JP2004210183A - In-vehicle program rewrite control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an in-vehicle program rewrite control device capable of reliably completing rewrite even if a voltage to normally operate an in-vehicle controller is not supplied from a battery in a vehicle body. <P>SOLUTION: A reset timing determination program 61a stored in a head storage area 22a of a flash memory 22 starts when getting into a reset state. Therefore, a CPU 21 determines that rewrite processing (A) is completed if a rewrite processing flag 23a is in a cleared state according to the reset timing determination program 61a, and performs the processing according to a new in-vehicle program 60 transferred to an in-vehicle program storage area 22b of the flash memory 22. However, if the rewrite processing flag 23a is set when getting into the reset condition, the CPU determines that the rewrite processing is not completed, and a rewrite control program 61b is re-executed. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an apparatus for performing control for rewriting an in-vehicle program.
[0002]
[Prior art]
Various types of controllers such as a controller that collects information on a vehicle state such as a current position of a vehicle body and a time value of a service meter are mounted on construction machines that have been developed in recent years. A CPU is provided in such an in-vehicle controller, and executes arithmetic processing in accordance with an in-vehicle program stored in an EEPROM (electrically erasable ROM) such as a flash memory to collect vehicle state information and to communicate with an external device. Performs processing such as transmission and reception. For example, a vehicle-mounted controller and an external server are communicably connected via communication means such as the Internet, and vehicle state information collected by the vehicle-mounted controller is transmitted to the server. Alternatively, a service person goes to the construction machine, connects a personal computer to the onboard controller, and takes in the vehicle state information into the personal computer.
[0003]
When the in-vehicle program is upgraded, or when it is desired to change the threshold value or the like for abnormality determination for each vehicle, it is necessary to rewrite the old in-vehicle program stored in the flash memory with a new in-vehicle program.
[0004]
(Prior art 1)
Patent Literature 1 (Japanese Patent Application Laid-Open No. 7-162547) describes an invention of a remote program rewriting system in which a program of a communication terminal device is changed in response to a request from a center device. That is, the communication terminal device is provided with an electrically non-erasable ROM in which a rewrite control program is stored, an electrically erasable flash ROM in which a main program is stored, and a RAM. Erroneous rewriting is prevented by erasing the main program in the flash ROM on condition that the received key data is received by the communication terminal device. The key data is analyzed by the key circuit to determine whether writing is prohibited or permitted. When a new main program is sent from the center device, the rewriting control program on the ROM is started, the rewriting process is started, and the new main program is temporarily stored in the RAM. Then, the new main program is transferred from the RAM to the flash ROM, and the system control right is transferred to the new main program.
[0005]
(Prior art 2)
Patent Document 2 (Japanese Patent Application Laid-Open No. 10-212739) relates to a construction machine with a controller for collecting operation data and a monitoring device provided at a remote place. The invention describes that the operation data processing program in the operation data collection controller is rewritten in response to a request from a monitoring device by connecting with a communication device. That is, the operation data collection controller includes an electrically non-erasable ROM storing a rewrite control program, an electrically erasable ROM (EEPROM) storing an operation data processing program, and a RAM. The command “rewrite request”, “rewrite permission”, “rewrite start”, “rewrite prohibition” and “rewrite end” are transmitted and received between the monitoring device and the operation data collection controller, and the EEPROM is written. The state is set to “OK” or “OFF” to prevent erroneous rewriting. A latch circuit and a gate circuit are provided between the CPU and the EEPROM in order to make the EEPROM writable or unwritable in accordance with each of the above commands. In a state where the EEPROM is writable, when a new operating data processing program is sent from the monitoring device, the rewriting control program on the ROM is started, the rewriting process is started, and the new operating data processing program is temporarily stored in the RAM. You. Then, the new operation data processing program is transferred from the RAM to the EEPROM, and the system control right is transferred to the new operation data processing program.
[0006]
[Problems to be solved by the invention]
In a vehicle such as a construction machine, the power supply of the starter device and the like and the power supply of the above-described in-vehicle controller are common. Therefore, when the starter device is operated at the time of starting the engine, the terminal voltage of the battery, which is a common power supply, may temporarily drop below the operating voltage of the onboard controller (CPU). In some cases, a voltage that causes the battery to operate normally may not be applied from the battery to the in-vehicle controller (CPU) due to other causes. In such a case, if the in-vehicle program is being rewritten, there is a possibility that the in-vehicle program may be reset without the rewriting being completed normally.
[0007]
However, both the above-described prior art 1 and prior art 2 assume that the power supply is normal, and do not describe at all how to cope with the case where the reset state occurs without rewriting being completed normally due to the power supply drop.
[0008]
Further, in the above-mentioned prior art 1, two ROMs and one RAM are required as storage media for performing rewriting. Further, a key circuit is required to prevent erroneous rewriting. Similarly, the prior art 2 also requires two ROMs and one RAM as storage media to perform rewriting, and requires a latch circuit and a gate circuit to prevent erroneous rewriting.
[0009]
Such an increase in the number of storage media and circuits for preventing erroneous rewriting takes a large space in the vehicle body, and causes a rise in cost.
[0010]
The present invention has been made in view of such circumstances, and it is intended to ensure that rewriting can be completed afterwards even when a voltage in a vehicle body does not supply a voltage for operating an onboard controller normally. Is to be solved.
[0011]
Means, actions, and effects for solving the problem
The first invention is
A CPU (21);
A writable and readable first storage medium (22);
A writable and readable second storage medium (23);
An onboard program rewriting control device provided in the onboard controller (20),
The first storage medium (22) includes:
An in-vehicle program (60) is stored in the in-vehicle program storage area (22b), and a rewrite control program (61b) for rewriting the in-vehicle program is stored in other areas.
A reset (restart) time determination program (61a) is stored,
In the second storage medium (23),
A new in-vehicle program temporary storage area (23a) for temporarily storing a new in-vehicle program (60);
An in-execution flag storage area for storing a rewriting execution flag (23c) indicating that the in-vehicle program is being rewritten and being executed is provided.
