Abstract:
A fault code memory management apparatus stores a permanent fault code in different places of a non-volatile memory, and restore the fault code when an error is detected in the fault code stored in the different places in a manner that, in case that discrepancy between the fault codes in different places is found, the fault code matching with data in a code table stored in a read-only memory is determined to be correct. If two fault codes have matching data in the code table, the fault code is compared with data in a standby random access memory that stores an original fault code data. Further, the data in the random access memory and the data in the code table are compared if the comparison between the code and the data in the random access memory is not sufficient.

Description:
CROSS REFERENCE TO RELATED APPLICATION 
       [0001]    The present application is based on and claims the benefit of priority of Japanese Patent Application No. 2007-203108 filed on Aug. 3, 2007, the disclosure of which is incorporated herein by reference. 
       FIELD OF THE INVENTION 
       [0002]    The present disclosure generally relates to a memory management apparatus for storing a fault code in a non-volatile memory and for detecting an error in the fault code. 
       BACKGROUND INFORMATION 
       [0003]    Conventionally, the electronic control unit (ECU) for controlling various parts of a vehicle typically performs diagnosis for detecting a fault of a predetermined diagnosis object and stores, in a semiconductor memory capable of rewriting contents such as an SRAM, an EEPROM or the like, a fault code of the detected fault in case a fault is detected. The semiconductor memory is usually disposed in the ECU. The SRAM is a volatile memory that is configured to have a continuous power supply from a vehicle battery. The EEPROM is a non-volatile memory. 
         [0004]    The ECU is, for example, configured to transmit the fault code to an external diagnosis device by reading the code from the SRAM when the ECU receives a fault code request from the external diagnosis device that is communicable through communication channel. 
         [0005]    In this case, the fault code lost from the SRAM due to the removal of the vehicle battery causing the loss the power supply, due to a defect in the SRAM or the like is restored by reading the code stored in the EEPROM and writing the code in the SRAM. The fault code may be configured to be read from the EEPROM and to be transmitted to the diagnosis device when the ECU receives the fault code request from the diagnosis device. 
         [0006]    The fault code stored in the non-volatile memory may be, for some reason, rewritten or turned to different data in some cases. 
         [0007]    In view of the above-described cases, the technique disclosed in, for example, Japanese patent documents JP-A-2005-196515 or JP-A-2006-286111 describes a method for detecting rewritten to fault data and for restoring a correct data from the fault data. 
         [0008]    For example, in the description of the patent document JP-A-2005-196515, the method describes how to restore the correct data based on comparison of same data stored in three different places. More practically, the method determines that the data is correct if at least two data out of three match with each other. Three data matching with each other is also considered to be correct. Further, when at least two data out of three are matching, the two matching data are determined to be correct data, and the rest is determined to be incorrect. Furthermore, in the description of the document, the method rewrites the data that has been determined to be correct in a memory area that stores the data that has been determined to be incorrect for data restoration of the correct data from the incorrect data. 
         [0009]    The description of JP-A-2006-286111 discloses a similar technical idea. 
         [0010]    However, the method and idea in the above-mentioned documents can not determined the correct fault code if the three different memory areas in the non-volatile memory store respectively different fault codes, that is, if the same codes stored in the three different areas are turned to be respectively different three codes. 
         [0011]    Therefore, the fault code in the SRAM may not be correctly restored when the fault code in the SRAM is lost. In other words, the fault code request from the external diagnosis device may not have the correct fault code transmitted in response. The fault code directly retrieved from the non-volatile memory does not solve the problem because there is no clue to determine which one of the fault codes in the non-volatile memory is correct. 
         [0012]    Further, in a case that at least two fault codes out of three in the non-volatile memory are turned to the incorrect fault codes and the fault codes after being turned accidentally match with each other the incorrect code is considered to be correct. In that case, the ECU transmits the incorrect fault code to the external diagnosis device in response to the fault code request from the diagnosis device. 
       SUMMARY OF THE INVENTION 
       [0013]    In view of the above and other problems, an aspect of the present invention provides a memory management apparatus that stores the same fault code in respectively different places in a non-volatile memory and detects an error in the stored fault code in an improved manner in case of having the error in the code. 
         [0014]    A fault code memory management apparatus of the present invention includes: a memory management unit capable of storing a same fault code of a detection object in a vehicle at respectively different memory areas of a non-volatile memory, wherein the fault code of the detection object represents a detected fault of the object, and wherein information in the non-volatile memory is both readable and writable; and an error detection unit capable of detecting an error of the fault code in the non-volatile memory upon detecting discrepancy of at least one of the same fault codes stored at respectively different memory areas through performing a mutual matching of the fault code. 
         [0015]    Further, the memory management apparatus includes: an information table memory capable of storing a fault code table to be stored in the non-volatile memory, wherein the fault code table is an information table that includes the fault codes; and an authentication unit capable of authenticating the fault code as a genuine fault code by comparing each of the fault codes stored at respectively different areas in the non-volatile memory with the fault code included in the fault code table when the error detection unit at least detects the error of the fault code in the non-volatile memory, wherein the fault code is determined as the genuine fault code when the authentication unit recognizes that the fault code is included in the fault code table. 
