Electronic control apparatus for vehicles

• US 20070198874A1
• Filed: 02/02/2007
• Published: 08/23/2007
• Est. Priority Date: 02/03/2006
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Watanabe, Hirokazu
• Granted Patent: US 8,849,504 B2
• Time in Patent Office: Days
• US Class Current: 714/49
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/1441 Resetting or repowering
• CPC Class Codes: G07C 5/085 using electronic data carriers

Abstract

An electronic control apparatus for vehicles is provided. The apparatus comprises a volatile memory storing control data therein, a control component performing control necessary to the vehicle using the control data in the volatile memory, and an update component updating the control data in the volatile memory based on controlled results. The apparatus further comprises a detecting component, recording component and transmitting unit. The detecting component detects an abnormality occurring in the volatile memory and the recording component correlates a history of the detected abnormality with information indicating a region of the volatile memory in which the abnormality occurs and records information indicating the abnormality history. The transmitting unit generates a transmission signal indicating the abnormality history on the basis of the information indicating the recorded history and transmitting the transmission signal to an external device via a communication interface.

Claims

1. An electronic control apparatus used in a vehicle, comprising:

a volatile memory in which control data is stored;

a control component performing control necessary to the vehicle using the control data stored in the volatile memory;

an update component updating the control data stored in the volatile memory on the basis of a result caused by the control performed by the control component;

a detecting component detecting an abnormality occurring in the volatile memory;

a recording component correlating a history of the abnormality detected by the detecting component with information indicating a region of the volatile memory in which the abnormality occurs and recording information indicating the history of the abnormality;

a communication interface communicable with an external device; and

a transmitting unit generating a transmission signal indicating the abnormality history of the volatile memory on the basis of the information indicating the history recorded by the recording component and transmitting the transmission signal to the external device via the communication interface.

2. The electronic control apparatus of claim 1, wherein

the recording component is configured to record the information indicating the history of the abnormality in the volatile memory;

the transmitting unit is configured to generate the transmission signal by using the information indicating the history of the abnormality and being recorded in the volatile memory; and

the volatile memory is configured to be powered constantly by a battery mounted in the vehicle and to constantly hold data including the control data by updating the data.

3. The electronic control apparatus of claim 1, further comprising a non-volatile memory in which data is stored in an electrically rewritable state, wherein

the recording component is configured to record the information indicating the history of the abnormality in the non-volatile memory;

and

the transmitting unit is configured to generate the transmission signal by using the information indicating the history of the abnormality and being recorded in the non-volatile memory.

4. The electronic control apparatus of claim 1, wherein the transmitting unit comprises

means for responding to a signal requesting the transmission signal, the transmission requesting signal being issued by the external device, by generating the transmission signal indicating the history of the abnormality;

and

means for transmitting the generated transmission signal via the communication interface to the external device that requests the transmission signal.

5. The electronic control apparatus of claim 4, wherein

the transmission requesting signal includes information specifying a region of the volatile memory in which the abnormality occurs;

and

the transmitting unit comprises

means for responding to a signal requesting the transmission signal, the transmission requesting signal being issued by the external device, by generating the transmission signal indicating, of the history of the abnormality recorded by the recording component, the history of the abnormality occurring in the region specified by the transmission requesting signal; and

means for transmitting the generated transmission signal via the communication interface to the external device that requests the transmission signal.

6. The electronic control apparatus of claim 1, comprising

a clearing component clearing the history of the abnormality recorded in the recording component in response to reception of a signal requesting clearance of the history of the abnormality from the external device via the communication interface.

7. The electronic control apparatus of claim 6, wherein

the clearance requesting signal includes information specifying a region of the volatile memory in which the abnormality occurs;

and

the clearing component is configured to respond to clearance requesting signal by clearing, of the history of the abnormality recorded by the recording component, the history of the abnormality correlated with the information indicating a region of the volatile memory in which the abnormality occurred and which is specified by the clearance requesting signal.

8. The electronic control apparatus of claim 1, wherein

the recording component comprises means for recording a frequency of occurrence of the abnormality in correlation with the information indicating the region of the volatile memory in which the abnormality occurs, the frequency serving as the history of the abnormality.

