JP2004199491A - Rewriting control device of onboard program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To surely perform regular operation processing by keeping the function of an onboard controller thereafter even if a communication abnormality or an abnormality such as hang-up occurs in the middle of rewrite processing, and to avoid long-hour occupation of a channel caused by communication for the rewrite processing. <P>SOLUTION: When a command for rewriting to a new onboard program 60 is imparted to an information collection controller 20 from a rewrite dedicated server 3 through communication means 5, 8, 9, 10, 11, a rewrite control program 61 is started and rewrite processing is executed (rewrite mode). When the communication abnormality or the hang-up occurs in the middle of rewriting and the rewrite processing is not finished even when exceeding a set time T of a timer, reset processing is executed and an old onboard program is started. In addition, the communication state between a construction machine 50 and a server is switched into a regular operation mode, and communication connection between a regular operation server 2 and the construction machine 50 is enabled, and a regular operation processing can be performed. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an apparatus for performing control for rewriting an in-vehicle program.
[0002]
[Prior art]
Recently developed construction machines include vehicle status information (hereinafter referred to as vehicle status data) such as the current position of the vehicle body, the clock value of the service meter (cumulative operating time), and the past history of error codes that occurred in the vehicle body. Various controllers such as a controller to collect are mounted. A CPU is provided in such an in-vehicle controller, which executes arithmetic processing according to an in-vehicle program stored in an EEPROM (electrically erasable ROM) such as a flash memory, collects vehicle state data, and communicates with external devices. Performs processing such as transmission and reception. For example, a vehicle-mounted controller and an external server are communicably connected via communication means such as the Internet, and vehicle state data collected by the vehicle-mounted controller is transmitted to the server. Alternatively, a service person goes to the construction machine, connects a personal computer to the onboard controller, and takes in the vehicle state data into the personal computer.
[0003]
If the in-vehicle program is upgraded, or if it is desired to change the threshold for error code generation and abnormality determination for each vehicle, it is necessary to rewrite the old in-vehicle program stored in the flash memory with a new in-vehicle program. .
[0004]
(Prior art 1)
Patent Document 1 (Japanese Patent Application Laid-Open No. H10-212739) relates to a construction machine, which includes a controller for collecting operation data and a monitoring device having a function as a server at a remote location. The invention describes that a monitoring device is connected by a communication device, and an operation data processing program in an operation data collection controller is rewritten in response to a request from the monitoring device. During normal operation, the operation data collection controller in the construction machine collects operation data according to the operation data processing program, processes the operation data, and transmits the processed operation data to the monitoring device in response to a request from the monitoring device. . At the time of rewriting, a new operation data processing program is transmitted from the monitoring device to the construction machine, and the operation data collection controller in the construction machine rewrites the old operation data processing program with the new operation data processing program.
[0005]
[Problems to be solved by the invention]
While a vehicle (monitoring device) at a remote location is remotely rewriting an in-vehicle program in a construction machine, a communication error or hang-up may occur. As described above, when an abnormality occurs during the in-vehicle program rewriting process, the in-vehicle program does not start thereafter, the in-vehicle controller itself does not function, and it may be impossible to collect vehicle state data during normal operation. Especially when rewriting is performed remotely from a remote location, every time a communication error or hang-up occurs, a service person from a remote location must go to the construction machine to replace or repair the onboard controller. In addition, the working efficiency of construction machinery is greatly impaired, and recovery requires a great deal of manpower, time and man-hours.
[0006]
Also, since the data volume of the in-vehicle program is as large as several hundred kilobytes, when the in-vehicle program is transmitted from a server (monitoring device) to many construction machines, the communication path becomes congested and the May take a long time. In such a case, the communication path is occupied by communication for rewriting processing, and communication for normal operation processing may be interrupted for a long time.
[0007]
In this regard, Patent Document 1 does not point out a problem caused by the communication path being occupied for the rewriting process, and does not describe measures for avoiding the problem.
[0008]
The present invention has been made in view of such a situation, and even if an error such as a communication error or a hang-up occurs during the rewriting process, the function of the on-board controller is maintained and the normal operation is continued. To ensure that the communication process for rewriting can be performed for a long time, and to secure communication for normal operation by avoiding occupying a communication path for a long time. Is to be solved.
[0009]
Means, actions, and effects for solving the problem
The first invention is
Server (2, 3),
In-vehicle program rewrite control device including in-vehicle controller (20) in vehicle (50) communicably connected to servers (2, 3) by communication means (14, 15, 8, 9, 10, 11) And
In the communication state of the communication,
A normal operation mode for transmitting and receiving a vehicle state between the server (2, 3) and the on-vehicle controller (20);
There is a rewrite mode for rewriting the onboard program of the onboard controller (20) to a new onboard program transmitted from the server (2, 3),
When the server (2, 3) receives an in-vehicle program rewriting command, the mode is switched from the normal operation mode to the rewriting mode,
When the switching means to the normal operation mode operates during the rewrite mode, the mode is switched from the rewrite mode to the normal operation mode.
[0010]
The second invention is based on the first invention,
The switching unit to the normal operation mode is operated by a timer unit or a logout unit.
[0011]
According to the present invention, as shown in steps 101 to 107 in FIG. 2, a command to rewrite to the new in-vehicle program 60 from the rewriting dedicated server 3 via the communication means 15, 8, 9, 10, 11 is sent to the information collection controller 20. When given, the rewrite control program 61 is activated to execute a rewrite process (rewrite mode).