         [0016]    Because the fault code table includes the fault codes to be stored in the non-volatile memory, the fault code from the non-volatile memory is an incorrect fault code if the code is not included in the fault code table. In other words, the fault code from the non-volatile memory has the higher possibility of being correct if the fault code is included in the fault code table. 
         [0017]    Therefore, the fault code memory management apparatus can recognize the correct fault code from among the respectively different fault codes stored in different memory areas in the non-volatile memory by comparing the fault code in the non-volatile memory with the fault code table. That is, the apparatus can recognize which one of the fault codes in the respectively different fault codes should be stored in the non-volatile memory in the above-described manner. In other words, the correct fault code is restored from the remaining correct code even when the same fault codes stored in the different memory areas in the non-volatile memory are turned to be respectively different codes. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0018]    Other objects, features and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings, in which: 
           [0019]      FIG. 1  is a configuration diagram of an electronic control unit in an embodiment of the present invention; 
           [0020]      FIG. 2  is a flowchart showing a DTC store processing executed by a CPU of the electronic control unit; 
           [0021]      FIG. 3  is a flowchart showing a PDTC store processing executed by the CPU of the electronic control unit; 
           [0022]      FIG. 4  is a flowchart showing a PDTC reliability checking processing for a PDTC in an EEPROM executed by the CPU of the electronic control unit; 
           [0023]      FIG. 5  is another flowchart showing a PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit; 
           [0024]      FIG. 6  is yet another flowchart showing a PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit; 
           [0025]      FIG. 7  is still yet another flowchart showing a PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit; 
           [0026]      FIG. 8  is a flowchart showing a rewrite processing executed by the CPU of the electronic control unit; 
           [0027]      FIG. 9  is a flowchart showing another PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit; 
           [0028]      FIG. 10  is another flowchart showing another PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit; 
           [0029]      FIG. 11  is yet another flowchart showing another PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit; and 
           [0030]      FIG. 12  is still yet another flowchart showing another PDTC reliability checking processing for the PDTC in the EEPROM executed by the CPU of the electronic control unit. 
       
    
    
     DETAILED DESCRIPTION 
       [0031]    In the following, an embodiment of the present invention is explained based on the drawing.  FIG. 1  is a configuration of an electronic control unit (it is mentioned as an ECU in the following)  1  which the present invention is applied to. The ECU  1  is a device to control each component of the vehicle. 
         [0032]    The ECU  1  includes a microcomputer  2  and an EEPROM  14  as the nonvolatile memory. As for the microcomputer  2 , a CPU  4  carrying out various processing according to a predetermined program, a ROM  8  storing the program carried out by the CPU  4 , a RAM  10  storing information such as a calculation result of the CPU  4  and the like, a backup RAM  12  (designated as SRAM  12  hereinafter) retaining data with a continuous supply of voltage from vehicle battery (not shown in the drawing), an interface (I/O)  6  connecting an external electronic device, and a bus  16  interconnecting above components are included therein. 
         [0033]    The CPU  4  operates according to a program for diagnosis memorized in the ROM  8 , and detects whether the vehicle has a trouble or not. The CPU  4  stores in the SRAM  12  and the EEPROM  14  a trouble code (DTC: Diagnostic Trouble Codes) representing trouble when a trouble is detected. More practically, the CPU  4  stores in the SRAM  12  the DTC, and stores in the EEPROM  14  same data as the DTC that has been stored in the SRAM  12  as a permanent trouble code (PDTC: Permanent Diagnostic Trouble Codes, i.e., Permanent fault code). In addition, having the EEPROM  14  memorize the PDTC is obliged by the law. 
         [0034]    In the following, the trouble code is designated as DTC, and in particular, the trouble code stored in the EEPROM  14  is designated as PDTC. A diagnosis device  3  is a device which diagnoses a state of the vehicle having the ECU  1  installed therein by acquiring a trouble code from the ECU  1 . The diagnosis device  3  is, through the I/O  6 , connected to the microcomputer  2  of the ECU  1 . For example, a service representative connects the diagnosis device  3  to the ECU  1  in a communicable condition in a repair shop, a dealer or the like. 
         [0035]    When a request to send the trouble code is transmitted from the diagnosis device  3 , the microcomputer  2  retrieves the DTC memorized in the SRAM  12 , and the retrieved DTC is transmitted to the diagnosis device  3 . Data in the SRAM  12  are restored by writing the PDTC which has been stored in the EEPROM  14  in the SRAM  12  when, due to loss of a power supply by removing the vehicle battery from the vehicle or due to abnormality of the SRAM  12  causing initialization, the DTC memorized in the SRAM  12  disappeared. 
         [0036]      FIG. 2  is a flowchart representing a DTC store processing that the CPU  4  carries out. For example, the DTC store processing is performed at least once for each of an abnormality detection object in, for example, a trip period (i.e., a period between a turn-on and a turn-off of the vehicle ignition switch, or a period between a turn-on and a subsequent turn-on of the switch: each of the two definitions are used in the present embodiment) Execution timing of the diagnosis may be set arbitrarily. 
