Control apparatus and control system controlling protective apparatus for protecting passenger of vehicle or pedestrian

An air bag ECU includes an ECU communication unit communicating with an external sensor (for example, a front right acceleration sensor) and a faulty sensor mount determination unit determining whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU based on failure history data indicating whether the external sensor has been diagnosed as being faulty before. The faulty sensor mount determination unit compares identification data recorded in, for example, a faulty sensor ID recording unit, for individually identifying an external sensor having been diagnosed as being faulty before with the identification data of the external sensor connected to the air bag ECU and determines whether a faulty sensor is connected to the air bag ECU.

BACKGROUND OF THE INVENTION

The present invention relates to a control apparatus and control system that controls a protective apparatus for protecting passengers in a vehicle or pedestrians.

Conventionally, a vehicle has been provided with a protective apparatus (such as, for example, an air bag) for protecting passengers in a vehicle or pedestrians and the activation of the protective apparatus is controlled by a control apparatus. An external sensor (such as, for example, an acceleration sensor for detecting an impact on the vehicle) for determining whether the protective apparatus is activated is connected to the control apparatus. When the external sensor detects an impact on the vehicle, the control apparatus dampers an impact on passengers in the vehicle by expanding the air bag or dampers an impact on pedestrians by lifting the hood of the vehicle.

Since the external sensor becomes faulty due to various causes, the prior art may perform failure diagnosis of the external sensor. For example, when the address set for the external sensor and the unique information of the external sensor are sent from the external sensor, the control apparatus associates these data items and stores them as corresponding information. Then, when unique information is sent from the external sensor, the control apparatus compares the sent unique information with the corresponding information and, if the part of the unique information does not match the corresponding information, diagnoses the external sensor having the part of the unique information as being faulty.

SUMMARY OF THE INVENTION

However, the prior art does not consider a determination as to whether a faulty sensor having been diagnosed as being faulty before is connected to the control apparatus.

That is, in the prior art, even when an external sensor is determined to be faulty once, after recovery from the failure, the external sensor may have been used to determine whether protective apparatus is activated even though the failure may occur again without being replaced. A failure that occurs again is, for example, a failure that occurs due to a short-circuit of the circuit on a board of the external sensor because a metal piece moves on the board due to vibration of the vehicle when, for example, a small conductive metal piece or the like is included during assembly process of the housing of the external sensor. Accordingly, an external sensor having been diagnosed as having its own failure can be replaced immediately with a good external sensor.

In addition, when a faulty external sensor having a failure difficult to reproduce is found in the assembly line for vehicles, if the faulty external sensor is erroneously assembled to a vehicle, the faulty external sensor cannot be detected until a failure occurs again.

In addition, in the assembly line for vehicles, to ensure the traceability (history) of a vehicle and an external sensor attached to the vehicle, a barcode label or two-dimensional barcode label on which information including the model and individual identifying ID of the external sensor is printed may be attached to the external sensor. That is, before an external sensor is assembled to a vehicle in the assembly line for vehicles, the traceability of external sensor to be attached to the vehicle is ensured using a computer system by reading the barcode of the external sensor with a barcode reader or the like. However, to increase the room space of a vehicle or for other reasons, the size reduction of an external sensor has been requested recently. Size reduction of an external sensor makes it difficult to obtain sufficient space to attach a barcode label to an external sensor. Since it is difficult for a person to visually identify an external sensor without a barcode label, the method for surely preventing faulty sensors from being put on the market has been requested.

On the other hand, methods for connecting sensors via a bus have been proposed (daisy chain connection and parallel connection). Since data from a plurality of external sensors connected via a single bus needs to be sent from the external sensors to an ECU at the same control cycle in either method, there is a restriction on the amount of data to be sent at a time. Since a vehicle may include two to eight external sensors, if a million vehicles having a protective apparatus are produced in a year, two to eight million external sensors are used. In this case, to individually identify external sensors, approximately at least three bytes are necessary even in the case of simple numeral data. In addition, if a measure such as addition of data for identifying different product models is taken, more than several bytes are necessary. If the communication speed is increased to send such a large amount of data at a time, disadvantage such as degradation in the EMC performance is caused.

Accordingly, an object of the invention in the present application is to determine whether a faulty sensor having been diagnosed as being faulty before is connected to the control apparatus.

According to an embodiment of the present invention, to address the above problem, there is provided a control apparatus controlling a protective apparatus for protecting a passenger of a vehicle or a pedestrian, characterized by including a communication unit communicating with an external sensor connected to the control apparatus and a determination unit determining whether a faulty sensor having been diagnosed as being faulty before is connected to the control apparatus, based on failure history data indicating whether the external sensor has been diagnosed as being faulty before.

In addition, the determination unit may compare identification data for individually identifying the external sensor connected to the control apparatus with identification data for individually identifying a faulty sensor having been diagnosed as being faulty before and determine whether the faulty sensor is connected to the control apparatus.

In addition, when the communication unit receives, from the external sensor, sensing data detected by the external sensor and the identification data for individually identifying the external sensor, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the sensing data and a faulty sensor ID recording unit recording, as the failure history data, the identification data of the external sensor diagnosed as being faulty by the sensor failure diagnosis unit, and the determination unit may compare the identification data recorded in the faulty sensor ID recording unit with the identification data received by the communication unit and determine whether the faulty sensor is connected to the control apparatus.

In addition, when the communication unit receives, from the external sensor, a diagnosis result indicating whether the external sensor is faulty and the identification data for individually identifying the external sensor, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the diagnosis result sent from the external sensor and a faulty sensor ID recording unit recording, as the failure history data, the identification data of the external sensor diagnosed as being faulty by the sensor failure diagnosis unit, and the determination unit may compare the identification data recorded in the faulty sensor ID recording unit with the identification data received by the communication unit and determine whether the faulty sensor is connected to the control apparatus.

In addition, the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure history data recorded in a failure history recording unit provided in the external sensor.

In addition, when the communication unit receives, from the external sensor, sensing data detected by the external sensor, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the sensing data and a writing requesting unit, when the external sensor is diagnosed as being faulty by the sensor failure diagnosis unit, outputting a request for recording, as the failure history data, failure information in a failure history recording unit provided in the external sensor diagnosed as being faulty, the communication unit may receive, from the external sensor, the failure information recorded in the failure history recording unit, and the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure information received by the communication unit.

In addition, when the communication unit receives, from the external sensor, a diagnosis result indicating whether the external sensor is faulty, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the diagnosis result sent from the external sensor and a writing requesting unit, when the external sensor is diagnosed as being faulty by the sensor failure diagnosis unit, outputting a request for recording, as the failure history data, failure information in a failure history recording unit provided in the external sensor diagnosed as being faulty, the communication unit may receive, from the external sensor, the failure information recorded in the failure history recording unit, and the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure information received by the communication unit.

In addition, when the communication unit receives the failure history data from the external sensor, the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure history data received by the communication unit.

According to an embodiment of the present invention, there is provided a control system including a control apparatus controlling a protective apparatus for protecting a passenger of a vehicle or a pedestrian and an external sensor connected to the control apparatus, in which the external sensor includes a sensor communication unit communicating with the control apparatus and the control apparatus includes an apparatus communication unit communicating with the external sensor and a determination unit determining whether a faulty sensor having been diagnosed as being faulty before is connected to the control apparatus, based on failure history data indicating whether the external sensor has been diagnosed as being faulty before.