The rewrite control program (61b)
When receiving a command to rewrite a new in-vehicle program (60) from outside,
The new in-vehicle program (60) is temporarily stored in the new in-vehicle program temporary storage area (23a),
A first function of storing a rewriting execution flag (23c) in an execution flag storage area;
A second function of transferring (rewriting) the new vehicle-mounted program stored in the new vehicle-mounted program temporary storage area (23a) onto the vehicle-mounted program stored in the first storage medium (22);
At the end of rewriting,
A third function of deleting the rewriting execution flag (23c) from the execution flag storage area;
After reset (restart),
It has a fourth function of activating the reset (restart) time determination program 61a,
The reset (restart) time determination program 61a
A fifth function of determining whether or not a rewriting execution flag (23c) exists in the execution flag storage area;
If there is no rewriting execution flag (23c), it is determined that the rewriting process has been completed, and the in-vehicle program (60) stored in the in-vehicle program storage area (22b) of the first storage medium (22) is deleted. A sixth function to be executed,
If there is a rewriting execution flag (23c), it is determined that the rewriting process is not completed, and a seventh function for executing the rewriting control program (61b) is provided.
It is characterized by.
[0012]
The second invention is based on the first invention,
Outside the vehicle (50), there is provided a server (3) communicably connected to an on-vehicle controller (20) in the vehicle (50) by communication means (15, 8, 9, 10, 11),
The server (3) has a function of giving an instruction to rewrite a new in-vehicle program (60) to the in-vehicle controller (20) via the communication means (15, 8, 9, 10, 11).
It is characterized by.
[0013]
According to the first invention and the second invention, as shown in FIGS. 2, 3 and 4, when a command for rewriting to a new in-vehicle program 60 is given from outside, the CPU 21 causes the second rewriting control program 61b to execute the second rewriting control program 61b. A buffer process is performed to temporarily store the new in-vehicle program 60 in the predetermined area 23a on the RAM 23, which is a storage medium (FIG. 2A, step 101 in FIG. 3). Then, the new in-vehicle program 60 once stored in the RAM 23 is transferred to the in-vehicle program storage area 22b on the flash memory 22 while the reset determination program 61a remains in the head storage area 22a of the flash memory 23 as the first storage medium. A rewriting process (A) for (copying) is executed (FIG. 2D, step 106 in FIG. 3).
[0014]
During the execution of the rewriting process (A), a rewriting execution flag 23a indicating that the rewriting is being executed is set in a predetermined area on the RAM 23 (FIG. 2B, step 102 in FIG. 3).
[0015]
When the rewriting process (A) is completed, the rewriting in progress flag 23a is set to a clear state (FIG. 2E, step 107 in FIG. 3), and a reset state (FIG. 2F, step 108 in FIG. 3). .
[0016]
At the time of the reset state, the reset determination program 61a stored in the head storage area 22a of the flash memory 22 starts.
[0017]
Therefore, according to the reset determination program 61a, if the rewriting in progress flag 23a is in the clear state, the CPU 21 determines that the rewriting process (A) has been completed, and the in-vehicle program storage area of the flash memory 22 The process is executed according to the new in-vehicle program 60 transferred to 22b (FIG. 2 (f), step 109 in FIG. 3).
[0018]
However, when the reset state is reached, if the rewriting in progress flag 23a is set, it is determined that the rewriting process has not been completed, and the rewriting control program 61b is executed again (step 201 in FIG. 4, 202-205).
[0019]
Therefore, according to the present invention, rewriting can be reliably completed afterwards even if a situation occurs in which a voltage for normally operating the on-vehicle controller 20 is not supplied from the battery 53 in the vehicle body.
[0020]
Moreover, since only the flash memory (first storage medium) 22 and the RAM (second storage medium) 23 are required as storage media, the space in the vehicle body does not increase, and the cost can be reduced. .
[0021]
The second invention of the first invention and the second invention is particularly applied to a case where the in-vehicle program 60 in the construction machine 50 is remotely rewritten via a communication unit in response to a request from the server 3.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 shows the overall apparatus configuration of the embodiment. In the following embodiment, a construction machine 50 is assumed as a vehicle, and a case is assumed in which the in-vehicle program 60 in the construction machine 50 is remotely rewritten in response to a request from the rewrite server 3.
[0023]
In the system of this embodiment, the construction machine 50 communicates with the normal operation server 2 and the dedicated rewrite server 3 via communication means (wireless communication 11, antenna 10, dedicated line 9, terrestrial base station 8, dedicated lines 14, 15). They are connected to each other so that they can be sent and received freely.
[0024]
The normal operation server 2 is located in the intranet 4 and is connected to the Internet 7. Thereby, the normal operation server 2 functions as a server for each client terminal of the Internet 7 and the intranet 4. The normal operation server 2 is provided with an IP address “ID1” which is an ID (server identification ID) for identifying itself in the network. The construction machine 50 is equipped with a communication terminal (communication controller 30), which will be described later, which can communicate with the normal operation server 2, and this communication terminal is assigned an IP address "ID3" corresponding to the server identification ID "ID1". ing.
[0025]
The rewritable server 3 is located in the intranet 5 and is connected to the Internet 7. Thus, the rewrite-only server 3 functions as a server for each client terminal of the Internet 7 and the intranet 5. This rewrite-only server 3 is given an IP address “ID2” which is an ID (server identification ID) for identifying itself in the network. The construction machine 50 has a communication terminal (communication controller 30) capable of communicating with the rewrite-only server 3, and this communication terminal is assigned an IP address "ID4" corresponding to the server identification ID "ID2". .
[0026]
A communication controller 30 having a built-in wireless device for packet data communication is provided in the vehicle body of the construction machine 50. Wireless communication 11 by packet communication is performed between the antenna 31 of the communication controller 30 and the terrestrial antenna 10. The antenna 10 is connected to a terrestrial base station 8 via a dedicated line 9. The terrestrial base station 8 is, for example, a mobile phone base station. The terrestrial base station 8 is connected to intranets 4 and 5 via dedicated lines 14 and 15, respectively.
[0027]
In the vehicle body of the construction machine 50, in addition to the communication controller 30, controllers such as the information collection controller 20 and the engine controller 40 are provided. These controllers communicate with each other in accordance with a predetermined communication protocol. They are communicably connected to each other by a line 51.
[0028]
In each part of the vehicle body of the construction machine 50, a cooling water for the engine 57, a voltage of the battery 53, a GPS sensor, and the like are arranged, and these sensors constitute a sensor group 52. The GPS sensor receives a radio wave transmitted from a GPS satellite and detects the absolute position of its own construction machine 50. A calendar and a timer are provided in the vehicle body of the construction machine 50. The calendar and timer measure the year, month, day, and time (hour, minute, second). A service meter SMR is provided in the vehicle body of the construction machine 50. The service meter SMR measures the operating time of the engine 57.
