from (not shown).

Among these, the position detection unit 20 includes an external device interface 21 for connecting to an external device (at least the main unit 10) via the communication cable C, and an internal auxiliary power supply circuit including a rechargeable secondary battery. Receiving power supply from the battery 22 and the outside (vehicle battery) to supply power to each part of the unit 20 and charge the internal battery 22, and when the power supply from the outside is cut off, the internal battery 22 A power supply circuit 23 that performs switching control to supply power to each unit of the unit 20, a storage unit 24 that includes an EEPROM that retains stored contents even when the power is turned off, and that can erase stored contents in a specified area, and a CPU and ROM , Constructed around a well-known microcomputer consisting of RAM, received via GPS antenna A Based on the signal from the PS satellites ST, it generates the positioning data consisting of the current position and the measured time, and a GPS receiver 25 for controlling the said unit 20 units.

  Note that the ROM constituting the GPS receiver 25 is necessary for the unit 20 such as processing for generating positioning data from signals received by the GPS antenna A, input / output processing of commands and data via the external device interface 21, and the like. A basic program for realizing a minimum function is stored.

  On the other hand, the main unit 10 includes an external device interface 11 for connecting to an external device (at least the position detection unit 20), a DSRC communication circuit 12 that performs wireless communication with the roadside device 3, an automatic charging process, and the like. A card interface 13 that reads information from an IC card 30 that stores at least identification information (membership number, account number, etc.) for specifying a billing target when an application with charge collection is executed, A display unit 14 for displaying processing results and other various information, and an internal battery 15, a power circuit 16, and a memory configured similarly to the internal battery 22, power circuit 23, and storage unit 24 provided in the position detection unit 20. A control microcomputer that is configured around the unit 17 and the CPU, ROM, and RAM, and controls each part of the unit 10 And a 8.

  Note that the ROM constituting the control microcomputer 18 communicates with the roadside device 3 via the DSRC communication circuit 12 and executes main processing for executing processing according to the received command, and commands and data via the external device interface 11. A basic program for realizing the minimum necessary functions in the unit 10 such as input / output processing is stored.

Here, main processing executed by the control microcomputer 18 of the main unit 10 will be described with reference to the flowchart shown in FIG.
This process is started after power supply is started from the in-vehicle battery and an initialization process such as hardware check is performed. First, in S <b> 110, it is determined whether or not the in-vehicle device 1 has been registered with the management center 5. Specifically, if registered, a formal authentication number or registration ID is assigned from the management center 5 side, and therefore it can be determined whether or not it has been assigned.

  If it is unregistered, the process proceeds to S120, and a response signal returned to the roadside device 3 when a polling signal is received from the roadside device 3 is given to the in-vehicle device 1 in advance and a status indicating that it is not registered. Set the temporary authentication number.

  In continuing S130, it is judged whether road-to-vehicle communication was started by receiving the polling from the roadside device 3, and if communication has not been started, it will wait by repeatedly performing the same step. On the other hand, when road-to-vehicle communication is started by receiving a polling signal, the process proceeds to S140, and registration processing is executed in accordance with commands sequentially transmitted from the roadside unit 3.

Here, an outline of the registration process will be described with reference to a sequence diagram shown in FIG.
The road-to-vehicle communication using the DSRC communication circuit 12 is basically performed in a format in which the in-vehicle device 1 responds to a command transmitted by the roadside device 3. Usually, the roadside device 3 repeatedly transmits a polling signal, and communication is started when the in-vehicle device 1 that has entered the communication area of the roadside device 3 responds to the polling signal.

  The initial response includes a status indicating the state and request of the in-vehicle device 1 and an authentication number used for mutual authentication processing for confirming whether the in-vehicle device 1 is valid. . However, since a formal authentication number is not assigned to the unregistered in-vehicle device 1, a temporary authentication number set in the in-vehicle device 1 from the beginning is used.