In addition, the determination unit may compare identification data for individually identifying the external sensor connected to the control apparatus with identification data for individually identifying a faulty sensor having been diagnosed as being faulty before and determine whether the faulty sensor is connected to the control apparatus.

In addition, the external sensor may further include a sensor ID recording unit in which the identification data for individually identifying the external sensor is recorded and a detection unit detecting data used to determine whether the protective apparatus is activated, the apparatus communication unit may receive, from the sensor communication unit, sensing data detected by the detection unit and the identification data recorded in the sensor ID recording unit, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the sensing data and a faulty sensor ID recording unit recording, as the failure history data, the identification data of the external sensor diagnosed as being faulty by the sensor failure diagnosis unit, and the determination unit may compare the identification data recorded in the faulty sensor ID recording unit with the identification data received by the apparatus communication unit and determine whether the faulty sensor is connected to the control apparatus.

In addition, the control apparatus may further include an installed sensor ID recording unit in which identification data for individually identifying the external sensor currently connected to the control apparatus is recorded and the control system may further include a failure diagnosis apparatus including an installed sensor ID reading unit reading the identification data recorded in the installed sensor ID recording unit, a faulty sensor ID reading unit reading the identification data recorded in the faulty sensor ID recording unit, and a display unit displaying the identification data read by the installed sensor ID reading unit and the identification data read by the faulty sensor ID reading unit.

In addition, the external sensor may further include a sensor ID recording unit in which the identification data for individually identifying the external sensor is recorded and an in-sensor failure diagnosis unit diagnosing whether the external sensor is faulty, the apparatus communication unit may receive, from the sensor communication unit, a diagnosis result by the in-sensor failure diagnosis unit and the identification data recorded in the sensor ID recording unit, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the diagnosis result sent from the external sensor and a faulty sensor ID recording unit recording, as the failure history data, the identification data of the external sensor diagnosed as being faulty by the sensor failure diagnosis unit, and the determination unit may compare the identification data recorded in the faulty sensor ID recording unit with the identification data received by the apparatus communication unit and determine whether the faulty sensor is connected to the control apparatus.

In addition, the control apparatus may further include an installed sensor ID recording unit in which identification data for individually identifying the external sensor currently connected to the control apparatus and the control system may further include a failure diagnosis apparatus including an installed sensor ID reading unit reading the identification data recorded in the installed sensor ID recording unit, a faulty sensor ID reading unit reading the identification data recorded in the faulty sensor ID recording unit, and a display unit displaying the identification data read by the installed sensor ID reading unit and the identification data read by the faulty sensor ID reading unit.

In addition, the determination unit may determine whether the faulty sensor is connected to the control apparatus based on failure history data recorded in a failure history recording unit provided in the external sensor.

In addition, the external sensor may further include a detection unit detecting data used to determine whether the protective apparatus is activated and a failure history recording unit recording the failure history data, the apparatus communication unit may receive, from the sensor communication unit, sensing data detected by the detection unit, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the sensing data and a writing requesting unit, when the external sensor is diagnosed as being faulty by the sensor failure diagnosis unit, outputting a request for recording, as the failure history data, failure information in the failure history recording unit provided in the external sensor diagnosed as being faulty, the apparatus communication unit may receive, from the sensor communication unit, the failure information recorded in the failure history recording unit, and the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure information received by the apparatus communication unit.

In addition, the external sensor may further include an in-sensor failure diagnosis unit diagnosing whether the external sensor is faulty and the failure history recording unit in which the failure history data is recorded, the apparatus communication unit may receive, from the sensor communication unit, a diagnosis result indicating whether the external sensor is faulty, the control apparatus may further include a sensor failure diagnosis unit diagnosing whether the external sensor is faulty based on the diagnosis result sent from the external sensor and a writing requesting unit, when the external sensor is diagnosed as being faulty by the sensor failure diagnosis unit, outputting a request for recording, as the failure history data, failure information in the failure history recording unit provided in the external sensor diagnosed as being faulty, the apparatus communication unit may receive, from the sensor communication unit, the failure information recorded in the failure history recording unit, and the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure information received by the apparatus communication unit.

The external sensor may further include an in-sensor failure diagnosis unit diagnosing whether the external sensor is faulty and a failure history recording unit recording failure information as the failure history data when the external sensor is diagnosed as being faulty by the in-sensor failure diagnosis unit, the apparatus communication unit may receive the failure history data from the sensor communication unit, and the determination unit may determine whether the faulty sensor is connected to the control apparatus based on the failure history data received by the apparatus communication unit.

According to the invention of the present application, it is possible to determine whether a faulty sensor having been diagnosed as being faulty before is connected to the control apparatus.

DETAILED DESCRIPTION

A control apparatus (air bag ECU) and an air bag control system according to an embodiment of the invention of the present application will be described below with reference to the drawings.FIG. 1illustrates the structure of the air bag control system (air bag ECU and external sensors) according to the embodiment of the invention of the present application.

An air bag control system1000according to the embodiment monitors sensing data detected by various types of acceleration sensors (external sensors) provided in a vehicle and, when determining that the vehicle collides, improves the safety of passengers in the vehicle or pedestrians by expanding the air bags for the driver seat, passenger seat, and other portions or by lifting the hood of the vehicle. An example of a protective apparatus expanding the air bags for the driver seat, passenger seat, and other portions will be described below.

As illustrated inFIG. 1, the air bag control system1000includes an air bag ECU (control apparatus)100, a passenger seat passenger sensing ECU200, a meter ECU300, a battery power supply (the first power supply)400, and an ignition switch410.

In addition, the air bag control system1000includes a driver seat air bag squib500, a passenger seat air bag squib510, a right side air bag squib520, a left side air bag squib530, a right curtain air bag squib540, and a left curtain air bag squib550.

In addition, the air bag control system1000includes a front right acceleration sensor600, a front left acceleration sensor610, a right side acceleration sensor620, a left side acceleration sensor630, a right side pressure sensor640, and a left side pressure sensor650as external sensors. The places and the number of external sensors installed are not limited to the present embodiment and are arbitrary. In addition, the air bag control system1000includes a failure diagnosis apparatus (diagnosis tester)700and an air bag warning lamp800. Components of the air bag control system1000will be described below.

The battery power supply400is one of various types of storage batteries such as a lead-acid battery installed in a vehicle. The battery power supply400directly supplies a power source to the meter ECU300via a power line405and directly supplies a power source to various types of other components of a vehicle via the power line405.

The ignition switch410starts up or stops the engine of a vehicle. In a state in which the engine of a vehicle is stopped, the ignition switch410is OFF. When the user turns the key in this state, the ignition switch410is turned ON. When the ignition switch410is turned ON, the battery power supply400supplies a power source to the meter ECU300, the passenger seat passenger sensing ECU200, and the air bag ECU100via a power line407.

The meter ECU300is a control apparatus that detects and records the vehicle speed of a vehicle and sends the recorded vehicle speed to the air bag ECU100or other components of the vehicle. The meter ECU300sends the recorded vehicle speed to the air bag ECU100via a CAN communication line430. Accordingly, the air bag ECU100can detect the operational state of the vehicle (such as, for example, the brake state of the vehicle and the like).

