Vehicle control apparatus with data reprogrammable via wireless communication network

In a vehicle control apparatus for reprogramming data stored therein based on a reprogramming instruction transmitted thereto via a wireless communication network, an asking unit is provided. The asking unit asks a data reprogramming unit about whether the reprogramming instruction is validated or not. The data reprogramming unit has been authorized to reprogram the data stored in the vehicle control apparatus. A determining unit is provided in the vehicle control apparatus. The determining unit receives a reply to the asking transmitted from the data reprogramming unit via the wireless communication network and determines whether to enable or disable the reprogramming of the data stored in the vehicle control apparatus based on the received reply.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is based on Japanese Patent Application 2007-122054 filed on May 7, 2007. This application claims the benefit of priority from the Japanese Patent Application, so that the descriptions of which are all incorporated herein by reference.

FIELD OF THE INVENTION

The present invention relates to vehicle control apparatuses with data reprogrammable through a wireless communication network.

BACKGROUND OF THE INVENTION

A plurality of electronic control units (ECUs) are normally installed in a motor vehicle. Such ECUs are operative to control at least one target device/function installed in the motor vehicle in accordance with corresponding control programs and control data stored therein.

Specifically, each of the ECUs is programmed to execute the control programs using the control data, thereby controlling the corresponding at least one target device/function.

Such control programs stored in an ECU may be required to be reprogrammed with new versions thereof due to, for instance, software bugs in the control programs. Similarly, control data associated with the control programs and stored in an ECU may be required to be reprogrammed with new control data due to, for example, errors in the control data.

A remote reprogramming technology has been used for such data reprogramming. An example of the conventional remote reprogramming technology is disclosed in Japanese Patent Application Publication No. H05-195859.

The remote reprogramming technology is designed to remotely reprogram control programs and control data associated therewith stored in an ECU through a radio communication network, such as cellular networks.

The remote reprogramming technique prevents the drivers (users) from driving their motor vehicles for data reprogramming, making it possible to rapidly repair the bugs and/or errors in the control programs and/or the control data.

Specifically, in the remote reprogramming technique, a data reprogramming unit of a reprogramming station is provided and managed by a manufacture of motor vehicles which are integrated with an ECU.

In response to a request for data reprogramming of an ECU (target ECU) of one motor vehicle (target motor vehicle), the data reprogramming unit accesses the target ECU through cellular networks so as to inform the target ECU of a reprogramming instruction. Next, the data reprogramming unit sends, to the target ECU through the cellular networks, data for use in reprogramming. This data for use in reprogramming will be referred to as “reprogramming data” hereinafter.

On the other hand, the target ECU of each of the motor vehicles receives the reprogramming instruction sent from the reprogramming station, and provides for the receipt of the reprogramming data. When the reprogramming data is sent thereto from the data reprogramming unit, the target ECU of the target motor vehicle receives the reprogramming data. Thereafter, the target ECU reprograms at least one of control programs and control data associated therewith based on the received reprogramming data; these control programs and control data having been stored in the target ECU.

BRIEF SUMMARY OF THE INVENTION

In the remote reprogramming technique, if the data reprogramming unit installed in the reprogramming station abnormally operates, an abnormal rewriting instruction may be sent, through the radio communication network, to a target ECU of a motor vehicle to be reprogrammed.

In this case, the abnormal rewriting instruction may reprogram the control programs and control data stored in the target ECU; this may affect the operating conditions of the motor vehicle.

In view of the background, an object of at least one aspect of the present invention is to provide vehicle control apparatuses and data reprogramming systems, which are capable of inhibiting reprogramming in response to an unauthorized reprogramming instruction being sent through a wireless communication network.

According to one aspect of the present invention, there is provided a vehicle control apparatus for reprogramming data stored therein based on a reprogramming instruction transmitted thereto via a wireless communication network. The vehicle control apparatus includes an asking unit configured to ask a data reprogramming unit about whether the reprogramming instruction is validated or not. The data reprogramming unit has been authorized to reprogram the data stored in the vehicle control apparatus. The vehicle control apparatus includes a determining unit configured to receive a reply to the asking transmitted from the data reprogramming unit via the wireless communication network and to determine whether to enable or disable the reprogramming of the data stored in the vehicle control apparatus based on the received reply.

According to another aspect of the present invention, there is provided a vehicle control apparatus for reprogramming data stored therein based on a reprogramming instruction transmitted thereto via a wireless communication network. The vehicle control apparatus includes a receiving unit configured to receive a reprogramming disable instruction transmitted via an alternative wireless communication network except for the wireless communication network. The vehicle control apparatus includes a disabling unit configured to disable, according to the reprogramming disabling instruction, any one of:reprogramming of the data stored in the vehicle control apparatus; andreceipt of an alternative reprogramming instruction transmitted via the wireless communication network.

According to a further aspect of the present invention, there is provided a data reprogramming system for reprogramming data stored in a vehicle control apparatus based on a reprogramming instruction transmitted thereto via a wireless communication network. The data reprogramming system includes a data reprogramming unit that has been authorized to reprogram the data stored in the vehicle control apparatus. The data reprogramming system includes an asking unit installed in the vehicle control apparatus and configured to ask the data reprogramming unit about whether the reprogramming instruction is validated or not. The data reprogramming system includes a determining unit installed in the vehicle control apparatus and configured to receive a reply to the asking transmitted from the data reprogramming unit via the wireless communication network and to determine whether to enable or disable the reprogramming of the data stored in the vehicle control apparatus based on the received reply.

According to a still further aspect of the present invention, there is provided a data reprogramming system for reprogramming data stored in a vehicle control apparatus based on a reprogramming instruction transmitted thereto via a wireless communication network. The data reprogramming system includes a data reprogramming unit that has been authorized to reprogram the data stored in the vehicle control apparatus. The data reprogramming system includes a receiving unit installed in the vehicle control apparatus and configured to receive a reprogramming disable instruction transmitted from the data reprogramming unit via an alternative wireless communication network except for the wireless communication network. The reprogramming disabling instruction represents disabling of any one of:reprogramming of the data stored in the vehicle control apparatus; andreceipt of an alternative reprogramming instruction transmitted via the wireless communication network.

In the one and further aspects of the present invention, the asking unit works to ask the data reprogramming unit about whether the reprogramming instruction is validated or not. The determining unit is configured to receive a reply to the asking transmitted from the data reprogramming unit via the wireless communication network and to determine whether to enable or disable the reprogramming of the data stored in the vehicle control apparatus based on the received reply.

Specifically, when the replay represents that the reprogramming instruction is validated, the determining unit enables the reprogramming of the data stored in the vehicle control apparatus.

In contrast, when the reply represents that the reprogramming instruction is not validated, the determining unit disables the reprogramming of the data stored in the vehicle control apparatus.

In another and the still further aspects of the present invention, the receiving unit works to receive a reprogramming disable instruction transmitted from the data reprogramming unit via an alternative wireless communication network except for the wireless communication network.

Specifically, in another and the still further aspects of the present invention, even if a failure occurs in the wireless communication network, it is possible to disable, according to the received reprogramming disabling instruction, any one of:reprogramming of the data stored in the vehicle control apparatus; andreceipt of an alternative reprogramming instruction transmitted via the wireless communication network.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

First Embodiment

In a first embodiment of the present invention, a vehicle control apparatus20is designed to, when receiving an instruction to reprogram data stored therein, ask, to a data reprogramming unit, whether the received reprogramming instruction is validated; this data reprogramming unit has been authorized to reprogram data stored in the vehicle control system20.