[0012]
When the rewriting is completed normally, the timer is cleared before the set time T has elapsed, and the timer is rewritten with a new in-vehicle program 60.
[0013]
On the other hand, if a communication error or a hang-up occurs during rewriting, the rewriting process will not end even if the timer exceeds the set time T (determination YES in step 108), the reset process is executed, and the old vehicle The program 60 'is started. Further, the communication state between the construction machine 50 and the server is switched from the rewrite mode to the normal operation mode (normal operation mode), and thereafter the communication connection between the normal operation server 2 and the construction machine 50 becomes possible, and the normal operation processing is performed. Can be performed (step 109).
[0014]
According to the present invention, even when an error such as a communication error or a hang-up occurs during the rewriting process, the old in-vehicle program 60 'is reliably started to maintain the function of the information collection controller 20. be able to. Therefore, normal operation processing can be reliably performed, and it is possible to prevent a reduction in work efficiency due to the malfunction of the information collection controller 20. When the set time T of the timer elapses, the mode shifts from the rewrite mode to the normal operation mode. Therefore, the communication path for the rewrite process is prevented from being occupied for a long time, and the communication for the normal operation process is secured. As a result, it is possible to prevent trouble in normal operation processing.
[0015]
Further, the communication connection with the dedicated server for rewriting 3 may be cut off at any time by the logout means, and the rewriting mode may be switched to the normal operation mode.
[0016]
The present invention can also be applied to a case where one server, for example, the normal operation server 2 returns from the rewrite mode to the normal operation mode.
[0017]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 shows the overall apparatus configuration of the embodiment. In the following embodiment, a construction machine 50 is assumed as a vehicle, and a case is assumed in which the in-vehicle program 60 in the construction machine 50 is remotely rewritten in response to a request from the rewrite server 3.
[0018]
In the system of this embodiment, the construction machine 50 communicates with the normal operation server 2 and the dedicated rewrite server 3 via communication means (wireless communication 11, antenna 10, dedicated line 9, terrestrial base station 8, dedicated lines 14, 15). They are connected to each other so that they can be sent and received freely.
[0019]
The normal operation server 2 is located in the intranet 4 and is connected to the Internet 7. Thereby, the normal operation server 2 functions as a server for each client terminal of the Internet 7 and the intranet 4. The normal operation server 2 is provided with an IP address “ID1” which is an ID (server identification ID) for identifying itself in the network. The construction machine 50 is equipped with a communication terminal (communication controller 30), which will be described later, which can communicate with the normal operation server 2, and this communication terminal is assigned an IP address "ID3" corresponding to the server identification ID "ID1". (See FIG. 10).
[0020]
The rewritable server 3 is located in the intranet 5 and is connected to the Internet 7. Thus, the rewrite-only server 3 functions as a server for each client terminal of the Internet 7 and the intranet 5. This rewrite-only server 3 is given an IP address “ID2” which is an ID (server identification ID) for identifying itself in the network. The construction machine 50 is equipped with a communication terminal (communication controller 30), which will be described later, capable of communicating with the rewrite-only server 3, and this communication terminal is assigned an IP address "ID4" corresponding to the server identification ID "ID2". (See FIG. 10).
[0021]
The same applies to the correspondence between other construction machines and the server.
[0022]
FIG. 10 shows the correspondence between a plurality of construction machines 50, 50a, 50b,...
[0023]
The communication terminal in the construction machine 50a is assigned an IP address “ID5” corresponding to the server identification ID “ID1” of the normal operation server 2 and corresponds to the server identification ID “ID2” of the rewritable server 3. The IP address “ID6” is assigned.
[0024]
The communication terminal in the construction machine 50b is assigned an IP address “ID7” corresponding to the server identification ID “ID1” of the normal operation server 2 and corresponds to the server identification ID “ID2” of the rewrite-only server 3. IP address “ID8” is assigned.
[0025]
The server and communication terminal specified by each ID1, ID3, ID5, ID7,... Constitute one intranet 4.
[0026]
The servers and communication terminals specified by ID2, ID4, ID6, ID8,... Constitute one intranet 5.
[0027]
A communication controller 30 having a built-in wireless device for packet data communication is provided in the vehicle body of the construction machine 50. Wireless communication 11 by packet communication is performed between the antenna 31 of the communication controller 30 and the terrestrial antenna 10. The antenna 10 is connected to a terrestrial base station 8 via a dedicated line 9. The terrestrial base station 10 is, for example, a mobile phone base station. The terrestrial base station 10 is connected to intranets 4 and 5 via dedicated lines 14 and 15, respectively.
[0028]
In the vehicle body of the construction machine 50, in addition to the communication controller 30, controllers such as the information collection controller 20 and the engine controller 40 are provided. These controllers communicate with each other in accordance with a predetermined communication protocol. They are communicably connected to each other by a line 51.
[0029]
In each part of the vehicle body of the construction machine 50, a cooling water for the engine 57, a voltage of the battery 53, a GPS sensor, and the like are arranged, and these sensors constitute a sensor group 52. The GPS sensor receives a radio wave transmitted from a GPS satellite and detects the absolute position of its own construction machine 50. A calendar and a timer are provided in the vehicle body of the construction machine 50. The calendar and timer measure the year, month, day, and time (hour, minute, second). A service meter SMR is provided in the vehicle body of the construction machine 50. The service meter SMR measures the cumulative operation time of the engine 57.