The passenger seat passenger sensing ECU200detects the weight applied to the passenger seat of the vehicle to determine the passenger state of the passenger seat: for example, a grown-up man, small woman, child, or vacant seat. The passenger seat passenger sensing ECU200sends the determined passenger state of the passenger seat to the air bag ECU100via a communication line440. The air bag ECU100can suppress the expansion of the air bag (not illustrated) of the passenger seat when, for example, the passenger is a child during a front collision of the vehicle by monitoring, for example, the passenger state of the passenger seat.

The air bag ECU100includes a voltage detector101, the voltage boosting circuit102, a voltage detector103, a capacitor104, voltage detection I/Fs105and107, a DC-DC converter106, a CAN (Controller Area Network) communication transceiver108, and a K-line communication driver110. In addition, the air bag ECU100includes an MCU (Micro Controller Unit)120, an ASIC (Application Specific Integrated Circuit)140, an acceleration sensor150, a non-volatile memory160, and the lamp driving circuit180.

The voltage detector101detects the value of a power voltage supplied from the battery power supply400to the air bag ECU100via the ignition switch410. That is, the voltage detector101detects the voltage of a power source supplied to passenger seat passenger sensing ECU200and the meter ECU300.

The voltage detection I/F (Interface)105outputs a voltage signal detected by the voltage detector101to the MCU120. The voltage signal detected by the voltage detector101is output to the MCU120via the voltage detection I/F105.

The voltage boosting circuit102boosts the power voltage supplied from the battery power supply400to the air bag ECU100via the ignition switch410. The voltage boosting circuit102boosts, for example, a supplied power voltage from 9V to 16V to approximately 24V. The voltage boosting circuit102supplies the boosted voltage to the capacitor104and the DC-DC converter106.

The voltage detector103detects the power voltage value output from the voltage boosting circuit102.

The voltage detection I/F107outputs a voltage signal detected by the voltage detector103to the MCU120. The voltage signal detected by the voltage detector103is output to the MCU120via the voltage detection I/F107.

The capacitor104charges or discharges a voltage supplied from the voltage boosting circuit102and is a backup power supply for the battery power supply400.

The DC-DC converter106converts (drops) a voltage supplied from the voltage boosting circuit102to a voltage (for example, 5V) used by the MCU120. The DC-DC converter106supplies the dropped voltage to the MCU120.

The CAN communication transceiver108is an interface that exchanges data with the meter ECU300and other ECUs (not illustrated) of the vehicle via the CAN communication line430based on the CAN standard. The data received by the CAN communication transceiver108is sent to the MCU120.

The K-line communication driver110is an interface that exchanges data with the passenger seat passenger sensing ECU200via the communication line440. The K-line communication driver110converts the voltage level of a communication signal. For example, the K-line communication driver110converts a 5V signal level handled by the MCU120into a K-line voltage level (12V).

The MCU120includes an A/D (Analog to Digital Converter)121, a CPU (Central Processing Unit)122, a ROM (Read Only Memory)124, a RAM (Random Access Memory)126, and a CAN communication controller128. In addition, the MCU120includes an SCI (Serial Communication Interface)132, SPIs (Serial Peripheral Interface)134,136, and138, and an IOPort139.

The A/D121, the CPU122, the ROM124, the RAM126, the CAN communication controller128, the SCI132, the SPIs134,136, and138, and the IOPort139are interconnected via an internal bus170of the MCU120.

The A/D121converts an analog voltage signal input via the voltage detection I/Fs105and107into a digital voltage signal.

The CPU122is a calculation processing unit executing various types of programs stored in the ROM124or the RAM126. The CPU122performs various types of functions of the air bag ECU100by executing various types of programs stored in the ROM124or the RAM126. Details on various types of functions of the air bag ECU100will be described later.

The ROM124is a memory storing data for performing various types of functions of the air bag ECU100and various types of programs for performing various types of functions of the air bag ECU100.

The RAM126is a relatively small capacity memory that can be accessed at high speed and stores calculation results and the like of programs executed by the CPU122among various types of programs stored in the ROM124.

The CAN communication controller128communicates with the meter ECU300or other components of the vehicle via the CAN communication transceiver108.

The SCI132is an asynchronous serial communication interface between a K-line communication driver110and devices in the MCU120.

The SPI134is a clock synchronous serial communication interface between the ASIC140and devices in the MCU120. The SPI136is an interface between the acceleration sensor150and devices in the MCU120. The SPI138is an interface between the non-volatile memory160and devices in the MCU120. The IOPort139is an interface between the lamp driving circuit180and devices the MCU120.

The acceleration sensor150detects acceleration in a place in which the air bag ECU100is disposed. The acceleration sensor150outputs the detected acceleration to the MCU120via the SPI136.

The non-volatile memory160holds a record without receiving a power source and is, for example, an EEPROM (Electrically Erasable Programmable Read-Only Memory). The non-volatile memory160records data output from, for example, the MCU120via the SPI138.

The ASIC140is an integrated circuit in which circuits having a plurality of functions are integrated into one. The ASIC140includes the squib I/F (Interface)142and a sensor I/F144.

The squib I/F142is an interface through which an air bag expansion signal is sent to the driver seat air bag squib500, the passenger seat air bag squib510, the right side air bag squib520, the left side air bag squib530, the right curtain air bag squib540, and the left curtain air bag squib550.

The sensor I/F144is an interface through which an acceleration signal and pressure signal sent from the front right acceleration sensor600, the front left acceleration sensor610, the right side acceleration sensor620, the left side acceleration sensor630, the right side pressure sensor640, and the left side pressure sensor650are received.

When, for example, a faulty sensor installed in the air bag ECU100is determined not to be replaced, the lamp driving circuit180issues a warning about the fact via the air bag warning lamp800.

The driver seat air bag squib500flows a current through an ignition apparatus (squib) on the driver seat side based on an expansion signal sent from the MCU120via the squib I/F142, generates high-pressure gas by igniting a gas generation agent, and expands the air bag instantaneously.

In addition, the passenger seat air bag squib510, the right side air bag squib520, the left side air bag squib530, the right curtain air bag squib540, and the left curtain air bag squib550also expand air bags disposed in the corresponding places based on the expansion signal sent from the MCU120.

The front right acceleration sensor600, which is disposed on the right side on the front of the vehicle, detects the acceleration, and sends the detected acceleration to the MCU120via the sensor I/F144.

Similarly, the front left acceleration sensor610, the right side acceleration sensor620, and the left side acceleration sensor630, which are disposed in the corresponding places in the vehicle, detect the accelerations in the corresponding places and send the detected accelerations to the MCU120.

The right side pressure sensor640, which is installed inside the door on the right side of the vehicle, detects a sudden change in the atmospheric pressure inside the door that occurs during a side collision of the vehicle. The right side pressure sensor640detects the atmospheric pressure or the change rate of the atmospheric pressure inside the door in which the sensor is disposed, and sends the detected value to the MCU120via the sensor I/F144.

The left side pressure sensor650, which is installed inside the door on the left side of the vehicle, detects a sudden change in the atmospheric pressure inside the door that occurs during a side collision of the vehicle. The left side pressure sensor650detects the atmospheric pressure or the change rate of the atmospheric pressure inside the door in which the sensor is disposed, and sends the detected value to the MCU120via the sensor I/F144.

The failure diagnosis apparatus700can communicate with ECUs on the network via a CAN communication line, which is a communication network of the vehicle. The ECUs monitor the presence or absence of their own failures. The failure diagnosis apparatus700is used in the assembly line for vehicles, the selling office of vehicles, the repair plant of vehicles, or the like to monitor the presence or absence of a failure in the ECUs and, if a failure is present, identify the portion having the failure.