Such an instruction to reprogram data stored in the vehicle control apparatus20will also be referred to as “reprogramming instruction” hereinafter. In addition, reprogramming of data stored in the vehicle control apparatus20will be referred to as “data reprogramming” hereinafter. The data stored in the vehicle control apparatus20includes at least one control program required to control at least one target device/function and control data associated with the at least one control program.

The vehicle control apparatus20is also designed to enable the data reprogramming based on the received reprogramming instruction when a reply sent from the authorized data reprogramming unit represents that the received reprogramming instruction is validated.

The vehicle control apparatus20is further designed to disable the data reprogramming based on the received reprogramming instruction when the reply sent from the authorized data reprogramming system represents that the received reprogramming instruction is not validated.

The configuration of the vehicle control system20prevents invalid data-reprogramming based on unauthorized reprogramming instructions.

In the first embodiment, data stored in the vehicle control system20includes at least one control program for controlling at least one target device installed in the motor vehicle and control data associated with the at least one control program.

Referring toFIG. 1, a data reprogramming system100according to the first embodiment is equipped with a reprogramming control center10, a plurality of reprogramming stations11under the control of the reprogramming control center10, and the vehicle control apparatus20. The combinations of the respective reprogramming stations11and the reprogramming control center10will be referred to as “data reprogramming units102” hereinafter. The data reprogramming units102share the reprogramming control center10.

The reprogramming control center10is provided in, for example, a predetermined geographic area of a country. The geographic area is divided into a plurality of regions. For instance, at least one of the plurality of reprogramming stations11is provided in each of the plurality of regions such that each of the plurality of reprogramming stations11has a communication range equivalent to a corresponding one of the regions.

Each of the reprogramming stations11, in other words, each of the data reprogramming units102, has been authorized to reprogram data stored in a plurality of motor vehicles13.

The vehicle control apparatus20has been installed in each of the motor vehicles13. In the vehicle control apparatus20, programs for control the corresponding motor vehicle13and control data associated therewith haven been stored.

For example, the reprogramming control center10, referred to simply as “control center10” is designed as a computer-based system.

Specifically, the control center10includes a transceiver10bwith an antenna10cand a rewritable memory10d.

The control center10has stored in the rewritable memory10da communication address CA(11) of each of the reprogramming stations11in, for example, file format. The communication address CA(11) of each of the reprogramming stations11identifies the location thereof in the cellular phone lines12as an example of wireless communication networks.

The transceiver10bis operative to:establish a connection through the cellular phone lines12between the control center10and either at least one reprogramming station11or the vehicle control apparatus20of at least one motor vehicle13; andinterrupt the established connection.

Similarly, each of the reprogramming stations11is designed as a computer-based system.

Each of the reprogramming stations11includes a transceiver11bwith an antenna11cand a rewritable memory11d.

Similarly, each of the reprogramming stations11has stored in the rewritable memory11da communication address CA(10) of the reprogramming control center10. The communication address CA(10) of the reprogramming control center10identifies the location thereof in the cellular phone lines12.

Each of the reprogramming stations11also has stored in the rewritable memory11da vehicle code VC(13) of each of the authorized motor vehicles13and a communication address CA(20) of the vehicle control apparatus20of each of the motor vehicles13. The communication address CA(20) of the vehicle control apparatus20of each of the motor vehicles13identifies the location thereof in the cellular phone lines12.

The transceiver11bis operative to:establish a connection through the cellular phone lines12between the corresponding reprogramming station11and either the reprogramming control center10or the vehicle control apparatus20of at least one motor vehicle13; andinterrupt the established connection.

The vehicle control apparatus20of each of the motor vehicles13includes a powertrain ECU21, an air-conditioner ECU22, an antilock braking (ABS) ECU23, a diagnostic ECU24, a in-vehicle network25, and a navigation system26. Each of the ECUs21to24is designed as a computer-based system with a rewritable memory28.

In the rewritable memory28of each of the ECUs21to24, a control program required to control corresponding at least one target device/function and control data associated with the control program have been stored. The control program and the control data stored in the rewritable memory28of each of the ECUs21to24is illustrated inFIG. 1as “data D”.

Specifically, the powertrain ECU21is operative to control, as its target devices/functions, an internal combustion engine and a power transmission system of the corresponding motor vehicle13in accordance with the control program and the control data stored therein.

The air conditioner ECU22is operative to control, as its target devices/functions, an air conditioner installed in the corresponding motor vehicle13in accordance with the control program and the control data stored therein.

The antilock braking ECU23is operative to control, as its target devices/functions, an antilock braking system installed in the corresponding motor vehicle13in accordance with the control program and the control data stored therein.

The diagnostic ECU24is operative to control, as its target devices/functions, a self-diagnostic function to diagnose each of the other ECUs21to23as slave ECUs and to diagnose itself in accordance with the control program and the control data stored therein.

Each of the ECUs21to24can communicate with another one of the ECUs21to24through the in-vehicle network25so as to transmit or receive information required for each of the ECUs21to24to control the corresponding target devices/functions.

The navigation system26consists of, for example, a memory and a display device, and electric map image data has been stored in the memory.

The navigation system26is operative to:calculate the current exact location of the corresponding motor vehicle13based on radio signals transmitted from global positioning systems (GPS) and the electronic map image data stored in the memory;display the current vehicle's exact location on the screen of the display device together with the readout electronic map image data associated with the vehicle's exact location;calculate the best route to occupant's destination from the current location according to occupant's instructions; andgive an occupant(s) voice or visual guidance to the destination along the calculated best route using the display device and/or a speaker.

In the first embodiment, for example, in the diagnostic ECU24, a transceiver27with an antenna27ahas been installed.

The diagnostic ECU24has stored in the memory28the communication address CA(10) of the reprogramming control center CA(10) and the communication address CA(11) of each of the authorized reprogramming stations11in, for example, file format.

The transceiver27is operative to:establish a connection through the cellular phone lines12between the diagnostic ECU24and either the reprogramming control center10or at least one reprogramming station11; andinterrupt the established connection.

Specifically, in the first embodiment, the diagnostic ECU24of the vehicle control apparatus20serves as a data reprogramming module for reprogramming the control program and the control data stored in at least one of the ECUs21to24.

The data reprogramming system100according to the first embodiment is designed to assume that a reprogramming instruction is transmitted from a reprogramming station that has been unauthorized to reprogram data stored in each of the motor vehicles13.

In the first embodiment, the reprogramming stations11that have been authorized to reprogram data stored in each of the motor vehicles13will be referred to as “authorized reprogramming stations” hereinafter. In addition, a reprogramming station that has been unauthorized to reprogram data stored in each of the motor vehicles13will be referred to as “unauthorized reprogramming station” hereinafter. To the unauthorized reprogramming station, a reference character11fis assigned.

Under the assumption, the data reprogramming system100is configured to disable data reprogramming based on the reprogramming instruction sent from the unauthorized reprogramming station11f.

FIG. 2schematically illustrates a routine to be executed by the data reprogramming system100to thereby enable the data reprogramming based on the reprogramming instruction sent from one of the authorized reprogramming stations11.

At a given timing, when wanting to reprogram the control data and the control program stored in at least one of the ECUs21to24of the vehicle control apparatus20of one of the motor vehicles13, the control center10generates a reprogramming instruction. The reprogramming instruction is to reprogram the control program and the control data stored in the at least one of the ECUs21to24of the vehicle control apparatus20of the one of the motor vehicles13. Hereinafter, the at least one of the ECUs21to24will be referred to as “target ECU”, and the one of the motor vehicles13will be referred to as “target vehicle”.