[0029]
In the information collection controller 20, a CPU 21, a flash memory 22, and a random access memory (RAM) 23 are mutually connected via a bus line 24 so that data can be freely input and output. The flash memory 22 is a type of EEPROM (electrically erasable ROM). Further, an EEPROM such as a flash memory may be used instead of the RAM 23. As will be described later, the predetermined storage area of the flash memory 22 captures the time value of the service meter SMR, each detection value of the sensor group 52, the time value of the calendar, and the time value of the timer to determine whether the construction machine 50 is abnormal. A vehicle that performs a determination or outputs a start lock setting command when the set start lock time zone is reached, performs a start lock described later, and outputs a start lock release command when the time is outside the start lock time zone. A program 60 is stored. In addition, in the head storage area of the flash memory 22, a head program 61 including a reset determination program 61a and a rewrite control program 61b is stored as described later. The following vehicle state data is stored in the predetermined storage area of the RAM 23.
[0030]
-Your own IP address (ID3, ID4)
Information that specifies the construction machine 50, such as the model, model, and machine number of the construction machine 50
Information collected by the information collection controller 20 such as the current time value of the service meter SMR or information obtained by processing the collected information.
-Information indicating the content of the event when an event such as an abnormality occurs in the construction machine 50
-Start lock information such as whether the current start lock is valid or invalid as described later, and the currently set start lock time zone
The vehicle status data is generated as the on-board program 60 operates.
[0031]
The bus line 24 is connected to the service meter SMR and the sensor group 52 outside the information collection controller 20 via an interface, and the bus line 24 is connected to the in-vehicle communication line 51 outside the controller 20 via the interface. .
[0032]
In the present embodiment, the communication controller 30 and the information collection controller 20 are provided separately, but they may be constituted by one controller.
[0033]
A starting lock circuit 55 is incorporated in the vehicle body of the construction machine 50.
[0034]
The start lock circuit 55 is constituted by a relay or the like and is interposed between the key switch 54 and a starter 56 for starting the engine 57. The power supply of the starter 56 is a battery 53 mounted on the vehicle.
[0035]
When the start lock setting command is output from the engine controller 40, the relay of the start lock circuit 55 is energized to enter the start lock setting state. That is, even if the key switch 54 is turned on (ACC position), the terminal voltage of the battery 53 is not applied to the starter 56. As a result, the starter 56 becomes inoperable and the engine 57 cannot be started. On the other hand, when a start lock release command is output from the engine controller 40, the relay of the start lock circuit 55 is deenergized and the start lock is released. That is, when the key switch 54 is turned on (ACC position), the starter 56 operates and the engine 57 can be started. The start lock setting command and the start lock release command are given from the information collection controller 20 to the engine controller 40 via the in-vehicle communication line 51 in accordance with the in-vehicle program 60. The start lock setting command and the start lock release command are output from the information collection controller 20 when the start lock is currently set to “valid”. Whether or not the start lock time zone has been entered is determined based on the values of the calendar and the timer in the information collection controller 20.
[0036]
The information that the key switch 54 is turned on (is in the ACC position) is taken into the information collection controller 20 from the engine controller 40 via the vehicle body communication line 51.
[0037]
The normal operation server 2 manages vehicle state data in a plurality of construction machines including the construction machine 50.
[0038]
The rewrite-only server 3 is a server that remotely rewrites the in-vehicle program 60.
[0039]
The normal operation server 2 has a master file 6. The latest vehicle state data taken into the normal operation server 2 is stored in the master file 6.
[0040]
On the other hand, the rewritable server 3 has a master file 6 '. The storage data of the master file 6 in the normal operation server 2 is taken into the rewritable server 3 via the Internet 7, and the same storage contents as the master file 6, that is, a master file 6 'as a "replica" is created.
[0041]
When a command for requesting vehicle state data of the construction machine 50 from the normal operation server 2 is transmitted to the construction machine 50 as the wireless communication 11 via the dedicated line 14, the terrestrial base station 8, the dedicated line 9, and the antenna 10, The data is received by the antenna 31 of the construction machine 50, and this data is taken into the communication controller 30. The data transmitted from the normal operation server 2 includes the server identification ID “ID1”. Since the communication controller 30 has set the IP address “ID3” and the received data includes the server identification ID “ID1”, both correspond (“ID1” and “ID3” are the same network). Is established), a communication connection is established, and the construction machine 50 is set to be able to transmit vehicle state data.
[0042]
Therefore, a command for requesting vehicle state data is fetched from the communication controller 30 into the information collection controller 20 via the vehicle body communication line 51. For example, when a command requesting the current time value of the service meter SMR is fetched into the information collection controller 20, the current time value of the service meter SMR stored in the RAM 23 is transmitted from the information collection controller 20 via the vehicle body communication line 51. The data is transmitted to the communication controller 30 and transmitted from the antenna 31 of the communication controller 30 as wireless communication 11, and is received by the normal operation server 2 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 14.
[0043]
Also, when a command for setting the start lock validity, invalidity, and start lock time period is transmitted from the normal operation server 2 to the construction machine 50, the information collected by the information collection controller 20 is set to the information collection controller 20 by the same route. Is done.
[0044]
Note that a similar command may be given from each client terminal of the normal operation server 2 to the construction machine 50 via the normal operation server 2.
[0045]
When a specific event occurs in the construction machine 50, such as when a specific abnormality occurs or at a specific time, the details of the abnormality stored in the RAM 23 at the time of the event and the vehicle to be transmitted periodically State data and the like are taken into the communication controller 30 from the information collection controller 20 via the vehicle body communication line 51, and transmitted as wireless communication 11 from the antenna 31 of the communication controller 30 (automatic transmission). The automatically transmitted data is taken into the normal operation server 2 via the antenna 10, the dedicated line 9, the terrestrial base station 8, and the dedicated line 14.
[0046]
The vehicle status data of the construction machine 50 taken into the normal operation server 2 is obtained by accessing the normal operation server 2 from each client terminal connected to the network belonging to the normal operation server 2, ie, the Internet 7 and the intranet 4. It is displayed on the display screen of the client terminal.
[0047]
The latest vehicle state data taken into the normal operation server 2 is stored in the master file 6 and also stored in the master file 6 ′ via the Internet 7.
[0048]
When the in-vehicle program 60 'is upgraded, or when it is desired to change the threshold for generating an error code or determining an abnormality for each construction machine, the old in-vehicle program 60' stored in the flash memory 22 is replaced with a new in-vehicle program. Rewritten into the program 60.