The air bag warning lamp800is driven by the lamp driving circuit180or the like when, for example, the determination is performed that a faulty sensor installed in the air bag ECU100is not replaced, to warn the user of the fact.

Next, the function blocks of an external sensor and an air bag ECU according to a first embodiment will be described.FIG. 2illustrates the function blocks of an air bag control system (air bag ECU and external sensor) according to the first embodiment. In the following embodiments, the front right acceleration sensor600will be described as an example of the external sensor. However, it is assumed that the other external sensors (the front left acceleration sensor610, the right side acceleration sensor620, the left side acceleration sensor630, the right side pressure sensor640, and the left side pressure sensor650) have the same structure and a plurality of external sensors are connected to the air bag ECU100. The method for connecting external sensors to the air bag ECU100is not particularly limited and application to the peer-to-peer method, bus connections (parallel connection and daisy chain connection), and the like is enabled.

As illustrated inFIG. 2, the front right acceleration sensor600includes a sensor communication unit601, a sensor ID recording unit602, and an impact detection unit603.

The sensor communication unit601communicates with the air bag ECU100. The sensor ID recording unit602is a memory in which identification data (individual identifying ID) for individually identifying the front right acceleration sensor600and is configured by a non-volatile memory. Identification data (individual identifying ID) represents data that can be used to uniquely identify an external sensor. As identification data, unique data is written in the production line when an external sensor is manufactured. The impact (acceleration) detection unit603is a sensor detecting the data (acceleration or impact value) used to determine whether a protective apparatus such as an air bag is activated.

On the other hand, the air bag ECU100includes an ECU communication unit181, a faulty sensor mount determination unit182, a first sensor failure diagnosis unit183-1, a faulty sensor ID recording unit184, and an installed sensor ID recording unit185.

The ECU communication unit181communicates with the front right acceleration sensor600. The ECU communication unit181is achieved by, for example, the SPI134, the sensor I/F144, and the like, but the invention is not limited to this.

The ECU communication unit181receives sensing data detected by the impact detection unit603and identification data recorded in the sensor ID recording unit.602from the sensor communication unit601.

The faulty sensor mount determination unit182determines whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU100based on failure history data indicating whether the external sensor has been diagnosed as being faulty before. Although the faulty sensor mount determination unit182is achieved by, for example, the CPU122, the invention is not limited to this.

The first sensor failure diagnosis unit183-1diagnoses whether the external sensor (the external sensor currently connected to the air bag ECU100) is faulty based on the received sensing data. When, for example, the sensing data detected by the impact detection unit603is kept at an abnormal value for a predetermined time period such as being fixed to a high value outside the normal range for a predetermined time period or being fixed to a low value outside the normal range for a predetermined time period, the first sensor failure diagnosis unit183-1diagnoses the front right acceleration sensor600as being faulty. The first sensor failure diagnosis unit183-1is achieved by, for example, the CPU122, but the invention is not limited to this.

The faulty sensor ID recording unit184is a memory in which the identification data of an external sensor diagnosed as being faulty by the first sensor failure diagnosis unit183-1is recorded as failure history data. The faulty sensor ID recording unit184is achieved by the non-volatile memory160. The installed sensor ID recording unit185is a memory in which the identification data of the external sensor (installed sensor) currently connected to the air bag ECU100is recorded. The installed sensor ID recording unit185is achieved by, for example, the RAM126, but the installed sensor ID recording unit185is not limited to this.

The faulty sensor mount determination unit182compares the identification data (the identification data of an external sensor having been diagnosed as being faulty before) recorded in the faulty sensor ID recording unit184with the identification data (the identification data of the external sensor currently connected to the air bag ECU100) received by the ECU communication unit181and recorded in the installed sensor ID recording unit185and determines whether a faulty sensor is connected to the air bag ECU100. Specifically, when the identification data recorded in the installed sensor ID recording unit185matches any of identification data recorded in the faulty sensor ID recording unit184, the faulty sensor mount determination unit182determines that a faulty sensor is connected to the air bag ECU100and, when the identification data does not match any of identification data, determines that a faulty sensor is not connected to the air bag ECU100.

Next, the operation of an air bag control system according to the first embodiment will be described.FIG. 3is a flowchart for the air bag control system (air bag ECU and external sensor) according to the first embodiment.

FIG. 3Ais a flowchart illustrating the entire process of the air bag control system according to the first embodiment,FIG. 3Bis a flowchart concerning the initialization processing of the air bag control system according to the first embodiment, andFIG. 3Bis a flowchart concerning the normal processing of the air bag control system according to the first embodiment.

As illustrated inFIG. 3A, the air bag control system1000first performs initialization processing (step S100) when, for example, the ignition switch of a vehicle is turned on and then repeats normal processing (step S200).

The initialization processing (step S100) will be described in detail. As illustrated inFIG. 3B, the sensor communication unit601sends the individual identifying ID of the front right acceleration sensor600recorded in the sensor ID recording unit602to the air bag ECU100(step S101). When the individual identifying ID cannot be sent from the sensor communication unit601to the air bag ECU100at a time because, for example, the data length of the individual identifying ID is long, the individual identifying ID may be sent at a plurality of divided times. The individual identifying ID is not necessary for the operation of the air bag ECU100during normal time and the individual identifying ID only needs to be received by the air bag ECU100only once during startup when an IGN power source is supplied, so the individual identifying ID is desirably executed in initialization processing.

On the other hand, the ECU communication unit181receives the individual identifying ID (step S102). Then, the ECU communication unit181writes the received individual identifying ID to the installed sensor ID recording unit185as an installed sensor (step S103).

Then, the faulty sensor mount determination unit182determines whether the same individual identifying ID as the installed sensor is recorded in the faulty sensor ID recording unit184(step S104). If the same individual identifying ID as the installed sensor is not recorded in the faulty sensor ID recording unit184(No in step S104), the faulty sensor mount determination unit182completes the processing.

In contrast, if the same individual identifying ID as the installed sensor is recorded in the faulty sensor ID recording unit184(Yes in step S104), the faulty sensor mount determination unit182determines that the faulty sensor is connected to the air bag ECU100(that is, the faulty sensor installed in the air bag ECU100is not replaced (step S105)), the faulty sensor mount determination unit182completes the processing. When determining that the faulty sensor installed in the air bag ECU100is not replaced, the faulty sensor mount determination unit182can output the fact as a warning using the air bag warning lamp800or stop the function of the air bag ECU100.

Next, normal processing (step S200) will be described in detail. As illustrated inFIG. 3C, the sensor communication unit601sends the impact value detected by the impact detection unit603to the air bag ECU100(step S201).

In response to this, the ECU communication unit181receives the impact value (step S202). Then, the first sensor failure diagnosis unit183-1determines whether the impact value received by the ECU communication unit181falls outside the normal range and is kept for a predetermined time (step S203).

When the impact value received by the ECU communication unit181does not fall outside the normal range or is not kept for a predetermined time (No in step S203), the first sensor failure diagnosis unit183-1completes the processing.

In contrast, when the impact value received by the ECU communication unit181falls outside the normal range and is kept for a predetermined time (Yes in step S203), the first sensor failure diagnosis unit183-1determines that the installed sensor is a faulty sensor (step S204).