9. The electronic control apparatus of claim 8, wherein

the detecting component is configured to detect the abnormality every type of the abnormality;

and

the recording means of the recording component is configured to record the frequency of occurrence of each abnormality, every region of the volatile memory detected by the detecting component,

10. The electronic control apparatus of claim 9, wherein

the recording component comprises means for incrementing the frequency of occurrence of the abnormality only once, every region of the volatile memory detected by the detecting component and every type of the abnormality, during a period of time from start of the control responsively to an operation done by an occupant the vehicle to end of the control,

wherein the recording means of the recording component is configured to record the frequency of occurrence of the abnormality every detected region of the volatile memory and every type of abnormality.

11. The electronic control apparatus of claim 1, comprising

a fail-safe processing component performing a fail-safe process for the abnormality detected by the detecting component.

12. The electronic control apparatus of claim 11, wherein

the fail-safe processing component comprises means for controlling a content of the fail-safe process depending on which region of the volatile memory causes the abnormality.

13. The electronic control apparatus of claim 11, wherein

the fail-safe processing component comprises mans for controlling a content of the fail-safe process depending on a frequency of occurrence of the abnormality caused, in the past, at a region of volatile memory which is the same as a region in which the abnormality is detected.

14. The electronic control apparatus of claim 11, wherein

the fail-safe processing component comprises mans for controlling a content of the fail-safe process depending on a region of the volatile memory in which the abnormality is caused and a frequency of occurrence of the abnormality caused in the same region of the volatile memory in the past.

15. The electronic control apparatus of claim 1, wherein

the control data includes check data serving as data for detecting illegal data;

and

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the basis of the check data.

16. The electronic control apparatus of claim 11, wherein

the control data includes check data serving as data for detecting illegal data;

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the basis of the check data; and

the fail-safe processing component comprises means for performing, as the fail-safe process for the illegal data, a process to update the control data in which the illegal data is detected to the control data which were present before an occurrence of the illegal data.

17. The electronic control apparatus of claim 16, wherein

the control data to be stored in the volatile memory is grouped into a plurality of control data type by type;

and

the fail-safe processing component comprises

means for performing, as the fail-safe process for the illegal data, not only a process to update the control data in which the illegal data is detected to the control data which were present before an occurrence of the illegal data but also a process to update control data belonging to a group in which the illegal data is detected to control data being paired to the control data which were present before an occurrence of the illegal data.

18. The electronic control apparatus of claim 3, comprising

a backup processing unit backing up, into the non-volatile memory, control data stored in regions of the volatile memory which are found to be normal by the detecting component;

and

a fail-safe processing component performing a fail-safe process for the abnormality detected by the detecting component,

wherein

the control data includes check data serving as data for detecting illegal data;

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the b asis of the check data; and

the fail-safe processing component is configured to perform, as the fail-safe process for the illegal data, a process to update the control data found to be as illegal data by the detecting means to the control data found to be normal and detected and stored in the non-volatile memory before the occurrence of the abnormality.

19. The electronic control apparatus of claim 2, wherein

the control data includes check data serving as data for detecting illegal data;

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the basis of the check data at start of the control,

the electronic control apparatus comprising a determining component determining whether or not the battery has detached from the vehicle on the basis of a result performed by the detecting means at the start of the control,

wherein the recording component is free from recording information indicating the illegal data detected by the detecting means at the start of the control when the determining component determines that the battery has been detached from the vehicle.

20. The electronic control apparatus of claim 3, wherein

the control data includes check data serving as data for detecting illegal data;

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the basis of the check data at start of the control;

the volatile memory is configured to be powered constantly by a battery mounted in the vehicle and to constantly memorize data including the control data,

the electronic control apparatus comprising a determining component determining whether or not the battery has detached from the vehicle on the basis of a result performed by the detecting means at the start of the control,

wherein the recording component is free from recording information indicating the illegal data detected by the detecting means at the start of the control when the determining component determines that the battery has been detached from the vehicle.

21. The electronic control apparatus of claim 15, wherein

the detecting component comprises means for detecting illegal data from the control data to be updated in the volatile memory, prior to the update of the control data.

22. The electronic control apparatus of claim 2, wherein

the detecting component comprises means for detecting the abnormality being caused in writing the control data by determining whether or not the control data is rewritten into control data to be desired when the data is updated in the volatile memory.

23. The electronic control apparatus of claim 11, wherein

the detecting component comprises means for detecting the abnormality being caused in writing the control data by determining whether or not the control data has been rewritten into control data to be desired when the data is updated in the volatile memory;

and

the fail-safe processing component comprises means for performing, as the fail-safe process for the abnormality being caused in writing the control data, a process to change a region of the volatile memory in which the control data found to be abnormal in writing thereof is written to another region of the volatile memory.

