WO2019111907A1

WO2019111907A1 - Updating device and updating system

Info

Publication number: WO2019111907A1
Application number: PCT/JP2018/044604
Authority: WO
Inventors: 恭一中熊; 秀敏寺岡; 浩小高; 靖永井; 祖父江　恒夫
Original assignee: クラリオン株式会社
Priority date: 2017-12-06
Filing date: 2018-12-04
Publication date: 2019-06-13
Also published as: JP2019101917A

Abstract

This updating device comprises: a memory in which a plurality of data files are stored; a communication unit which receives updating files from a server device; an overlay management unit which sets a read-dedicated image layer containing a plurality of data files which is a file path of the memory, a read/write-enabled container layer which is a file path of the memory, and a container mount which is a file path in the memory; an overlay execution unit which constitutes the container mount as an superimposed file state with the image layer as the lower layer and the container layer as the upper layer, and which executes overlay processing in which the writing to the container mount is writing to the container layer; and an updating unit which writes to the container mount using updating files, updating at least some of a plurality of data files.

Description

Update device, update system

The present invention relates to an update device and an update system.

In recent years, with the improvement of the technical level of vehicles, control of vehicles has been automated by an electronic control unit (ECU: Electric Control Unit), and sophistication and softwareization have progressed. Along with that, the increase in software caused by software problems is also increasing. In particular, devices such as ECUs and IVI (In-Vehicle Infotainment) and TCU (Telematics Communication Unit) have come to be mounted on a large number of vehicles, and software update thereof is important. Under such circumstances, there is a growing need for a service for remotely updating car ECUs and IVI software updates that have been conducted by mechanics. Among them, OTA (Over The Air), which updates software for in-vehicle devices using wireless, is increasing in focus, and it is necessary to cope with the increase in the size of software installed in devices as the performance of devices increases. . There is also a strong need for software updates without stopping the system, such as effectively using less storage and performing background updates while driving. Patent Document 1 includes an update work terminal for storing the latest version of the boot loader, and an update target device for controlling the control target device without stopping, the first update target device being the execution region of the boot loader. The boot loader management table having a second boot loader area, update information corresponding to the first and second boot loader areas, and the latest version of the boot loader downloaded from the update work terminal, with reference to the boot loader management table A software update system is disclosed, comprising: a boot loader management unit that updates a boot loader area that has not been updated last time based on update information.

Japanese Patent Application Laid-Open No. 2004-157767

In the invention described in Patent Document 1, a large storage area is required to update data.

The update apparatus according to the first aspect of the present invention is a storage unit in which a plurality of data files are stored, a communication unit that receives an update file from a server device, and a file path of the storage unit, the plurality of data files being An overlay management unit for setting a container mount, which is a read-only image layer included, a file path of the storage unit, which is readable and writable, and a file path of the storage unit, the container mount; The lower layer is a file state in which the container layer is superimposed on the upper layer, and the writing process on the container mount is an overlay execution unit that executes an overlay process of writing on the container layer, and the update file Write to the container mount There, and a update unit for updating at least a portion of said plurality of data files.
An update system according to a second aspect of the present invention is an update system including a server apparatus and an update apparatus connected by a network, wherein the update apparatus is a storage unit in which a plurality of data files are stored, and the server apparatus A communication unit that receives an update file from the storage unit, a read-only image layer that is the file path of the storage unit and that includes the plurality of data files, a read / write container layer that is the file path of the storage unit, and the storage unit Overlay management unit for setting a container mount, which is a file path, and the container mount in a file state in which the image layer is a lower layer and the container layer is an upper layer, and the writing process to the container mount is Write to the container layer The server apparatus includes: an overlay execution unit that executes a burley process; and an update unit that writes to the container mount using the update file and updates at least a part of the plurality of data files. Server storage unit in which the data file of the above is stored, an update file storage unit in which the update file to be transmitted to the update device is stored, a server communication unit for transmitting the update file to the update device, the server storage unit A read-only server image layer including the plurality of data files, a file path of the server storage unit, a readable and writable server container layer, and a server container mount that is the file path of the server storage unit; A server overlay management unit to set up, and Tenamount executes server overlay processing in which the server image layer is the lower layer and the server container layer is the upper layer and the file is in the file state, and the writing process to the server container mount is writing to the server container layer A server overlay execution unit; and a server update unit that writes to the server container mount using the update file and updates at least a part of the plurality of data files, the server overlay execution unit The second server overlay process is further executed in a state in which the first server overlay process is effective, and the server image layer in the second server overlay process is processed by the server controller in the first server overlay process. The file path set in the tena mount is set, the server overlay execution unit executes a plurality of the server overlay processes, and in any of the plurality of server overlay processes, the server overlay immediately before the server overlay on the server image layer The file path set in the server container mount in the process is set, and the server device uses the file path set in the server container mount in the latest server overlay process created by the server overlay execution unit as a copy source. The server communication unit further includes a server layer combining unit that merges a plurality of updates by the server updating unit by copy processing for copying a merge path that is a predetermined file path, and the server communication unit copy The rollup information which is the information of the plurality of files is transmitted to the update device, and when the update device receives the rollup information from the server device, the update process cancels the overlay processing and replaces the plurality of data files. Use the rollup information.

According to the present invention, data can be updated with a small storage area.

A diagram showing a configuration of an update system in the first embodiment Diagram showing information stored in the storage 48 of the update device 10 Hardware configuration of update device 10 Hardware configuration of server device 2 Diagram showing data file 330 A diagram showing the structure of the update file 307 Diagram showing the configuration of binary file 310 A diagram showing the structure of the difference file 305 A diagram showing the configuration of difference data 306 A diagram showing the structure of the archive file 308 Diagram showing the configuration of layer image file 309 Diagram showing the configuration of file information Diagram explaining the overlay mount Diagram showing file configuration 6 The figure which shows the state in which the overlay 251 was formed Diagram illustrating multiple mounts Diagram showing an example of management information 7 FIG. 18A shows a list of data files in each version of the operation example, and FIG. 18B shows the contents of the update file 307 in the operation example. Diagram showing the file configuration after updating to version 4 in the operation example A diagram showing the configuration of a data file after performing merge processing from the state shown in FIG. Diagram showing transitions of the soft execution path 70, the soft update path 71, and the layer combining path 72 in the operation example Flow chart showing update process of data file 330 Flow chart showing details of overlay mounting process Flowchart showing details of merge processing Flowchart showing details of rollback processing The figure which shows an example of the screen display which inquires the propriety of the update in a modification The figure which shows the constitution of the renewal system in the form of 2nd execution A diagram showing an example of management information 7A The figure which shows the constitution of the renewal system in the form of 3rd execution Flow chart showing update processing of data file 330 in the third embodiment The figure which shows the constitution of the renewal system in the form of 4th execution Flowchart representing the operation of the difference update unit 36 A diagram showing an example of management information 7B in the fifth embodiment Flowchart representing the operation of the rollback unit 47 in the fifth embodiment

-First embodiment-
Hereinafter, a first embodiment of the update device according to the present invention will be described with reference to FIGS. 1 to 25.

(System configuration)
FIG. 1 is a diagram showing the configuration of an update system including the update device 10. The update system includes the vehicle 1 and the server device 2. The vehicle 1 and the server device 2 communicate with each other via the communication network 5. The communication network 5 may include the Internet. Since the update device 10 is mounted on the moving vehicle 1, wireless communication is included in the communication network 5 itself or the communication path from the update device 10 to the communication network 5.

The server device 2 includes a storage 165 and a server communication unit 20. The update file 307 is stored in the storage 165 of the server device 2. The server communication unit 20 transmits the update file 307 to the update device 10 via the communication network 5.

The update apparatus 10 has, as its functions, an update management unit 30, a communication unit 31, an update unit 33, an execution unit 34, an overlay execution unit 35, an execution layer specification unit 37, and an update start determination unit 38. Update layer specification unit 39, layer file synthesis unit 40, synthesis range specification unit 41, update file storage unit 42, backup unit 43, storage remaining amount detection unit 44, unnecessary layer deletion unit 45, management information 7 includes an overlay management unit 46, a rollback unit 47, and an HMI unit 49. The update device 10 includes a storage 48. The information stored in the storage 48 will be described later with reference to FIG. The storage 48 is a non-volatile storage device such as a hard disk drive, a solid state drive (SSD), a flash memory, an optical disk or the like.