That is, the first sensor failure diagnosis unit183-1monitors the impact value received from an external sensor and diagnoses whether the external sensor is normal. Specifically, when the received impact value is a high value outside the normal range or a low value outside the normal range and is kept for a predetermined time or more, the first sensor failure diagnosis unit183-1determines that there is an internal abnormality and the external sensor is a faulty sensor. The time required for determining a failure is desirably longer than the time until an impact value changes due to a collision of a vehicle. The normal range of an impact value and the time required for determining to a failure are set to appropriate values depending on the reliability needed for the air bag ECU100and the reliability of components to be adopted.

Then, the first sensor failure diagnosis unit183-1records the individual identifying ID of the installed sensor in the faulty sensor ID recording unit184(step S205) and completes the processing. After receiving an impact value, the ECU communication unit181performs processing such as determination as to whether the air bag is expanded based on the received impact value. However, the detailed description is omitted.

According to the first embodiment, since the individual identifying ID of an external sensor diagnosed as being faulty is recorded in the faulty sensor ID recording unit184, by comparing this individual identifying ID with the individual identifying ID of the external sensor currently connected to the air bag ECU100, a determination can be made as to whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU100.

Next, the functional blocks of an external sensor and an air bag ECU according to a second embodiment will be described.FIG. 4is a diagram illustrating the functional blocks of an air bag control system (air bag ECU and external sensor) according to the second embodiment. The detailed description of components that are the same as in the first embodiment is omitted.

The front right acceleration sensor600includes the sensor communication unit601, the sensor ID recording unit602, the impact detection unit603, and an in-sensor failure diagnosis unit604.

The in-sensor failure diagnosis unit604diagnoses whether the front right acceleration sensor600is faulty. The in-sensor failure diagnosis unit604determines whether the impact value normally exceeds a predetermined threshold by, for example, physically operating the element of the sensing part of the impact detection unit603to the plus side and the minus side. When the impact value does not exceed the predetermined threshold, the in-sensor failure diagnosis unit604diagnoses the external sensor as having any failure and determines it to be a faulty sensor. In contrast, when the impact value exceeds the predetermined threshold, the in-sensor failure diagnosis unit604determines the external sensor to be normal.

The air bag ECU100includes the ECU communication unit181, the faulty sensor mount determination unit182, the faulty sensor ID recording unit184, the installed sensor ID recording unit185, and a second sensor failure diagnosis unit183-2.

The ECU communication unit181receives, from the sensor communication unit601, a diagnosis result (for example, failure information indicating the external sensor to be faulty) diagnosed by the in-sensor failure diagnosis unit604and identification data recorded in the sensor ID recording unit602. In addition, the ECU communication unit181also receives sensing data detected by the impact detection unit603.

The second sensor failure diagnosis unit183-2diagnoses whether the front right acceleration sensor600is faulty based on the diagnosis result sent from the front right acceleration sensor600.

The faulty sensor ID recording unit184records, as failure history data, the identification data of the external sensor diagnosed as being faulty by the second sensor failure diagnosis unit183-2.

The faulty sensor mount determination unit182compares the identification data (the identification data of the external sensor having been diagnosed as being faulty before) recorded in the faulty sensor ID recording unit184with the identification data (the identification data of the external sensor currently connected to the air bag ECU100) received by the ECU communication unit181and recorded in the installed sensor ID recording unit185and determines whether a faulty sensor is connected to the air bag ECU100. Specifically, when the identification data recorded in the installed sensor ID recording unit185matches any of identification data recorded in the faulty sensor ID recording unit184, the faulty sensor mount determination unit182determines that a faulty sensor is connected to the air bag ECU100and, when the identification data does not match any of identification data, determines that a faulty sensor is not connected to the air bag ECU100.

Next, the operation of an air bag control system according to the second embodiment will be described.FIG. 5is a flowchart for the air bag control system (air bag ECU and external sensor) according to the second embodiment. The flowchart illustrating the entire process of the air bag control system1000according to the second embodiment is the same as in the first embodiment (FIG. 3A). The flowchart concerning the initialization processing of the air bag control system according to the second embodiment is also the same as in the first embodiment (FIG. 3B). Accordingly, only the flowchart concerning the normal processing of the air bag control system according to the second embodiment will be described.

As illustrated inFIG. 5, the in-sensor failure diagnosis unit604performs internal failure diagnosis (step S211). Then, the in-sensor failure diagnosis unit604determines whether the result of the internal failure diagnosis indicates a failure (step S212).

If the result of the internal failure diagnosis is determined to be a failure (Yes in step S212), the sensor communication unit601sends failure information indicating that the external sensor is faulty to the air bag ECU100(step S213).

In contrast, if the result of the internal failure diagnosis is determined not to be a failure (No in step S212), the sensor communication unit601sends the impact value detected by the impact detection unit603to the air bag ECU100(step S214).

After step S213or step S214, the second sensor failure diagnosis unit183-2determines whether the data received from the external sensor is failure information (step S215). If the data received from the external sensor is not failure information (No in step S215), the second sensor failure diagnosis unit183-2completes the processing.

In contrast, if the data received from the external sensor is failure information (Yes in step S215), the second sensor failure diagnosis unit183-2records the individual identifying ID of the installed sensor in the faulty sensor ID recording unit184(step S216) and completes the processing.

According to the second embodiment, by recording the individual identifying ID of the external sensor diagnosed as being faulty by the external sensor in the faulty sensor ID recording unit184and comparing this individual identifying ID with the individual identifying ID of the external sensor currently connected to the air bag ECU100, a determination can be made as to whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU100.

Next, the functional blocks of an external sensor and an air bag ECU according to a third embodiment will be described.FIG. 6is a diagram illustrating the functional blocks of an air bag control system (air bag ECU and external sensor) according to the third embodiment. The detailed description of components that are the same as in the first or second embodiment is omitted.

The front right acceleration sensor600includes the sensor communication unit601, the impact detection unit603, and a failure history recording unit605.

The failure history recording unit605is a memory in which the failure history data of the failure history recording unit605is recorded and is configured by a non-volatile memory.

On the other hand, the air bag ECU100includes the ECU communication unit181, the faulty sensor mount determination unit182, the first sensor failure diagnosis unit183-1, and a writing requesting unit186.

The ECU communication unit181receives, from the sensor communication unit601, the sensing data detected by the impact detection unit603.

When the front right acceleration sensor600is diagnosed as being faulty by the first sensor failure diagnosis unit183-1, the writing requesting unit186outputs a request for recoding, as failure history data, failure information in the failure history recording unit605provided in the front right acceleration sensor600diagnosed as being faulty. Accordingly, the failure information is recorded in the failure history recording unit605.

In the embodiment, the ECU communication unit181receives the failure information recorded in the failure history recording unit605from the sensor communication unit601.

Then, the faulty sensor mount determination unit182determines whether a faulty sensor is connected to the air bag ECU100based on the failure information received by the ECU communication unit181. For example, if data sent from the external sensor currently connected to the air bag ECU100contains failure information, the faulty sensor mount determination unit182determines that a faulty sensor is connected to the air bag ECU100. In contrast, if data sent from the external sensor currently connected to the air bag ECU100does not contain failure information, the faulty sensor mount determination unit182determines that a faulty sensor is not connected to the air bag ECU100.