Next, the control center10transmits, from the antenna10cto the communication address CA(11) of one of the authorized reprogramming stations11, the reprogramming instruction as, for example, modulated carrier waves via cellular phone lines12in step S1. The one of the authorized reprogramming stations11is selected such that:the location of the garage for the target vehicle13belongs to one of the regions corresponding to the one of the authorized reprogramming stations11; orthe current location of the target vehicle13detected by the navigation system26belongs to one of the regions corresponding to the one of the authorized reprogramming stations11. Hereinafter, the one of the authorized reprogramming stations11will be referred to as “target station”.

The target station11receives, via the antenna11c, the reprogramming instruction transmitted from the control center10. The target station11transmits, from the antenna11cto the communication address CA(20) of the vehicle control apparatus20of the target vehicle13, the reprogramming instruction as modulated carrier waves via cellular phone lines12in step S2.

Simultaneously or thereafter, the target station11registers, in the rewritable memory11d, a history of the transmission of reprogramming instructions to the target vehicle13in step S3. For example, the history is stored in the rewritable memory11dto be associated with the vehicle code VC(13) of the target vehicle13.

When the reprogramming instruction is transmitted from the target station11, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13establishes a connection through the cellular phone lines12between the target station11and the corresponding vehicle control apparatus20to thereby receive, via the antenna27a, the reprogramming instruction in step S4.

Next, the diagnostic ECU24interrupts the established connection in step S5.

Thereafter, the diagnostic ECU24searches the rewritable memory28for the communication address CA(11) of the one of the authorized reprogramming stations11(the target station11). Then, the diagnostic ECU24calls back to the searched communication address CA(11) of the target station11in step S6. In other words, the diagnostic ECU24reestablishes a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the target station11based on the searched communication address CA(11) in step S6.

In step S6, the diagnostic ECU24informs the target station11of the vehicle code VC(13) of the corresponding target vehicle13to thereby ask the target station11about whether the history of the transmission of reprogramming instructions to the target vehicle13is registered in the target station11.

When receiving the query including the vehicle code VC(13) of the target vehicle13, the target station11searches the rewritable memory11dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13in step S7.

At that time, the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d(see step S3). For this reason, the target station11transmits, to the vehicle control apparatus20of the target vehicle13, a reply representing that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11din step S8.

When receiving the reply representing that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the target station11, the diagnostic ECU24determines that the received reprogramming instruction is validated. Then, the diagnostic ECU24goes into reprogramming authorization mode in step S9.

In the reprogramming authorization mode, the diagnostic ECU24enables reprogramming of the control program and the control data stored in the target ECU.

Specifically, the diagnostic ECU24reprograms at least part of the control program and/or the control data based on the received reprogramming instruction and on data used to the data reprogramming and sent from the target station11after the transmission of the reprogramming instruction in steps S10and S11. The data used to the data reprogramming will be referred to as “reprogramming data” hereinafter.

In contrast,FIG. 3schematically illustrates a routine to be executed by the data reprogramming system100to thereby disable the data reprogramming based on a reprogramming instruction sent from the unauthorized reprogramming station11f.

When an unauthorized reprogramming instruction is transmitted from the unauthorized reprogramming station11f, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13establishes a connection through the cellular phone lines12between the unauthorized reprogramming station11fand the corresponding vehicle control apparatus20. This allows receipt, via the antenna27a, of the unauthorized reprogramming instruction in step S20.

Next, the diagnostic ECU24interrupts the established connection in step S21.

Thereafter, the diagnostic ECU24searches the rewritable memory28for the communication address CA(11) of one of the authorized reprogramming stations11independently of the source of the unauthorized reprogramming instruction. Specifically, the one of the authorized reprogramming stations11is selected such that:the location of the garage for the target vehicle13belongs to one of the regions corresponding to the one of the authorized reprogramming stations11; orthe current location of the target vehicle13detected by the navigation system26belongs to one of the regions corresponding to the one of the authorized reprogramming stations11. As described above, the one of the authorized reprogramming stations11corresponds to the target station11.

Then, the diagnostic ECU24calls back to the searched communication address CA(11) of the target station11in step S22. In other words, the diagnostic ECU24reestablishes a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the target station11based on the searched communication address CA(11) in step S22.

In step S22, the diagnostic ECU24informs the target station11of the vehicle code VC(13) of the corresponding target vehicle13to thereby ask the target station11about whether a history of the transmission of reprogramming instructions to the target vehicle13is registered in the target station11.

When receiving the vehicle code VC(13) of the target vehicle13, the target station11searches the rewritable memory11dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13in step S23.

At that time, no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d. For this reason, the target station11transmits, to the vehicle control apparatus20of the target vehicle13, a reply representing that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11din step S24.

When receiving the reply representing that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the target station11, the diagnostic ECU24determines that the received reprogramming instruction is invalid, the diagnostic ECU24goes into reprogramming protection mode in step S25.

In the reprogramming protection mode, the diagnostic ECU24disables reprogramming of the control program and the control data stored in the target ECU even if data used to the reprogramming is sent from the unauthorized target station11fafter the transmission of the unauthorized reprogramming instruction.

In the descriptions set forth above, one of the motor vehicles13is set as the target vehicle13, but each of the motor vehicles13can be set as the target vehicle13.

As described above, when receiving a reprogramming instruction, the vehicle control apparatus20of each of the motor vehicles13is configured to ask one of the authorized reprogramming stations11about whether the received reprogramming instruction is validated.

The vehicle control apparatus20of each of the motor vehicles13is configured to enable data reprogramming based on the received reprogramming instruction only when a reply sent from the destination authorized reprogramming unit represents that the received reprogramming instruction is validated.

In other words, the vehicle control apparatus20of each of the motor vehicles13is configured to disable the data reprogramming based on the received reprogramming instruction when a reply sent from the destination authorized reprogramming unit represents that the received reprogramming instruction is invalid.

This prevents invalid data-reprogramming based on unauthorized reprogramming instructions when they are transmitted to the vehicle control apparatus20of each of the motor vehicles13.

Note that, in a state that the unauthorized reprogramming instruction has been transmitted to the vehicle control apparatus20via the cellular phone lines12, in other words, the data reprogramming system100has not been working properly, the transmission of the unauthorized reprogramming instruction can be repeated. For this reason, it is preferable that the remote reprogramming via the cellular phone lines12be held until the data reprogramming system100returns to proper operating conditions.

In this circumstance, after going into the reprogramming protection mode, the vehicle control apparatus20continuously operates in the reprogramming protection mode while disabling receipt of the reprogramming instructions.

For this reason, even if a new reprogramming instruction is sent to the vehicle control apparatus20after transition of its operation mode to the reprogramming protection mode, the reprogramming of the data stored in the vehicle control apparatus20based on the new reprogramming instruction is automatically prevented independently of whether the new reprogramming instruction is validated or not.

Next, tasks to be executed by one of the authorized reprogramming stations11serving as the target station11will be further described hereinafter with reference toFIGS. 4 and 5.

FIG. 4schematically illustrates a reprogramming-instruction transmitting task to be executed by the target station11.

The target station11starts the reprogramming-instruction transmitting task in response to receiving the reprogramming instruction transmitted from the control center10. First, the target station11transmits, from the antenna11cto the communication address CA(20) of the vehicle control apparatus20of the target vehicle13, the reprogramming instruction as the modulated carrier waves via cellular phone lines12in step S401.