[0049]
When a command to rewrite the in-vehicle program 60 of the construction machine 50 is transmitted from the rewrite dedicated server 3 to the construction machine 50 as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10, The data is received by the antenna 31 of 50, and this data is taken into the communication controller 30.
[0050]
The data transmitted from the rewrite-only server 3 includes the server identification ID “ID2”. In the communication controller 30, the IP address “ID3” is currently set, and the received data includes the server identification ID “ID2”. Therefore, the two do not correspond (“ID2” and “ID3”). It is not the same network) and disconnects the communication connection.
[0051]
Information that the communication connection has been disconnected due to the mismatch of the IDs is taken into the information collection controller 20 from the communication controller 30 via the in-vehicle communication line 51. In response, the information collection controller 20 switches its own IP address “ID4” corresponding to the server identification ID “ID2” of the rewrite-only server 3 to “valid”, and the server identification ID “ID1” of the normal operation server 2. Is switched to “invalid” (rewrite mode). The data “ID4” of the own IP address set as “valid” by the information collection controller 20 is taken into the communication controller 30 from the information collection controller 20 via the in-vehicle communication line 51.
[0052]
The rewrite-only server 3 transmits the rewrite command to the construction machine 50 again in response to the disconnection of the communication connection. The data transmitted from the rewrite-only server 3 includes the server identification ID “ID2”. Since the communication controller 30 is currently set with the IP address “ID4” and the received data includes the server identification ID “ID2”, both correspond (“ID2” and “ID4”). It is determined to be the same network) and a communication connection is established.
[0053]
Thereafter, a process of rewriting the in-vehicle program 60 by the information collection controller 20 in accordance with a command from the rewrite-only server 3 is performed.
[0054]
Next, a process of rewriting the vehicle-mounted program 60 will be described with reference to FIGS. FIGS. 2A to 2F are diagrams showing transitions of the states of the flash memory 22 and the RAM 23. FIG. 3 is a flowchart showing a procedure of a rewriting process in a normal state. FIG. 4 shows a case where a reset occurs during rewriting. 9 is a flowchart showing the procedure of a rewriting process of the first embodiment. In the following description, a dash is given to the old in-vehicle program 60 to distinguish it from the new in-vehicle program 60.
[0055]
As shown in FIG. 2F, a leading program 61 is stored in a leading storage area of the flash memory 22, that is, a storage area 22a to be executed first upon reset. As described above, the head program 61 includes the reset judgment program 61a and the rewrite control program 61b. The reset-time determination program 61a is a program that determines whether or not the rewriting process has been completed according to the state of a rewriting execution flag 23c described later, and selects the next process according to the determination result. The rewrite control program 61b is a program for performing a process of rewriting the old in-vehicle program 60 'with the new in-vehicle program 60. An old in-vehicle program 60 'is stored in a predetermined storage area 22b following the head storage area 22a of the flash memory 22.
[0056]
A command to rewrite the in-vehicle program 60 of the construction machine 50 from the rewriting dedicated server 3 is transmitted to the construction machine 50 as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10 together with the new in-vehicle program 60. Then, the data is received by the antenna 31 of the construction machine 50, and this data is taken into the information collection controller 20 from the communication controller 30 via the in-vehicle communication line 51.
[0057]
When the rewrite command is fetched into the information collection controller 20, the process proceeds according to the rewrite control program 61b on the flash memory 22. First, as shown in FIG. 2A, the CPU 21 buffers the received new in-vehicle program 60 in a predetermined storage area 23a of the RAM 23 (Step 101 in FIG. 3). Next, as shown in FIG. 2B, the CPU 21 performs a process of setting a rewrite execution flag 23c in a predetermined storage area of the RAM 23 to indicate that the rewrite process is being executed (step 102 in FIG. 3).
[0058]
Next, as shown in FIG. 2C, the leading program 61 stored in the flash memory 22 is copied (transferred) to a predetermined storage area 23b of the RAM 23 (Step 103 in FIG. 3). This transfers the system control right to the copied top program 61 on the RAM 23 (step 104 in FIG. 3).
[0059]
As a result, the flash memory 22 enters the write mode, and the rewrite processing (A) for rewriting the old vehicle-mounted program 60 'on the flash memory 22 with the new vehicle-mounted program 60 on the RAM 23 is started according to the write control program 61b on the RAM 23 (FIG. Step 105 in FIG. 3).
[0060]
When the rewriting process (A) is executed, the new in-vehicle program 60 buffered in the storage area 23a of the RAM 23 is replaced with the storage area 22b of the flash memory 22, ie, the old in-vehicle program 60 'as shown in FIG. The data is copied (transferred) to the stored area 22b, and the old vehicle-mounted program 60 'is rewritten with the new vehicle-mounted program 60. However, the head program 61 in the head storage area 22a of the flash memory 22 remains without being rewritten (step 106 in FIG. 3).
[0061]
When the rewriting process (A) is completed normally, the rewriting in progress flag 23c is cleared as shown in FIG. 2E (step 107 in FIG. 3).
[0062]
Next, the CPU 21 performs a self-reset process. Therefore, the system control right is transferred to the flash memory 22, and the head program 61 stored in the head storage area 22a of the flash memory 22 is activated. In this case, the reset-time determination program 61a, which is the first program of the head program 61, is executed (Step 108 in FIG. 3).
[0063]
The reset determination program 61a performs the following processing.
[0064]
1) If the rewriting execution flag 23c is in the clear state at the time of reset, the flash memory 22 is set to the normal mode, and the new in-vehicle program 60 stored in the storage area 22b of the flash memory 22 is executed.
[0065]
2) If the rewriting execution flag 23c is set at the time of reset, the system control right is transferred to the RAM 23, the flash memory 22 is again set in the write mode, and the flash memory 22 is written in accordance with the write control program 61b on the RAM 23. The rewriting process (A) for rewriting the old vehicle-mounted program 60 'on the RAM 22 with the new vehicle-mounted program 60 on the RAM 23 is executed again.
[0066]
When the rewriting process (A) has been completed normally, the rewriting execution flag 23c is cleared at the time of reset, and thus the process 1) is executed. As a result, as shown in FIG. 2 (f), a new in-vehicle program 60 stored in the storage area 22b of the flash memory 22 is started, and normal operation processing such as taking in the time value of the service meter SMR is executed. (Step 109 in FIG. 3).