Next, the operation of an air bag control system according to the third embodiment will be described.FIG. 7is a flowchart for the air bag control system (air bag ECU and external sensor) according to the third embodiment. The flowchart illustrating the entire process of the air bag control system1000according to the third embodiment is the same as in the first embodiment (FIG. 3A). Accordingly, only the flowchart concerning the initialization processing of the air bag control system according to the third embodiment and the flowchart concerning the normal processing of the air bag control system according to the third embodiment will be described.FIG. 7Ais a flowchart concerning the initialization processing of the air bag control system according to the third embodiment andFIG. 7Bis a flowchart concerning the normal processing of the air bag control system according to the third embodiment.

As illustrated inFIG. 7A, the sensor communication unit601determines whether the failure history (write history of failure information) of the front right acceleration sensor600is present in the failure history recording unit605(step S121).

When the failure history of the front right acceleration sensor600is present in the failure history recording unit605(Yes in step S121), the sensor communication unit601sends a signal indicating the presence of internal failure history to the air bag ECU100(step S122).

In contrast, when the failure history of the front right acceleration sensor600is absent in the failure history recording unit605(No in step S121), the sensor communication unit601sends a signal indicating the absence of internal failure history to the air bag ECU100(step S123)

After step S122or step S123, the faulty sensor mount determination unit182determines whether the received data from the external sensor is a signal (failure information) indicating the presence of an internal failure (step S124).

When the received data from the external sensor is not a signal (failure information) indicating the presence of an internal failure (No in step S124), the faulty sensor mount determination unit182completes the processing.

In contrast, when the received data from the external sensor is a signal (failure information) indicating the presence of an internal failure (Yes in step S124), the faulty sensor mount determination unit182determines that a faulty sensor is connected to the air bag ECU100(that is, the faulty sensor installed in the air bag ECU100is not replaced (step S125)) and completes the processing. When determining that the faulty sensor installed in the air bag ECU100is not replaced, the faulty sensor mount determination unit182can output the fact as a warning using the air bag warning lamp800or stop the function of the air bag ECU100.

Next, normal processing (step S200) will be described in detail. As illustrated inFIG. 7B, the sensor communication unit601sends the impact value detected by the impact detection unit603to the air bag ECU100(step S221).

Then, the ECU communication unit181receives the impact value (step S222). Then, the first sensor failure diagnosis unit183-1determines whether the impact value received by the ECU communication unit181falls outside the normal range and is kept for a predetermined time (step S223).

When the impact value received by the ECU communication unit181does not fall outside the normal range or is not kept for a predetermined time (No in step S223), the first sensor failure diagnosis unit183-1completes the processing.

In contrast, when the impact value received by the ECU communication unit181falls outside the normal range and is kept for a predetermined time (Yes in step S223), the first sensor failure diagnosis unit183-1determines that the installed sensor is a faulty sensor (step S224).

Then, the writing requesting unit186sends failure information to the external sensor diagnosed as being faulty (step S225) and requests the recording of the failure information in the failure history recording unit605.

In response to this, the sensor communication unit601receives the failure information sent from the writing requesting unit186, records the received failure information in the failure history recording unit605(step S226), and completes the processing.

According to the third embodiment, the air bag ECU100diagnoses whether an external sensor is faulty and, if a failure is present, records faulty information in the external sensor, so the external sensor holds its own failure history data in the failure history recording unit605. Since the external sensor sends failure history data to the air bag ECU100in initialization processing, the air bag ECU100can determine whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU100based on the failure history data. According to the third embodiment, since an external sensor has its own failure history data in the failure history recording unit605, even if a faulty sensor is replaced with a new one and the faulty sensor is erroneously assembled to another vehicle without being discarded in the assembly line for vehicles or the like, the attachment of the faulty sensor can be detected.

Next, the functional blocks of an external sensor and an air bag ECU according to a fourth embodiment will be described.FIG. 8is a diagram illustrating the functional blocks of an air bag control system (air bag ECU and external sensor) according to the fourth embodiment. The detailed description of components that are the same as in the first to third embodiments is omitted.

The front right acceleration sensor600includes the sensor communication unit601, the impact detection unit603, the in-sensor failure diagnosis unit604, and the failure history recording unit605.

On the other hand, the air bag ECU100includes the ECU communication unit181, the faulty sensor mount determination unit182, the second sensor failure diagnosis unit183-2, and the writing requesting unit186.

The ECU communication unit181receives, from the sensor communication unit601, the diagnosis result (the diagnosis result by the in-sensor failure diagnosis unit604) indicating whether the front right acceleration sensor600is faulty. The ECU communication unit181also receives the sensing data detected by the impact detection unit603.

The second sensor failure diagnosis unit183-2diagnoses whether the front right acceleration sensor600is faulty based on the diagnosis result sent from the front right acceleration sensor600.

When the front right acceleration sensor600is diagnosed as being faulty by the second sensor failure diagnosis unit183-2, the writing requesting unit186outputs a request for recoding, as failure history data, failure information in the failure history recording unit605provided in the front right acceleration sensor600diagnosed as being faulty. Accordingly, the failure information is recorded in the failure history recording unit605.

In the embodiment, the ECU communication unit181receives the failure information recorded in the failure history recording unit605from the sensor communication unit601.

Then, the faulty sensor mount determination unit182determines whether a faulty sensor is connected to the air bag ECU100based on the failure information received by the ECU communication unit181. For example, if data sent from the external sensor currently connected to the air bag ECU100contains failure information, the faulty sensor mount determination unit182determines that a faulty sensor is connected to the air bag ECU100. In contrast, if data sent from the external sensor currently connected to the air bag ECU100does not contain failure information, the faulty sensor mount determination unit182determines that a faulty sensor is not connected to the air bag ECU100.

Next, the operation of an air bag control system according to the fourth embodiment will be described.FIG. 9is a flowchart for the air bag control system (air bag ECU and external sensor) according to the fourth embodiment. The flowchart illustrating the entire process of the air bag control system1000according to the fourth embodiment is the same as in the first embodiment (FIG. 3A). The flowchart concerning the initialization processing of the air bag control system1000according to the fourth embodiment is also the same as in the third embodiment (FIG. 7A). Accordingly, only the flowchart concerning the normal processing of the air bag control system according to the fourth embodiment will be described.

As illustrated inFIG. 9, the in-sensor failure diagnosis unit604performs internal failure diagnosis (step S231). Then, the in-sensor failure diagnosis unit604determines whether the result of the internal failure diagnosis indicates a failure (step S232).

If the result of the internal failure diagnosis is determined to be a failure (Yes in step S232), the sensor communication unit601sends failure information indicating that the external sensor is faulty to the air bag ECU100(step S233).

In contrast, if the result of the internal failure diagnosis is determined not to be a failure (No in step S232), the sensor communication unit601sends the impact value detected by the impact detection unit603to the air bag ECU100(step S234).

After step S233or step S234, the second sensor failure diagnosis unit183-2determines whether the data received from the external sensor is failure information (step S235). If the data received from the external sensor is not failure information (No in step S235), the second sensor failure diagnosis unit183-2completes the processing.

In contrast, if the data received from the external sensor is failure information (Yes in step S235), the second sensor failure diagnosis unit183-2determines that the installed sensor is a faulty sensor (step S236).

Then, the writing requesting unit186sends failure information to the external sensor diagnosed as being faulty (step S237) and requests the recording of the failure information in the failure history recording unit605.