The update management unit 30 communicates with the server device 2 using the communication unit 31, and inquires whether it is necessary to update a data file 330, which will be described later, stored in the update device 10. When it is determined that the update is necessary, the update management unit 30 downloads the update file 307 using the communication unit 31 and temporarily stores the update file 307 in the storage unit 151 using the update file holding unit 42. Then, the update management unit 30 updates the data file 330 stored in the storage 48 using the update file 307. In this embodiment, DM (Device Management) defined in OMA (Open Mobile Alliance) is assumed, and the update management unit 30 is a DM client defined in OMA. Note that OMA DM is a type of technology used for software update of mobile phones, and is a mechanism for exchanging information necessary for software update between a server and a client through access to a tree-like database called tree-DB. It is.

The communication unit 31 is an information communication unit that communicates with the server device 2. The communication unit 31 receives the update file 307 from the server device 2. Although the communication protocol used for this reception is not particularly limited, for example, TCP / IP, UDP / IP, HTTP, HTTPS, FTP, etc. can be used. The update unit 33 updates the data file 330 stored in the storage 48 using the update file 307 stored in the storage unit 151 by the update file storage unit 42 described later. The updating unit 33 uses a directory described in the software update path 71 described later as a root directory, that is, a root directory, and performs update processing of the data file 330 with respect to files and directories arranged thereunder.

The execution unit 34 causes the control unit 152 described later to execute the program included in the data file 330. The execution unit 34 executes an execution process on a file or directory located thereunder, with the directory described in the software execution path 70 described later as a base point directory. The update unit 33 and the execution unit 34 can operate at the same time. The overlay execution unit 35 executes an overlay mount instruction in Linux (registered trademark) which is an OS. The specific operation will be described later with reference to FIG.

The execution layer designation unit 37 designates a directory in which the data file 330 to be processed by the execution unit 34 is stored. The execution unit 34 causes the control unit 152 to execute a program stored under the directory designated by the execution layer designation unit 37 on the premise that this designation is performed. The update layer designation unit 39 designates a directory in which the data file 330 to be processed by the update unit 33 is stored. The aforementioned update unit 33 updates the data file 330 below the directory designated by the update layer designation unit 39 on the premise that this designation has been made.

The update start determination unit 38 determines the timing at which the update unit 33 should start the operation, and outputs an operation command to the update unit 33. The timing at which the updating unit 33 should start operation is, for example, the timing of receiving the data file 330 from the server device 2, the timing designated by the server device 2, the timing of receiving notification from the storage residual amount detecting unit 44, etc. . Further, the timing at which the updating unit 33 should start operation may be timing at which the engine of the vehicle 1 is started.

The layer file combining unit 40 combines a plurality of layers specified by the combining range specification unit 41 into one layer. The specific operation will be described later with reference to FIG. The synthesis range designation unit 41 designates a layer to be integrated by the layer file synthesis unit 40. The update file holding unit 42 stores the data file 330 received from the server device 2 in the storage 48. The backup unit 43 stores the integrated layer generated by the layer file synthesis unit 52 in the storage 48.

The storage remaining amount detection unit 44 calculates the total capacity and free capacity of the storage 48, and notifies the update start determination unit 38 when the free capacity is smaller than a predetermined threshold. The unnecessary layer deleting unit 45 deletes the unnecessary layer from the storage 48 after being integrated by the layer file synthesizing unit 52 and backed up by the backup unit 43 to a storage or the like.

The overlay management unit 46 manages a plurality of overlays described later using management information 7 described later. Hereinafter, multiple overlays are also called multiple mounts. Specific processing of the overlay management unit 46 will be described with reference to FIG. The rollback unit 47 uses the overlay management unit 46 and the unnecessary layer deletion unit 45 to restore the data file 330 of the update device 10 to the initial state. Specifically, the rollback unit 47 deletes from the storage 48 the data file included in the layer recorded in the record other than the record created first among the records described later, and is created in the second or later. Delete all records. Thus, the updating device 10 can be easily returned to the initial state. Therefore, the rollback unit 47 can also be called an initialization unit.

The HMI unit 49 provides a display of output information of a program operated by the update device 10 and a user interface function of delivering input received from the user to the program. The HMI unit 49 displays processing results and log information of the updating unit 33 and the executing unit 34 on an HMI described later.

(Held data of storage 48)
FIG. 2 is a diagram showing information stored in the storage 48 of the update device 10. As shown in FIG. In the storage 48, a data file 330, a soft execution path 70, a soft update path 71, and a layer combining path 72 are stored. The soft execution path 70, the soft update path 71, and the layer combining path 72 are storage areas in which information of paths necessary for the operation of the updating apparatus 10 is stored. A value is stored in advance in the software execution path 70 at the time of factory shipment of the update device 10, and the value is rewritten along with the update of the data file 330. Details will be described later.

(Hardware configuration of update device)
FIG. 3 is a hardware block diagram of the update device 10. As shown in FIG. The update device 10 includes a storage unit 151, a control unit 152, a storage 48, a network I / F 153, a bus 154, and an HMI 155. The control unit 152 is a central control unit, that is, a CPU. The control unit 152 loads the program included in the data file 330 stored in the storage 48 in the storage unit 151 and executes the program. The storage unit 151 is a main storage device, for example, a RAM. The storage unit 151 temporarily stores information handled by the control unit 152, and exchanges data via the bus 154.

The storage 48 is a non-volatile storage device as described above. The update device 10 can change the operation of the update device 10 by updating the data file 330 stored in the storage 48. A network I / F 153 is an interface that wirelessly transmits and receives information via a bus, and supports, for example, communication standards such as LTE, 3G, 4G, WiMax, WiFi, infrared, and CSMA / DA. The network I / F 153 may be a network used inside the vehicle 1, for example, an interface of a CAN (Controller Area Network).

The HMI 155 is hardware capable of inputting and outputting information, and is, for example, a touch panel capable of displaying an image and performing a touch operation. However, the HMI 155 may be configured by combining a liquid crystal display that can only output information and a button that can only input information. Note that the update device 10 may not include the HMI 155, and an input / output device connected via the bus 154 or the network I / F 153 may be used as the HMI 155. That is, the HMI 155 may not have a button operated by the user or a display for presenting information to the user.

The update device 10 is, for example, an ECU, a TCU, an IVI, an MPU (Map Processing Unit), a gateway, a display, a smartphone, a feature phone, a tablet terminal, a head mounted display, and the like. The IVI is, for example, a car navigation device, and the gateway is a device that connects a plurality of communication networks mounted on the vehicle 1 and enables mutual data communication. The MPU is a device that creates a map around the traveling route based on the information acquired from the sensor.

(Hardware configuration of server device)
FIG. 4 is a hardware configuration diagram of the server device 2. The server device 2 includes a storage unit 161, a control unit 162, a storage 165, a network I / F 163, and a bus 164.

The control unit 162 is a central control unit, that is, a CPU. The control unit 162 expands a program stored in a ROM (not shown) into a RAM (not shown) and executes the program. The storage unit 161 is a main storage device, for example, a RAM. The storage unit 161 temporarily stores information handled by the control unit 162. The storage 165 is a non-volatile storage device such as a hard disk drive, an SSD, or a flash memory. The network I / F 163 is an interface that transmits and receives information wirelessly via the bus 164, such as LTE, 3G, 4G, WiMax, WiFi, infrared, CSMA / DA, and the like. The server device 2 passes the update file 307 stored in the storage 165 by the server communication unit 20 to the communication unit 31 of the update device 10 via the network I / F 163.

(Data file 330)
FIG. 5 shows the data file 330. As shown in FIG. However, the configuration shown in FIG. 5 is an example, and the data file 330 in the present embodiment may include at least one program, that is, an executable file 3101 described later. That is, the data file 330 may include a plurality of programs, or may include binary data other than the programs and the text file 311. The data file 330 may also include a difference file 305, an archive file 308, and a layer image file 309.

The data file 330 is a set of files and directories that can be handled by an OS such as Linux or Windows (registered trademark). Data files 330 may include binary file 310, text file 311, difference file 305, archive file 308, and layer image file 309. Although not shown in FIG. 5, a directory structure may be included.