[0030]
In the information collection controller 20, a CPU 21, a flash memory 22, and a random access memory (RAM) 23 are mutually connected via a bus line 24 so that data can be freely input and output. The flash memory 22 is a type of EEPROM (electrically erasable ROM). Further, an EEPROM such as a flash memory may be used instead of the RAM 23. The vehicle-mounted program 60 is stored in a predetermined storage area of the flash memory 22 as described later. In a predetermined storage area of the flash memory 22, a rewrite control program 61 for performing a rewrite process for rewriting the in-vehicle program 60 as described later is stored.
[0031]
The CPU 21 performs arithmetic processing according to the in-vehicle program 60 and generates vehicle state data. The vehicle state data is stored in the data area of the RAM 23.
[0032]
For example, when the start lock is set to be valid, a calendar, a time value of a timer, and the like are acquired, and when the set start lock time period is reached, a start lock setting command is output, and a start lock described below is performed and a start lock is performed. When the time is outside the time zone, a process of outputting a start lock release command is performed.
[0033]
The following vehicle state data is stored in the data area of the RAM 23.
[0034]
-Your own IP address (ID3, ID4)
The current version of the in-vehicle program 60 The opening inspection completion information indicating that the opening inspection of the communication terminal (communication controller 30) has been completed The model, model, and machine number of the construction machine 50 The time value of the service meter SMR (cumulative operating time)
・ Current terminal voltage of battery 53 (battery terminal voltage information)
・ Temperature of cooling water ・ Current absolute position of own vehicle detected by GPS sensor (absolute position information)
-History of error codes generated in the vehicle body-Key switch information indicating whether or not the key switch 54 is currently turned on (is in the ACC position)-Whether the current start lock is valid or invalid and whether or not the current start lock is currently set The start lock information bus line 24 such as the start lock time zone is connected to the service meter SMR and the sensor group 52 outside the information collection controller 20 via an interface, and the bus line 24 is connected to the in-vehicle communication outside the controller 20. It is connected to the line 51 via an interface.
[0035]
In the present embodiment, the communication controller 30 and the information collection controller 20 are provided separately, and the IP addresses “ID3” and “ID4” of the communication controller 30 as communication terminals are set in the information collection controller 20. The functions of the communication controller 30 as the communication terminal and the information collection controller 20 may be achieved by one controller.
[0036]
A starting lock circuit 55 is incorporated in the vehicle body of the construction machine 50.
[0037]
The start lock circuit 55 is constituted by a relay or the like and is interposed between the key switch 54 and a starter 56 for starting the engine 57. The power supply of the starter 56 is a battery 53 mounted on the vehicle.
[0038]
When the start lock setting command is output from the engine controller 40, the relay of the start lock circuit 55 is energized to enter the start lock setting state. That is, even if the key switch 54 is turned on (ACC position), the terminal voltage of the battery 53 is not applied to the starter 56. As a result, the starter 56 becomes inoperable and the engine 57 cannot be started. On the other hand, when a start lock release command is output from the engine controller 40, the relay of the start lock circuit 55 is deenergized and the start lock is released. That is, when the key switch 54 is turned on (ACC position), the starter 56 operates and the engine 57 can be started. The start lock setting command and the start lock release command are given from the information collection controller 20 to the engine controller 40 via the in-vehicle communication line 51 in accordance with the in-vehicle program 60. The start lock setting command and the start lock release command are output from the information collection controller 20 when the start lock is currently set to “valid”. Whether or not the start lock time zone has been entered is determined based on the values of the calendar and the timer in the information collection controller 20.
[0039]
The information that the key switch 54 is turned on (is in the ACC position) is taken into the information collection controller 20 from the engine controller 40 via the vehicle body communication line 51.
[0040]
Server Switching Control The normal operation server 2 manages vehicle state data in a plurality of construction machines including the construction machine 50.
[0041]
The rewrite-only server 3 is a server that remotely rewrites the in-vehicle program 60.
[0042]
The normal operation server 2 has a master file 6. The latest vehicle state data taken into the normal operation server 2 is stored in the master file 6.
[0043]
On the other hand, the rewritable server 3 has a master file 6 '. The storage data of the master file 6 in the normal operation server 2 is taken into the rewritable server 3 via the Internet 7, and the same storage contents as the master file 6, that is, a master file 6 'as a "replica" is created.
[0044]
Next, with reference to FIG. 8, a description will be given of control of connection switching with which server the construction machine 50 establishes a connection.
[0045]
In the initial state, the vehicle controller 20 of the construction machine 50 has its own IP address “ID3” corresponding to the server identification ID “ID1” of the normal operation server 2 set to “valid”. The own IP address “ID4” corresponding to the server identification ID “ID2” is set to “invalid” (normal operation mode). The data “ID3” of the own IP address set as “valid” by the information collection controller 20 is taken into the communication controller 30 from the information collection controller 20 via the in-vehicle communication line 51.
[0046]
When a command for requesting vehicle state data of the construction machine 50 from the normal operation server 2 is transmitted to the construction machine 50 as the wireless communication 11 via the dedicated line 14, the terrestrial base station 8, the dedicated line 9, and the antenna 10, The data is received by the antenna 31 of the construction machine 50, and this data is taken into the communication controller 30. The data transmitted from the normal operation server 2 includes the server identification ID “ID1”. Since the communication controller 30 is currently set with the IP address “ID3” and the received data includes the server identification ID “ID1”, the two correspond (“ID1” and “ID3”). It is determined that the network is the same network), the communication connection is established, and the vehicle state data can be transmitted from the construction machine 50 side (determination YES in step 401 in FIG. 8).