In response to this, the sensor communication unit601receives the failure information sent from the writing requesting unit186, records the received failure information in the failure history recording unit605(step S238), and completes the processing.

According to the fourth embodiment, an external sensor diagnoses whether the external sensor is faulty and, if it is faulty, the failure information is written to the external sensor according to a write request from the air bag ECU100, so the external sensor holds its failure history data in the failure history recording unit605. Since the external sensor sends failure history data to the air bag ECU100in initialization processing, the air bag ECU100can determine whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU100based on the failure history data.

Next, the functional blocks of an external sensor and an air bag ECU according to a fifth embodiment will be described.FIG. 10is a diagram illustrating the functional blocks of an air bag control system (air bag ECU and external sensor) according to the fifth embodiment. The detailed description of components that are the same as in the first to fourth embodiments is omitted.

The front right acceleration sensor600includes the sensor communication unit601, the impact detection unit603, the in-sensor failure diagnosis unit604, and the failure history recording unit605.

The in-sensor failure diagnosis unit604diagnoses whether the front right acceleration sensor600is faulty. The in-sensor failure diagnosis unit604determines whether the impact value normally exceeds a predetermined threshold by, for example, physically operating the element of the sensing part of the impact detection unit603to the plus side and the minus side. When the impact value does not exceed the predetermined threshold, the in-sensor failure diagnosis unit604diagnoses the external sensor as having any failure and determines it to be a faulty sensor. In contrast, when the impact value exceeds the predetermined threshold, the in-sensor failure diagnosis unit604determines the external sensor to be normal. In addition, when diagnosing that the front right acceleration sensor600as being faulty, the in-sensor failure diagnosis unit604records, as failure history data, failure information in the failure history recording unit605.

On the other hand, the air bag ECU100includes the ECU communication unit181and the faulty sensor mount determination unit182.

The ECU communication unit181receives, from the sensor communication unit601, the failure history data recorded in the failure history recording unit605.

The faulty sensor mount determination unit182determines whether a faulty sensor is connected to the air bag ECU100based on the failure history data received by the ECU communication unit181. For example, if failure history data sent from the external sensor currently connected to the air bag ECU100contains failure information, the faulty sensor mount determination unit182determines that a faulty sensor is connected to the air bag ECU100. In contrast, if failure history data sent from the external sensor currently connected to the air bag ECU100does not contain failure information, the faulty sensor mount determination unit182determines that a faulty sensor is not connected to the air bag ECU100.

Next, the operation of an air bag control system according to the fifth embodiment will be described.FIG. 11is a flowchart for the air bag control system (air bag ECU and external sensor) according to the fifth embodiment. The flowchart illustrating the entire process of the air bag control system1000according to the fifth embodiment is the same as in the first embodiment (FIG. 3A). The flowchart concerning the initialization processing of the air bag control system according to the fifth embodiment is also the same as in the third embodiment (FIG. 7A). Accordingly, only the flowchart concerning the normal processing of the air bag control system according to the fifth embodiment will be described.

As illustrated inFIG. 11, the in-sensor failure diagnosis unit604performs internal failure diagnosis (step S241). Then, the in-sensor failure diagnosis unit604determines whether the result of the internal failure diagnosis indicates a failure (step S242).

If determining that the result of the internal failure diagnosis to be a failure (Yes in step S242), the in-sensor failure diagnosis unit604records failure information in the failure history recording unit605(step S243). Then, the sensor communication unit601sends failure information indicating that the external sensor is faulty to the air bag ECU100(step S244).

In contrast, if the result of the internal failure diagnosis is determined not to be a failure (No in step S242), the sensor communication unit601sends the impact value detected by the impact detection unit603to the air bag ECU100(step S245).

After step S244or step S245, the faulty sensor mount determination unit182determines whether the data received from the external sensor is failure information (step S246). If the data received from the external sensor is not failure information (No in step S246), the faulty sensor mount determination unit182completes the processing.

In contrast, if the data received from the external sensor is failure information (Yes in step S246), the faulty sensor mount determination unit182determines that the installed sensor us a faulty sensor and the faulty sensor is connected to the air bag ECU100(step S247) and completes the processing.

According to the fifth embodiment, an external sensor diagnoses the presence or absence of its own failure and the diagnosis result is recorded in the failure history recording unit605. Since the external sensor sends failure history data to the air bag ECU100, the air bag ECU100can determine whether a faulty sensor having been diagnosed as being faulty before is connected to the air bag ECU100based on the failure history data.

Next, the functional blocks of an external sensor, an air bag ECU, and a failure diagnosis apparatus according to a sixth embodiment will be described.FIG. 12is a diagram illustrating the functional blocks of an air bag control system (air bag ECU, external sensor, and failure diagnosis apparatus) according to the sixth embodiment. The detailed description of components that are the same as in the first to fifth embodiments is omitted.

The front right acceleration sensor600includes the sensor communication unit601, the sensor ID recording unit602, and the impact detection unit603.

On the other hand, the air bag ECU100includes the ECU communication unit181, the faulty sensor mount determination unit182, the first sensor failure diagnosis unit183-1, the faulty sensor ID recording unit184, the installed sensor ID recording unit185, and an ECU second communication unit187.

The ECU second communication unit187communicates with the failure diagnosis apparatus (diagnosis tester)700. The ECU second communication unit187is achieved by, for example, the CAN communication controller128and the like, but the invention is not limited to this.

The failure diagnosis apparatus700includes a failure diagnosis apparatus communication unit710, an installed sensor ID reading unit720, a faulty sensor ID reading unit730, and a display unit740.

The failure diagnosis apparatus communication unit710communicates with the air bag ECU100. The installed sensor ID reading unit720reads identification data (individual identifying ID) for individually identifying the external sensor currently connected to the air bag ECU100via the failure diagnosis apparatus communication unit710. The faulty sensor ID reading unit730reads identification data for individually identifying a faulty sensor via the failure diagnosis apparatus communication unit710. The display unit740is an output interface displaying the individual identifying ID of the external sensor currently connected to the air bag ECU100and the individual identifying ID of a faulty sensor read by the faulty sensor ID reading unit730.

Next, the operation of an air bag control system according to the sixth embodiment will be described.FIG. 13is a flowchart for the air bag control system (air bag ECU, external sensor, and failure diagnosis apparatus) according to the sixth embodiment.

FIG. 13Ais a flowchart illustrating the entire process of the air bag control system according to the sixth embodiment andFIG. 13Bis a flowchart concerning the failure diagnosis apparatus communication processing of the air bag control system according to the sixth embodiment.

The flowchart concerning the initialization processing of the air bag control system according to the sixth embodiment is the same as in the first embodiment (FIG. 3B). The flowchart concerning the normal processing of the air bag control system according to the sixth embodiment is the same as in the first embodiment (FIG. 3C). Accordingly, only the flowchart illustrating the entire process of the air bag control system according to the sixth embodiment and the flowchart concerning failure diagnosis apparatus communication processing will be described.

As illustrated inFIG. 13A, the air bag control system1000first performs initialization processing (step S100) when, for example, the ignition switch of the vehicle is turned on. Then, the air bag control system1000performs normal processing (step S200) and then performs failure diagnosis apparatus communication processing (step S300). The air bag control system1000repeats normal processing (step S200) and failure diagnosis apparatus communication processing (step S300).