         [0037]    At first, in the DTC store processing, whether or not there is abnormality in a predetermined detection object is determined to in S 110 . Then the process proceeds to S 120 , and it is determine whether there is abnormality based on an abnormality determination in S 110 , and when it is determined that there is no abnormality (S 120 : NO), the processing concerned is simply finished. 
         [0038]    On the other hand, when abnormal is determined to be existing in S 120 -(S 120 : YES), the process proceeds to S 130 , and the DTC (object DTC) corresponding to the detected abnormality is searched for in the DTC table stored in the ROM  8 , which is mentioned later. The DTC table is a table memorizing all trouble codes, one or more of which might be memorized in the SRAM  12  and the EEPROM  14 , required for the vehicle on which the ECU  1  is assembled. The example of the DTC table is shown in the  FIG. 2  in an (a) portion In the example of  FIG. 2 , a DTC table storing four DTC&#39;s of 0x11, 0x12, 0x20, and 0x25 is shown. The DTC represents, by using lower two digits, a code (a numerical value) in the hexadecimal notation serving as a main part of the DTC. The upper two digits of the DTC serve as an indicator that the lower two digits are in the hexadecimal notation. 
         [0039]    After S 130 , S 140  follows in the processing, and whether the DTC (an object DTC) representing the currently detected abnormality is stored in the DTC table (for example, the (a) portion in  FIG. 2  is referred to) in the ROM  8 . 
         [0040]    When it is determined that the object DTC is not memorized in the DTC table in the ROM  8  in S 140  (S 140 : NO), it is determined that the DTC needs not be memorized about the currently detected abnormality or the DTC is assigned to the currently detected abnormality, and the processing concerned is simply finished. 
         [0041]    On the other hand, S 150  follows in the processing when it is determined that the object DTC is memorized in the DTC table in the ROM  8  in S 140  (S 140 : YES). In S 150 , the DTC memorized in the DTC table representing the abnormality currently detected is stored in the SRAM  12 . Then, the processing concerned is finished The sequence of processing is, for example, the abnormality detected by a sensor (S 120 : YES) is examined if the DTC corresponding to the abnormality of the sensor is stored in the DTC table, and if it is stored (S 140 : YES), the DTC of 0x11 in this case is stored in the SRAM  12  (S 150 ). 
         [0042]    In addition, in S 150 , the processing lets the SRAM  12  memorize DTC by a mirror method. More practically, the processing stores original data together with reverse data that is derived from the original data. If we take 0x11 as an example, 0x11 together with 0xEE are stored due to the method of data mirroring. That is, when 0x11 is “mirrored,” data having a value that adds up to the value FF is used as a mirrored data. In this case, the value EE added to 11 makes the value FF. In other words, the mirrored data 0xEE derived from 0x11 represents the “same” contents as the 0x11. Or, still in other words, 0x11 serves as a mirrored data for 0xEE. The reason why the data is mirrored is, for example, that the data reliability check is performed by mirror checking (That is, the reliability of the original data is checked by examining if the original data and the mirrored data add up to FF, with a recovery process by initializing the SRAM  12  if the sum of the original and mirrored data is not equal to FF.) in a case that the data in the SRAM  12  is, for some reason, rewritten or damaged. 
         [0043]      FIG. 3  is a flowchart representing a PDTC store processing that the CPU  4  carries out. It is a processing to let the EEPROM  14  memorize, as the PDTC, the DTC stored in the SRAM  12 . In addition, for example, the processing is carried out at least once in a trip period. Further, it may be carried out several times regularly in a trip period. 
         [0044]    At first, in the PDTC store processing, the processing concerned simply is finished when it is determined that the DTC is not memorized in the SRAM  12  in S 210  (S 210 : NO) after determining whether the DTC is memorized in the SRAM  12 . In addition, the DTC is memorized by a mirror method as mentioned above if the DTC is memorized in the SRAM  12  (cf. an (a) portion in  FIG. 3 ). 
         [0045]    On the other hand, when it is determined that DTC is memorized in the SRAM  12  in S 210  (S 210 : YES), S 220  follows in the processing, and the DTC memorized in the SRAM  12  is stored as PDTC in the EEPROM  14 . Among the storage areas in the EEPROM  14 , the same PDTC is stored in pre-assigned three areas in the case ( FIG. 3 , a (b) portion). Or, among the storage areas in the EEPROM  14 , pre-assigned two areas are used for storing the same PDTC ( FIG. 3 , a (c) portion). In the following description, the former one is designated as a double redundancy method, and the latter one is designated as triple redundancy method. 
         [0046]    As shown in the (b) portion of  FIG. 3 , the PDTC (for example, 0x11) is memorized in three places in the triple redundancy method, and the PDTC (for example, 0x11) is memorized in two places in the double redundancy method as shown in the (c) portion of  FIG. 3 . In addition, in either of the triple redundancy method or the double redundancy method, the CPU  4  writes and reads the PDTC area by area, and determines that the PDTC is normally written upon checking an agreement of the read data with the written data. Then, the processing in S 220  is finished when the CPU  4  determines that all areas have the normally written PDTC by going through each of the storage areas. 