Simultaneously or thereafter, the target station11registers, in the rewritable memory11d, a history of the transmission of the reprogramming instruction to the target vehicle13in step S402. Thereafter, the target station11terminates the reprogramming-instruction transmitting task.

Next,FIG. 5schematically illustrates a replying task to be executed by the target station11.

When launching the replying task in response to the query, the target station11searches the rewritable memory11dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13included in the query.

Based on the result of the search, the target station11determines whether the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11din step S501.

When it is determined that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d(the determination in step S501is NO), the target station11proceeds to step S505. In step S505, the target station11transmits, to the vehicle control apparatus20of the target vehicle13, the reply representing that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11din step S505.

Otherwise, when it is determined that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d(the determination in step S501is YES), the target station11proceeds to step S502.

In step S502, the target station11transmits, to the vehicle control apparatus20of the target vehicle13, the reply representing that the history of the transmission of the reprogramming instruction to the target vehicle13has been registered in the rewritable memory11d.

Next, the target vehicle13transmits, to the vehicle control apparatus20of the target vehicle13, the reprogramming data in step S503. Subsequently, the target vehicle13clears the history log for the target vehicle13stored in the rewritable memory11din step S504.

Next, tasks to be executed by the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13will be further described hereinafter with reference toFIGS. 6 and 7.

FIG. 6schematically illustrates a query task to be executed by the diagnostic ECU24of the target vehicle13.

When establishing a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the sender of the reprogramming instruction so as to receive the reprogramming instruction, the diagnostic ECU24starts the query task.

Specifically, in step S601, the diagnostic ECU24determines whether its operation mode is reprogramming initial mode. Note that the reprogramming initial mode represents the operation mode of the diagnostic ECU24(the vehicle control apparatus20) except for the reprogramming authorization mode and the reprogramming protection mode before initially receiving the reprogramming instruction.

When it is determined that the operation mode of the diagnostic ECU24of the target vehicle13is not the reprogramming initial mode (the determination in step S601is NO), the diagnostic ECU24proceeds to step S607. In step S607, the diagnostic ECU24goes into the reprogramming protection mode, terminating the query task.

Otherwise, when it is determined that the operation mode of the diagnostic ECU24is the reprogramming initial mode (the determination in step S601is YES), the diagnostic ECU24proceeds to step S602. In step S602, the diagnostic ECU24interrupts the established connection.

After the interruption, the diagnostic ECU24searches the rewritable memory28for the communication address CA(11) of the target station11independently of the sender of the received reprogramming instruction. After the search, the diagnostic ECU24calls back to the searched communication address CA(11) of the target station11in step S603. In step S603, the diagnostic ECU24informs the target station11of the vehicle code VC(13) of the corresponding target vehicle13to thereby ask the target station11about whether the history of the transmission of reprogramming instructions to the target vehicle13is registered in the target station11.

As described above, in response to the callback, the target station11executes the replying task illustrated inFIG. 5to thereby transmit the reply to the diagnostic ECU24.

The diagnostic ECU24receives the reply transmitted from the target station11in step S604, and determines whether the reply represents that the history of the transmission of the reprogramming instruction to the target vehicle13has been registered in the rewritable memory11or not in step S605.

When it is determined that the reply represents that the history of the transmission of the reprogramming instruction to the target vehicle13has been registered in the rewritable memory11(the determination in step S605is YES), the diagnostic ECU24goes into the reprogramming authorization mode in step S606, exiting the query task.

Otherwise, when it is determined that the reply represents that no history of the transmission of the reprogramming instruction to the target vehicle13has been registered in the rewritable memory11(the determination in step S605is NO), the diagnostic ECU24goes into the reprogramming protection mode in step S607, exiting the query task.

Next,FIG. 7schematically illustrates a data reprogramming task to be executed by the diagnostic ECU24of the target vehicle13.

When starting the data reprogramming task in response to receiving the reprogramming data, the diagnostic ECU24determines whether its operation mode is the reprogramming authorization mode in step S701.

When it is determined that the operation mode of the diagnostic ECU24is not the reprogramming authorization mode (the determination in step S701is NO), the diagnostic ECU24determines that:its operation mode has been already shifted to the reprogramming protection mode; orthe received reprogramming data is invalidly transmitted via the cellular phone lines12while the reply for the query transmitted in step S603remains unsent.

In any case set forth above, the diagnostic ECU24determines that the reprogramming data is invalidly transmitted through the cellular phone lines12. Then, the diagnostic ECU24makes its operation mode unchanged when its operation mode is the reprogramming protection mode in step S704. Otherwise, the diagnostic ECU24goes into the reprogramming protection mode when its operation mode is another operation mode in step S704.

Otherwise, when it is determined that the operation mode of the diagnostic ECU24is the reprogramming authorization mode (the determination in step S701is YES), the diagnostic ECU24proceeds to step S702. In step S702, the diagnostic ECU24reprograms the control program and the control data stored in the target ECU based on the received reprogramming data. Thereafter, the diagnostic ECU24goes into the reprogramming initial mode in step S703, exiting the data reprogramming task.

As described above, in the data reprogramming system100according to the first embodiment, when receiving a reprogramming instruction, the vehicle control apparatus20of one target vehicle13asks one of the authorized reprogramming stations11about whether the received reprogramming instruction is validated.

Then, the vehicle control apparatus20disallows the data reprogramming based on the received reprogramming instruction unless a reply sent from the one of the authorized reprogramming units represents that the received reprogramming instruction is validated. In other words, the vehicle control apparatus20disables the data reprogramming based on the received reprogramming instruction when a reply sent from the one of the authorized reprogramming units represents that the received reprogramming instruction is invalid.

This achieves a first effect of appropriately preventing unauthorized data reprogramming based on the invalid reprogramming instruction.

In response to receiving a reprogramming instruction, the vehicle control apparatus20of one target vehicle13according to the first embodiment asks one of the authorized reprogramming stations11about whether the received reprogramming instruction is validated. When receiving the query sent from the target vehicle13, the one of the authorized reprogramming stations11transmits, to the target vehicle13, a reply indicative of the existence of the history of the transmission of reprogramming instructions to the target vehicle13. The replay allows the vehicle control apparatus20of the target vehicle13to verify whether the received reprogramming instruction is validated.

This achieves a second effect of easily and properly verifying the validity of the received reprogramming instruction.

In the first embodiment, when establishing a connection between the vehicle control apparatus20and the sender of a reprogramming instruction to receive it, the vehicle control apparatus20interrupts the established connection, and reestablishes a connection between the vehicle control apparatus20and one of the authorized reprogramming stations11.

This achieves a third effect of querying one of the authorized reprogramming stations11as to whether the received reprogramming instruction is validated independently of the sender of the reprogramming instruction.

In the first embodiment, after the unauthorized reprogramming instruction has been transmitted to the vehicle control apparatus20via the cellular phone lines12, in other words, the data reprogramming system100has not been working properly, the vehicle control apparatus20continuously disables receipt of the reprogramming instructions. This prevents the vehicle control apparatus20from executing the data reprogramming task in response to receiving the reprogramming instructions.

This achieves a fourth effect of disabling the data reprogramming for the vehicle control apparatus20under the state in which the reliability of the data reprogramming system100cannot be ensured.