[0067]
FIG. 4 shows a procedure of the rewriting process when a reset occurs during the rewriting process (A). That is, when the starter 56 is operated at the time of starting the engine 57, the terminal voltage of the battery 53 may temporarily drop below the operating voltage of the CPU 21. In some cases, a voltage that causes the battery 53 to operate normally may not be applied from the battery 53 to the CPU 21 due to other causes. In such a case, if the rewriting process (A) is being executed, the rewriting process (A) may be in a reset state without being completed normally.
[0068]
When a reset occurs during the rewriting process (A) shown in FIG. 2D, the head program 61 stored in the head storage area 22a of the flash memory 22 is started. In this case, the reset-time determination program 61a, which is the first program of the head program 61, is executed (Step 201 in FIG. 4).
[0069]
When the rewriting process (A) is not completed normally, the rewriting in progress flag 23c is in a standing state without being cleared, so that the process 2) described above is executed. That is, when the rewriting in progress flag 23c is set at the time of reset, the system control right is transferred to the RAM 23, the flash memory 22 is again set in the write mode, and the flash memory 22 is written in accordance with the write control program 61b on the RAM 23. The rewriting process (A) for rewriting the old vehicle-mounted program 60 'on the RAM 22 with the new vehicle-mounted program 60 on the RAM 23 is executed again (step 202 in FIG. 4).
[0070]
When the rewriting process (A) is completed normally, the rewriting in progress flag 23c is cleared as shown in FIG. 2E (step 203 in FIG. 4).
[0071]
Next, the CPU 21 performs a self-reset process. Therefore, the system control right is transferred to the flash memory 22, and the head program 61 stored in the head storage area 22a of the flash memory 22 is activated. In this case, the reset-time determination program 61a, which is the first program of the head program 61, is executed (Step 204 in FIG. 4).
[0072]
When the rewriting process (A) has been completed normally, the rewriting execution flag 23c is cleared at the time of reset, and thus the process 1) is executed. As a result, as shown in FIG. 2 (f), a new in-vehicle program 60 stored in the storage area 22b of the flash memory 22 is started, and normal operation processing such as taking in the time value of the service meter SMR is executed. (Step 205 in FIG. 4).
[0073]
As described above, according to the present embodiment, even if a situation occurs in which a voltage for operating the on-vehicle controller 20 is not supplied from the battery 53 in the vehicle body, the rewriting can be reliably completed thereafter. it can.
[0074]
In addition, since only the flash memory 22 and the RAM 23 are required as storage media, the space in the vehicle body does not increase, and the cost can be reduced.
[0075]
In this embodiment, it is assumed that the in-vehicle program 60 in the information collection controller 20 is rewritten. However, the present invention can be similarly applied to the case in which the in-vehicle program in the other controllers 30, 40,.
[0076]
In the present embodiment, the head program 61 is stored in the head storage area 22a of the flash memory 22. However, at least the reset determination program 61a of the head program 61 is stored in the head storage area 22a of the flash memory 22. It should just be.
[0077]
In the present embodiment, the reset-time determination program 61a and the rewrite control program 61b have been described as separate programs. However, the function of the reset-time determination program 61a may be incorporated in the rewrite control program 61b.
[0078]
Further, in the present embodiment, the description has been made on the assumption that the new in-vehicle program 60 is transmitted from outside the construction machine 50 and buffered in the RAM 23 in the construction machine 50, thereby rewriting the old in-vehicle program 60 ′. A new program in which the determination program 61a, the rewrite control program 61b, and the in-vehicle program 60 are integrated may be transmitted, and the old in-vehicle program 60 'may be rewritten by the new in-vehicle program 60.
[0079]
Further, a new program in which the reset determination program 61a, the rewrite control program 61b, and the in-vehicle program 60 are integrated is transmitted, and the transmitted in-vehicle program 60 rewrites the old in-vehicle program 60 ', and transmits the new rewrite. The old rewrite control program may be rewritten by the control program 61b. Rewriting of the rewriting control program may be performed when the communication protocol is changed.
[0080]
In the above-described embodiment, when the in-vehicle program 60 in the information collection controller 20 or the in-vehicle program 60 in the communication controller 30 or the information collection controller 20 and the communication controller 30 are integrally formed, the integrated controller The description has been made on the assumption that the vehicle-mounted program 60 is rewritten. Next, an embodiment suitable for rewriting the in-vehicle program 60 in each controller such as the engine controller 40 other than these controllers and the work implement controller, the monitor panel controller, etc., which are not shown in FIG. 1, will be described. The work machine controller is a controller for operating the work machine provided in the construction machine 50, and the monitor panel controller is configured to display a vehicle state on a monitor panel provided in a cab of the construction machine 50. Controller.
[0081]
When the key switch 54 is turned on, that is, when the construction machine 50 is operating, the engine controller 40, the work equipment controller, the monitor panel controller, and the like need to operate normally by executing the in-vehicle program 60. is there. Therefore, when the key switch 54 is on, it is necessary to execute the in-vehicle program 60 by not executing or interrupting the process of rewriting the in-vehicle program 60.
[0082]
FIG. 5 is a flowchart showing the procedure of the rewriting process, and FIG. 6 is a flowchart showing the procedure at the time of reset. Hereinafter, assuming that the same CPU 21, flash memory 22, and RAM 23 as the information collection controller 20 are mounted in the engine controller 40, the process of rewriting the in-vehicle program 60 in the engine controller 40 will be described with reference to FIG. I do.
[0083]
In the following description, a signal indicating a switching position of the key switch 54 is taken into the engine controller 40, and whether the construction machine 50 is operating or not depends on whether the key switch 54 is turned off (ACC position off). It shall be determined whether or not it is inside. However, whether the construction machine 50 is not operating or is operating can also be determined by detecting the terminal voltage of the alternator or detecting the number of revolutions of the engine 57.
[0084]
A command to rewrite the in-vehicle program 60 of the construction machine 50 from the rewriting dedicated server 3 is transmitted to the construction machine 50 as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10 together with the new in-vehicle program 60. Then, the data is received by the antenna 31 of the construction machine 50, and this data is taken into the engine controller 40 from the communication controller 30 via the in-vehicle communication line 51.
[0085]
When the rewrite command is fetched into the engine controller 40, the process proceeds according to the rewrite control program 61b on the flash memory 22.