         [0047]    And, after the processing in S 220 , the processing concerned is simply finished. 
         [0048]      FIGS. 4 to 12  are used for describing the checking process of the reliability of the PDTC memorized in the EEPROM  14 . Both of the double redundancy method and the triple redundancy method are described in terms of storing the PDTC in the EEPROM  14  in this case. 
         [0049]    First, the double redundancy method is described with reference to  FIGS. 4 to 8 . In this case, the assumption is that 0x11 is memorized in the EEPROM  14  in two places, and the DTC table has the same configuration same as  FIG. 2  in the (a) portion. 
         [0050]    In addition, the processing of  FIG. 4-FIG .  8  is carried out at least once in a trip period. Or, the processing is started by the timing when the request to send of the trouble code is received from the diagnosis device  3 . First, in S 310 , by the processing of  FIG. 4 , the PDTCs memorized in the EEPROM  14  in two places, respectively, are compared. 
         [0051]    When S 320  follows subsequently in the processing, upon determining that the PDTCs in two places are matching (S 320 : YES), it is determined that, based on a comparison result of S 310 , there is no abnormality (the PDTC is reliable), and the processing concerned is simply finished. 
         [0052]    On the other hand, in S 320 , when the PDTC memorized in two places is determined not to be matching (S 320 : NO), the process proceeds to S 330 , and the two types of PDTC stored in the two places are respectively compared with the DTC table of the ROM  8 . More practically, each of the two types of PDTC&#39;s is examined if any of the plural types of DTC in the DTC table is matching with them. 
         [0053]    Then, S 340  follows in the processing, and it is determined whether the PDTC&#39;s in the two places are included in the DTC table based on a comparison result of S 330 , and the process proceeds to the one shown in  FIG. 5  if it is determined that the DTC table includes both of the PDTC&#39;s. The process proceeds to the one shown in  FIG. 6  if it is determined that only one of the two PDTC&#39;s is in the DTC table. The process proceeds to the processing in  FIG. 7  if it is determined that none of the PDTC&#39;s is in the DTC table. 
         [0054]      FIG. 4  in the (a) portion illustrates a case that two PDTC&#39;s are not matching with each other and both PDTC&#39;s are in the DTC table.  FIG. 4  in the (b) portion illustrates a case that two PDTC&#39;s are not matching with each other and only one of the two PDTC&#39;s is in the DTC table.  FIG. 4  in the (c) portion illustrates a case that two PDTC&#39;s are not matching with each other and none of the two PDTC&#39;s is in the DTC table. 
         [0055]    The case that two PDTC&#39;s are not matching with each other and both PDTC&#39;s are in the DTC table is, as shown in  FIG. 4  in the (a) portion, further detailed as an upper example in the (a) portion that one of the two data entries (e.g., the second data) is accidentally turned to the DTC included in the DTC table and as a lower example in the (a) portion that both of the two data entries are accidentally turned to the DTC&#39;s in the DTC table. 
         [0056]    The case that two PDTC&#39;s are not matching with each other and only one of the two PDTC&#39;s is in the DTC table is further detailed as an upper example in the (b) portion of  FIG. 4  that one of the two PDTC&#39;s (e.g., the second data) is turned to data that is not included in the DTC table and as a lower example in the (b) portion that one of the two PDTC&#39;s respectively being turned (e.g., the second data) is accidentally matching with the DTC data in the DTC table. 
         [0057]    The case that two PDTC&#39;s are not matching with each other and none of the two PDTC&#39;s is in the DTC table is explained as a case in the (c) portion of  FIG. 4  that two PDTC&#39;s are being turned to two data entries that are not included in the DTC table. The processing of  FIG. 5  is explained next. 
         [0058]    The processing in  FIG. 5  is executed when, as mentioned before, it is determined that the two PDTC&#39;s are determined to be in two places in the EEPROM  14  in S 340  of the  FIG. 4 , and at first, the processing of  FIG. 5  determines whether abnormality exists in the SRAM  12  in S 410 . In this step, the abnormality of the SRAM  12  is determined as, for example, loss of the power supply from the vehicle battery by examining if the power supply from the battery is existing. Further, a special keyword is to be memorized in the SRAM  12 , and the abnormality of the SRAM  12  is determined based on whether the keyword is correct or not. More practically, if the keyword is not stored in the SRAM  12 , or if the keyword is turned to other word or is broken, it is determined that the SRAM  12  has abnormality. Further, the abnormality of the SRAM  12  may be determined by examining that the original data and the mirrored data are in normal conditions with reference to each of the plural DTC&#39;s in the DTC storage area, with an examination result that most of the DTC&#39;s has inconsistency between the original data and the mirrored data. 
         [0059]    When it is determined that abnormality exists in the SRAM  12  in S 410  (S 410 : NO), S 460  follows in the processing, and clearing (initialization) is performed on both of the DTC memorized in the SRAM  12  and the PDTC memorized in the EEPROM  14 . This is because it is not clear which one of the DTC in the SRAM  12  and the PDTC in the EEPROM  14  should be trusted. In addition, the abnormality of the EEPROM  14  is stored in the SRAM  12  or in the EEPROM  14 . Further, because it is possible that the SRAM  12  and the EEPROM  14  has abnormality, the abnormality of the EEPROM  14  may be stored in another memory which is not illustrated. 