In addition, as illustrated inFIG. 13B, the ECU second communication unit187determines whether the failure diagnosis apparatus700is connected (step S301). If the failure diagnosis apparatus700is not connected (No in step S301), the ECU second communication unit187completes the processing.

In contrast, if the failure diagnosis apparatus700is connected (Yes in step S301), the installed sensor ID reading unit720requests the air bag ECU100to indicate the individual identifying ID of the sensor currently connected, via the failure diagnosis apparatus communication unit710(step S302).

Then, the ECU second communication unit187reads, from the installed sensor ID recording unit185, the individual identifying ID of the sensor currently connected and sends it to the failure diagnosis apparatus700(step S303).

Then, the display unit740displays the individual identifying ID (read by the installed sensor ID reading unit720) of the sensor currently connected (step S304).

Then, the faulty sensor ID reading unit730requests the air bag ECU100to indicate whether a faulty sensor is connected (step S305).

Then, the faulty sensor mount determination unit182sends a signal indicating whether a faulty sensor is connected to the failure diagnosis apparatus700via the ECU second communication unit187(step S306).

Then, the faulty sensor ID reading unit730determines whether a faulty sensor is connected based on the signal (sent by the faulty sensor mount determination unit182) indicating whether a faulty sensor is connected (step S307). If determining that a faulty sensor is not connected (No in step S307), the faulty sensor ID reading unit730completes the processing.

In contrast, when determining that a faulty sensor is connected (Yes in step S307), the faulty sensor ID reading unit730requests the air bag ECU to indicate the individual identifying ID of the faulty sensor (step S308).

Then, the faulty sensor mount determination unit182sends the individual identifying ID of the faulty sensor to the failure diagnosis apparatus700via the ECU second communication unit187(step S309).

Then, the display unit740displays the individual identifying ID of the faulty sensor read by the faulty sensor ID reading unit730(step S310).

According to the sixth embodiment, the individual identifying ID of the external sensor connected to the air bag ECU100can be read from the failure diagnosis apparatus700via the communication network of the vehicle. In addition, the individual identifying ID of the external sensor held by the air bag ECU100, and the presence or absence or the individual identifying ID of an external sensor having been determined to be faulty before can be read from the failure diagnosis apparatus700via communication.

In addition, according to the sixth embodiment, the external sensor currently assembled to the vehicle can be individually identified in the assembly line for vehicles. Accordingly, although the traceability of the vehicle and the external sensor is ensured conventionally by performing work such as the reading of a barcode label attached to an external sensor using a barcode reader, by abolishing the reading work using a barcode reader in the assembly line for vehicles, the assembling time of the vehicle can be shortened. In addition, since the barcode label attached to the external sensor becomes unnecessary, the cost of the barcode label can be reduced. In addition, since the work of attaching a barcode becomes unnecessary in manufacturing an external sensor, the time required for manufacturing an external sensor can be shortened. In addition, since the external sensor having been determined to be faulty before can be individually identified in the assembly line for vehicles, it is possible to surely prevent faulty products from being on the market.

Next, the functional blocks of an external sensor, an air bag ECU, and a failure diagnosis apparatus according to a seventh embodiment will be described.FIG. 14is a diagram illustrating the functional blocks of an air bag control system (air bag ECU, external sensor, and failure diagnosis apparatus) according to the seventh embodiment. The detailed description of components that are the same as in the first to sixth embodiments is omitted.

The front right acceleration sensor600includes the sensor communication unit601, the sensor ID recording unit602, the impact detection unit603, and the in-sensor failure diagnosis unit604.

On the other hand, the air bag ECU100includes the ECU communication unit181, the faulty sensor mount determination unit182, the second sensor failure diagnosis unit183-2, the faulty sensor ID recording unit184, the installed sensor ID recording unit185, and the ECU second communication unit187.

In addition, the failure diagnosis apparatus700includes the failure diagnosis apparatus communication unit710, the installed sensor ID reading unit720, the faulty sensor ID reading unit730, and the display unit740.

The flowchart illustrating the entire process of the air bag control system according to the seventh embodiment is the same as in the sixth embodiment (FIG. 13A). The flowchart concerning the initialization processing of the air bag control system according to the seventh embodiment is also the same as in the first embodiment (FIG. 3B). The flowchart concerning the normal processing of the air bag control system according to the seventh embodiment is also the same as in the second embodiment (FIG. 5). The flowchart concerning the failure diagnosis communication processing of the air bag control system according to the seventh embodiment is the same as in the sixth embodiment (FIG. 13B).

According to the seventh embodiment, as in the sixth embodiment, the individual identifying ID of the external sensor connected to the air bag ECU100can be read from the failure diagnosis apparatus700via the communication network of the vehicle. In addition, the individual identifying ID of the external sensor held by the air bag ECU100, and the presence or absence or the individual identifying ID of an external sensor having been determined to be faulty before can be read from the failure diagnosis apparatus700via communication.

In addition, according to the seventh embodiment, as in the sixth embodiment, the external sensor currently assembled to a vehicle can be individually identified in the assembly line for vehicles. Accordingly, the traceability of the vehicle and the external sensor is ensured conventionally by performing work such as the reading of a barcode label attached to an external sensor using a barcode reader, but the assembling time of the vehicle can be shortened by abolishing the reading work with a barcode reader in the assembly line for vehicles. In addition, since the barcode label attached to the external sensor becomes unnecessary, the cost of the barcode label can be reduced. In addition, since the work of attaching a barcode becomes unnecessary in manufacturing an external sensor, the time required for manufacturing an external sensor can be shortened. In addition, since the external sensor having been determined to be faulty before can be individually identified in the assembly line for vehicles, it is possible to surely prevent faulty products from being on the market.

Although examples of a protective apparatus expanding air bags for driver seat, passenger seat, and other portions have been described in the above embodiments, the invention is not limited to this, and application to a control system for protecting pedestrians is also enabled as described below.

FIG. 15is a diagram illustrating the functional blocks of a control system for protecting pedestrians. As illustrated inFIG. 15, the control system for protecting pedestrians includes a pedestrian protection ECU900, a right bumper acceleration sensor910, a center bumper acceleration sensor920, a left bumper acceleration sensor930, a first actuator940, and a second actuator950.

The right bumper acceleration sensor910, the center bumper acceleration sensor920, and the left bumper acceleration sensor930obtain the acceleration when a vehicle collides with a pedestrian and sends the acceleration to the pedestrian protection ECU900.

The pedestrian protection ECU900estimates a collision object based on the data received from the right bumper acceleration sensor910, the center bumper acceleration sensor920, and the left bumper acceleration sensor930and, if determining that the collision object is a pedestrian, operates the first actuator940and the second actuator950.

For example, in a vehicle having a small clearance between the hood and the engine, the pedestrian protection ECU900reduces the disability value of the pedestrian by lifting the hood using the first actuator940and the second actuator950to increase the clearance between the hood and the engine disposed immediately below the hood. The pedestrian protection ECU900also has a function of, for example, covering the wiper and the A-pillar with the air bag expanding outward to prevent the disability value from increasing because the pedestrian collides with the projection disposed at the root of the wiper and the A-pillar.

The pedestrian protection ECU900operates the first actuator940and the second actuator950by, for example, energizing the squib, igniting the inflator to generate gas, and operating the piston by using the generated gas. When there is room for the microcomputer processing capability and memory space, the air bag ECU100can be integrated with the pedestrian protection ECU900.