  As shown in FIG. 4A, the roadside device 3 that has received the status and the temporary authentication number from the in-vehicle device 1 determines that registration processing is necessary based on the contents, and performs mutual authentication using the temporary authentication number. Execute. If the mutual authentication is successful, a registration ID for specifying the official authentication number and the in-vehicle device 1 is given to the in-vehicle device 1.

  Following this mutual authentication, downloading of the application program to the main unit 10 is executed, and subsequently, setup of the downloaded application program and operation confirmation are also executed.

  At this time, the roadside device 3 identifies the model of the main unit 10 based on the contents of the status included in the response signal to the polling signal, and the main unit application program corresponding to the device configuration of the model (here, ERP processing, power supply monitoring processing, card monitoring processing, etc., which will be described later, are selected and downloaded. When the operation check of the downloaded application program is completed in the main unit 10, the setup log is transmitted to the roadside device 3.

  Further, when the main unit 10 is a model that can be connected to an external device, after the download, setup, and operation check of the main body application program are completed, the roadside unit 3 connects to the connected device (in this case, the external device interface 11). Command to inquire about the device being sent). On the other hand, the main body unit 10 of the vehicle-mounted device 1 responds to the roadside device 3 by specifying the presence / absence of the connected device and its model by starting the connected device check program included in the main body application program. .

  When the roadside unit 3 confirms that an external device that requires an application program is connected based on the content of the response, for the connected device corresponding to the model of the external device (here, the position detection unit 20) Download of the application program is executed, and subsequently, setup of the downloaded application program and operation check are also executed.

  At this time, the main unit 10 transfers the data received from the roadside device 3 (application program for connected device, its setup command, operation check command, etc.) to the position detection unit 20 connected to the external device interface 11, Based on the transferred data, the position detection unit 20 executes the same processing as when the main body application program is downloaded.

When the download of the connection device application program, its setup, and operation check are completed, the setup data is transmitted to the roadside device 3 and the registration process is terminated.
The data (authentication number, registration ID) given to the in-vehicle device 1 and the data acquired from the in-vehicle device 1 (model, connected device, setup log of downloaded application program, etc.) 5 and stored in the user data management unit 52 as user data.

  Returning to FIG. 3, in S150, as a result of the registration process, the authentication number given from the roadside device 3, the registration ID, and the setup log generated when setting up the downloaded application program are stored in the storage unit 17, The process proceeds to S160.

  As described above, when the registration process is completed or it is determined that the registration has been completed in the management center 5 in the previous S110, the process proceeds to S160 and returns to the roadside unit 3 when a polling signal is received from the roadside unit 3. As a response signal, a status indicating that the registration has been completed and a formal authentication number given by the previous registration process (S140) are set.

  In subsequent S170, each set-up application program is started. In S180, it is determined whether road-to-vehicle communication has been started by receiving a polling signal from roadside device 3 in the same manner as in S130. If the communication is not started, the same step is repeatedly executed to stand by. On the other hand, when road-to-vehicle communication is started by receiving a polling signal, the process proceeds to S190, and according to commands sequentially transmitted from the roadside device 3, transmission of user data (billing data, monitoring data, etc.), system data After executing a normal process for updating (application program, billing data, etc.), the process returns to S180.

Here, the outline of the normal process will be described with reference to the sequence diagram shown in FIG.
That is, the roadside device 3 that has received the status and the authentication number from the in-vehicle device 1 determines that it is a normal process from the contents, and executes mutual authentication using the authentication number.

  If the mutual authentication is successful, a command for realizing the processing selected according to the status content is transmitted. Here, when the in-vehicle device 1 executes the application program, user data (billing data and monitoring data) is generated and transmitted to the management center 5 by road-to-vehicle communication. An example set in is shown. In response to this status, the roadside device 3 transmits an “information request command”, and as a response, user data generated by the in-vehicle device 1 is transmitted to the roadside device 3 side. Such command exchange is repeated as many times as necessary in accordance with the contents of the status. The user data transferred to the management center 5 is processed by the maintenance control unit 53 (monitoring data) and the charge collection control unit 54 (billing data and monitoring data).