[0086]
First, it is determined whether the key switch 54 is turned off (step 301 in FIG. 5). As a result, when the key switch 54 is off, that is, when the engine 57 is not operating, it is determined that the rewriting process should be executed (determination Yes in step 301), and as shown in FIG. The received new in-vehicle program 60 is buffered in a predetermined storage area 23a of the RAM 23 (Step 302 in FIG. 5). Unless the receiving process of the new vehicle-mounted program 60 and the buffering process to the storage area 23a have been completed (No in step 303), the process returns to step 301 and the same process is repeated (steps 301 to 303). When the buffering process is completed (Yes in step 303), as shown in FIG. 2B, the CPU 21 stores the rewrite execution flag 23c in a predetermined storage area of the RAM 23 indicating that the rewrite process is being executed. (Step 304 in FIG. 5).
[0087]
Hereinafter, processing similar to steps 103, 104, and 105 in FIG. 3 is performed in steps 305, 306, and 307 in FIG.
[0088]
That is, as shown in FIG. 2C, the leading program 61 stored in the flash memory 22 is copied (transferred) to a predetermined storage area 23b of the RAM 23 (Step 305 in FIG. 5). As a result, the system control right is transferred to the copied top program 61 on the RAM 23 (step 306 in FIG. 5).
[0089]
As a result, the flash memory 22 enters the write mode, and the rewrite processing (A) for rewriting the old vehicle-mounted program 60 'on the flash memory 22 with the new vehicle-mounted program 60 on the RAM 23 is started according to the write control program 61b on the RAM 23 (FIG. Step 307 in FIG. 5).
[0090]
When the rewriting process (A) is executed, the new in-vehicle program 60 buffered in the storage area 23a of the RAM 23 is replaced with the storage area 22b of the flash memory 22, ie, the old in-vehicle program 60 'as shown in FIG. The data is copied (transferred) to the stored area 22b, and the old vehicle-mounted program 60 'is rewritten with the new vehicle-mounted program 60. However, the head program 61 in the head storage area 22a of the flash memory 22 remains without being rewritten (step 308 in FIG. 5).
[0091]
During the rewriting process (A), similarly to step 301, it is determined whether the key switch 54 is turned off (step 309 in FIG. 5). As a result, when the key switch 54 is off, that is, the engine 57 is operating. If not, it is determined that the rewriting process should be continued (Yes in step 309), and the copy (transfer) of the new in-vehicle program 60 to the area 22b has not been completed (No in step 310). Then, the process returns to step 308 to continue the rewriting process (A) (steps 308 to 310). However, when the copy (transfer) of the new in-vehicle program 60 to the area 22b is completed, that is, when the rewriting process (A) is normally completed (Yes in step 310), the steps 107 and 108 in FIG. , 109 are performed in steps 311, 312, and 313 in FIG.
[0092]
That is, as shown in FIG. 2E, the rewriting execution flag 23c is cleared (step 311 in FIG. 5), and then the CPU 21 performs a self-reset process. Therefore, the system control right is transferred to the flash memory 22, and the head program 61 stored in the head storage area 22a of the flash memory 22 is activated. In this case, the reset-time determination program 61a, which is the first program of the head program 61, is executed (step 312 in FIG. 5).
[0093]
FIG. 6 shows the processing contents of the reset determination program 61a.
[0094]
11) If the rewriting execution flag 23c is in the clear state at the time of reset, or if the key switch 54 is ON (No in step 401 in FIG. 6), the in-vehicle program is executed. When the rewriting execution flag 23c is in the clear state, the new vehicle-mounted program 60 stored in the storage area 22b of the flash memory 22 is executed. However, when the rewriting execution flag 23c is on and the key switch 54 is on, the old in-vehicle program 60 'stored in the storage area 22b is not executed, and the storage area 23a of the RAM 23 is not executed. Is executed (step 403 in FIG. 6).
[0095]
12) If the rewriting in progress flag 23c is set at the time of reset and the key switch 54 is off (Yes in step 401 of FIG. 6), it is determined that the rewriting process should be executed (continued). Then, the system control right is transferred to the RAM 23, the flash memory 22 is again set in the write mode, and the old in-vehicle program 60 'in the flash memory 22 is rewritten by the new in-vehicle program 60 in the RAM 23 according to the write control program 61b on the RAM 23. The rewriting process (A) is executed again (step 402 in FIG. 6).
[0096]
When the rewriting process (A) is completed normally, the rewriting in progress flag 23c is cleared at the time of reset, and thus the process of the above 11) is executed. As a result, as shown in FIG. 2 (f), a new in-vehicle program 60 stored in the storage area 22b of the flash memory 22 is started, and normal operation processing such as taking in the time value of the service meter SMR is executed. (Step 313 in FIG. 5).
[0097]
If the key switch 54 has already been turned on at the start of the processing in FIG. 5 or if the key switch 54 has been turned on in the middle of the rewriting processing (A) (No in step 301 or no in step 309) No), the process proceeds to step 314 to operate the engine controller 40 normally, and the CPU 21 performs a self-reset process. When the self-reset process is performed, the reset-time determination program 61a is started, and the process shown in FIG. 6 is executed. Since the key switch 54 is in the ON state, the processing of the above 11) is executed. For this reason, after the judgment processing of step 401 (the key switch 54 is on and the judgment of step 401 is No), if the rewriting processing (A) is not being performed (if the rewriting execution flag 23c is in a clear state), The in-vehicle program stored in the storage area 22b of the flash memory 22 is executed, the rewriting process (A) is being performed (if the rewriting in progress flag 23c is on), and the key switch 54 is turned on. If so, the new in-vehicle program 60 buffered in the storage area 23a of the RAM 23 is executed (step 403). Alternatively, the CPU 21 may directly activate the in-vehicle program buffered in the storage area 22b of the flash memory 22 or the storage area 23a of the RAM 23 without performing the self-reset process (Step 314 in FIG. 5).
[0098]
If a reset occurs due to a drop in the voltage of the battery 53 or the like during the rewriting process (A), the reset determination program 61a is activated and the process proceeds according to the procedure shown in FIG.
[0099]
In the above-described embodiment, the case where the first storage medium is the flash memory 22 and the second storage medium is the RAM 23 has been described. However, the first storage medium and the second storage medium are described below. The storage media may be the same storage media shown or different storage media shown below.
[0100]
・ EEPROM (electrically erasable ROM)
・ RAM backed up by a battery outside the controller
・ RAM backed up by battery inside controller
・ Non-volatile RAM such as FRAM that does not require a backup power supply
.Flash memory 22 provided inside the one-chip microcomputer
In the above-described embodiment, the rewriting process for copying (transferring) the new in-vehicle program 60 buffered in the RAM 23 to the flash memory 22 is performed, but the new in-vehicle program buffered without performing such rewriting process is performed. It is also possible to execute 60 as it is.