[0047]
Therefore, a command for requesting vehicle state data is fetched from the communication controller 30 into the information collection controller 20 via the vehicle body communication line 51. For example, when a command requesting the current time value of the service meter SMR is taken into the information collection controller 20, the current time value of the service meter SMR stored in the data area of the RAM 23 is transmitted from the information collection controller 20 to the vehicle body communication line. The data is taken into the communication controller 30 via the communication controller 51, transmitted as radio communication 11 from the antenna 31 of the communication controller 30, and transmitted to the normal operation server 2 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 14 It is captured.
[0048]
Similarly, when the command for setting the start lock information such as the start lock validity, invalidity, and start lock time zone is transmitted from the normal operation server 2 to the construction machine 50, the start lock commanded to the information collection controller 20 is similarly issued. Information is set.
[0049]
Note that a similar command may be given from each client terminal of the normal operation server 2 to the construction machine 50 via the normal operation server 2.
[0050]
When a specific event occurs in the construction machine 50, such as when a specific abnormality occurs or at a specific time, the details of the abnormality stored in the RAM 23 at the time of the event and the vehicle to be transmitted periodically State data and the like are taken into the communication controller 30 from the information collection controller 20 via the vehicle body communication line 51, and transmitted as wireless communication 11 from the antenna 31 of the communication controller 30 (automatic transmission). The automatically transmitted vehicle state data is taken into the normal operation server 2 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 14.
[0051]
The vehicle status data of the construction machine 50 taken into the normal operation server 2 is obtained by accessing the normal operation server 2 from each client terminal connected to the network belonging to the normal operation server 2, ie, the Internet 7 and the intranet 4. It is displayed on the display screen of the client terminal.
[0052]
The latest vehicle state data taken into the normal operation server 2 is stored in the master file 6 as well as in the master file 6 'via the Internet 7 (step 405 in FIG. 8).
[0053]
When the in-vehicle program 60 'is upgraded, or when it is desired to change the threshold for generating an error code or determining an abnormality for each construction machine, the old in-vehicle program 60' stored in the flash memory 22 is replaced with a new in-vehicle program. Rewritten into the program 60. In the following description, a dash is given to the old in-vehicle program 60 to distinguish it from the new in-vehicle program 60.
[0054]
When a command to rewrite the in-vehicle program 60 of the construction machine 50 is transmitted from the rewrite dedicated server 3 to the construction machine 50 as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10, The data is received by the antenna 31 of 50, and this data is taken into the communication controller 30.
[0055]
The data transmitted from the rewrite-only server 3 includes the server identification ID “ID2”. In the communication controller 30, the IP address “ID3” is currently set, and the received data includes the server identification ID “ID2”. Therefore, the two do not correspond (“ID2” and “ID3”). It is determined that they are not the same network), and the communication connection is disconnected (NO in step 401 in FIG. 8).
[0056]
Information that the communication connection has been disconnected due to the mismatch of the IDs is taken into the information collection controller 20 from the communication controller 30 via the in-vehicle communication line 51. In response, the information collection controller 20 switches its own IP address “ID4” corresponding to the server identification ID “ID2” of the rewrite-only server 3 to “valid”, and the server identification ID “ID1” of the normal operation server 2. Is switched to “invalid” (rewrite mode). The data “ID4” of the own IP address set as “valid” by the information collection controller 20 is taken into the communication controller 30 from the information collection controller 20 via the in-vehicle communication line 51 (step 402 in FIG. 8). .
[0057]
The rewrite-only server 3 transmits the rewrite command to the construction machine 50 again in response to the disconnection of the communication connection. The data transmitted from the rewrite-only server 3 includes the server identification ID “ID2”. Since the communication controller 30 is currently set with the IP address “ID4” and the received data includes the server identification ID “ID2”, both correspond (“ID2” and “ID4”). It is determined that the network is the same network) and a communication connection is established (determination YES in step 403 of FIG. 8).
[0058]
Thereafter, a process of rewriting the in-vehicle program 60 is performed by the information collection controller 20 in response to a command from the rewrite-only server 3 on the assumption that certain conditions are cleared (step 404 in FIG. 8).
[0059]
As described above, according to the present embodiment, the communication connection can be switched between the construction machine 50 and each of the servers such as the normal operation server 2 and the rewrite-only server 3. For this reason, as shown in FIG. 10, when a large number of construction machines 50, 50a, 50b,... Exist, a communication connection between a certain construction machine and the normal operation server 2 is established to perform the normal operation processing. Then, a communication connection between the other construction machine and the rewrite-only server 3 can be established to perform the rewrite process. For this reason, the communication path is not occupied by a heavy load on the server or transmission of a program having a large data amount, and data transmission and reception between the server and many construction machines are performed stably.
[0060]
FIG. 2 shows a procedure of a process of rewriting the in-vehicle program 60 in response to a command from the rewrite-only server 3.
[0061]
Return Control to Normal Operation Mode As shown in FIG. 2, when a communication connection is established between the construction machine 50 and the rewritable server 3 in step 403 in FIG. 8 (step 101 in FIG. 2), the information collection controller At 20, a timer is set and a timer task is executed (steps 102, 108, 109).
[0062]
Here, the set time of the timer is set to a time T that allows for the time required for the rewriting process.
[0063]
The information collection controller 20 operates in a multitask, and the timer task operates independently of another task, that is, the rewriting task (steps 103 to 107). Therefore, even if another task goes out of control, the timer task operates reliably, and the old in-vehicle program 60 'can be started by the self-reset process (step 109).
[0064]
When the rewriting task (steps 103 to 107) ends normally, the timer is cleared before the set time T has elapsed, and the timer is rewritten with the new in-vehicle program 60.