The text file 311 is a file that can be read directly by humans, and is a file composed of only character codes. The binary file 310 is all files other than the text file 311, and is an audio file such as MP3 format or WAV format, an image file such as PNG format or GIF format, IMG format, ELF format or a. For example, application files in the out format or COFF format. The configuration of the binary file 310 will be described later with reference to FIG. The difference file 305 is a type of binary file 310, and is a file in which the difference between the two files is digitized and generated by a program such as bspatch, xdelta or zdelta as described above. The configuration of the difference file 305 will be described later with reference to FIG.

The archive file 308 is a file in which one or more files and directories are combined into one file, and is a file in a ZIP format, tar format, GZIP format, or the like. The configuration of the archive file 308 will be described later with reference to FIG. The layer image file 309 is a type of archive file that can be used in the overlay mechanism described later, and is assumed to be a file of ISO format or the like. The configuration of the layer image file 309 will be described later with reference to FIG.

(Update file 307)
FIG. 6 shows the structure of the update file 307. As shown in FIG. However, the configuration shown in FIG. 6 is an example, and the update file 307 in the present embodiment may be capable of updating at least one execution file 3101. That is, the update file 307 may include the executable file 3101 itself or the difference file 305 for updating the executable file 3101. The update file 307 can include a binary file 310, a text file 311, a difference file 305, an archive file 308, and a layer image file 309.

(Binary file 310)
FIG. 7 shows the structure of the binary file 310. As shown in FIG. The binary file 310 is all files other than the text file 311 as described above. The binary file 310 includes an executable file 3101, an image file 3102, a data file 3103, an invisible file 3104, a map data file 3105 and a system file 3106.

The executable file 3101 has an ELF format or a. It is an application file that can be read and executed by the control unit 152 or the control unit 162, that is, a program, such as an out format or a COFF format. The image file 3102 is a still image file such as PNG format, GIF format, or IMG format, or a moving image file such as MP4 format or AVI format. The data file 3103 is data generated when the binary file 310 is executed. The invisible file 3104 is'. It is a file with a file name beginning with '(dot). The map data file 3105 is data obtained by converting map information into binary data in an information terminal such as an IVI or smart phone. A system file 3106 is a file group that configures an OS such as Linux or Windows.

(Difference file 305)
FIG. 8 shows the structure of the difference file 305. As shown in FIG. The difference file 305 is a type of binary file 310, and is a file that is generated by a program such as bspatch, xdelta, zdelta, etc., and the difference between the two files is digitized. The difference file 305 includes a difference header 3051, an original path 3052, and one or more difference data 306. The difference header 3051 is data used by the difference update unit 36, such as information identifying the difference file 305 and the file size. The original path 3052 is the file name of the data file 330 that is the source of the difference update, of the two files used when generating the difference file 305.

FIG. 9 is a diagram showing the configuration of the difference data 306. As shown in FIG. The difference data 306 is composed of an offset 3061, a size 3062 and update data 3063. The offset 3061 is a numerical value indicating which file position of the original data file is to be updated, and is represented by the number of bytes from the beginning. The size 3062 is a numerical value indicating how many bytes from the file position of the offset 3061 are to be rewritten. The update data 3063 is a data string to be written in the range indicated by the offset 3061 and the size 3062.

(Archive file 308)
FIG. 10 shows the structure of the archive file 308. As shown in FIG. The archive file 308 is a file capable of managing a plurality of files in one archive file and is assumed to be an archive file in a ZIP format, tar format, GZIP format or the like. It comprises a header 320 and one or more data 304. The header 320 is a header that stores information indicating where the file managed by the archive file 308 is stored in the archive file 308 and information such as a file name. The data 304 may store and compress the data file 303.

(Layer image file 309)
FIG. 11 shows the structure of the layer image file 309. As shown in FIG. The layer image file 309 is a type of archive file that can be used in the overlay mechanism described later, and is assumed to be a file of ISO format or the like. The layer image file 309 is composed of a header 321 and one or more file information 300. The difference from the archive file 308 is that the data 304 of the archive file is the file information 300, and includes not only the binary data of the file but also the path 301 of the file, the type 302 of the file, and the access authority 303. Therefore, even if the layer image file 309 is not actually expanded into individual files, access to the data file 330 is virtually assumed that a directory or file group exists inside the file configuration 6 in one layer image file. It is possible.

(File information 300)
FIG. 12 shows the structure of file information. The file information 300 is set for each directory and file, and includes a path 301, a type 302, an access authority 303, and data 304. That is, the file information 300 is composed of the information stored in the inode in the format format ext2 and the like, and the data itself. However, in the case of the directory, the data 304 does not exist.

The path 301 is a string indicating the absolute path of the file or directory. If "7f209" of FIG. 14 mentioned later is made into an example, since "7f209" exists under the "4d205", the path | pass 301 is "/ 4d / 7f." The type 302 is information indicating which of a file and a directory. For example, in the case of "7f 209" in FIG. 14, the file type is "file" because it is a file. However, a predetermined bit value may be stored, for example, "0" for a file, and "1" for a directory.

The access authority 303 is information representing the access permission to the file, and represents the presence of the read authority, the write authority, and the execution authority. For example, according to the traditional notation, the right is expressed by a 3-digit number, "4" indicates that you have read permission, "2" indicates that you have write permission, and "1" indicates that you have execute permission. The first digit indicates the owner of the file or directory, the second digit indicates the person who belongs to the same group as the owner, and the third digit indicates the authority of the other user. However, in the present embodiment, since the user is not distinguished, all three digits have the same value.

(Operation of update device 10)
The operation of the update device 10 will be described below, but first, the overlay that is the premise will be described. Next, multiple overlays will be described, and finally, an example of file configuration in the present embodiment and an operation example of updating will be described.

(overlay)
The function of the overlay will be described with reference to FIGS. 13-16. In this embodiment, the overlay mount in Linux is applied to realize a mechanism for updating the data file 330 in the background while executing the data file 330. Overlays can be referred to by overlaying multiple directories as layers, so that writing can be performed on one layer and treated as if writing has been performed without changing files existing in another layer. It is a technology that can Note that this overlay can be realized, for example, by using a function built into the Linux kernel.

The overlay mount will be described with reference to FIG. The overlay 51 is composed of a container mount 61, a container layer 62 and an image layer 63. The container mount 61, the container layer 62, and the image layer 63 can each specify an arbitrary directory, and files are disposed in the container layer 62 and the image layer 63, but files are not disposed in the container mount 61. When creating an overlay mount using the Linux mount command, these three directories are associated with each other to form an overlay. When the overlay is formed, file access to the container mount 61 is treated as access to a file group formed by overlapping the image layer 63 as the upper layer and the container layer 62 as the lower layer. The details will be described below.

The directory specified in the image layer 63 is "/ local / P", and the file A80 and the file C84 are stored in this directory. The directory specified in the container layer 62 is “/ local / Q”, and the file B 82 and the file C 85 are stored in this directory. The file C 84 and the file C 85 have the same file name but different contents. The directory specified for the container mount 61 is "/ ol / R". When the file list stored in “/ ol / R” is acquired after forming the overlay, as shown in FIG. 13, file A 81, file B 83, and file C 86 are obtained.

The substance of the file A81 is the file A80, the substance of the file B83 is the file B82, and the substance of the file C86 is the file C85. The file C84 is not referenced from the container mount 61. In other words, the file C84 is hidden because files of the same name exist in the two layers and the container layer 62 has priority over the image layer 63. is there. Also, when any of the file A81, the file B83, and the file C86 included in the container mount 61 is edited, the edited information is stored in the container layer 62, and the file stored in the image layer 63 is affected by the editing. Absent. The above is the operation of the overlay mounting.

(Multiple overlay)
In the following, multiple overlays on the premise of the above-described overlay will be described by taking file configuration 6, which is a file tree, as an example.

FIG. 14 shows a file configuration 6. In the file configuration 6, for convenience of explanation, the name of the directory is attached with "d", and the name of the file is attached with "f". As shown in FIG. 14, the file configuration 6 has a tree structure starting from the root 201, and five

directories 1d

202,

4d

205,

8d

210,

9d

211, and 11d 213 exist in the root directory of the top layer. In the example shown in FIG. 14, no file exists in the root directory. A plurality of directories existing in the root directory are largely different in position in the horizontal direction in FIG. 14 for the reason for drawing and for the consistency with the drawings to be described later.