  Next, various processes (power supply monitoring process, IC card monitoring process, ERP process) realized by the in-vehicle device 1 by the downloaded application program will be described with reference to flowcharts shown in FIGS.

  First, the power supply monitoring process will be described. As shown in FIG. 5, when this processing is started, first, in S210, the position and time when the power supply to the main unit 10 is cut off regardless of whether the ignition (IG) switch is not turned off. It is determined whether or not the power-off data to be expressed is stored in the storage unit 17. If the power-off data is not saved, it is assumed that the operation of the apparatus has been normally completed at the previous activation, and the process directly proceeds to S230. On the other hand, when the power-off data is stored, the process proceeds to S220, monitoring data is created based on the power-off data, the status is “sent”, and the process proceeds to S230.

  Thereby, when the vehicle M enters the communication area of the roadside device 3, the monitoring data created in S220 by road-to-vehicle communication is transmitted to the management center 5 via the roadside device 3.

  In S230, it is determined whether or not power-off has been detected. If not detected, the same step is repeatedly executed to stand by. The detection of the power interruption can be determined by a detection signal output from the power supply circuit 16 when the power supply from the in-vehicle battery is interrupted and the power supply from the internal battery 15 is switched.

  Then, when power-off is detected, the process proceeds to S240, and it is determined whether or not the IG switch is turned off. If it is turned off, it is determined that the power is off normally. A process for normally stopping the operation is performed, and this process is terminated.

  That is, even if the IG switch is turned off and the power supply from the in-vehicle battery is interrupted, the power supply from the internal battery 15 is continued. Processing such as saving data to be stored in the storage unit 17 is performed.

  On the other hand, if it is determined in S240 that the IG switch is not turned off, the process proceeds to S260 as an abnormal situation based on a failure or an illegal act, and a power-off is displayed on the display unit 14.

  In subsequent S270, the positioning data (position / time) is acquired from the position detection unit 20, and is stored in the RAM constituting the control microcomputer 18 as power-off data. In subsequent S280, it is determined whether or not a predetermined set time has elapsed since the power-off was detected. If the set time has not elapsed, the process proceeds to S290, in which power supply from the in-vehicle battery has been resumed. Judge whether or not.

If the power supply has not been resumed, the process returns to S280. If the power supply has been resumed, the process proceeds to S300 to cancel the power-off display on the display unit 14, and then returns to S230.
On the other hand, if it is determined in S280 that the set time has elapsed, the process proceeds to S250, the operation stop process is performed as described above, and the process is terminated. At this time, the power-off data stored in the RAM in S270 is saved in the storage unit 17. Therefore, when this processing is started next time, the power-off data is processed into monitoring data by the processing of S210 and S220 and transmitted to the management center 5 by road-to-vehicle communication.

  In other words, in this process, when the IG switch is not turned off despite the fact that the power failure has been detected, and the state continues for the set time or longer, this is regarded as an abnormal situation, and the position where the power failure has occurred. The power-off data representing the time is stored, and when road-to-vehicle communication becomes possible after that, this is transmitted to the management center 5 as monitoring data.

  Next, the IC card monitoring process will be described. As shown in FIG. 6, when this process is started, first, in S410, “vehicle ID”, which is a unique number for each in-vehicle device 1 assigned at the time of manufacture, is set as identification information, and “card invalid” is set as a status. In subsequent S420, it is determined whether or not the IC card 30 is attached to the card interface 13.

  If the IC card 30 is mounted, the process proceeds to S430 and card authentication processing is executed. In subsequent S440, the mounted IC card 30 can be used in this system based on the result of the card authentication processing. It is determined whether or not.

If the IC card 30 is unusable, the process proceeds to S480 as it is, and if it is usable, the process proceeds to S450, and the identification information read from the IC card 30 is “user ID”.
The status is rewritten to “card valid” and the process proceeds to S480.