[0065]
On the other hand, if a communication error or a hang-up occurs during the rewriting task (steps 103 to 107), the rewriting process will not end even if the timer exceeds the set time T (determination YES in step 108), and the reset is performed. The process is executed, and the old in-vehicle program 60 'is started.
[0066]
Further, the communication state between the construction machine 50 and the server is switched from the rewrite mode to the normal operation mode. That is, the information collection controller 20 returns its own IP address “ID4” corresponding to the server identification ID “ID2” of the rewrite-only server 3 to “invalid” and corresponds to the server identification ID “ID1” of the normal operation server 2. The own IP address “ID3” is returned to “valid” (normal operation mode). The data “ID3” of the own IP address set as “valid” by the information collection controller 20 is taken into the communication controller 30 from the information collection controller 20 via the in-vehicle communication line 51. For this reason, the communication connection between the normal operation server 2 and the construction machine 50 becomes possible thereafter, and the normal operation process can be performed (step 109).
[0067]
As described above, according to the present embodiment, even if an error such as a communication error or a hang-up occurs during the rewriting process, the old in-vehicle program 60 'is reliably started and the information collection controller 20 is started. Function can be maintained. Therefore, normal operation processing can be reliably performed, and it is possible to prevent a reduction in work efficiency due to the malfunction of the information collection controller 20. When the set time T of the timer elapses, the mode shifts from the rewrite mode to the normal operation mode. Therefore, the communication path for the rewrite process is prevented from being occupied for a long time, and the communication for the normal operation process is secured. As a result, it is possible to prevent trouble in normal operation processing.
[0068]
Also, a logout means may be provided to disconnect the communication connection with the dedicated rewrite server 3 at any time and switch the rewrite mode to the normal operation mode.
[0069]
Check Process of Vehicle State Data When a communication connection between the rewrite-only server 3 and the communication controller 30 of the construction machine 50 is established in step 101 of FIG. 2, the rewrite command transmitted from the rewrite-only server 3 is transmitted to the communication controller 30. From the information collection controller 20 via the in-vehicle communication line 51.
[0070]
When the information collection controller 20 receives the rewrite command, in the next step 103, a process of checking the current vehicle state data is executed. In the next step 104, the rewrite process of the in-vehicle program 60 is performed according to the check result. A determination process of whether or not to execute (whether or not rewriting process is possible) is performed.
[0071]
The check processing and the judgment processing in steps 103 and 104 are performed by the rewrite-only server 3. That is, when receiving the rewrite command, the information collection controller 20 transmits vehicle state data to be checked from the information collection controller 20 to the communication controller 30 via the vehicle body communication line 51. For this reason, the vehicle state data to be checked is transmitted from the antenna 31 of the communication controller 30 as the wireless communication 11, and is taken into the rewritable server 3 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 15.
[0072]
The rewrite-only server 3 checks the received vehicle state data, and determines that the rewrite process should be executed on condition that all of the following conditions are satisfied.
[0073]
1) The start lock is not in progress 2) The construction machine 50 is not in operation 3) The current old in-vehicle program 60 'is the version to be rewritten Rewrite the above 1) "Not in start lock" The condition for executing the process is that the information collection controller 20 may not function during the rewriting process, and the command to release the start lock may not be output because the information collection controller 20 does not function. Because. The construction machine 50 is often operated under severe conditions. For example, if the starting lock cannot be released in a situation where the surroundings of the construction machine are cliffs or collapsed objects, the construction machine 50 may be exposed to danger. become.
[0074]
The determination that “the start lock is not being performed” is made based on the start lock information stored in the information collection controller 20. For example, when the start lock is set to “invalid”, if the start lock is “valid” and the current time is outside the start lock time zone, it is determined that “the start lock is not being performed”.
[0075]
The condition that the construction machine 50 is not operating in the above 2) is used as a condition of the rewriting process because the new in-vehicle program 60 is being transmitted to the operating construction machine 50 and depending on the operating state (for example, running). This is because the communication may be interrupted or the communication may become unstable, and the rewriting process may not end normally.
[0076]
“The construction machine 50 is not operating” is determined based on the key switch information stored in the information collection controller 20. For example, when the key switch 54 is off (ACC position off), it is determined that "the construction machine 50 is not operating". Whether or not the construction machine 50 is operating can also be determined by detecting the terminal voltage of the alternator or detecting the number of revolutions of the engine 57.
[0077]
The condition 3) "the current old in-vehicle program 60 'is the version to be rewritten" is a condition because it is not necessary to perform the rewriting process. As described above, the current version of the in-vehicle program is stored in the information collection controller 20 as vehicle state data.
[0078]
In addition, the following conditions may be appropriately added.
[0079]
4) The communication terminal (communication controller 30) has completed the station opening inspection. 5) The battery terminal voltage is within a normal range. 6) The construction machine 50 is located in a place where the wireless communication 11 can be performed stably or in a safe place. The reason that the condition (4) above is that the communication terminal (communication controller 30) has completed the station opening inspection is that the server is not ready to manage the construction machine 50.
[0080]
The condition that “the battery terminal voltage is in the normal range” in 5) above is that the CPU 21 of the information collection controller 20 can operate stably if the terminal voltage of the battery 53 is out of the normal range. This is because the rewriting process may not be completed normally. “The battery terminal voltage is within the normal range” is determined based on the battery terminal voltage information stored in the information collection controller 20.