2f203 and 3f204 are arranged under 1d202. Under 4d205, 5d206 and 7f209 are arranged. 6f207 is arranged under 5d206. 10f 212 is disposed under 9 d 211. There are no files not shown. For example, there is no file or directory under 8d210. The specific operation of the overlay mount will be described with reference to FIGS. 15 to 16 taking the file configuration 6 as an example.

FIG. 15 is a diagram showing a state in which the overlay 251 is formed. In the

overlay

251, 8d 210 is set in the

container mount

261, 1d 202 is set in the

container layer

262, and 4d 205 is set in the image layer 263. As described above, although there is no file in 8d 210, the formation of overlay 251 treats files and folders as if

4d

205 and 1d 202 were combined and stored in 8d 210. That is, the contents of directory 1 d 202 indicated by reference numeral 230 in FIG. 15 and the contents of directory 4 d 205 indicated by reference numeral 231 are treated like the contents of directory 8 d 210 indicated by reference numeral 232. Specifically, it is treated as if 2f203, 3f204, 5d206, 6f207, and 7f209 are placed under 8d210.

FIG. 16 is a diagram for explaining multiple mounting of overlay mounting. Multiple mounting is a combination of multiple overlays, one container mounting being the other image layer. In the example shown in FIG. 16, an overlay 252 is formed in addition to the overlay 251 described above, 8d 210 is designated in the image layer 266 of the

overlay

252, 9d 211 is designated in the container layer 265, and 11d 213 is designated in the container mount 264. It is specified. Therefore, the container mount 264 is treated as if the file group subordinate to 8d 210 and the file group subordinate to 9 d 211 overlap and exist.

Specifically, in

11d

213, 10f 212,

2f

203,

3f

204,

5d

206, 6f 207 and 7f 209 are treated as being present. Here, when the 10 f 212 included in the container mount 264 is edited, the 10 f 212 subordinate to 9 d 211 is actually edited. If 6f207 of container mount 264 is edited, 6f207 under 4d205 will be edited, but 6f207 and 5d206 are copied to 9d211, and 6f207 under 9d211 after copying is edited from the mechanism of overlay mounting Ru. That is, in the operation to the container mount 261, the contents of the image layer 263 are not edited. The rollback unit 47 can use this to restore the initial state. The above is the description of multiple mounting.

(Management information 7)
FIG. 17 is a diagram showing an example of management information 7 of the overlay management unit 46. As shown in FIG. The management information 7 is composed of 18 records created in advance, and each record has fields of process number, lower path, upper path, and mount path. The serial number field stores the serial number from 1. The lower path field stores the path set in the image layer 63, the upper path field stores the path set in the container layer 62, and the mount path field sets the container mount 61 Is stored. The eighteen records are roughly divided into two groups, ie, 1 to 9 groups and 10 to 18 groups, each corresponding in turn.

In the groups of process numbers 1 to 9, all directory names are “s”, and in the groups of process numbers 10 to 18, all directory names are “t”. That is, in the record of the process number "1", the record of the process number "10" is obtained by changing the directory name from "s" to "t". In each group, the path stored in the mount path of a given process number and the path stored in the lower path of the next process number are the same. All paths stored in the upper path are different. Although nine processing numbers are included in each group in the example shown in FIG. 17, the number of processing numbers included in each group may be any number as long as it is two or more, and may be different in each group. There may also be three or more groups.

When the information shown in FIG. 17 is generalized, the lower path of the process number “k” in each group is the same as the mount path of the process number “k−1”. However, "k" is an integer greater than or equal to "2" and less than or equal to the number of records in each group.

(Operation example)
The operation of the update device 10 will be described with reference to FIGS. 18 to 21 in addition to FIG. 17 showing the management information 7 described above. In this operation example, an operation of updating the data file of the update device 10 from version 1 to version 4 and an operation of merging are described. However, the version mentioned here is for convenience and may be called a revision or a build. Also, the changes of two or more versions described here may be combined into one version of change. Further, in the present operation example, the data file is described as only the file without including the directory for simplification, but as described above, the data file may include the directory structure. Version 1 is the initial configuration of the updating apparatus 10, in other words, the configuration at the time of shipment from the factory.

FIG. 18A is a view showing a list of data files in each version of the operation example, and FIG. 18B is a view showing contents of the update file 307 in the operation example. Data files of all versions consist of files only, with the first character schematically representing the file name and the next character representing the file version. For example, “A1” indicates version “1” of file “A”, and “A1” and “A2” indicate files having the same file name but different versions. Also, circles in the figure indicate changes from the previous version.

As shown in FIG. 18A, the version 1 data file is composed of A1 and B1. The version 2 data file is composed of A1, B1 and C1 with the addition of file C. The version 3 data file is constructed by updating file A and consisting of A2, B1 and C1. The data file of version 4 is composed of A2, B2, C1, and D1 with file B updated and file D added. As shown in FIG. 18B, the contents of the update file 307 that the update device 10 receives first are C1, the contents of the second update file 307 are A2, the contents of the second update file 307 are B2, and It is D1.

FIG. 19 is a diagram showing the file configuration after updating to version 4 in the operation example. The file configuration shown in FIG. 19 includes the respective paths shown in FIG. 17, that is, directories. Furthermore, the file "C1" is placed under the directory "/ s / dif1-2", the file "A2" is placed under the directory "/ s / dif2-3", and the directory "/ s / dif3-" is placed. Files "B2, D1" are placed under "4.", and files "A1, B1" are placed under the directory "/ s / ver1". There are no files in other directories.

In FIG. 19, there are two symmetrical directories “s” and “t” in the root directory. As described later, update is performed using one of the directories, and when a predetermined condition is satisfied, the directory to be used is changed and the update is continued. Therefore, in the following, the directory of "s" or "t" used for updating is referred to as "using side", and the other is also referred to as "not using side" or "opposite side". In the following, the update process will be described first, and then the merge process will be described.

(Operation example | Update process)
FIG. 21 is a diagram showing transitions of the soft execution path 70, the soft update path 71, and the layer combining path 72 in the operation example. The description will be continued below with reference to FIG. When the update device 10 is shipped from the factory, “/ s / ver1” is set in the software execution path 70, and the management number is set to “1”. Further, the data file of the update device 10 is only the files “A1, B1” placed under “/ s / ver1”, and no files are placed in the other directories shown in FIG. Then, the execution unit 34 of the update device 10 executes the file of “/ s / ver1” or less described in the software execution path 70, that is, the file “A1, B1”.

When the update file 307 is received from the server device 2 in this state, the update device 10 performs overlay mounting as follows. That is, based on the description of the record in which the management number of the management information 7 is “1”, the updating apparatus 10 sets “/ s / ver1” described in the field of the lower path as the image layer, and “// described in the field of the upper path Perform overlay mounting with s / dif1-2 "as the container layer and" / s / ver2 "described in the field of mount path as container mount.

Then, the update device 10 writes the received first update file 307 in the container mount “/ s / ver2”. The content of the first update file 307 is only the file "C1" as shown in the first line of FIG. 18 (b). The overlay mount function writes the container mount "/ s / dif1-2", so the file "C1" is written to "/ s / dif1-2". Even while this writing is being performed, execution of the file "A1, B1" is continued. In other words, this write is a background update that takes place in the background.

After that, when the program execution is finished and the update can be reflected, the update device 10 rewrites the software execution path 70 to "/ s / ver2" which is the current mount path, and is included in "/ s / ver2". The execution unit 34 is made to execute the file “A1, B1, C1” to be obtained. Among the three files, the first two have an entity in "/ s / ver1", and the last one has an entity in "/ s / dif1-2". Thus, as shown in the second line of FIG. 18A, the version “2” files “A1, B1, C1” are executed by the execution unit.

Thereafter, when the update device 10 receives the second update file 307 from the server device 2, the update device 10 performs the second overlay mounting as follows. That is, based on the description of the record with the management information 7 number “2”, the update device 10 sets “/ s / ver2” described in the lower path field as an image layer, and “/ s” described in the upper path field Perform overlay mounting with / dif2-3 "as the container layer and" / s / ver3 "described in the field of mount path as the container mount.

Then, the update device 10 writes the received second update file 307 in the container mount “/ s / ver3”. The content of the second update file 307 is only the file "A2" as shown in the second line of FIG. 18 (b). The overlay mount function writes the container mount "/ s / dif2-3", so the file "A2" is written to "/ s / dif2-3". The execution of the file "A1, B1, C1" continues even while this writing is being performed. In other words, this write is a background update that takes place in the background.