         [0060]    On the other hand, when it is determined that abnormality does not exist in the SRAM  12  in S 410  (S 410 : YES), the process proceeds to S 420 , and the DTC in the SRAM  12  and the PDTC in the EEPROM  14  are compared. 
         [0061]    Then, S 430  follows in the processing, and it is determined whether there is any matching data between the DTC in the SRAM  12  and the PDTC in the EEPROM  14  as a result of comparison in S 420 . When it is determined that there are no matching data in S 430  (S 430 : NO), S 460  follows in the processing. This is because it is not clear which one of the DTC in the SRAM  12  and the PDTC in the EEPROM  14  should be trusted. 
         [0062]    On the other hand, when data are determined to be matching in S 430  (S 430 : YES), the process proceeds to S 440 , and PDTC matching with the DTC in the SRAM  12  is determined as the correct PDTC among the PDTC&#39;s in the EEPROM  14 . As having been mentioned above in  FIG. 2  and  FIG. 3 , because the CPU  4  stores the DTC in the SRAM  12 , and stores the DTC already stored in the SRAM  12  as the PDTC in the EEPROM  14 , the DTC stored in the SRAM  12  is an origin of the PDTC in the EEPROM  14 . Therefore, among the PDTC in the EEPROM  14 , the PDTC matching with the DTC in the SRAM  12  has a higher probability of being a correct data, that is, highly reliable data. 
         [0063]    Then, S 450  follows subsequently in the processing, and the storage area storing incorrect PDTC is overwritten by the correct PDTC determined in S 440 . That is, the storage area having the incorrect PDTC (designated as a “false information storage area” in the following description) undergoes the correct PDTC writing process. The rewrite processing is described in  FIG. 8 . Then, after the rewrite processing in S 450 , the processing in  FIG. 5  is finished. 
         [0064]    The rewrite processing is explained with reference to  FIG. 8 . It is determined, in the rewrite processing, whether all of the storage areas in the EEPROM  14  are not broken in S 710 . In this case, if one or more of the storage areas are broken, information of breakage is stored in a predetermined memory in S 780  to be mentioned later. When it is determined that all of the storage areas are broken in S 710  (S 710 : YES), it is determined that rewriting is not possible, and the processing concerned is simply finished. 
         [0065]    On the other hand, in S 710  if not all of the storage areas are broken, in other words, at least one storage area is not broken (S 710 : NO), the process proceeds to S 720 , and resetting of a write error counter (not shown) for counting the number of writing the correct PDTC in the storage areas (or the false information storage area) is performed and the counter value is set to zero. 
         [0066]    Then, S 730  follows subsequently in the processing, and the correct data (PDTC) is written in the false information storage area. Then, S 740  follows subsequently in the processing, and the PDTC written in the false information storage area in S 730  is retrieved. Then, S 750  follows in the processing, and it is determined whether the PDTC retrieved from the false information storage area in S 740  matches with the PDTC written in the false information storage area in S 730 , and it is determined that the correct PDTC is normally written in the false information storage area upon detecting that the both PDTC&#39;s are matching, and the processing concerned is simply finished. 
         [0067]    On the other hand, when it is determined that both PDTC&#39;s are not matching in S 750  (S 750 : NO), S 760  follows in the processing, and the error counter is incremented by 1 count. Then, S 770  follows subsequently in the processing, and whether the error counter value is greater than 2 is determined, and the process returns to S 730  after determining that the error counter value is not greater than 2 (S 770 : NO), and the rewrite processing is performed. 
         [0068]    On the other hand, when the error counter value is determined to be greater than 2 in S 770  (S 770 : YES), it is determined that rewrite processing cannot be normally performed, and the process proceeds to S 780 , and the trouble of the storage area that is an object of current rewrite processing is stored in a predetermined memory. 
         [0069]    Then, S 790  follows in the processing, and it is determined whether there is any other writable area in the EEPROM  14 , and writing data is given up if it is determined that there is not writable area (S 790 : NO), and the processing concerned is simply finished. 
         [0070]    On the other hand, when a writable area is determined to be existing in S 790  (S 790 : YES), the process proceeds to S 800 , and the storage area for storing the correct PDTC is changed to the writable area. Then, the process returns to S 710  again. 
         [0071]    Processing of  FIG. 6  is explained in the following. The processing of  FIG. 6  is a process that is carried out when it is determined that only one of two types of the PDTC is matching with one of the plural DTC types in the DTC table in S 340  of the  FIG. 4 , and the processing of  FIG. 6  first determines in S 510  that the PDTC included in the DTC table among two types of PDTC as the correct PDTC as mentioned before. Then, S 520  follows in the processing, and rewrite processing of  FIG. 8  which is mentioned above is carried out. Then, processing of  FIG. 6  concerned is finished. 