[0081]
The condition 6) that “the construction machine 50 is located in a place where the wireless communication 11 can be stably performed or in a safe place” is a condition that the new in-vehicle program 60 is transmitted to the construction machine 50 during the transmission. This is because there is a risk that communication may be interrupted or communication may become unstable, and the rewriting process may not end normally. Further, even if the controller does not function, the safety of the construction machine 50 is ensured. “The construction machine 50 is located in a place where the wireless communication 11 can be performed stably or in a safe place” is determined based on the absolute position information stored in the information collection controller 20.
[0082]
It is to be noted that, not all conditions 1) to 6) are satisfied, but any one or a combination of two or more of the conditions 1) to 6) may be set as the conditions for executing the rewriting process. Good.
[0083]
The rewrite-only server 3 refers to the vehicle state data stored in the information collection controller 20 to determine whether or not the rewrite process can be executed. However, the master file 6 'includes the latest vehicle of the construction machine 50. Since the state data is stored, it may be determined whether or not the rewriting process can be executed by referring to the vehicle state data stored in the master file 6 '. Alternatively, it may be determined whether or not the rewriting process can be performed by referring to the vehicle state data stored in the information collection controller 20 and the vehicle state data stored in the master file 6 '.
[0084]
FIG. 7 shows a procedure of a process of verifying both the vehicle state data stored in the information collection controller 20 and the vehicle state data stored in the master file 6 'when both are referred to.
[0085]
That is, when a communication connection between the server 3 for exclusive use of rewriting and the communication controller 30 of the construction machine 50 is established (step 301), the vehicle state data to be checked inside the information collection controller 20 is sent from the construction machine 50 to the server 3 exclusively for rewriting. It is transmitted and acquired by the rewrite-only server 3 (step 302). On the other hand, the rewritable server 3 acquires the same vehicle state data to be checked by referring to the master file 6 '. The vehicle state data acquired in advance with reference to the master file 6 'is compared with the vehicle state data acquired from inside the information collection controller 20 (step 303), and whether or not both are the same is determined. Is determined. For example, it is determined whether the data of the master file 6 'and the data inside the information collection controller 20 are the same for the start lock information (step 304).
[0086]
As a result, if they are the same (determination Y in step 304), the check processing in step 103 in FIG. 2 is executed, and the rewrite permission / inhibition determination processing in step 104 in FIG. 305). However, if they are not the same (determination N in step 305), the subsequent check processing and rewrite permission / inhibition determination processing are interrupted, and processing for analyzing the cause of the difference in data is executed (step 306).
[0087]
If the rewrite-only server 3 determines that the rewrite process should be executed (determination YES in step 104 of FIG. 2), the rewrite-only server 3 transmits the data to that effect to the construction machine 50, and thereafter collects information. The controller 20 rewrites the old in-vehicle program 60 'with the new in-vehicle program 60 and executes it (steps 105, 106, 107). However, if the rewrite-only server 3 determines that the rewrite process should not be executed (NO in step 104 in FIG. 2), the data is transmitted from the rewrite-only server 3 to the construction machine 50 to collect information. Captured by the controller 20. In response to this, the information collection controller 20 executes a reset process and activates the old in-vehicle program 60 ', as in the case where the timer has exceeded the set time T. Further, the communication state between the construction machine 50 and the server is switched from the rewrite mode to the normal operation mode. For this reason, the communication connection between the normal operation server 2 and the construction machine 50 becomes possible thereafter, and the normal operation process can be performed (step 109).
[0088]
As described above, according to the present embodiment, the vehicle state data is checked in advance in the rewriting process, so that a situation in which the rewriting process does not end normally or a dangerous state can be avoided in advance. it can. In particular, it is possible to avoid a situation in which the information collection controller 20 does not function in the startup locked state, so that a situation in which the operation rate decreases can be avoided in advance.
[0089]
・ Rewrite processing (evacuation processing of vehicle state data)
Next, the rewriting process of steps 105, 106, and 107 in FIG. 2 will be described with reference to FIG. 2 and FIG. FIGS. 3A to 3F show transitions of the states of the flash memory 22 and the RAM 23.
[0090]
3A shows the states of the flash memory 22 and the RAM 23 before rewriting. As shown in FIG. 3A, the in-vehicle program 60 'is stored in the program area of the flash memory 22. Note that a rewrite control program 61 is stored in a storage area (not shown) of the flash memory 22.
[0091]
The rewrite control program 61 is a program that performs a process of rewriting an old in-vehicle program 60 ′ with a new in-vehicle program 60.
[0092]
The RAM 23 includes work areas 23a and 23c and a data area 23b in which vehicle state data 60d is stored. The work areas 23a and 23c are empty capacity areas.
[0093]
When the rewrite-only server 3 determines that the rewrite process should be performed (YES in step 104 in FIG. 2), the data to that effect is sent from the rewrite-only server 3 to the dedicated line 15, the terrestrial base station 8, The information is transmitted to the construction machine 50 as wireless communication 11 via the line 9 and the antenna 10, received by the antenna 31 of the construction machine 50, and taken into the information collection controller 20 from the communication controller 30 via the in-vehicle communication line 51. In response to this, the CPU 21 of the information collection controller 20 reads the vehicle state data 60d from the data area 23b of the RAM 23 as shown in FIG. 30. Therefore, the vehicle state data 60d is transmitted as the wireless communication 11 from the antenna 31 of the communication controller 30, and is taken into the rewrite server 3 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 15.
[0094]
The rewrite-only server 3 stores the vehicle state data 60d in a predetermined storage medium in the server 3 and saves it (step 105 in FIG. 2).