24. The electronic control apparatus of claim 11, wherein

the detecting component comprises means for detecting the abnormality being caused in writing the control data by determining whether or not the control data has been rewritten into control data to be desired when the data is updated in the volatile memory;

and

the fail-safe processing component comprises means for responding to issuance of a read command of the control command found to be abnormal in writing thereof, by performing, as the fail-safe process for the abnormality being caused in writing the control data, a process to output initial values of the control data found to be abnormal in writing thereof.

25. The electronic control apparatus of claim 3, wherein

a backup processing unit backing up, into the non-volatile memory, control data stored in regions of the volatile memory which are found to be normal by the detecting component;

and

a fail-safe processing component performing a fail-safe process for the abnormality detected by the detecting component,

wherein

the detecting component comprises means for detecting the abnormality being caused in writing the control data by determining whether or not the control data has been rewritten into control data to be desired when the data is updated in the volatile memory; and

the fail-safe processing component comprises means for responding to issuance of a read command of the control command found to be abnormal in writing thereof, by performing, as the fail-safe process for the abnormality being caused in writing the control data, a process to output the control data stored in the non-volatile memory by the backup unit prior to the detection of the abnormality.

26. The electronic control apparatus of claim 1, comprising

a warning determining component determining whether or not it is required to inform an occupant in the vehicle of an occurrence of the abnormality on the basis of the history recorded by the recoding unit;

and

a warning controlling unit controlling a warning device mounted in the vehicle so that the occurrence of the abnormality is informed, when the warning determining component determines that it is required to inform the occupant of the occurrence of the abnormality.

27. The electronic control apparatus of claim 26, wherein

the warning determining component is configured to determine whether or not it is required to inform the occupant of the occurrence of the abnormality based on different criteria assigned to different regions of the volatile memory in each of which the abnormality occurs.

28. The electronic control apparatus of claim 2, wherein the transmitting unit comprises

means for responding to a signal requesting the transmission signal, the transmission requesting signal being issued by the external device, by generating the transmission signal indicating the history of the abnormality;

and

means for transmitting the generated transmission signal via the communication interface to the external device that requests the transmission signal.

29. The electronic control apparatus of claim 2, comprising

a clearing component clearing the history of the abnormality recorded in the recording component in response to reception of a signal requesting clearance of the history of the abnormality from the external device via the communication interface.

30. The electronic control apparatus of claim 2, comprising

a fail-safe processing component performing a fail-safe process for the abnormality detected by the detecting component.

31. The electronic control apparatus of claim 2, wherein

the control data includes check data serving as data for detecting illegal data;

and

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the basis of the check data.

32. The electronic control apparatus of claim 2, comprising

a warning determining component determining whether or not it is required to inform an occupant in the vehicle of an occurrence of the abnormality on the basis of the history recorded by the recoding unit;

and

a warning controlling unit controlling a warning device mounted in the vehicle so that the occurrence of the abnormality is informed, when the warning determining component determines that it is required to inform the occupant of the occurrence of the abnormality.

33. The electronic control apparatus of claim 3, wherein the transmitting unit comprises

means for responding to a signal requesting the transmission signal, the transmission requesting signal being issued by the external device, by generating the transmission signal indicating the history of the abnormality;

and

means for transmitting the generated transmission signal via the communication interface to the external device that requests the transmission signal.

34. The electronic control apparatus of claim 3, comprising

a clearing component clearing the history of the abnormality recorded in the recording component in response to reception of a signal requesting clearance of the history of the abnormality from the external device via the communication interface.

35. The electronic control apparatus of claim 3, comprising

a fail-safe processing component performing a fail-safe process for the abnormality detected by the detecting component.

36. The electronic control apparatus of claim 3, wherein

the control data includes check data serving as data for detecting illegal data;

and

the detecting component comprises means for detecting, as one kind of the abnormality, the illegal data in the control data stored in the volatile memory on the basis of the check data.

37. The electronic control apparatus of claim 3, comprising

a warning determining component determining whether or not it is required to inform an occupant in the vehicle of an occurrence of the abnormality on the basis of the history recorded by the recoding unit;

and

a warning controlling unit controlling a warning device mounted in the vehicle so that the occurrence of the abnormality is informed, when the warning determining component determines that it is required to inform the occupant of the occurrence of the abnormality.