Second Embodiment

A data reprogramming system according to a second embodiment of the present invention will be described hereinafter. The data reprogramming system of the second embodiment has substantially the same structure as that of the data reprogramming system100of the first embodiment except for some differences described hereinafter. For this reason, like reference characters are assigned to like parts in the data reprogramming systems according to the first and second embodiments so that descriptions of the parts of the data reprogramming system of the second embodiment will be omitted.

In the first embodiment, the vehicle control apparatus20of the target vehicle13is programmed to ask one of the authorized reprogramming stations11about whether a reprogramming instruction received thereby is validated. This prevents unauthorized data reprogramming based on the unauthorized reprogramming instruction based on the premise that the one of the authorized reprogramming stations11normally operates.

As an example of the circumstances where an unauthorized reprogramming instruction is transmitted via the cellular phone lines12, an authorized reprogramming station may fail so that it may transmit a reprogramming instruction although the control center10does not generate an authorized reprogramming instruction.

In this circumstance, even if the vehicle control apparatus20of a target vehicle13asks the failed station11about whether the reprogramming instruction transmitted from the failed station11, it may be difficult for the vehicle control apparatus20to receive proper replies from the failed station11so that unauthorized data reprogramming may be executed.

Specifically, after the reprogramming instruction has been transmitted from the failed station11, the history of the transmission of reprogramming instructions can be stored in the rewritable memory11dalthough the reprogramming instruction is invalidly transmitted from the failed station11. At that time, when receiving a query of whether the reprogramming instruction sent from the failed station11is validated, the failed station11may transmit, to the vehicle control apparatus20, a reply representing that the history of the transmission of reprogramming instructions has been stored therein. This may result that the vehicle control apparatus20misjudges that the reprogramming instruction sent from the failed station11is validated.

In order to address the misjudge of the vehicle control apparatus20, the vehicle control apparatus20according to the second embodiment is configured to ask the control center10about whether a reprogramming instruction received thereby is validated. Specifically, even if a reprogramming instruction is invalidly transmitted from the failed station11so that the history of the transmission of reprogramming instructions has been stored in the rewritable memory11d, no history of the transmission of reprogramming instructions has been stored in the rewritable memory10dof the control center10.

For this reason, querying the control center10as to whether the history of the transmission of reprogramming instructions has been stored therein properly checks the validity of a reprogramming instruction even if one of the authorized reprogramming stations11is malfunctioned to erroneously transmit the reprogramming instruction.

FIG. 8schematically illustrates a routine to be executed by the data reprogramming system100according to the second embodiment to thereby enable the data reprogramming based on the reprogramming instruction sent from one of the authorized reprogramming stations11.

As described above, the control center10transmits, from the antenna10cto the communication address CA(11) of a target station11corresponding to a target vehicle13, the reprogramming instruction via cellular phone lines12in step S1.

Simultaneously or thereafter, the control center10registers, in the rewritable memory10d, a history of the transmission of reprogramming instructions to the target vehicle13in step S31. For example, the history is stored in the rewritable memory10dto be associated with the vehicle code VC(13) of the target vehicle13.

The target station11receives, via the antenna11c, the reprogramming instruction transmitted from the control center10. The target station11transmits, from the antenna11cto the communication address CA(20) of the vehicle control apparatus20of the target vehicle13, the reprogramming instruction in step S2.

Simultaneously or thereafter, the target station11registers, in the rewritable memory11d, a history of the transmission of reprogramming instructions to the target vehicle13in step S3. For example, the history is stored in the rewritable memory11dto be associated with the vehicle code VC(13) of the target vehicle13.

When the reprogramming instruction is transmitted from the target station11, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13establishes a connection through the cellular phone lines12between the target station11and the corresponding vehicle control apparatus20to thereby receive, via the antenna27a, the reprogramming instruction in step S4.

Next, the diagnostic ECU24interrupts the established connection in step S5.

Thereafter, the diagnostic ECU24searches the rewritable memory28for the communication address CA(10) of the control center10. Then, the diagnostic ECU24calls back to the searched communication address CA(10) of the control center10in step S32. In other words, the diagnostic ECU24reestablishes a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the control center10based on the searched communication address CA(10) in step S32.

In step S32, the diagnostic ECU24informs the control center10of the vehicle code VC(13) of the corresponding target vehicle13to thereby ask the control center10about whether the history of the transmission of reprogramming instructions to the target vehicle13is registered in the control center10.

When receiving the query including the vehicle code VC(13) of the target vehicle13, the control center10searches the rewritable memory10dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13in step S33.

At that time, the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10d(see step S31). For this reason, the control center10transmits, to the vehicle control apparatus20of the target vehicle13, a reply representing that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10din step S34.

When the reply is transmitted from the control center10, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle11establishes a connection through the cellular phone lines12between the control center20and the corresponding vehicle control apparatus20in step S35. In step S35, the diagnostic ECU24receives, via the antenna27a, the reply representing that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the control center10.

Based on the received reply, the diagnostic ECU24determines that the received reprogramming instruction is validated. Then, the diagnostic ECU24goes into the reprogramming authorization mode in step S35.

Next, the diagnostic ECU24interrupts the established connection in step S36.

Thereafter, the diagnostic ECU24searches the rewritable memory28for the communication address CA(11) of the target station11. Then, the diagnostic ECU24reestablishes a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the target station11based on the searched communication address CA(11) in step S37.

In step S37, the diagnostic ECU24transmits, to the target station11, a request therefor to transmit reprogramming data; this request includes the vehicle code VC(13) of the target vehicle13. The reprogramming data is required to reprogram the control program and the control data stored in the target ECU.

When receiving the request, the target station11searches the rewritable memory11dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13in step S7.

At that time, the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d(see step S3). For this reason, the target station11transmits, to the vehicle control apparatus20of the target vehicle13, the reprogramming data in step S10.

When receiving the reprogramming data, the diagnostic ECU24reprograms at least part of the control program and/or the control data based on the received reprogramming instruction and on the received reprogramming data in step S11.

In contrast,FIG. 9schematically illustrates a routine to be executed by the data reprogramming system100when one failed or malfunctioned reprogramming station11erroneously transmits a reprogramming instruction independently of the generation of a reprogramming instruction by the control center10. Hereinafter, the reprogramming instruction to be erroneously sent from the failed or malfunctioned reprogramming station11will be referred to as “unauthorized reprogramming instruction”.

When the unauthorized reprogramming instruction is transmitted from the failed or malfunctioned reprogramming station11, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13establishes a connection through the cellular phone lines12between the failed or malfunctioned reprogramming station11and the corresponding vehicle control apparatus20. Then, the diagnostic ECU24receives, via the antenna27a, the unauthorized reprogramming instruction in step S20.

Next, the diagnostic ECU24interrupts the established connection in step S21.

Thereafter, the diagnostic ECU24searches the rewritable memory28for the communication address CA(10) of the control center10. Then, the diagnostic ECU24reestablishes a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the control center10based on the searched communication address CA(10) in step S32.

In step S32, the diagnostic ECU24informs the control center10of the vehicle code VC(13) of the corresponding target vehicle13to thereby ask the control center10about whether the history of the transmission of reprogramming instructions to the target vehicle13is registered in the control center10.

When receiving the query including the vehicle code VC(13) of the target vehicle13, the control center10searches the rewritable memory10dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13in step S33.

At that time, no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10d(see step S31). For this reason, the control center10transmits, to the vehicle control apparatus20of the target vehicle13, a reply representing that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10din step S40.

When the reply is transmitted from the control center10, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle11establishes a connection through the cellular phone lines12between the control center20and the corresponding vehicle control apparatus20in step S41. In step S41, the diagnostic ECU24receives, via the antenna27a, the reply representing that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the control center10.