If it is determined in the previous S420 that the IC card 30 has not been mounted, the process proceeds to S460, where the display unit 14 is caused to display a mounting prompt for prompting the IC card 30 to be mounted.
In subsequent S470, it is determined whether or not a predetermined time has elapsed since the start of the installation reminder display. If the predetermined time has elapsed, the process returns to S420 to wait for the IC card 30 to be mounted, and when the predetermined time has elapsed. Assuming that the IC card 30 is not attached, the process proceeds to S480.

  In step S480, the card interface is monitored by repeatedly executing the same step. If the card mounting state changes, the process returns to step S410, and the processes in steps S410 to S470 described above are repeated.

  That is, when the IC card 30 is attached, the user ID recorded on the IC card 30 is used as identification information for identifying the beneficiary receiving the service, and the IC card 30 is not attached. The vehicle ID unique to the in-vehicle device 1 is used as identification information instead of the user ID.

Next, the ERP process that is one of the accounting processes will be described.
However, the position detection unit 20 generates positioning data at regular intervals based on the received signal from the GPS antenna A as a connection device application program during the previous registration process, and the positioning data is stored in the main unit 10. When the communication with the main unit 10 is detected, the subsequent positioning data is accumulated in the storage unit 24 as history data, and then the communication with the main unit 10 is resumed. It is assumed that what implements the process of transferring history data to the main unit 10 in response to a request from the unit 10 has been set up.

In addition, this process is assumed to be repeatedly started at regular time intervals after the application is started in S170.
As shown in FIG. 7, when this process is started, first, in S510, the positioning data is acquired by transmitting a command to the position detection unit 20, and in the subsequent S520, the positioning data is successfully acquired. Determine whether or not. If the acquisition is successful, the process proceeds to S530, and this time, it is determined whether or not the operation mode is set to “GPS disconnection mode”.

  If it is not “GPS disconnection mode”, the process proceeds to S540, and whether or not the vehicle M is located in the charging area based on the charging area data acquired by downloading and the positioning data acquired in S510. If it is determined that it is not within the billing area, the process is terminated.

  On the other hand, if it is determined in S540 that the vehicle M is located in the billing area, the process proceeds to S550 and the positioning data is stored. In the subsequent S560, the vehicle M is based on the stored positioning data. It is determined whether or not the current traveling state satisfies the charging condition, and if not, the process is terminated.

  The billing conditions include, for example, billing when entering the billing area, billing every time the staying time in the billing area elapses, and dividing the billing area and changing the classification. (For example, higher as the city center is approached), a fee that changes according to the time zone, or a combination of these may be considered and may be appropriately selected according to the purpose of ERP. .

If it is determined in S560 that the charging conditions are satisfied, the process proceeds to S570, where charging data is created so that charges are collected according to the charging conditions, and the contents are displayed on the display unit 14. At the same time, the status is set to “with transmission”, the billing data is set to be transmitted to the management center 5 by road-to-vehicle communication, and this processing is terminated.

  The billing data includes billing information indicating a fee to be collected according to billing conditions, identification information set in the previous IC card monitoring process (that is, a user read from the IC card 30 when the IC card 30 is mounted). ID, the vehicle ID when the IC card 30 is not mounted, and route information including a positioning data group that is the basis for charging are included.

  Then, by performing road-to-vehicle communication between the vehicle M and the roadside device 3, the toll collection control unit 54 of the management center 5 that has received the billing data checks the validity of the billing information based on the route information. If the validity is confirmed, a procedure for actually collecting a fee is performed based on the identification information. Specifically, when the user ID is set as the identification information, the charge is deducted from the bank account specified from the user ID, while when the vehicle ID is set, Billing or IC card 30 is not attached to the purchaser of the in-vehicle device 1 specified from the vehicle ID or the owner of the vehicle in which the in-vehicle device 1 is incorporated using some method (for example, mail) A warning is given about what happened.