         [0072]    In addition, though it is considered as a very rare case, when only one of the two PDTC&#39;s is existing in the DTC table, both of the two PDTC&#39;s may be turned to incorrect PDTC&#39;s with one of the turned PDTC&#39;s matching with the DTC in the DTC table. Therefore, instead of the processing in S 550  of  FIG. 6 , the two PDTC&#39;s may be compared with the DTC in the SRAM  12 , and the PDTC matching with the DTC may be used as the correct PDTC. In this manner, data reliability is improved. 
         [0073]    Processing of  FIG. 7  is explained in the following. It is a processing that is carried out when it is determined that both of the two PDTC&#39;s are included in the DTC table in S 340  of the  FIG. 4 , and the processing of  FIG. 7  first determines whether there exists abnormality in the SRAM  12  in S 610  as mentioned before. The processing in S 610  is same as the processing in S 410 . Then, S 660  follows in the processing when it is determined that some kind of abnormality occurs in the SRAM  12  in S 610  (S 610 : NO). The processing of the S 660  is same as the processing in S 460 . 
         [0074]    On the other hand, when it is determined that abnormality does not occur in the SRAM  12  in S 610  (S 610 : YES), S 620  follows in the processing, and the DTC in the SRAM  12  and the DTC table in the ROM  8  are compared. This is because both of the two PDTC&#39;s in the EEPROM  14  are not reliable due to the lack of their existence in the DTC table, thereby employing the examination whether or not the DTC stored in the SRAM  12  that is an origin of the PDTC stored in the EEPROM  14  is reliable. 
         [0075]    Then, S 630  follows in the processing, and whether the DTC in the SRAM  12  has any matching data in the DTC table in the ROM  8  is determined based on a comparison result in S 620 . If there is no matching data (S 630 : NO), it is determined that the DTC in the SRAM  12  is not reliable, and the process proceeds to S 660 . 
         [0076]    On the other hand, when it is determined in S 630  that matching data is found (S 630 : YES), the process proceeds to S 640 , and the DTC in the SRAM  12  is used as the correct DTC. Then, S 650  follows subsequently in the processing, and the above-mentioned rewrite processing (cf.  FIG. 8 ) is carried out, and then the processing in  FIG. 7  is finished. 
         [0077]    The triple redundancy method is described with reference to  FIGS. 9 to 12  in the following. In this case, the assumption is that 0x11 is stored in three places in the EEPROM  14  and the DTC table has the same configuration as  FIG. 2  in the (a) portion. 
         [0078]    First, in the processing of  FIG. 9 , the PDTC memorized in three places in the EEPROM  14  is compared in S 810 . Then, S 820  follows subsequently in the processing, and it is determined whether all of the PDTC&#39;s in the three places match with each other based on a comparison result of S 810 . If all of them are determined to be matching (S 820 : YES), it is determined that there is no abnormality, and the processing concerned is simply finished. 
         [0079]    On the other hand, when it is determined that all of the PDTC&#39;s in three places do not match in S 820  (S 820 : NO), the process proceeds to S 830 , and each of the PDTC&#39;s stored in three places is respectively compared with the DTC table memorized in the ROM  8 . More practically, three PDTC&#39;s are respectively examined whether any of plural types of the DTC in the DTC table is matching with one of the PDTC&#39;s. Then, in S 840 , it is determined, based on the comparison result of S 830 , whether the PDTC&#39;s in the three places are included in the DTC table. If more than two types of the three PDTC&#39;s are determined to be in the DTC table, the process proceeds to processing of  FIG. 10 . In addition, the process proceeds to processing of  FIG. 11  when it is determined that there is only one kind among the three PDTC&#39;s in the DTC table. In addition, processing of  FIG. 12  follows in the processing when it is determined that there is no PDTC among three PDTC&#39;s in the DTC table. 
         [0080]    Further, a case showing that more than two kinds of PDTC&#39;s among three PDTC&#39;s are in the DTC table is illustrated in  FIG. 9  in an (a) portion, a case showing that only one kind of PDTC&#39;s among three PDTC&#39;s is in the DTC table is illustrated in  FIG. 9  in a (b) portion, and a case showing that no PDTC among three PDTC&#39;s is in the DTC table is illustrated in  FIG. 9  in a (c) portion. 
         [0081]    An example of showing that more than two kinds of PTDC&#39;s among the three PDTC&#39;s is in the DTC table is further detailed as an upper example of the (a) portion of  FIG. 9  that two out of three PDTC&#39;s (i.e., the second and third data) are turned to different data with one of the two turned data accidentally matching with the DTC in the DTC table, and as a lower example of the (a) portion that one of three PDTC&#39;s (i.e., the third data) is accidentally turned to the DTC in the DTC table. 
         [0082]    An example of showing that only one of three kinds of PTDC&#39;s is in the DTC table is further detailed as an upper example of the (b) portion of  FIG. 9  that two out of three PDTC&#39;s (i.e., the second and third data) are turned to different data that are not found in the DTC table, and as a lower example of the (b) portion that all of three PDTC&#39;s are turned to different data with one of the three turned data (i.e., the second data) accidentally matching with the DTC in the DTC table. 
         [0083]    An example of showing that none of three PTDC&#39;s is in the DTC table is illustrated as an example of the (c) portion of  FIG. 9  that three PDTC&#39;s are turned to data that are not in the DTC table. 