Next, in step S42, the diagnostic ECU24determines that the received reprogramming instruction is invalid, the diagnostic ECU24goes into the reprogramming protection mode.

In the reprogramming protection mode, the diagnostic ECU24disables reprogramming of the control program and the control data stored in the target ECU based on the unauthorized reprogramming instruction.

Next, tasks to be executed by the control center10will be further described hereinafter with reference toFIGS. 10 and 11.

FIG. 10schematically illustrates a reprogramming-instruction generating task to be executed by the control center10.

When launching the reprogramming-instruction generating task, the control center10generates a reprogramming instruction. The reprogramming instruction is to reprogram the control program and the control data stored in a target ECU of the vehicle control apparatus20of the target vehicle13.

Then, the control center10transmits, from the antenna10cto the communication address CA(11) of the target station11corresponding to the target vehicle13, the reprogramming instruction via cellular phone lines12in step S1001.

Simultaneously or thereafter, the control center10registers, in the rewritable memory10d, a history of the transmission of reprogramming instructions to the target vehicle13in step S1002. Thereafter, the control center10terminates the reprogramming-instruction generating task.

Next,FIG. 11schematically illustrates a replying task to be executed by the control center10.

When launching the replying task in response to the query, the control center10searches the rewritable memory10dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13included in the query.

Based on the result of the search, the control center10determines whether the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10din step S1101.

When it is determined that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10d(the determination in step S1101is YES), the control center10proceeds to step S1102.

In step S1102, the control center10transmits, to the vehicle control apparatus20of the target vehicle13, the reply representing that the history of the transmission of the reprogramming instruction to the target vehicle13has been registered in the rewritable memory10d.

Next, the control center10clears the history log for the target vehicle13stored in the rewritable memory10din step S1103.

Otherwise, when it is determined that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10d(the determination in step S1101is NO), the control center10proceeds to step S1104. In step S1104, the control center10transmits, to the vehicle control apparatus20of the target vehicle13, the reply representing that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory10d.

Next, a reprogramming-data transmitting task to be executed by the target station11will be further described hereinafter with reference toFIG. 12. Note that, in the second embodiment, the target station11is programmed to carry out the reprogramming-instruction transmitting task illustrated inFIG. 4in response to receiving the reprogramming instruction generated by the control center10.

When launching the reprogramming-data transmitting task in response to receiving the request, the target station11searches the rewritable memory11dfor the history of the transmission of reprogramming instructions to the target vehicle13based on the vehicle code VC(13) of the target vehicle13included in the request.

Based on the result of the search, the target station11determines whether the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11din step S1201.

When it is determined that the history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d(the determination in step S1201is YES), the target station11proceeds to step S1202.

In step S1202, the target station11transmits, to the vehicle control apparatus20of the target vehicle13, the reprogramming data.

Next, the target vehicle13clears the history log for the target vehicle13stored in the rewritable memory11din step S1203.

Otherwise, when it is determined that no history of the transmission of reprogramming instructions to the target vehicle13has been registered in the rewritable memory11d(the determination in step S1201is NO), the target station11terminates the reprogramming-data transmitting task.

Next, tasks to be executed by the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13will be further described hereinafter with reference toFIGS. 13 and 14. Note that, in the second embodiment, the diagnostic ECU24of the vehicle control apparatus20of the target vehicle13is programmed to carry out the data reprogramming task illustrated inFIG. 7in response to receiving the reprogramming data transmitted from the target station11.

FIG. 13schematically illustrates a query task to be executed by the diagnostic ECU24of the target vehicle13.

When establishing a connection through the cellular phone lines12between the corresponding vehicle control apparatus20and the sender of the reprogramming instruction so as to receive the reprogramming instruction, the diagnostic ECU24starts the query task.

Specifically, in step S1301, the diagnostic ECU24determines whether its operation mode is the reprogramming initial mode.

When it is determined that the operation mode of the diagnostic ECU24of the target vehicle13is not the reprogramming initial mode (the determination in step S1301is NO), the diagnostic ECU24proceeds to step S1304. In step S1304, the diagnostic ECU24goes into the reprogramming protection mode, terminating the query task.

Otherwise, when it is determined that the operation mode of the diagnostic ECU24is the reprogramming initial mode (the determination in step S1301is YES), the diagnostic ECU24proceeds to step S1302. In step S1302, the diagnostic ECU24interrupts the established connection.

After the interruption, the diagnostic ECU24searches the rewritable memory28for the communication address CA(10) of the control center10independently of the sender of the received reprogramming instruction. After the search, the diagnostic ECU24calls back to the searched communication address CA(10) of the control center10in step S1303. In step S1303, the diagnostic ECU24informs the control center10of the vehicle code VC(13) of the corresponding target vehicle13to thereby ask the control center10about whether the history of the transmission of reprogramming instructions to the target vehicle13is registered in the control center10.

Next,FIG. 14schematically illustrates a reprogramming-mode setting task to be executed by the diagnostic ECU24of the target vehicle13.

When the query task is carried out by the diagnostic ECU24of the target vehicle13, the replying task illustrated inFIG. 11is performed by the control center10. This results that the reply indicative of the existence of the history of the transmission of reprogramming instructions to the target vehicle13is returned from the control center10to the vehicle control apparatus20of the target vehicle13.

When establishing a connection between the vehicle control apparatus20and the control center10to receive the reply, the diagnostic ECU24of the target vehicle13starts the reprogramming-mode setting task.

Specifically, the diagnostic ECU24of the target vehicle13determines whether the reply represents that the history of the transmission of reprogramming instructions is present in step S1402.

When it is determined that the reply represents that the history of the transmission of reprogramming instructions is not present (the determination in step S1402is NO), the diagnostic ECU24determines that the received reprogramming instruction is invalid. Then, the diagnostic ECU24goes into the reprogramming protection mode in step S1403, exiting the reprogramming-mode setting task.

Otherwise, when it is determined that the reply represents that the history of the transmission of reprogramming instructions is present (the determination in step S1402is YES), the diagnostic ECU24determines that the received reprogramming instruction is validated. Then, the diagnostic ECU24goes into the reprogramming authorization mode in step S1404.

Next, the diagnostic ECU24interrupts the established connection in step S1405, and reestablishes a connection between the vehicle control apparatus20and the target reprogramming station11in step S1406.

In step S1406, the diagnostic ECU24transmits, to the target station11, the request therefor to transmit the reprogramming data. Thereafter, when receiving the reprogramming data sent from the target station11, the diagnostic ECU24starts to execute the data reprogramming task illustrated inFIG. 7.

As described above, in the data reprogramming system100according to the second embodiment, the vehicle control apparatus20one target vehicle13asks the control center10about whether a received reprogramming instruction is validated.

This achieves, in addition to the first to fourth effects, a fifth effect of disabling, when a failed or malfunctioned station11erroneously transmits an unauthorized reprogramming instruction, invalid data reprogramming based on the unauthorized reprogramming instruction.

In each of the first and second embodiments, after going into the reprogramming protection mode, the vehicle control apparatus20continuously operates in the reprogramming protection mode while disabling receipt of the reprogramming instructions, in other words, disabling the data reprogramming based on the reprogramming instructions.

Specifically, in a state that the unauthorized reprogramming instruction has been transmitted to the vehicle control apparatus20via the cellular phone lines12, there is a possibility that a failure occurs in the data reprogramming system100so that the transmission of the unauthorized reprogramming instruction can be repeated. For this reason, it is effective to disable receipt of the reprogramming instructions after the vehicle control apparatus20has gone into the reprogramming protection mode.