[0101]
FIG. 9 shows a storage medium suitable for this embodiment. As shown in FIG. 9, a CPU 21, a flash memory 22, and a RAM 23 are provided inside the one-chip microcomputer, and a reset-time determination program 61a and a rewrite control program 61b are stored in a head storage area 22a of the flash memory 22. Is stored. On the flash memory 22, a first storage area 22d and a second storage area 22e for buffering the vehicle-mounted program 60 are provided.
[0102]
In the first storage area 22d, a rewriting execution flag 22f1 is set to indicate that rewriting is being performed if buffer processing is being performed, and the rewriting execution flag 23f1 is cleared when the buffer processing is completed. Similarly, in the second storage area 22e, if a buffer process is being performed, a rewrite execution flag 22f2 is set to indicate that rewrite is being performed, and when the buffer process is completed, a rewrite execution flag 23f2 is cleared.
[0103]
If buffer processing is being performed in the first storage area 22d, the program executable flag 22g1 indicating that the in-vehicle program in the first storage area 22d is executable is cleared, and when the buffer processing is completed, the program is executed. The possible flag 22g1 is set. Similarly, if buffer processing is being performed in the second storage area 22e, the program executable flag 22g2 indicating that the in-vehicle program in the second storage area 22e is executable is cleared. The possible flag 22g2 is set.
[0104]
When the in-vehicle program 60 is buffered, date information indicating the buffered date and time is stored in each of the storage areas 22d and 22e. The in-vehicle program 60 itself may be provided with information on the date and time of the version upgrade, and this may be stored as date information in the buffered storage areas 22d and 22e.
[0105]
FIG. 7 is a flowchart showing the procedure of the rewriting process, and FIG. 8 is a flowchart showing the procedure at the time of reset. Hereinafter, the process of rewriting the in-vehicle program 60 in the engine controller 40 will be described with reference to FIG.
[0106]
A command to rewrite the in-vehicle program 60 of the construction machine 50 from the rewriting dedicated server 3 is transmitted to the construction machine 50 as the wireless communication 11 via the dedicated line 15, the terrestrial base station 8, the dedicated line 9, and the antenna 10 together with the new in-vehicle program 60. Then, the data is received by the antenna 31 of the construction machine 50, and this data is taken into the engine controller 40 from the communication controller 30 via the in-vehicle communication line 51.
[0107]
When the rewrite command is fetched into the engine controller 40, the process proceeds according to the rewrite control program 61b on the flash memory 22.
[0108]
First, it is determined which of the first storage area 22d and the second storage area 22e is to be buffered in which storage medium (storage area). This criterion is as follows.
[0109]
Criteria 1) If one of the program executable flags 22g1 and 22g2 of the storage areas 22d and 22e is cleared, the new in-vehicle program is stored in the storage area where the program executable flag is cleared. Buffer 60. When one of the rewriting execution flags 22f1 and 22f2 of the storage areas 22d and 22e is in the on state, the storage area in which the rewriting execution flag is on (the storage area in which the rewriting process is being executed) is stored. Buffer the new in-vehicle program 60.
[0110]
Judgment criterion 2) When the program executable flags 22g1 and 22g2 of both storage areas 22d and 22e are set and the in-vehicle program 60 stored in both storage areas 22d and 22e can be executed. Buffers the new in-vehicle program 60 in a predetermined specific storage area, for example, the second storage area 22e.
[0111]
The following criterion 3 may be applied instead of criterion 2.
[0112]
Judgment criterion 3) When the program executable flags 22g1 and 22g2 of both storage areas 22d and 22e are on and the on-board program 60 stored in both storage areas 22d and 22e can be executed. Buffers the new in-vehicle program 60 in the storage area of the earlier date and time of the date and time indicated in the date information (step 501 in FIG. 7).
[0113]
The CPU 21 performs a process of setting the rewriting execution flag 22f1 or 22f2 in the storage area 22d or 22e determined to be buffered (step 502 in FIG. 7).
[0114]
Next, the top program 61 stored in the flash memory 22 is copied (transferred) to a predetermined storage area of the RAM 23 (Step 503 in FIG. 7). As a result, the system control right is transferred to the copied top program 61 on the RAM 23 (step 504 in FIG. 7).
[0115]
As a result, the flash memory 22 enters the write mode, and the new vehicle-mounted program 60 is written in the storage area 22d or 22e on the flash memory 22 according to the write control program 61b on the RAM 23, and the old vehicle-mounted program 60 'is rewritten by the new vehicle-mounted program 60. The rewriting process is started (Step 505 in FIG. 7).
[0116]
At the start of the rewriting process, it is determined whether the key switch 54 is turned off (step 506 in FIG. 7). As a result, when the key switch 54 is off, that is, when the engine 57 is not operating, the rewriting process is continued. The CPU 21 determines that the process should be performed (Yes in step 506), and proceeds to the next step 507, where the CPU 21 buffers the received new in-vehicle program 60 in the storage area 22d or 22e of the flash memory 22 to be buffered. A process of writing and rewriting the old in-vehicle program 60 'with the new in-vehicle program 60 is executed (step 507 in FIG. 7).
[0117]
Unless the receiving process of the new in-vehicle program 60 and the buffering process (writing process) to the storage areas 22d and 22e have been completed (No in step 508), the same process is repeated (steps 506 to 508). When the rewriting process is completed (Yes in step 508), the CPU 21 clears the rewriting execution flag 22f1 or 22f2 of the storage region 22d or 22e for which the rewriting process has been completed, and clears the storage region 22d or 22e for which the rewriting process has been completed. A process for setting the program executable flag 22g1 or 22g2 is performed. At the same time, the program executable flag 22g1 or 22g2 of the storage area 22d or 22e which is not the target of the rewriting process is cleared. For example, when the rewriting process is completed in the second storage area 22e, a process of clearing the rewriting execution flag 2222f2 of the second storage area 22e and setting a program executable flag 22g2 of the second storage area 22e is performed. At the same time, the program executable flag 22g1 of the first storage area 22d is cleared (Step 509 in FIG. 5).
[0118]
Thereafter, the CPU 21 performs a self-reset process. Therefore, the system control right is transferred to the flash memory 22, and the head program 61 stored in the head storage area 22a of the flash memory 22 is activated. In this case, the reset-time determination program 61a, which is the first program of the head program 61, is executed (Step 510 in FIG. 5).
[0119]
FIG. 8 shows the processing contents of the reset determination program 61a.
[0120]
That is, when the reset-time determination program 61a is activated, an executable in-vehicle program is activated according to the following criteria.