After that, when it becomes possible to reflect the update by turning off the ignition, etc., the update device 10 rewrites the software execution path 70 to "/ s / ver3" which is the current mount path, and the file included in "/ s / ver3" The execution unit 34 is made to execute “A2, B1, C1”. Note that these three files exist in order "/ s / dif2-3", "/ s / ver1", and "/ s / dif1-2". The file "A1" exists in "/ s / ver1", but the file "A2" having the same file name A exists in the container layer "/ s / dif2-3", so the file "A1" is The presence of is hidden. Thus, as shown in the third line of FIG. 18A, the version “3” file “A2, B1, C1” is executed by the execution unit.

Thereafter, when the update device 10 receives the third update file 307 from the server device 2, the update device 10 performs the third overlay mount. The details of the operation will be omitted since they will be repeated. Then, the update device 10 writes the received third update file 307 in the container mount “/ s / ver 4”. Thus, the file "B2, D1" is written to "/ s / dif3-4", and the file configuration shown in FIG. 19 is obtained.

After that, when it becomes possible to reflect the update by turning off the ignition, etc., the update device 10 rewrites the software execution path 70 to "/ s / ver4" which is the current mount path, and the file included in "/ s / ver4" The execution unit 34 is made to execute “A2, B2, C1, D1”. The three files are, in order, "/ s / dif2-3", "/ s / dif3-4", "/ s / dif1-2", and "/ s / dif3-4". Thus, the execution unit 34 executes the version 3 file "A2, B2, C1, D1" as shown in the fourth line of FIG. 18A. The above is the description of the update process. Next, merge processing will be described.

(Operation example | Merge process)
FIG. 20 is a diagram showing the configuration of a data file after the merge process has been performed from the state shown in FIG. The merge process is a process of integrating a plurality of layers, specifically, a process of collecting files distributed in a plurality of directories into one directory and further deleting an older version file of the same file name. . In the merge processing illustrated in FIG. 20, files updated to version 4 by the above-described update processing and distributed to a plurality of directories are integrated into “/ t / ver1”. In FIG. 19, the file “A1” and the file “B1” which are old versions of the file A also exist, but they are deleted in FIG.

This merge process is divided into a first process of collecting necessary files into one directory and a second process of deleting unnecessary files. The first process is performed by copying the mount path indicated by the process number, that is, the data file of “/ s / ver 4” to “/ t / ver 1” which is the version 1 directory on the reverse side. This first process corresponds to "cp / s / ver4 / t / ver1" when it is expressed by an input to the shell for inputting an operation command to the OS. That is, the process of excluding the file “A1, B1” from the copy target in the merge process is unnecessary. The reason is as follows. That is, access to the container mount is treated as access to a file group formed by overlapping the image layer as the upper layer and the container layer as the lower layer, and files having the same name are only files existing in the image layer Is referred to.

The second process is performed by deleting all files existing on the side indicated by the process number. This second process corresponds to “rm −rf / s” when it is expressed by an input to a shell for inputting an operation command to the OS. Although the illustrated command also deletes the directory, only the file may be deleted.

(Flowchart | Main processing)
FIG. 22 is a flowchart showing the process of updating the data file 330 performed by the updating apparatus 10. The execution subject of each step described below is the control unit 152 of the update device 10. The updating unit 33 starts the operation shown in FIG. 22 when the updating device 10 is activated, and starts the operation shown in FIG. 22 again when the operation shown in FIG. 22 is completed.

The update device 10 first uses the update start determination unit 38 to determine whether the update should be started (S1001). If it is determined that the update is not started yet, the process remains at S1001. When it is determined that the update should be started, the overlay mounting process (S1200) is performed, and the update process (S1013) is performed. The operation flow of the overlay mounting process (S1200) will be described later with reference to FIG. The update process of S1013 is the writing of the received update file 307 into the software update path 71.

Next, the update device 10 determines whether the unused area of the storage 48 is less than or equal to a predetermined ratio (S1014), and executes merge processing (S1100) when determining that the unused area is less than or equal to the predetermined ratio. The operation flow of the merge process (S1100) will be described later with reference to FIG. If it is determined that the unused area is larger than the predetermined ratio (S1014: NO), the update device 10 determines whether the process number has reached a specified number, specifically, whether the process number has reached the end of each group It is determined whether or not it is (S1015). For example, in the example shown in FIG. 17, when the process number is 9 or 18, an affirmative determination is made in S1015. If it is determined that the process number has reached the specified value, merge processing (S1100) is executed, and if it is determined that the process number has not reached the specified value, the process proceeds to S1016.

In S1016, the updating apparatus 10 sets the mount path to the software execution path 70 (S1016), and invalidates the software update path 71 (S1017). The above is the update process of the data file 330.

(Flowchart | overlay mounting process)
FIG. 23 is a flowchart showing details of the overlay mounting process shown in S1200 of FIG. First, the update device 10 reads the path described in the field of the lower path of the current processing number in the management information 7, and sets the path as read only (S1203). Next, the path described in the field of the upper path of the current processing number in the management information 7 is read, and the path is set to read / write (S1204). Next, the update device 10 reads the path described in the field of the mount path of the current processing number in the management information 7, and sets the path as readable and writable (S1205).

Next, the updating apparatus 10 forms an overlay in which the paths for which the attributes are set in S1203, S1204, and S1205 are an image layer, a container layer, and a container mount (S1206). Next, the update device 10 sets a mount path, that is, a path whose attribute is set in S1205, as the software update path 71 (S1207). Finally, the update device 10 increments the process number, that is, increments the process number by "1" (S1208), and ends the overlay mounting process shown in FIG.

(Flowchart | merge process)
FIG. 24 is a flowchart showing details of the merge process shown in S1100 of FIG. First, the update device 10 acquires the mount path of the process number (S1101). Next, the updating apparatus 10 determines whether the processing number is less than 10, and sets the layer combining path to “/ t / ver1” when determining that the processing number is less than 10 (S1102: YES), When it is determined that the process number is 10 or more (S1102: NO), the layer combining path is set to "/ s / ver1". The processing of S1102 to S1104 is to select a version 1 directory on the opposite side to the side currently being used.

When the layer combining path is set by the processing of S1103 or S1104, the updating apparatus 10 copies the data file of the mount path to the layer combining path (S1105). This copy processing corresponds to substantial merge processing. Next, the updating apparatus 10 sets the layer combining path 72 as the software execution path 70 (S1106), and determines whether the processing number is less than 10 as in S1102 (S1107).

If the update device 10 determines that the process number is less than 10, it deletes the file included in the side currently being used, that is, the file under "/ s" (S1108), and sets the process number to 10 It sets (S1109). When it is determined that the processing number is 10 or more, the update device 10 deletes the file included in the side currently being used, that is, the file under "/ t" (S1110), and sets the processing number to 10 (S1111). After S1109 or S1111, the updating apparatus 10 deletes the character string set in the layer combining path 72 (S1112), and ends the merge processing illustrated in FIG.

(Flowchart | Rollback process)
FIG. 25 is a flowchart showing the details of the rollback process. The rollback unit 47 performs the rollback process according to a command from the server device 2 via the communication unit 31 or a command from the occupant of the vehicle 1 via the HMI unit 49. The rollback processing instruction includes a rollback number indicating to what number of the processing number the rollback is to be performed.

The rollback unit 47 first acquires a rollback number (S1401), and then sets the current processing number as a processing target (S1402). Then, with reference to the management information 7, the file included in the upper path in the current process number is deleted (S1403), and the overlay corresponding to the current process number is canceled (S1404). Next, the process number is decremented, that is, the numerical value of the process number is decremented by "1" (S1405), and the magnitude relationship between the rollback number and the process number is evaluated (S1406). If it is determined that the rollback number is larger than the process number, the process returns to S1402, and if it is determined that the rollback number is less than or equal to the process number, the process illustrated in FIG. 25 ends.

According to the first embodiment described above, the following effects can be obtained.
(1) The update device 10 includes a storage unit 151 storing a plurality of data files, a communication unit 31 receiving the update file 307 from the server device 2, and a plurality of data files as file paths of the storage unit 151. And an overlay management unit 46 configured to set a container mount which is a file path of the storage unit 151 and is a readable and writable container layer and a file path of the storage unit 151. The update device 10 is an overlay execution unit that executes an overlay process in which the container mount is in a file state in which the image layer is a lower layer and the container layer is an upper layer and the writing process to the container mount is writing to the container layer And an update unit 33 that writes data to the container mount using the update file 307 and updates at least a part of the plurality of data files.

