In-Vehicle Controller And Non-Transitory Tangible Computer Readable Medium

• US 20130173767A1
• Filed: 12/19/2012
• Published: 07/04/2013
• Est. Priority Date: 12/28/2011
• Status: Active Grant

• Current Assignee: DENSO Corporation
• Original Assignee: DENSO Corporation
• Inventors: Kobayashi, Masayuki, Nakamura, Aya
• Granted Patent: US 9,569,404 B2
• Time in Patent Office: Days
• US Class Current: 709/222
• CPC Class Codes: B60W 50/00 Details of control systems for road vehicle drive control not related to the control of a particular sub-unit , e.g. process diagnostic or vehicle driver interfaces
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 17/00 Digital computing or data processing equipment or methods, specially adapted for specific functions information retrieval, database structures or file system structures therefor G06F16/00
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

An in-vehicle controller includes: a first control element for outputting a first output, which corresponds to functional safety standards, in response to a input; a first platform element for controlling a first software in the first control element; a second control element for outputting a second output, which does not correspond to the functional safety standards, in response to the input; a second platform element for controlling a second software in the second control element; and a comparison coupling element for comparing and coupling the first output and the second output, and for outputting a coupled output to an external control object device. The first platform element controls the first software in the first control element independently from the second platform element, which controls the second software in the second control element.

Claims

1. An in-vehicle controller comprising:

a first control element for outputting a first output, which corresponds to functional safety standards, in response to a input;

a first platform element for controlling a first software in the first control element;

a second control element for outputting a second output, which does not correspond to the functional safety standards, in response to the input;

a second platform element for controlling a second software in the second control element; and

a comparison coupling element for comparing and coupling the first output and the second output, and for outputting a coupled output to an external control object device,

wherein the first platform element controls the first software in the first control element independently from the second platform element, which controls the second software in the second control element.

2. The in-vehicle controller according to claim 1,

wherein one of the first control element, the first platform element, the second platform element and the comparison coupling element functions, or one of combinations selected from the first control element, the first platform element, the second control element, the second platform element and the comparison coupling element cooperate together, so that occurrence of functional failure of the second control element is restricted.

3. The in-vehicle controller according to claim 1,

wherein one of the first control element, the first platform element, the second platform element and the comparison coupling element functions, or one of combinations selected from the first control element, the first platform element, the second control element, the second platform element and the comparison coupling element cooperate together, so that the coupled output from the comparison coupling element is transferred to a safety state when functional failure of the second control element occurs.

4. The in-vehicle controller according to claim 3,

wherein the first software in the first control element is prepared by retrieving a part of programs in the second software of the second control element, the part of programs relating, to a function, which is required to correspond to the functional safety standards, and by conforming the part of programs with the functional safety standards.

5. The in-vehicle controller according to claim 1,

wherein the in-vehicle controller controls to execute:

a first process for inputting the input into the second control element or the second platform element via, the first control element or the first platform element;

a second process relating to the first control element and the second control element; and

a third process relating to the comparison coupling element, and

wherein the first process to the third process are executed in an order from the first process to the third process via the second process.

6. The in-vehicle controller according to claim 1,

wherein a part of or a whole of a process relating to the second control element is executed between a process other than a process relating to the comparison coupling element and the process relating to the comparison coupling element.

7. The in-vehicle controller according to claim 2,

wherein a program in the first software of the first control element is detachable.

8. The in-vehicle controller according to claim 2, further comprising:

a memory having a plurality of arrangement blocks,

wherein the arrangement blocks include a first arrangement block and a second arrangement block, which is different from the first arrangement block,

wherein the first arrangement block stores a program in the first software of the first control element, and the second arrangement block stores a program in the second software of the second control element, and

wherein the memory sets an arrangement address in each arrangement block.

36. The in vehicle controller according to claim 1,

wherein, when a connection object is set, the connection object is connected to a non-transitory tangible computer readable medium,

wherein the non-transitory tangible computer readable medium includes instructions being executed by a computer,

wherein the instructions includes:

setting a connection source and a connection object of a daisy chain in order to contacting a program, and

wherein the program relates to a software corresponding to functional safety standards.

9. An in-vehicle controller comprising:

a plurality of sequence monitors,

wherein each sequence monitor has an effective range, and

wherein the effective range of one sequence monitor is overlapped to the effective range of another sequence monitor.

10. An in-vehicle controller comprising:

a first control element for outputting a first output, which corresponds to functional safety standards, in response to a input;

a first platform element for controlling a first software in the first control element;

a second control element for outputting a second output, which does not correspond to the functional safety standards, in response to the input;

a second platform element for controlling a second software in the second control element; and

a comparison coupling element for comparing and coupling the first output and the second output, and for outputting a coupled output to an external control object device,

wherein the second software of the second control element is assigned to a conventional software, and

wherein the first software of the first control element is assigned to a newly developed software.