  By the way, when acquisition of positioning data from the position detection unit 20 fails in the previous S520, the process proceeds to S630, and it is determined whether or not the current operation mode is the “GPS disconnection mode”. If it is not “GPS disconnection mode”, it is assumed that the communication with the position detection unit 20 has changed to an abnormal situation in which communication is impossible, and the process proceeds to S640 and the operation mode is set to “GPS disconnection mode”. At the same time, the positioning data acquired last from the position detection unit 20 is stored as start data, and this processing is terminated.

Further, when it is determined in S630 that the current operation mode is the “GPS disconnection mode”, it is assumed that an abnormal situation is continuing, and this processing is terminated.
Further, when it is determined in the previous S530 that the current operation mode is the “GPS disconnection mode”, a normal state in which communication is possible is restored from an abnormal situation in which communication with the position detection unit 20 is impossible. As a result, the process proceeds to S580, where the “GPS disconnection mode” is canceled, and the positioning data acquired in the previous S510 is stored as return data.

Continued In S590, the stored start data at S640, and thereby create a monitoring data composed of the stored return data at S580, and the status to "Yes transmission", the management monitoring data by road-vehicle communication center 5 Set to be sent to.

In subsequent S600, the history data accumulated while the operation mode is the “GPS disconnection mode” is acquired from the position detection unit 20, and the process proceeds to S540.
In the above description, the processing of S540 to S570 is only for the positioning data acquired in S510. However, in the case of shifting from S600, the history data acquired in S600 and the positioning acquired in S510. The same processing is executed for all data.

  That is, even if an abnormal situation (GPS disconnection mode) occurs in which communication between the main unit 10 and the position detection unit 20 is interrupted by the execution of this process, if the position detection unit 20 is operating normally, Since the positioning data is left as history data, charging is correctly performed based on the history data, and the management center 5 is also notified of the start position / time and return position / time of the abnormal situation. .

  As described above, in the automatic billing system of the present reference example, the in-vehicle device 1 always downloads the application program necessary for receiving the automatic billing service via the road-to-vehicle communication, thereby making sure that the management center 5 Have been to get from. In addition, the management center 5 stores the information related to the downloaded in-vehicle device 1 (the model of the main unit 10, the presence / absence of the connected device, the connected device model, the setup log of the downloaded application program, etc.) as user data. Has been.

  Therefore, according to the automatic billing system of the present reference example, the in-vehicle device 1 that is operating in the management center 5 can be reliably grasped, and the use of the in-vehicle device 1 loaded with an illegal application program can be prevented. it can.

  Further, when there is an abnormality in the operation of the in-vehicle device 1, the device is modified by comparing the current state of the in-vehicle device 1 with user data (device configuration and setup log) stored in the management center 5. It is possible to confirm the presence or absence of fraudulent acts on the in-vehicle device 1 such as falsification of programs and programs.

  Also, in the automatic charging system of this reference example, when an abnormal situation (power interruption, GPS interruption, etc.) occurs, the starting position / time (GPS interruption mode start data, power interruption data) and return to normal state Monitoring data is created from the positioning data representing the position / time (GPS disconnection mode return data), and this is notified to the management center 5.

  Therefore, in the automatic billing system of the present reference example, the management center 5 can grasp the occurrence state of the abnormal situation of each in-vehicle device 1 and if the in-vehicle device 1 is operating normally according to this, It is possible to collect charges that would have been charged, and to add penalties such as warnings, fines, prohibition of use, etc. to the user (owner) of the in-vehicle device 1 that frequently becomes abnormal Therefore, it is possible to suppress fraud.

  Further, in the automatic charging system of this reference example, when the IC card 30 storing the user ID is not attached as the identification information for specifying the charging target, the vehicle ID unique to the in-vehicle device 1 is used. It is supposed to be. For this reason, it becomes possible to charge the purchaser of the in-vehicle device 1 specified by the vehicle ID and the owner of the vehicle in which the in-vehicle device 1 is incorporated, and the fee can be collected reliably.