The update file 307 is written to the container mount, only the information on the data file to be updated is newly written to the storage unit 151, and the data file without change is not replicated. Therefore, data can be updated with a small storage area. Although writing of the update file 307 is substantially performed to the container layer, the state before the update can be referenced from the image layer and the state after the update can be referenced from the container mount by the overlay mounting mechanism. In other words, the state before and after updating can be obtained without consuming extra storage area. Furthermore, there is no particular limitation on the paths set in the image layer and the container layer, and for example, it is not necessary to set each path in different areas divided in advance, and it is not necessary to secure a wide storage area in advance.

(2) The plurality of data files include executable files. The update device 10 includes an execution unit 35 that executes an executable file present in the software execution path 70 which is a file path of the storage unit 151. When writing to the container mount, the updating unit 33 rewrites the software execution path 70 from the image layer to the container mount. Therefore, the update device 10 can update in the background without interrupting the execution of the executable file included in the image layer.

(3) The overlay execution unit 35 further executes the second overlay processing in a state in which the first overlay processing is valid, and as shown in the management information 7 of FIG. 17 for the image layer in the second overlay processing. , And a file path set for container mounting in the first overlay processing is set. Therefore, the overlay execution unit 35 can configure multiple overlays and can handle multiple updates.

(4) The overlay execution unit 35 executes a plurality of overlay processes. In any of the plurality of overlay processes, the file path set in the container mount in the previous overlay process is set in the image layer. The update device 10 includes the layer combining unit 40 that merges the update performed by the update unit 33 a plurality of times by the copy process in which the file path set in the container mount in the latest overlay process created by the overlay execution unit 35 is a copy source. . Therefore, the update device 10 can extract only necessary data files by the merge process. This extraction can be executed by the copy command of the OS, and the processing is simple.

(5) The updating apparatus 10 includes a processing step (S1014 in FIG. 22) of outputting an operation command to the layer combining unit when the free space of the storage unit 161 falls below a predetermined value. Therefore, merge processing is performed when the free space is reduced, and after the necessary files are extracted, the previous file can be deleted (S1107 to S1111 in FIG. 24).

(6) The update device 10 includes a rollback unit that restores the state before the update by deleting the container layer. Therefore, unnecessary updates can be deleted and restored to the state before the update.

(Modification 1)
In the processing of S1112 to S1700 of FIG. 24, all the records are deleted. However, the first record may be left undeleted. In this case, a record other than the first one is obtained in S1112, and it is determined in S1700 whether or not all but the first record has been deleted.

(Modification 2)
In S1108 and S1110 of FIG. 24, the program being executed may not be deleted, but may be deleted after the execution of the program is completed. Depending on the configuration of the processing system or the configuration of the program, there is a possibility that a problem may occur by deleting the program being executed, and this modification can cope with such a case.

(Modification 3)
The data file included in the storage 48 and the update file 307 may not include a program that is an executable file. In this case, the update device 10 may not include the execution unit 34 and the execution layer designation unit 37.

(Modification 4)
The management information 7 may not be created in advance, and may be generated by the updating device 10 as needed. In this case, the update device 10 may set the lower path in the process number to be created next to be the same as the mount path in the previous process number. The names of the directories are not particularly limited as long as the names do not overlap, and in particular, it is not necessary to sequentially number as shown in FIG.

(Modification 5)
The updating device 10 may use the consent of the occupant of the vehicle 1 as a condition for updating. For example, when an update is possible, the update device 10 uses the HMI unit 49 to inquire of the passenger whether the update is possible or not, and executes the update when the update is accepted.

FIG. 26 is a diagram showing an example of a screen display inquiring whether the occupant can update or not. This display is displayed on the HMI 155, and when the passenger selects "Yes", the process is continued. When the occupant selects "No", the process is interrupted, and the same screen display is performed when an update is possible again. However, when the occupant selects "No", the processing may be continued without inquiring the occupant when the ignition is turned on or off next time.

(Modification 6)
The process of S1015 of FIG. 22 may be deleted. It is for convenience of explanation that management information 7 has been created in advance in the present embodiment, and there is no particular disadvantage to perform automatic generation. Therefore, if there is no restriction on the storage area, the management information 7 is appropriately rewritten. It is because it is possible.

(Modification 7)
In the first embodiment described above, the merge process and the rollback process are performed separately. However, rollback processing may be performed simultaneously when performing merge processing.

-Second embodiment-
The second embodiment of the update device according to the present invention will be described with reference to FIGS. In the following description, the same components as in the first embodiment will be assigned the same reference numerals and differences will be mainly described. The points that are not particularly described are the same as in the first embodiment. The present embodiment is different from the first embodiment mainly in that the server apparatus performs integration processing.

(Summary of operation)
The server apparatus 2 not only sequentially transmits the update file 307 to the update apparatus 10 as in the first embodiment, but also when a predetermined condition is satisfied, a layer image file in which the contents of the update so far are put together, so-called A rollup is created and sent to the update device 10. However, not all update contents are necessarily included, and information indicating which past updates are included is also transmitted at the same time. The update device 10 deletes the file to be deleted and applies the received layer image file to the container layer. This simplifies the processing of the updating device 10 and reduces the load.

(Constitution)
FIG. 27 is a diagram showing the configuration of the update system in the second embodiment. In addition to the configuration in the first embodiment, the server apparatus 2 according to the present embodiment includes the update management unit 30, the update unit 33, the overlay execution unit 35, the update layer specification unit 39, the layer combination unit 40, and the combination range specification. A section 41, an unnecessary layer deletion section 45, an overlay management section 46, an update storage 48A, and a flag setting section 51 are provided. The update storage 48A may be realized by the same hardware as the storage 165 or by different hardware.

The operations of the update management unit 30, the update unit 33, the overlay execution unit 35, the update layer specification unit 39, the layer combining unit 40, and the overlay management unit 46, which are functions included in the server device 2, are the same as those in the first embodiment. is there. The operation of the synthesis range designation unit 41 is different from the operation in the updating device 10 as described later. Further, the same information as the storage 48 of the update device 10 in the first embodiment is stored in the update storage 48A. That is, in the present embodiment, the update file 307 is used to update data files using multiple overlays not only in the update device 10 but also in the server device 2. Further, in the storage 165 of the server device 2 in the present embodiment, the update file 307 which the server device 2 has transmitted to the update device 10 is stored.

The updating apparatus 10 has a configuration in which the layer file combining unit 40 and the combining range designation unit 41 are deleted from the configuration of the first embodiment, and the record updating unit 50 is added. However, the update device 10 may include at least one of the difference update unit 36, the update file holding unit 42, the layer file combining unit 52, and the combining range specification unit 41. The update device 10 also has management information 7A in place of the management information 7.

(Management information 7A)
FIG. 28 is a diagram showing an example of the management information 7A. The management information 7A has a deletion target flag field in addition to all the fields included in the management information 7 in the first embodiment. The initial value of the deletion target flag is “NO”, and is updated to “YES” based on the deletion target information received from the server device 2. The record deletion unit 1400 performs deletion processing based on the value of the record for which the deletion target flag is set to “YES”.

(Functional configuration of server device 2)
According to the determination of the operator of the server device 2 or the determination of other programs incorporated in the server device 2, the combining range designation unit 41 designates a range of process numbers to be combined by the server device 2. The flag setting unit 51 determines the processing number to which the deletion target flag is to be added based on the specification of the combination range specification unit 41, and transmits it to the update device 10 as deletion target information. The layer file synthesizing unit 40 synthesizes the layer file based on the command of the synthesis range designation unit 41 and uses it as rollup information. The specific combining operation is the same as that of the first embodiment.

For example, when the synthesis range designation unit 41 designates the process numbers 1 to 3 as the synthesis range, the flag setting unit 51 outputs information “process numbers 1 to 3” to the update device 10 as deletion target information. Further, according to the example of FIG. 28, the layer file combining unit 52 of the server device 2 performs file copy with “/ s / ver 4” as the copy source and “/ rollup” as the copy destination, for example. Then, the server device 2 transmits the rollup information “/ rollup” or less as the image file 309 to the update device 10.