         [0084]    Processing of  FIG. 10  is explained in the following. 
         [0085]    The processing in  FIG. 10  is, as mentioned before, a processing that is executed when more than two kinds of PTDC&#39;s among the three PDTC&#39;s is determined to be in the DTC table in S 840  of  FIG. 9 . First, in S 910 , it is determined whether, among PDTC&#39;s memorized in the EEPROM  14 , matching PDTC is found in two places, and the matching PDTC&#39;s in two places are included in the DTC table of the ROM  8 . 
         [0086]    When it is determined, in S 910 , that the matching PDTC&#39;s in two places are not found, or that existing PDTC&#39;s matching in two places are not included in the DTC table of the ROM  8  (S 910 : NO), the process proceeds to S 920 . 
         [0087]    In S 920 , it is determined whether abnormality occurs in the SRAM  12 , and when it is determined that abnormality occurs (S 920 : NO), the process proceeds to S 970 . In S 970 , clearing (initialization) is performed on both of the DTC memorized in the SRAM  12  and the PDTC memorized in the EEPROM  14 , and information that the EEPROM  14  has abnormality is stored in either of the SRAM  12  or the EEPROM  14 . In addition, the abnormality information of the EEPROM  14  may be stored in another memory which is not illustrated. 
         [0088]    On the other hand, after determining that abnormality does not occur in the SRAM  12  in S 920  (S 920 : YES), the process proceeds to S 930 , and the DTC in the SRAM  12  and the PDTC in the EEPROM  14  are compared. 
         [0089]    Then, S 940  follows subsequently in the processing, and it is determined whether any one of the PDTC&#39;s in the EEPROM  14  is matching with the DTC in the SRAM  12 . If it is determined that no PDTC is matching with the DTC (S 940 : NO), the process proceeds to S 970 . The reason is because it is not clear that which one of the DTC in the SRAM  12  and the PDTC in the EEPROM  14  should be trusted. 
         [0090]    On the other hand, S 950  follows in the processing when at least one of the PDTC&#39;s in the EEPROM  14  is matching with the DTC in the SRAM  12  in S 940  (S 940 : YES). In addition, the process proceeds to S 950  when it is determined that, among the PDTC&#39;s stored in the EEPROM  14 , the PDTC&#39;s in two places are matching and the PDTC&#39;s matching in two places are included in the DTC table in the ROM  8  (S 910 : YES). 
         [0091]    In S 950  that follows S 910 , the PDTC which is included in the DTC table of the ROM  8  with a matching condition in two places is used as the correct PDTC. In addition, in S 950  which follows S 940 , the PDTC in the EEPROM  14  that matches with the DTC in the SRAM  12  is used as the correct PDTC. 
         [0092]    Then, S 960  follows subsequently in the processing, and rewrite processing (cf.  FIG. 8 ) that is mentioned above is carried out. Then, processing of  FIG. 10  is finished. Processing of  FIG. 11  is explained in the following. 
         [0093]    The processing in  FIG. 11  is, as mentioned before, a processing that is executed when only one kind among the three PDTC&#39;s is determined to be matching with one of plural DTC kinds in the DTC table in S 840  of  FIG. 9 . First, the processing uses one kind of PDTC in the DTC table among three PDTC&#39;s as the correct PDTC in S 1010 . 
         [0094]    The process proceeds to S 1020  after S 1010 , and rewrite processing (cf.  FIG. 8 ) that is mentioned above is carried out. Then, processing of  FIG. 11  is finished. In addition, though it is considered as a very rare case, when only one of the three PDTC&#39;s is existing in the DTC table, all of the three PDTC&#39;s may be turned to incorrect PDTC&#39;s with one of the turned PDTC&#39;s accidentally matching with the DTC in the DTC table. Therefore, instead of the processing in S 1010  of  FIG. 11 , the three PDTC&#39;s may be compared with the DTC in the SRAM  12 , and the PDTC matching with the DTC may be used as the correct PDTC. In this manner, data reliability is improved. 
         [0095]    Processing of  FIG. 12  is explained in the following. It is the processing that is carried out when it is determined that none of the three PDTC&#39;s exists in S 840  of the  FIG. 9  as mentioned before, and the processing of  FIG. 12  determines whether abnormality exists in the SRAM  12  in S 1110 . The processing of the S 1110  is same as the above-mentioned processing S 410  (or, as the processing S 610 ). When it is determined that some kind of abnormality occurs in the SRAM  12  in S 1110  (S 1110 : NO), the process proceeds to S 1160 , and clearing (initialization) of the DTC memorized in the SRAM  12  and the PDTC in the EEPROM  14  is performed, and information that the EEPROM  14  has abnormality is stored in the SRAM  12  or the EEPROM  14 . In addition, the information of the abnormality of the EEPROM  14  may be stored in another memory which is not illustrated. 
         [0096]    On the other hand, when it is determined that abnormality does not occur in the SRAM  12  in S 1110  (S 1110 : YES), S 1120  follows in the processing, and the DTC in the SRAM  12  and the DTC table in the ROM  8  are compared. This is because none of the three PDTC&#39;s is not reliable due to the lack of their existence in the DTC table, thereby employing the examination whether or not the DTC stored in the SRAM  12  that is an origin of the PDTC stored in the EEPROM  14  is reliable. 