However, even if the unauthorized reprogramming instruction is repeatedly transmitted to the vehicle control apparatus20of the target vehicle13, the vehicle control apparatus20can check the validity of the unauthorized reprogramming instruction every time the unauthorized reprogramming instruction is received. This prevents invalid data-reprogramming based on the unauthorized reprogramming instructions.

Specifically, the vehicle control apparatus20can reset the reprogramming protection mode every time a reprogramming request is received.

For example, in the query task illustrated inFIG. 6orFIG. 13, the vehicle control apparatus20can forcibly go into the reprogramming initial mode when the query task illustrated inFIG. 6has been completed.

More specifically, in the first embodiment, when starting the query task in response to receiving a reprogramming instruction, the diagnostic ECU24can set its operation mode to the reprogramming initial mode in step S601, and thereafter can execute the operations in steps S602to S607.

In the second embodiment, when starting the query task in response to receiving a reprogramming instruction, the diagnostic ECU24can set its operation mode to the reprogramming initial mode in step S1301, and thereafter can execute the operations in steps S1302to S1304.

In each of the first and second embodiments, the transmissions of the reprogramming instructions, the reprogramming data, the queries to check the validity of each of the received reprogramming instructions are carried out via the cellular phone lines12. The present invention is not limited to the structure. Specifically, the transmissions of the reprogramming instructions, the reprogramming data, and the queries to check the validity of each of the received reprogramming instructions can be carried out via another wireless communication network.

Third Embodiment

A data reprogramming system according to a third embodiment of the present invention will be described hereinafter. The data reprogramming system of the third embodiment has substantially the same structure as that of the data reprogramming system100of the first embodiment except for some differences described hereinafter. For this reason, like reference characters are assigned to like parts in the data reprogramming systems according to the first and third embodiments so that descriptions of the parts of the data reprogramming system of the third embodiment will be omitted.

In each of the first and second embodiments, when it is determined that a reprogramming instruction transmitted to each of the motor vehicles13is invalid, the vehicle control apparatus20of each of the motor vehicles13is configured to disable the data reprogramming based on the invalid reprogramming instruction.

In contrast, in the third embodiment, when it is determined that a reprogramming instruction transmitted to each of the motor vehicles13is invalid, a data reprogramming system100A according to the third embodiment simultaneously disables data reprogramming of all of the motor vehicles13.

Specifically, in the third embodiment, when it is determined that a reprogramming instruction transmitted to each of the motor vehicles13is invalid or likely to be invalid, the control center10works to broadcast, to the vehicle control apparatuses20of all of the motor vehicles13, an instruction to disable data reprogramming. In particular, under circumstances in which the reprogramming instructions are invalidly transmitted via the cellular phone lines12, communications via the cellular phone lines12cannot be guaranteed in validity. For this reason, under the circumstances, when the cellular phone lines12are used to broadcast, to the vehicle control apparatuses20of all of the motor vehicles13, the instruction to disable data reprogramming, it may be difficult to reliably inform all of the motor vehicles13of the instruction to disable data reprogramming.

In order to address the problem set forth above, in the third embodiment, the control center10works to broadcast, to the vehicle control apparatuses20of all of the motor vehicles13, an instruction to disable data reprogramming through an alternative radio communication network except for the cellular phone lines12. The instruction to disable data reprogramming will be referred to as “disable reprogramming instruction”.

Referring toFIG. 15, a data reprogramming system100A according to the third embodiment is equipped with a reprogramming control center10A, a plurality of reprogramming stations11under the control of the control center10A, and a vehicle control apparatus20of each of motor vehicles13A. The combinations of the respective reprogramming stations11and the control center10A will be referred to as “data reprogramming units102” hereinafter. The data reprogramming units102share the control center10A.

As well as each of the first and second embodiments, one of the reprogramming stations11corresponding to at least one of the motor vehicles13works to transmit a reprogramming instruction to the vehicle control apparatus20A of each of the motor vehicles13A via the cellular phone lines12.

In addition, the data reprogramming system100A is equipped with a frequency modulation (FM) broadcast station30and a road automobile communication station31. The FM broadcast station30works to broadcast frequency-modulated multiplex signals over at least the predetermined geographic area. The road automobile communication station31works to transmit road traffic information via infrared (optical) beacons and/or radio beacons located along loads of the regions of the predetermined geographic area.

The control center10A is communicably coupled to the FM broadcast station30and the road automobile communication station31. The control center10A is operative to broadcast, to the vehicle control apparatus20A of each of the motor vehicles13A, the disable reprogramming instruction via the FM broadcast station30and/or the road automobile communication station31by way of an FM multiplex broadcast network30A and/or an infrared or radio communication network31A.

A navigation system26A of the vehicle control apparatus20A of each of the motor vehicles13A is equipped with a receiver29. The receiver29is operative to receive the disable reprogramming instructions transmitted from the control center10A via the FM broadcast station30and/or the road automobile communication station31.

FIG. 16schematically illustrates a routine to be executed by the data reprogramming system100A to thereby broadcast the reprogramming disable instruction.

When it is determined that a reprogramming instruction to be transmitted to each of the motor vehicles13is invalid or likely to be invalid, the control center10A informs the FM broadcast station30and the road automobile communication station31of “failure” in step S50.

When receiving the notice “failure”, the FM broadcast station30and the road automobile communication system31broadcast the reprogramming disable instruction to the vehicle control apparatus20A of each of the motor vehicles13A via the FM multiplex broadcast network30A and the infrared or radio communication network31A in step S51.

When receiving the reprogramming disable instruction, the vehicle control apparatus20A of each of the motor vehicles13A registers in at least one rewritable memory28a history of receiving the reprogramming disable instruction in step S52.

In a state that the history of receiving the reprogramming disable instruction has been stored in the at least one rewritable memory28, when receiving a reprogramming instruction transmitted from a reprogramming station11in step S53, the vehicle control apparatus20A goes into the reprogramming protection mode in step S54. This disables the vehicle control apparatus20A to reprogram the control program and the control data stored in at least one target ECU based on the received reprogramming instruction.

FIG. 17schematically illustrates a reprogramming-mode setting task to be executed by the vehicle control apparatus20A of each of the motor vehicles13A according to the third embodiment.

When establishing a connection between the vehicle control apparatus20A and a target station11to receive a reprogramming instruction, the vehicle control apparatus20A of each of the motor vehicles13A starts the reprogramming-mode setting task.

Specifically, the vehicle control apparatus20A determines whether the current operation mode thereof is the reprogramming initial mode in step S1701.

When it is determined that the current operation mode thereof is not the reprogramming initial mode (the determination in step S1701is NO), the vehicle control apparatus20A goes into the reprogramming protection mode in step S1704, exiting the reprogramming-mode setting task.

Otherwise, when it is determined that the current operation mode thereof is the reprogramming initial mode (the determination in step S1701is YES), the vehicle control apparatus20A determines whether the history of receiving the reprogramming disable instruction in step S1702.

When the history of receiving the reprogramming disable instruction has been registered in the vehicle control apparatus20A (the determination in step S1702is YES), the vehicle control apparatus20A goes into the reprogramming protection mode in step S1704, exiting the reprogramming-mode setting task.