(Operation of update device 10)
When receiving the deletion target information from the server device 2, the update device 10 reflects the deletion target information on the management information 7A. Specifically, based on the deletion target information, the field of the deletion target flag of the management information 7A is rewritten from the initial value "NO" to "YES", and the deletion target flag is "YES" in the directory of the upper path of the processing number. Delete the stored data file. Further, the update device 10 deletes the contents of the directory of the lower path of the processing number “1”, and writes the roll-up information received from the server device 2 therein. Furthermore, the update device 10 cancels the overlay mounting of the processing number for which the deletion target flag of the management information 7A is "YES", and the lower path for the youngest processing number for which the mount path of the processing number "1" is not targeted for deletion. Rewrite to form an overlay mount. For example, in the example shown in FIG. 28, the mount path of process number 1 is rewritten to “/ s / ver 4”.

According to the second embodiment described above, the following effects can be obtained.
(7) The update device 10 has at least the same configuration as that of the first embodiment. The server device 2 includes an update storage 48A storing a plurality of data files, a storage 3 storing an update file 307 to be transmitted to the update device 10, and a server communication unit 20 to transmit the update file 307 to the update device 10. , The overlay management unit 46, the overlay execution unit 35, and the update unit 33 that performs writing to the server container mount using the update file and updates at least a part of the plurality of data files. The overlay execution unit 35 of the server device 2 further executes the second server overlay process in a state in which the first server overlay process is effective, and the image layer in the second server overlay process is subjected to the first overlay process. The file path set in the container mount is set, and the overlay execution unit 35 of the server device 2 executes a plurality of overlay processes, and all of them are files set in the container mount in the previous overlay process in the image layer A path is set. The server apparatus 2 uses the file path set as the container mount in the latest overlay processing created by the overlay execution unit 35 of the server apparatus 2 as a copy source, and the server apparatus 2 as a copy process that copies a merge path that is a predetermined file path. The layer combining unit 40 merges a plurality of updates by the second update unit 33. The server communication unit 20 transmits rollup information, which is information on a plurality of files copied to the merge path by the layer combining unit 40 of the server device 2, to the updating device 10. When the update device 10 receives the rollup information from the server device 2, the update device 10 cancels the overlay processing and uses the rollup information in place of the plurality of data files. Therefore, since the server apparatus 2 performs the layer combining process instead of the updating apparatus 10, the processing load of the updating apparatus 10 can be reduced.

(Modification 1 of the second embodiment)
The update device 10 may receive only the rollup information without receiving the update file 307 from the server device 2. In this case, the update device 10 discards the information received from the previous server device 2 when receiving the rollup information, and uses the newly received rollup information instead. In this case, the update device 10 may not include the overlay execution unit 35 or the overlay management unit 46. According to this modification, the update device 10 does not perform the update process by itself, so the processing load can be further reduced.

-Third embodiment-
A third embodiment of the update device according to the present invention will be described with reference to FIGS. 29 and 30. FIG. In the following description, the same components as in the first embodiment will be assigned the same reference numerals and differences will be mainly described. The points that are not particularly described are the same as in the first embodiment. The present embodiment differs from the first embodiment mainly in that the state of the ignition of the vehicle 1 is included in the update start condition.

FIG. 29 is a diagram showing the configuration of the update system in the third embodiment. The update device 10 according to the present embodiment includes an ignition receiving unit 54 in addition to the configuration according to the first embodiment. The ignition receiving unit 54 receives an operation of an ignition switch by an occupant of the vehicle 1, specifically, a signal obtained by switching on the ignition switch, and a signal obtained by switching off. For the transmission of this signal, a dedicated signal line may be used, or an in-vehicle network such as CAN may be used. In the present embodiment, the update start determining unit 38 determines the state of the ignition switch received by the ignition receiving unit 54. For example, the update start determination unit 38 sets that the ignition switch is off as an additional condition.

FIG. 30 is a flowchart showing an update process of the data file 330 performed by the update device 10 in the third embodiment. The flowchart shown in FIG. 30 is different from FIG. 22 in that S1002 is added. In S1002, which is executed when the configuration is determined in S1001, the update start determination unit 38 determines whether the ignition switch is off. If the update start determination unit 38 determines that the ignition switch is off, the process proceeds to S1200 and continues the processing as in the first embodiment. If the update start determination unit 38 determines that the ignition switch is on, the process returns to S1001.

According to the third embodiment described above, the following effects can be obtained.
(8) The updating device 10 outputs an operation command to the updating unit 33 based on the reception result of the ignition receiving unit 54 that acquires the state of the ignition switch of the vehicle on which the updating device is mounted and the ignition receiving unit 54 And a unit 38. Therefore, it is possible to perform updating at the time of starting or stopping of the vehicle 1 with less influence on the operation of the vehicle 1.

-Fourth Embodiment-
A fourth embodiment of the update device according to the present invention will be described with reference to FIGS. 31 and 32. FIG. In the following description, the same components as in the first embodiment will be assigned the same reference numerals and differences will be mainly described. The points that are not particularly described are the same as in the first embodiment. The present embodiment differs from the first embodiment mainly in that the difference between the files is received to update the file.

FIG. 31 is a diagram showing the configuration of the update system in the fourth embodiment. The update device 10 in the present embodiment further includes a difference update unit 36 in addition to the configuration in the first embodiment. The update file 307 in the present embodiment may include the file itself as in the first embodiment etc., but the file itself is not included but the information indicating the difference with the file of the previous version is included. There is. The update of the data file 330 using the latter information is hereinafter referred to as “differential update”. In the present embodiment, since the above-mentioned difference information may be included in the update file 307 temporarily stored in the storage unit 151 by the update file holding unit 42, the update file holding unit 42 also serves as the difference information holding unit. I can call.

The difference update unit 36 performs difference update based on the operation command of the update unit 33. Specifically, the difference update unit 36 is bspatch, xdelta, or zdelta. Note that bspatch, xdelta and zdelta are open source software and are included in various Linux distributions.

An outline of the difference update will be described. A file obtained by converting the difference between the data file 330 of the old version and the data file 330 of the new version is a difference file. The above-described bspatch and the like are programs for constructing the new version data file 330 using the old version data file 330 and the difference file. Specifically, with respect to the data file 330 held in the storage 48, using the update file 307 held by the update file holding unit 42, a specific path of the storage 48, in this case, the new data file 330 in the software update path 71. Perform processing to generate. Generally, the difference file is smaller than the size of the original data file 330, so the amount of communication between the server device 2 and the update device 10 can be reduced.

(flowchart)
FIG. 32 is a flowchart showing the operation of the difference update unit 36. The difference update unit 36 first acquires a difference file based on the operation command of the update unit 33 (S1309), and acquires an old file (S1310). Then, the difference update unit 36 performs difference update processing to rewrite the old file to a new file using the difference file (S1311), writes the new file to the software update path (S1312), and ends the difference update processing shown in FIG. .

According to the above-described fourth embodiment, the following effects can be obtained.
(9) The update file 307 received from the server device 2 is difference data. The update device 10 includes a difference update unit 36 that creates the updated data file 330 using the data file 330 stored in the storage unit 151 and the update file 307. Therefore, the amount of data of the update file 307 can be reduced, and the amount of communication between the server device 2 and the update device 10 can be reduced.

-Fifth embodiment-
A fifth embodiment of the update device according to the present invention will be described with reference to FIGS. 33 to 34. In the following description, the same components as in the first embodiment will be assigned the same reference numerals and differences will be mainly described. The points that are not particularly described are the same as in the first embodiment. The present embodiment differs from the first embodiment mainly in that a certain restriction is imposed on rollback.

(Constitution)
The update device 10 in the present embodiment includes management information 7B instead of the management information 7 in the first embodiment. The operation of the rollback unit 47 is partially different as described below.

In the present embodiment, there are two types of rollback commands that the updating device 10 receives from the server device 2: normal commands and forced commands. In the case of the normal command, rollback is possible within the limits described below. In the case of the forcible command, as in the first embodiment, rollback to any version is possible.