         [0097]    Then, S 1130  follows in the processing, and whether there is any matching data is determined in S 1120  based on the comparison result between the DTC in the SRAM  12  and the DTC table of the ROM  8 . If it is determined that there is no matching data (S 1130 : NO), the process proceeds to S 1160  by determining that the DTC in the SRAM  12  is not reliable. 
         [0098]    On the other hand, if it is determined that there is matching data in S 1130  (S 1130 : YES), the process proceeds to S 1140 , and the DTC in the SRAM  12  is used as the correct DTC. Then, S 1150  follows subsequently in the processing, and the above-mentioned rewrite processing (cf.  FIG. 8 ) is carried out, and processing of the  FIG. 12  is finished. 
         [0099]    The reliability of data (a trouble code) of the EEPROM  14  is improved, as mentioned above in the present embodiment, by storing the trouble code indicating the trouble of the vehicle in the respectively different areas of the EEPROM  14  and by determining that the trouble code is correct based on the matching of all codes in the different areas. 
         [0100]    In addition, even when the trouble code stored in the EEPROM  14  is turned to a different code to break the consistency among the codes in the different areas, the correct trouble code is verified by comparing the trouble code table to be stored in the EEPROM  14  with the trouble code in the EEPROM  14  as long as the correct trouble code is maintained in the EEPROM  14 . The above reasoning is further verified based on an argument that the trouble code in the EEPROM  14  is determined to be false if the code is not included in the trouble code table. 
         [0101]    Further, even when the correct trouble code is not maintained in the EEPROM  14 , the reliability can be assured by comparing the trouble code in the SRAM  12  that is used as original data of the trouble code in the EEPROM  14  and the trouble code table and determining that matching code is the correct code. 
         [0102]    Furthermore, when the EEPROM  14  stores plural types of trouble codes that are included in the trouble code table, which one from among the trouble codes in the EEPROM  14  is the correct trouble code can be recognized by comparing the trouble code in the EEPROM  14  with the trouble code in the SRAM  12 . As mentioned before, because the same trouble code is stored in the SRAM  12  as the code stored in the EEPROM  14 , the trouble codes in the EEPROM  14  can be determined as correct when they match with the trouble code in the SRAM. 
         [0103]    Furthermore, because the trouble code table is memorized in the ROM  8 , it is prevented from being rewritten and safely used. In addition, in the present embodiment, processing of S 150  and S 220  is equivalent to a memory management unit, processing of S 310 , S 320 , S 810  and S 820  is equivalent to an error detection unit processing of S 420 -S 440 , S 510 , S 620 -S 640 , S 930 -S 950 , S 1010  and S 1120 -S 1140  is equivalent to an authentication unit, processing of  FIG. 8 , that is, processing of S 730 -S 750  in particular is equivalent to rewrite means in particular, and the CPU  4  is equivalent to both of a trip term operation control unit and a code request operation control unit. 
         [0104]    Although the present invention has been fully described in connection with the preferred embodiment thereof with reference to the accompanying drawings, it is to be noted that various changes and modifications will become apparent to those skilled in the art. 
         [0105]    For example, in the above embodiment, the storage of the fault code for representing the vehicle break-down is taken as an example. However, the storage of other kinds of information may be implemented in the same manner. 
         [0106]    In addition, though it may be a very rare case, there still is a chance that two DTC&#39;s in two different places are accidentally turned to the same PDTC&#39;s, thereby leading to a determination that the two PDTC&#39;s are matching with each other in S 320  of  FIG. 4 . Therefore, even when the PDTC&#39;s in two places are matching, the PDTC&#39;s in two places may respectively be compared with the DTC stored in the ROM  8  just like the process in S 330 . In other words, the PDTC&#39;s may be determined to be correct after confirming that both PDTC&#39;s are included in the DTC table. In this manner, the reliability of the data may further be improved. The above modification may also be applicable to the triple redundancy method. That is, even when all of the PDTC&#39;s in three places are determined to be matching in S 820  of  FIG. 9 , the PDTC&#39;s may be compared with the DTC table in the ROM  8  as in S 830 . In other words, the PDTC&#39;s may be determined to be having no abnormality (i.e., correct) after confirming that the PDTC&#39;s are included in the DTC table. 
         [0107]    In addition, the storage area for store rewriting PDTC data is switched with other storage area (S 800 ) when the storage area is determined to have some defects (S 770 : YES) and is not capable of storing the PDTC data in the process of  FIG. 8 . However, the process in  FIG. 8  may be finished without switching the storage area. 
         [0108]    In addition, though the mirrored DTC data is stored in the SRAM  12  in the above embodiment, the mirrored DTC data may not be stored. In this manner, the memory resource of the SRAM  12  is saved. Further, instead of storing the mirrored data, duplicated original data may be stored in the SRAM  12 . 
         [0109]    Such changes and modifications are to be understood as being within the scope of the present invention as defined by the appended claims.