  In this reference example, since the status included in the response signal of the polling signal indicates the mounting state of the IC card 30, the roadside device 3 can check the IC card 30 only by confirming this status. Violated vehicles that are not attached can be immediately identified. For example, when the in-vehicle device 1 can perform billing processing by ETC, the vehicle M is going to pass through the gate at the toll gate. The response to the vehicle can be performed reliably and promptly.

In this reference example, when returning from the GPS disconnection mode (S530-YES), monitoring data consisting of start data and return data is created (S580, S590) and transmitted to the management center 5 and position detection is performed. Based on the history data stored in the unit 20, the in-vehicle device 1 side creates billing data in the GPS disconnect mode (S600, S540 to S570). For example, as shown in FIG. Monitoring data is created by adding history data to the data and return data (S580, S600, S630) and transmitted to the management center 5. Based on this monitoring data, the management center 5 determines whether or not there is a charge. You may do it.

  For example, if the version of the system data used (charging area, charging condition data, application program) is displayed in the status included in the response signal to the polling signal, the revision of these system data is possible. If there is, the roadside device 3 (that is, the management center 5) side can determine whether or not the system data of the in-vehicle device 1 has been updated only by referring to the status. Re-downloading can be performed easily, reliably, and almost simultaneously in a short period of time.

  Further, the in-vehicle device 1 may be configured to be able to obtain information from the ECU or the like via the in-vehicle LAN. In this case, as charging conditions, for example, the engine operating time, the exhaust gas amount, etc. May be added. When such billing conditions are introduced, an effect of reducing exhaust gas is expected, so that the environment can be improved.

  By the way, in this reference example, application programs (power supply monitoring processing, IC card monitoring processing, ERP processing) are downloaded by road-to-vehicle communication, but these are installed in the in-vehicle device 1 from the beginning as basic programs. In addition, the configuration may be such that only the data relating to the accounting area and accounting conditions can be changed, or the application program installed from the beginning can be updated with the application program acquired by downloading.

  In this reference example, the position detection unit 20 is also configured to download an application program, but has a function of outputting positioning data in response to a command from the main unit 10 as a basic program. May be used. Further, the position detection unit 20 may be configured to receive power supply via the main unit 10.

Further, in the present reference example, an in-vehicle device that supports automatic billing using an existing ETC may be used as the main unit 10. However, in this case, the ETC-compatible in-vehicle device needs to have a function of downloading an application program by road-to-vehicle communication with the roadside device 3 and an external device interface to which the position detection unit 20 can be connected. According to this, the user of the ETC-compatible in-vehicle device can cope with automatic billing by ERP by adding the minimum necessary configuration (position detection unit 20).
[Embodiment]
Next, an embodiment of the present invention will be described.

Since the present embodiment is only partially different in configuration from the above-described reference example, only the differences will be described.
In the above reference example, the DSRC communication circuit 12 is used for communication with the management center 5. However, in this embodiment, as shown by a dotted line in FIG. It is configured to connect two-way communication via the mobile phone 40.

Next, remote maintenance processing executed by the maintenance control unit 53 of the management center 5 will be described with reference to the flowchart shown in FIG.
That is, in S710, it is determined whether or not the inquiry timing is set in advance, and if it is the inquiry timing, the process proceeds to S720 to connect with the mobile phone 40 attached to the in-vehicle device 1, and the main unit 10 reads the setup log stored in the storage unit 17.

  In subsequent S730, the setup log on the in-vehicle device 1 side read in S720 is compared with the setup log stored in the user data management unit 52 of the management center 5, and the process proceeds to S760.

  On the other hand, if it is determined in S710 that it is not the inquiry timing, the process proceeds to S740, and it is determined whether monitoring data is received from the in-vehicle device 1 by road-to-vehicle communication. If monitoring data has not been received, the process returns to S710. If monitoring data has been received, the process proceeds to S750, and after analyzing the monitoring data, the process proceeds to S760.