In the update file 307 transmitted by the update device 10 to the update device 10 in the present embodiment, a deletion prohibition flag described later may be set. However, the deletion prohibition flag may express the presence or absence of the flag by ON / OFF, and may indicate the presence or absence of the flag according to the presence or absence of the deletion prohibition flag. The creator of the update file 307 or the person who stores the update file 307 in the server apparatus 2 determines whether to add the deletion prohibition flag to the update file 307 or not. There are various criteria for giving the deletion prohibition flag, but it is conceivable to give the deletion prohibition flag, for example, when the update of important information, for example, the update of a map used for navigation etc. is included.

(Management information 7B)
FIG. 33 is a diagram showing an example of management information 7B in the present embodiment. The management information 7B includes, in addition to the configuration of the first embodiment, a field of a deletion prohibition flag indicating prohibition of deletion. The initial value of the deletion prohibition flag is "NO", and deletion is not prohibited. When the deletion prohibition flag is added to the update file 307 received from the server device 2, the deletion prohibition flag of the management information 7 B is rewritten to “YES” at the time of writing to the mount path.

For example, in the example shown in FIG. 33, since the deletion prohibition flag is added to the update file 307 received when the processing numbers are "2" and "4", deletion prohibition flags for the processing numbers "2" and "4" are given. Is set to "YES".

(Flowchart of rollback unit 47)
FIG. 34 is a flowchart showing the operation of the rollback unit 47 in the present embodiment. Since the rollback processing itself is the same operation as that of the first embodiment, the description is omitted here, and the processing for determining to which processing number the rollback is to be performed will be described. When the rollback unit 47 receives a rollback instruction from the server device 2, the rollback unit 47 first determines whether the instruction is a forced instruction (S1401). If it is determined that the command is a compulsory command (S1401: YES), the rollback unit 47 performs rollback to the designated number. If it is determined that the rollback command is not a forcible command, the management information 7B is referred to and the highest number to which the deletion prohibition flag is attached is specified (S1403). For example, in the example shown in FIG. 33, since the deletion prohibition flag is attached to the process numbers “2” and “4”, “4” is specified as the highest order number.

Next, the rollback unit 47 determines whether the number designated by the server device 2 is larger than the number identified in S1403 (S1404). If it is determined that the designated number is larger (S1404: YES), the rollback unit 47 proceeds to S1402 and performs rollback to the designated number. If it is determined that the designated number is equal to or less than the flagged topmost (S1404: NO), the rollback unit 47 performs rollback to the flagged topmost number (S1405). When the execution of S1402 or S1405 is completed, the rollback unit 47 ends the process shown in FIG.

According to the fifth embodiment described above, the following effects can be obtained.
(10) The communication unit 31 receives the update prohibition file 307 and the deletion prohibition flag indicating the deletion possibility. The updating unit 33 manages the presence / absence of the deletion prohibition flag for each container layer using the management information 7B. The rollback unit 47 does not delete the container layer with the deletion prohibition flag by limiting the rollback number to the number higher than or equal to the highest number with the deletion prohibition flag, as shown in FIG. Therefore, as long as the compulsory instruction is not received, it is possible to hold the information of the important update with the deletion prohibition flag.

Each embodiment and modification mentioned above may be combined respectively. Although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other embodiments considered within the scope of the technical idea of the present invention are also included within the scope of the present invention.

The disclosure content of the following priority basic application is incorporated herein by reference.
Japanese patent application 2017-234383 (filed on December 6, 2017)

DESCRIPTION OF SYMBOLS 1 ... Vehicle 2 ...

Server apparatus

7, 7A, 7B ... Management information 10 ... Update apparatus 30 ... Update management part 31 ... Communication part 33 ... Update part 34 ... Execution part 35 ... Overlay execution part 36 ... Difference update part 37 ... Execution layer Designation section 38 Update start judgment section 39 Update layer specification section 40 Layer file synthesis section 41 Combination range specification section 44 Storage remaining amount detection section 46 Overlay management section 47 Rollback section 50 Record update section 51 Flag setting unit 52 ... layer file combining unit 54 ... ignition receiving unit 70 ... software execution path 71 ... software update path 72 ... layer combining path

Claims

A storage unit in which a plurality of data files are stored;
A communication unit that receives an update file from the server device;
The file path of the storage unit, the read-only image layer including the plurality of data files, the file path of the storage unit, the readable and writable container layer, and the container mount which is the file path of the storage unit are set. Overlay management department,
An overlay execution unit that executes an overlay process in which the container mount is in a file state in which the image layer is a lower layer and the container layer is an upper layer and the writing to the container mount is writing to the container layer When,
An update device comprising: an update unit that executes a write process to the container mount using the update file and updates at least a part of the plurality of data files.
In the updating device according to claim 1,
The plurality of data files include executable files,
It further comprises an execution unit for executing an executable file present in an execution path which is a file path of the storage unit,
The update device rewrites the execution path from the image layer to the container mount when the update unit performs writing to the container mount.
In the updating device according to claim 1 or 2,
The overlay execution unit further executes the second overlay processing while the first overlay processing is in effect.
The update device in which a file path set in the container mount in the first overlay process is set in the image layer in the second overlay process.
In the updating device according to claim 3,
The overlay execution unit executes a plurality of overlay processes.
In any of the plurality of overlay processes, a file path set in the container mount in the immediately preceding overlay process is set in the image layer,
The updating apparatus further includes a layer combining unit that merges a plurality of updates by the updating unit by copy processing in which the file path set in the container mount in the latest overlay processing created by the overlay execution unit is a copy source.
In the updating device according to claim 4,
The updating apparatus further comprises a layer combining command unit that outputs an operation command to the layer combining unit when the free space of the storage unit falls below a predetermined value.
The update device according to any one of claims 1 to 5.
An ignition receiving unit for acquiring a state of an ignition switch of a vehicle on which the updating device is mounted;
The update device further comprising: an update start determination unit that outputs an operation command to the update unit based on the reception result of the ignition reception unit.
The update device according to any one of claims 1 to 6.
The update file received from the server device is differential data,
An update device further comprising: a differential update unit that creates an updated data file using the data file stored in the storage unit and the update file.
In the updating device according to claim 3,
The update device further comprising: a rollback unit that restores the state before the update by deleting the container layer.
In the updating device according to claim 8,
The communication unit receives, together with the update file, a deletion prohibition flag indicating whether or not deletion is possible,
The update unit manages the presence or absence of the deletion prohibition flag for each container layer,
The update unit does not delete the container layer to which the deletion prohibition flag is attached.
An update system including a server device and an update device connected by a network, the update system comprising:
The updating device is
A storage unit in which a plurality of data files are stored;
A communication unit that receives an update file from the server device;
The file path of the storage unit, the read-only image layer including the plurality of data files, the file path of the storage unit, the readable and writable container layer, and the container mount which is the file path of the storage unit are set. Overlay management department,
An overlay execution unit that executes an overlay process in which the container mount is in a file state in which the image layer is a lower layer and the container layer is an upper layer and the writing to the container mount is writing to the container layer When,
And an update unit that performs writing to the container mount using the update file and updates at least a part of the plurality of data files,
The server device is
A server storage unit in which the plurality of data files are stored;
An update file storage unit storing the update file to be transmitted to the update device;
A server communication unit that transmits the update file to the update device;
A file path of the server storage unit, a read-only server image layer including the plurality of data files, a file path of the server storage unit, a readable / writable server container layer, and a file path of the server storage unit A server overlay management unit that sets a server container mount;
A server overlay process in which the server container mount is in a file state in which the server image layer is a lower layer and the server container layer is an upper layer and the writing process to the server container mount is a writing to the server container layer A server overlay execution unit that executes
A server update unit that writes to the server container mount using the update file and updates at least a part of the plurality of data files;
The server overlay execution unit further executes the second server overlay process while the first server overlay process is in effect.
In the server image layer in the second server overlay process, a file path set in the server container mount in the first server overlay process is set.
The server overlay execution unit executes a plurality of server overlay processes.
In any of the plurality of server overlay processes, a file path set in the server container mount in the server overlay process immediately before is set in the server image layer,
The server device uses the file path set as the server container mount in the latest server overlay processing created by the server overlay execution unit as a copy source, and performs the copy processing to copy a merge path that is a predetermined file path. And a server layer composition unit that merges multiple updates by the server update unit,
The server communication unit transmits rollup information, which is information on a plurality of files copied by the server layer synthesis unit to the merge path, to the update device.
The update system, when receiving the rollup information from the server device, cancels the overlay processing and uses the rollup information in place of the plurality of data files.