In contrast, when the history of receiving the reprogramming disable instruction has not been registered in the vehicle control apparatus20A (the determination in step S1702is NO), the vehicle control apparatus20A goes into the reprogramming authorization mode in step S1703, exiting the reprogramming-mode setting task.

Note that, after the reprogramming-mode setting task has been completed, when receiving the reprogramming data, the vehicle control apparatus20A carries out the data reprogramming task illustrated inFIG. 7to thereby execute the data reprogramming on the conditions that the operation mode of the apparatus20A is the reprogramming authorization mode. When the data reprogramming has been completed, the vehicle control apparatus20goes into the reprogramming initial mode.

As described above, in the third embodiment, the control center10A works to broadcast, to the vehicle control apparatuses20A of all of the motor vehicles13A, the reprogramming disable instruction through an alternative wireless communication network (the FM multiplex broadcast network30A and/or the infrared or radio communication network31A) except for the cellular phone lines12.

This achieves a sixth effect of disabling date reprogramming of the vehicle control apparatus20of each vehicle13even if a failure occurs in the cellular phone lines12.

In the third embodiment, the cellular phone lines12is used for transmitting the reprogramming instructions, and the FM multiplex broadcast network30A and the infrared or radio communication network31A are used for transmitting the reprogramming disable instructions. The present invention is however not limited to the combination. Specifically, one of the wireless communication networks and another one thereof can be used for transmitting the reprogramming instructions and the reprogramming disable instructions, respectively.

This allows transmissions of the reprogramming disable instructions even if a failure occurs in the one of the wireless communication networks for transmitting the reprogramming instructions.

Modifications

In each of the first to third embodiments, after going into the reprogramming protection mode, the vehicle control apparatus20,20A of each of the motor vehicles13,13A continuously operates in the reprogramming protection mode while disabling data reprogramming even when receiving the reprogramming instructions.

As a modification, the vehicle control apparatus20,20A of each of the motor vehicles13,13A returns from the reprogramming protection mode to the reprogramming initial mode when at least one of the following first and second conditions is met:

The first condition is that a predetermined period has elapsed since the shift of the operation mode to the reprogramming protection mode.

The second condition is to receive a return instruction transmitted from, for example, the control center10,10A.

FIG. 18schematically illustrates a return task to be executed by the vehicle control apparatus20of each of the motor vehicles13using the first condition. The return task is executed by the vehicle control apparatus20each time an interrupt periodically occurs.

When starting the return task, the vehicle control apparatus20determines whether its operation mode is the reprogramming protection mode in step S1801. When it is determined that the operation mode is not the reprogramming protection mode (the determination in step S1801is NO), the vehicle control apparatus20exits the return task.

Otherwise, when it is determined that the operation mode is the reprogramming protection mode (the determination in step S1801is YES), the vehicle control apparatus20references a period that has elapsed since the shift of the operation mode to the reprogramming protection mode. Then, the vehicle control apparatus20determines whether the referenced period exceeds a predetermined maintenance period for the reprogramming protection mode in step S1802.

When it is determined that the referenced period does not exceed the predetermined maintenance period for the reprogramming protection mode (the determination in step S1802is NO), the vehicle control apparatus20exits the return task.

Otherwise, when it is determined that the referenced period exceeds the predetermined maintenance period for the reprogramming protection mode (the determination in step S1802is YES), the vehicle control apparatus20returns from the reprogramming protection mode to the reprogramming initial mode in step S1803.

In this case, it is preferable that, as the maintenance period, a long enough period, such as one week, allowed to recover the data reprogramming system100be set.

FIG. 19schematically illustrates a return task to be executed by the data reprogramming system100A using the second condition.

As well as the third embodiment, when a failure occurring in the data reprogramming system100A so that a reprogramming instruction to be transmitted to each of the motor vehicles13is likely to be invalid, the control center10A informs the FM broadcast station30and the road automobile communication station31of “failure” in step S50.

When receiving the notice “failure”, the FM broadcast station30and the road automobile communication system31broadcast the reprogramming disable instruction to the vehicle control apparatus20A of each of the motor vehicles13A via the FM multiplex broadcast network30A and the infrared or radio communication network31A in step S51.

When receiving the reprogramming disable instruction, the vehicle control apparatus20A of each of the motor vehicles13A registers in at least one rewritable memory28a history of receiving the reprogramming disable instruction in step S52.

In a state that the history of receiving the reprogramming disable instruction has been stored in the at least one rewritable memory28, when receiving a reprogramming instruction transmitted from a reprogramming station11in step S53, the vehicle control apparatus20A goes into the reprogramming protection mode in step S54.

Thereafter, when the failure is eliminated in the data reprogramming system100A, the control center10A informs each of the reprogramming stations11of “elimination of failure” in step S55.

When receiving the “elimination of failure”, each of the reprogramming stations11transmits, to a corresponding at least one of the motor vehicles13A, a return instruction from the reprogramming protection mode via the cellular phone lines12in step S56. Specifically, because the failure is eliminated in the data reprogramming system100A, it is possible to use the cellular phone lines12in order to transmit the return instruction.

When receiving the return instruction, the vehicle control apparatus20A of each of the motor vehicles13A goes into the reprogramming initial mode in step S57. The control center10A can transmit the return instruction to each of the motor vehicles13A via the FM multiplex broadcast network30A and the infrared or radio communication network31A except for the cellular phone lines12.

FIG. 20schematically illustrates a return task to be executed by the vehicle control apparatus20of each of the motor vehicles13using the first and second conditions. The return task is executed by the vehicle control apparatus20each time an interrupt periodically occurs.

When starting the return task, the vehicle control apparatus20determines whether its operation mode is the reprogramming protection mode in step S2001. When it is determined that the operation mode is not the reprogramming protection mode (the determination in step S2001is NO), the vehicle control apparatus20exits the return task.

Otherwise, when it is determined that the operation mode is the reprogramming protection mode (the determination in step S2001is YES), the vehicle control apparatus20references a period that has elapsed since the shift of the operation mode to the reprogramming protection mode. Then, the vehicle control apparatus20determines whether the referenced period exceeds a predetermined maintenance period for the reprogramming protection mode in step S2002.

When it is determined that the referenced period does not exceed the predetermined maintenance period for the reprogramming protection mode (the determination in step S2002is NO), the vehicle control apparatus20exits the return task.

Otherwise, when it is determined that the referenced period exceeds the predetermined maintenance period for the reprogramming protection mode (the determination in step S2002is YES), the vehicle control apparatus20determines whether a history of receiving the return instruction is registered therein.

When it is determined that no history of receiving the return instruction is registered therein (the determination in step S2003is NO), the vehicle control apparatus20exits the return task.

Otherwise, when it is determined that the history of receiving the return instruction is registered therein (the determination in step S2003is YES), the vehicle control apparatus20A returns from the reprogramming protection mode to the reprogramming initial mode in step S2004.

Such release of the disabling of receipt or execution of the reprogramming instructions can be manually performed by the owner of a corresponding one of the motor vehicles13A. Specifically, when the failure is eliminated in the data reprogramming system100A, an administrator for the data reprogramming system100A contacts the owner of each of the motor vehicles13A with a request to cancel the disabling of receipt or execution of the reprogramming instructions. Thus, the owner of each of the motor vehicles13manipulates the data reprogramming system100A to cancel the disabling of receipt or execution of the reprogramming instructions.

While there has been described what is at present considered to be the embodiments and their modifications of the present invention, it will be understood that various modifications which are not described yet may be made therein, and it is intended to cover in the appended claims all such modifications as fall within the true spirit and scope of the invention.