  In S760, if it is determined from the comparison in S730 that the setup logs of the two match or the result of the analysis in S750 is that the in-vehicle device 1 has been cheated, the process directly proceeds to S710. On the other hand, if there is a difference between the setup logs of the two, or if it can be determined that the in-vehicle device 1 has been fraudulent, the process proceeds to S770 and system data is transmitted via the mobile phone 40 or the roadside device 3. After executing the re-setup process for executing download, the process returns to S710.

  As described above, according to the automatic billing system of the present embodiment, since the mobile phone 40 is connected to the in-vehicle device 1 and the state of each in-vehicle device 1 can be regularly monitored, It can be detected promptly.

  The in-vehicle device 1 is configured so that the downloaded application cannot be executed when the monitoring data is created, and the management center 5 is configured to always start the re-setup process when the monitoring data is received. May be.

1 is an overall configuration diagram of an automatic billing system. It is a block diagram showing the structure of the vehicle-mounted apparatus of embodiment. It is a flowchart showing the content of the main process which a main body unit performs. It is a sequence diagram showing the outline | summary of the registration process by road-to-vehicle communication, and a normal process. It is a flowchart showing the content of an application program (power supply monitoring process). It is a flowchart showing the content of an application program (card monitoring process). It is a flowchart showing the content of an application program (ERP process). It is a flowchart showing the modification of ERP processing. It is a flowchart showing the content of the remote maintenance process which a management center performs.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... In-vehicle device, 3 ... Roadside device, 5 ... Management center, 10 ... Main unit, 11, 21 ... External device interface, 12 ... DSRC communication circuit, 13 ... Card interface, 14 ... Display part, 15, 22 ... Internal battery , 16, 23 ... power supply circuit, 17, 24 ... storage unit, 18 ... control microcomputer, 20 ... position detection unit, 25 ... GPS receiver, 30 ... IC card, 40 ... mobile phone, 51 ... system data management unit, 52 ... User data management unit, 53 ... maintenance control unit, 54 ... charge collection control unit, A ... GPS antenna, C ... communication cable, M ... vehicle, N ... communication network, ST ... GPS satellite

Claims (4)

A service providing system capable of providing a specific service via the in-vehicle device by causing the in-vehicle device to acquire an application program by wireless communication with an external management device and causing the in-vehicle device to execute the acquired application program. In
The in-vehicle device stores a setup log of the application program in the storage unit of the in- vehicle device, and detects an abnormal situation that may have occurred due to an improper act applied to the in-vehicle device. Create monitoring data indicating that it has been detected, send it to the management device via the wireless communication,
The management device registers the in-vehicle device that has executed the download of the application program, stores a setup log of the downloaded application program as user data, and at each inquiry timing set in advance, When the setup log stored in the in-vehicle device is read via communication, the setup log read in is compared with the setup log stored in the management device , and as a result of the comparison, there is a difference between the two setup logs Or a service providing system for executing a re-setup process for causing the in-vehicle device to re-acquire an application program from the management device when the monitoring data is received from the in-vehicle device via the wireless communication .   Although it is detected that the power supply to the in-vehicle device is interrupted, the abnormal state is when the IG switch is not turned off and the state continues for a set time or more. The service providing system according to claim 1.   The in-vehicle device is
  A position detection unit that generates positioning data including a current position and a measured time based on a signal from a GPS satellite;
  A main unit that is connected to the position detection unit via a communication cable and that acquires and executes the application program;
  Consists of
  When the application program executes ERP processing for charging based on whether the vehicle equipped with the in-vehicle device is located in the charging area based on the positioning data acquired from the position detection unit, The service providing system according to claim 1, wherein a state where communication with the position detection unit is impossible is set as the abnormal situation.   The main body unit starts the positioning data acquired last from the position detection unit before the abnormal situation occurs, and returns to a state where communication with the position detection unit is possible from the abnormal situation. The positioning data first acquired from the position detection unit is stored as return data, and the monitoring data including the start data and the return data is created at a timing when the return from the abnormal situation occurs. The service provision system described.

Images