[0121]
Judgment Criteria 11) If one of the program executable flags 22g1 and 22g2 of the storage areas 22d and 22e is on, the new in-vehicle program 60 in the storage area on which the program executable flag is on is activated. Let it.
[0122]
Judgment criterion 12) When the program executable flags 22g1 and 22g2 of both storage areas 22d and 22e are on and the vehicle-mounted program 60 stored in both storage areas 22d and 22e can be executed. Starts a new in-vehicle program 60 in a predetermined specific storage area, for example, the first storage area 22d.
[0123]
The following criterion 13 may be applied instead of the criterion 12.
[0124]
Judgment Criteria 13) When the program executable flags 22g1 and 22g2 of both storage areas 22d and 22e are set and the in-vehicle program 60 stored in both storage areas 22d and 22e can be executed. Starts a new in-vehicle program 60 in the storage area of the newer date and time of the date and time indicated in the date information.
[0125]
When the rewriting process is normally completed, a process of setting the program executable flag 22g1 or 22g2 of the storage region 22d or 22e where the rewriting process is completed is performed, and at the same time, the storage region 22d or 22e which is not the target of the rewriting process is set. The program executable flag 22g1 or 22g2 has been cleared. For example, when the rewriting process is completed in the second storage area 22e, the program executable flag 22g2 of the second storage area 22e is set, and at the same time, the program executable flag 22g1 of the first storage area 22d is cleared. Therefore, the latest in-vehicle program 60 in the second storage area 22e is activated and executed according to the criterion 11 (step 511 in FIG. 7).
[0126]
If the key switch 54 is turned on during the rewriting process of FIG. 7 (No in step 506), the process proceeds to step 512 so that the engine controller 40 operates normally, and the CPU 21 performs a self-reset process. . When the self-reset process is performed, the reset-time determination program 61a is started, and the process shown in FIG. 8 is executed. For this reason, according to the criteria 11, 12, and 13, the in-vehicle program 60 in the storage area where the program execution flag is set is activated. Further, the CPU 21 may directly activate the in-vehicle program in the storage areas 22d and 22e of the flash memory 22 without performing the self-reset process (Step 512 in FIG. 7).
[0127]
If a reset occurs due to a drop in the voltage of the battery 53 or the like during the rewriting process, the reset determination program 61a is activated and the process proceeds according to the procedure shown in FIG.
[0128]
In FIG. 9, the first storage area 22d and the second storage area 22e are provided on the flash memory. However, the EEPROM is not limited to the flash memory. The first storage area 22d and the second storage area 22e may be provided on a non-volatile RAM such as an FRAM which does not require a backup power supply.
[0129]
In the present embodiment described above, the in-vehicle program 60 is rewritten in response to a command from the rewrite-only server 3. However, the in-vehicle program 60 may be rewritten in response to a command from the normal operation server 2. .
[0130]
Further, in the above-described embodiment, it is assumed that the in-vehicle program 60 in the construction machine 50 is remotely rewritten in response to a request from the server. However, a service person goes to the construction machine 50 and connects a personal computer to the controller. Thus, the present invention can be applied to the case where the on-board program 60 is rewritten.
[0131]
In the embodiments described above, the construction machine 50 is assumed as a vehicle. However, the present invention can be applied to a case where an in-vehicle program of an arbitrary vehicle such as a general automobile is rewritten.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating an overall configuration of a system according to an embodiment.
FIGS. 2A to 2F are diagrams showing state transitions of a flash memory and a RAM.
FIG. 3 is a flowchart showing a procedure of a rewriting process in a normal state in FIG. 3;
FIG. 4 is a flowchart illustrating a procedure of a rewriting process when a reset occurs during rewriting.
FIG. 5 is a flowchart illustrating a procedure of a rewriting process;
FIG. 6 is a flowchart related to FIG. 5 and showing a procedure of a process at the time of reset;
FIG. 7 is a flowchart illustrating a procedure of a rewriting process;
FIG. 8 is a flowchart related to FIG. 7 and showing a procedure of processing at the time of reset.
FIG. 9 is a diagram showing a configuration example of a storage medium provided with two storage areas for storing a vehicle-mounted program on a flash memory.
[Explanation of symbols]
21 CPU
22 Flash memory
23 RAM

Claims (2)

A CPU (21);
A writable and readable first storage medium (22);
A writable and readable second storage medium (23);
An onboard program rewriting control device provided in the onboard controller (20),
The first storage medium (22) includes:
An in-vehicle program (60) is stored in the in-vehicle program storage area (22b), and a rewrite control program (61b) for rewriting the in-vehicle program is stored in other areas.
A reset (restart) time determination program (61a) is stored,
In the second storage medium (23),
A new in-vehicle program temporary storage area (23a) for temporarily storing a new in-vehicle program (60);
An in-execution flag storage area for storing a rewriting execution flag (23c) indicating that the in-vehicle program is being rewritten and being executed is provided.
The rewrite control program (61b)
When receiving a command to rewrite a new in-vehicle program (60) from outside,
The new in-vehicle program (60) is temporarily stored in the new in-vehicle program temporary storage area (23a),
A first function of storing a rewriting execution flag (23c) in an execution flag storage area;
A second function of transferring (rewriting) the new vehicle-mounted program stored in the new vehicle-mounted program temporary storage area (23a) onto the vehicle-mounted program stored in the first storage medium (22);
At the end of rewriting,
A third function of deleting the rewriting execution flag (23c) from the execution flag storage area;
After reset (restart),
It has a fourth function of activating the reset (restart) time determination program 61a,
The reset (restart) time determination program 61a
A fifth function of determining whether or not a rewriting execution flag (23c) exists in the execution flag storage area;
If there is no rewriting execution flag (23c), it is determined that the rewriting process has been completed, and the in-vehicle program (60) stored in the in-vehicle program storage area (22b) of the first storage medium (22) is deleted. A sixth function to be executed,
When there is a rewriting execution flag (23c), it is determined that the rewriting process has not been completed, and a seventh function for executing the rewriting control program (61b) is provided. apparatus. Outside the vehicle (50), there is provided a server (3) communicably connected to an on-vehicle controller (20) in the vehicle (50) by communication means (15, 8, 9, 10, 11),
The server (3) has a function of giving a command to rewrite a new vehicle-mounted program (60) to the vehicle-mounted controller (20) via the communication means (15, 8, 9, 10, 11). The rewrite control device for an in-vehicle program according to claim 1, wherein

Images