[0095]
When the vehicle state data 60 d is saved in the dedicated rewriting server 3, a new in-vehicle program 60 is sent from the dedicated rewriting server 3 to the construction machine as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10. The data is transmitted to the antenna 50 of the construction machine 50 and received by the communication controller 30 via the in-vehicle communication line 51 into the information collection controller 20. In response to this, the CPU 21 of the information collection controller 20 temporarily buffers the received new in-vehicle program 60 in the temporary area 23d of the RAM 23 as shown in FIG. This temporary area 23d includes not only the work areas 23a and 23c but also the data area 23b. That is, the capacity of the new vehicle-mounted program 60 is often large enough to correspond to the entire area of the RAM 23. However, the vehicle state data 60d is saved so that the data area 23b can be used as a buffer area of the new vehicle-mounted program 60. Therefore, a large-capacity new in-vehicle program 60 can be reliably buffered on the RAM 23.
[0096]
The rewrite control program 61 stored in the flash memory 22 is copied to a predetermined storage area of the RAM 23, whereby the system control is transferred to the copied rewrite control program 61 on the RAM 23. It becomes. Therefore, as shown in FIG. 3D, the old in-vehicle program 60 'in the flash memory 22 is rewritten by the new in-vehicle program 60 in the RAM 23 according to the write control program 61 in the RAM 23. That is, after performing a CRC check on the new vehicle-mounted program 60 buffered in the temporary area 23d of the RAM 23, the new vehicle-mounted program 60 is copied to the program area of the flash memory 22, that is, the area where the old vehicle-mounted program 60 'is stored. The old in-vehicle program 60 'is rewritten with the new in-vehicle program 60 (step 106 in FIG. 2).
[0097]
When the new in-vehicle program 60 is copied to the flash memory 22 as shown in FIG. 3 (e), data to that effect is transmitted from the information collection controller 20 to the communication controller 30 via the vehicle body communication line 51. The data is transmitted as the wireless communication 11 from the antenna 31 of the server 30, and is taken into the rewrite server 3 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 15.
[0098]
In response to this, the rewrite-only server 3 receives the vehicle status data 60 d saved in the storage medium and transmits it to the construction machine 50 as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10. Send. The vehicle state data 60d is received by the antenna 31 of the construction machine 50, and taken into the information collection controller 20 from the communication controller 30 via the in-vehicle communication line 51. In response to this, the CPU 21 of the information collection controller 20 performs a process of writing back the received vehicle state data 60d to the original data area 23b of the RAM 23 as shown in FIG.
[0099]
When the rewriting process ends, the CPU 21 performs a self-reset process. As a result, the system control right is transferred to the flash memory 22, the flash memory 22 enters the normal mode, and a new in-vehicle program 60 stored in the program area of the flash memory 22 is activated.
[0100]
By the way, when the old in-vehicle program 60 'is rewritten to the new in-vehicle program 60, the address of the vehicle state data 60d may be changed. Therefore, while the vehicle state data 60d is being evacuated to the rewrite-only server 3, a process of rewriting the vehicle state data 60d is performed by changing the address of the vehicle state data 60d so as to correspond to the new in-vehicle program 60. The vehicle state data 60d may be written back to the original data area 23b of the RAM 23.
[0101]
As described above, according to the present embodiment, the vehicle state data 60d that should not be reset during the rewriting process, such as the time value (accumulated operating time) of the service meter SMR and the past error history generated in the vehicle body, must be inherited. During the rewriting process, the vehicle state data 60d to be inherited is saved from the data area 23b of the RAM 23 to the storage medium of the dedicated rewriting server 3 and written back to the original data area 23b after the rewriting processing is completed. The information can be reliably left on the memory of the information collection controller 20. Further, since the data area 23b after saving the vehicle state data 60d is used as a buffer area for the new in-vehicle program 60, the large-capacity in-vehicle program 60 can be stored on a small-capacity memory in the information collection controller 20. Buffering can be performed reliably, and rewriting processing can be performed reliably.
[0102]
In the above-described embodiment, the vehicle state data 60d is saved in the storage medium of the dedicated rewrite server 3 outside the construction machine 50, but the vehicle state data is stored in another storage area or another storage medium during the rewrite processing. As long as the data 60d can be saved, the data 60d may be saved inside the construction machine 50.
[0103]
FIG. 5 shows a state transition of the memory when the vehicle state data 60d is saved in another storage area on the same RAM 23. Hereinafter, FIG. 5 will be described with reference to the flowchart of FIG.
[0104]
That is, as shown in FIG. 5A, the vehicle state data 60d stored in the data area 23b of the RAM 23 is copied and saved in the last storage area 23e of the RAM 23 (Step 201 in FIG. 6). Next, as shown in FIG. 5B, the new in-vehicle program 60 received from the rewrite-only server 3 is temporarily buffered in the temporary area 23d including the data area 23b (Step 202 in FIG. 6).
[0105]
Next, as shown in FIG. 5C, the new in-vehicle program 60 buffered in the temporary area 23d of the RAM 23 is copied to the program area of the flash memory 22 (Step 203 in FIG. 6). After this rewriting process, the new in-vehicle program 60 remaining in the temporary area 23d on the RAM 23 is cleared (step 204).
[0106]
Next, as shown in FIG. 5D, the vehicle state data 60d saved in the last storage area 23e of the RAM 23 is written back to the data area 23b, which is the original normal position of the RAM 23 (see FIG. 6). Step 205). After the writing back, the vehicle state data 60d remaining in the last storage area 23e of the RAM 23 is cleared (step 206).