11. The in-vehicle controller according to claim 10,

wherein a program in the first software of the first control element is detachable.

12. The in-vehicle controller according to claim 11,

wherein the program in the first software of the first control element is stored in a first file,

wherein a program in the second software of the second control element is stored in a second file, which is different from the first file, and

wherein each of the first file, and the second file is detachable.

13. The in-vehicle controller according to claim 11, further comprising:

a memory having a plurality of arrangement blocks,

wherein the arrangement blocks includes a first arrangement block and a second arrangement block, which is different from the first arrangement block,

wherein the first arrangement block stores the program in the first software of the first control element, and the second arrangement block stores a program in the second software of the second control element, and

wherein each program in a respective arrangement block is detachable in the memory.

14. An in-vehicle controller comprising:

a sequence monitor having an effective range; and

a network connection monitor having another effective range, which is overlapped to the effective range of the sequence monitor.

15. A non-transitory tangible computer readable medium comprising instructions being executed by a computer, the instructions including:

storing a first program in a first file;

storing a second program in a second file, which is different from the first program; and

controlling the first file and the second file individually,

wherein the first program relates to a first software in a first control element, and the second program relates to a second software in a second control element,

wherein the first control element outputs a first output, which corresponds to functional safety standards, in response to a input,

wherein the second control element outputs a second output, which does, not correspond to the functional safety standards, in response to the input.

25. An in-vehicle controller comprising:

the non-transitory tangible computer readable medium according to claim 15.

16. A non-transitory tangible computer readable medium comprising instructions being executed by a computer, the instructions including:

controlling a program by a software of a platform element;

configuring the program to be detachable independently from the software of the platform element,

wherein the program relates to a software corresponding to functional safety standards.

17. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a function for determining a functional failure according to the functional safety standards,

wherein the function includes a sequence monitor, a time monitor, a network connection monitor, a network time monitor, a read and write monitor, or a calculation monitor.

18. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a sequence monitor having at least one of connection information and an order identifier for the program,

wherein the sequence monitor sets the at least one of connection information and the order identifier for the program to be changeable.

19. The non-transitory tangible computer readable medium according to claim 18,

wherein the sequence monitor is executed with using the at least one of the connection information and the order identifier, and

wherein the sequence monitor is determined as normal when data written in the sequence monitor at a beginning of the program is equal to predetermined data, and data read out from the sequence monitor at an end of the program is equal to another predetermined data.

20. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a time monitor for setting an execution time of the program to be changeable.

21. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a function of a sequence monitor and a function of a time monitor at one time.

22. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a read and write monitor for specifying a designation of data to be changeable.

23. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a calculation monitor for specifying a designation of data to be changeable.

24. The non-transitory tangible computer readable medium according to claim 16, the instructions further including:

providing a function for switching a determined function failure to be in a stable state.

26. A non-transitory tangible computer readable medium comprising instructions being executed by a computer;

the instructions including;

configuring a program to be detachable from a software of a platform element;

wherein the program relates to a software corresponding to functional safety standards.

27. The non-transitory tangible computer readable medium according to claim 26, the instructions further including:

providing a function for determining a function failure according to the functional safety standards,

wherein the function includes a network connection monitor or a network time monitor.

28. The non-transitory tangible computer readable medium according to claim 26, the instructions further including:

providing a sequence monitor having at least one of connection information and an identifier for a connection source for the program,

wherein the sequence monitor sets the at least one of connection information and the identifier for the connection source for the program to be changeable.

29. The non-transitory tangible computer readable medium according to claim 28,

wherein the sequence monitor is executed with using the at least one of the connection information and the identifier for the connection source, and

wherein the sequence monitor is determined as normal when data sent from the connection source satisfies with a predetermined rule, and data received by a connection object satisfies with another predetermined rule.

30. The non-transitory tangible computer readable medium according to claim 26, the instructions further including:

providing a time Monitor for setting an execution time of the program to be changeable.

31. The non-transitory tangible computer readable medium according to claim 26, the instructions further including:

providing a function of a network connection monitor and a function of a network time monitor at one time.

32. The non-transitory tangible computer readable medium according to claim 26, the instructions further including:

providing a sequence monitor having an effective range; and

providing a network connection monitor having another effective range, which is overlapped to the effective range of the sequence monitor.

33. The non-transitory tangible computer readable medium according to claim 27, the instructions further including:

providing a function for switching a determined function failure to be in a stable state.

34. An in-vehicle controller comprising:

the non-transitory tangible computer readable medium according to claim 26.

35. A non-transitory tangible computer readable medium comprising instructions being executed by a computer, the instructions including:

setting a connection source and a connection object of a daisy chain in order to contacting a program,

wherein the program relates to a software corresponding to functional safety standards.