[0107]
Note that the clear processing in steps 204 and 206 may be performed as needed, and the program and data may be left without being cleared.
[0108]
In FIG. 5, the vehicle state data 60d is saved in another storage area on the RAM 23 which is the same storage medium. However, the vehicle state data 60d may be saved in a storage medium different from the RAM 23 in the vehicle body in the same manner. . For example, as shown in FIG. 1, the construction machine 50 includes a controller such as a communication controller 30 and an engine controller 40 in addition to the information collection controller 20. Therefore, at the time of the rewriting process, the vehicle state data 60d is saved from the information collection controller 20 to the storage medium in another controller via the in-vehicle communication line 51, and after the rewriting process is completed, the other controller sends the vehicle state data 60d to the information collection controller 20. The vehicle state data 60d may be written back to the original data area 23b on the RAM 23.
[0109]
In the above-described embodiment, the vehicle state data 60d is saved in another storage area. However, the vehicle state data 60d only needs to be reset during the rewriting process, and does not necessarily need to be saved in another area.
[0110]
That is, as shown in FIG. 4, the data area 23b of the RAM 23 is set as a non-overwritable area, and the temporary area 23d of the RAM 23 is set as an overwritable area. Therefore, the new in-vehicle program 60 transmitted from the rewritable server 3 is temporarily buffered in the overwritable temporary area 23b, but is not buffered in the overwritable data area 23b. This prevents a situation in which the vehicle state data 60d stored in the data area 23b is reset during the rewriting process.
[0111]
In the embodiment described above, the case where the normal operation process and the rewrite process are performed on each of the two servers has been described. However, the normal operation process and the rewrite process may be performed on one server. For example, the normal operation server 2 may perform not only the normal operation processing but also the rewriting processing.
[0112]
FIG. 9 shows a processing procedure for switching between the normal operation mode and the rewrite mode between the normal operation server 2 and the construction machine 50.
[0113]
In this case, two transport layer protocols, UDP and TCP, are prepared as communication protocols between the application program on the normal operation server 2 side and the application program on the construction machine 50 side.
[0114]
Therefore, when data is transmitted from the normal operation server 2 according to the UDP communication protocol, the communication controller 30 of the construction machine 50 establishes a connection with the UDP application program, and connects with the other TCP application program. Is invalidated (determination Y in step 501). In response to this, the communication controller 30 of the construction machine 50 determines that the operation mode is the normal operation mode, and thereafter executes the normal operation process via the information collection controller 20 (step 503). On the other hand, when data is transmitted from the normal operation server 2 according to the TCP communication protocol, the communication controller 30 of the construction machine 50 establishes a connection with the TCP application program and communicates with the other UDP application program. Is invalidated (judgment Y in step 502). In response to this, the communication controller 30 of the construction machine 50 determines that the mode is the rewrite mode, and thereafter executes the rewrite process via the information collection controller 20 (step 504).
[0115]
When two servers are provided, it is also possible to use one server mainly and use the other server as a spare server. For example, the server performs the normal operation process and the rewrite process on one side, and when the server is being maintained, the other spare server may be operated to perform the normal operation process and the rewrite process. Also in this case, the switching of the communication connection between the two servers and the construction machine can apply the method of the above-described embodiment.
[0116]
Further, in the present embodiment, the construction machine 50 is assumed as a vehicle, but the present invention can be applied to a case where an in-vehicle program of an arbitrary vehicle such as a general automobile is rewritten.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating an overall configuration of a system according to an embodiment.
FIG. 2 is a diagram illustrating a procedure of a rewriting process according to the embodiment;
FIGS. 3A to 3F are diagrams showing state transitions of a flash memory and a RAM.
FIG. 4 is a diagram showing a data area in which overwriting is impossible.
FIGS. 5A to 5D are diagrams showing state transitions of a flash memory and a RAM.
FIG. 6 is a diagram depicting a processing procedure for saving data;
FIG. 7 is a diagram illustrating a processing procedure when performing verification with a master file;
FIG. 8 is a diagram illustrating a procedure of a server switching process;
FIG. 9 is a diagram illustrating a procedure of a switching process between a normal operation mode and a rewrite mode;
FIG. 10 is a diagram illustrating a correspondence relationship between a server and a construction machine.
[Explanation of symbols]
2 Normal operation server 3 Rewrite only server 4, 5 Intranet 6, 6 'Master file 7 Internet 8 Terrestrial base station 9, 14, 15 Dedicated line 10 Antenna 11 Wireless communication 20 Information collection controller 21 CPU
22 Flash memory 23 RAM
30 Communication controller 50 Construction machine

Claims (2)

Server (2, 3),
In-vehicle program rewrite control device including in-vehicle controller (20) in vehicle (50) communicably connected to servers (2, 3) by communication means (14, 15, 8, 9, 10, 11) And
In the communication state of the communication,
A normal operation mode for transmitting and receiving a vehicle state between the server (2, 3) and the on-vehicle controller (20);
There is a rewrite mode for rewriting the onboard program of the onboard controller (20) to a new onboard program transmitted from the server (2, 3),
When the server (2, 3) receives an in-vehicle program rewriting command, the mode is switched from the normal operation mode to the rewriting mode,
An in-vehicle program rewriting control device characterized in that when the switching means for switching to the normal operation mode operates during the rewriting mode, the mode is switched from the rewriting mode to the normal operation mode. 2. The rewrite control device according to claim 1, wherein the switching unit to the normal operation mode is operated by a timer unit or a logout unit.

Images