# US 11,444,891 B2 · Electronic control unit, abnormality determination program, and abnormality determination method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,891 B2 - Document ID: US11444891B2 - Status: Granted - Kind: B2 - Application number: 16/940,490 - Filed: 2020-07-28 - Published: 2021-02-04 - Granted: 2022-09-13 - Earliest claimed: 2019-08-01 - Assignees: Denso Corporation - Applicants: Denso Corporation - Inventors: Takeshi Sugashima - Web page: https://patentgrep.com/patent/US11444891B2 ## CPC - H04L 49/9084: {Reactions to storage capacity overflow} - H04L 43/0847: {Transmission error} - H04L 43/16: Threshold monitoring - H04L 47/20: Traffic policing - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An electronic control unit includes a receiver that receives a data frame transmitted at given transmission periods from a transmission source electronic control unit connected via a communication network, a buffer capable of storing the data frame, a writer that writes the data frame received by the receiver into the buffer, and an abnormality determiner that determines that the data frame is abnormal when the number of data frames written into the buffer exceeds a given threshold or when the data frame is written in excess of a capacity of the buffer. ## Claims ### Claim 1 An electronic control unit comprising: a receiver that receives a plurality of data frames transmitted at given transmission periods from a transmission source electronic control unit connected via a communication network; a buffer that stores the plurality of data frames; a writer that writes the plurality of data frames received by the receiver into the buffer; a first abnormality determiner that determines that a particular data frame of the plurality of data frames received by the receiver is abnormal in response to determining that at least one of (i) the number of data frames written into the buffer exceeds a given threshold after writing the particular data frame into the buffer, or (ii) a capacity of the buffer would be exceeded by writing the particular data frame into the buffer; a reader that reads each of the plurality of data frames stored in the buffer at given reading periods and deletes each data frame from the buffer once each data frame is read by the reader; and a second abnormality determiner that performs an abnormality detection process to determine whether there is an abnormality in all data frames received by the receiver that are not already determined to be abnormal by the first abnormality determiner, wherein: the given threshold or the capacity is set based on a maximum number of data frames transmitted at the given transmission periods and received by the receiver during the reading period. ### Claim 2 (depends on 1) The electronic control unit according to claim 1, wherein: when the number of data frames written into the buffer exceeds the given threshold, the first abnormality determiner determines that all of the data frames stored in the buffer before being deleted by the reader are abnormal. ### Claim 3 (depends on 1) The electronic control unit according to claim 1, wherein: when the number of data frames written into the buffer exceeds the given threshold, the first abnormality determiner determines that only the particular data frame written into the buffer after the number of data frames exceeds the given threshold is abnormal. ### Claim 4 (depends on 1) The electronic control unit according to claim 1, wherein: the number of data frames storable in the buffer is equal to the given threshold. ### Claim 5 (depends on 1) The electronic control unit according to claim 1, wherein: the given threshold is zero. ### Claim 6 (depends on 1) The electronic control unit according to claim 1, further comprising: a third abnormality determiner, wherein: when the data frames stored in the buffer are not determined to be abnormal by the first abnormality determiner and a total of the number of data frames read by reader within a given time span that is longer than the reading period exceeds a total threshold, the third abnormality determiner determines that the data frames stored in the buffer are abnormal; and the second abnormality determiner performs the abnormality detection process on each data frame stored in the buffer that is not determined to be abnormal by the third abnormality determiner. ### Claim 7 (depends on 1) The electronic control unit according to claim 1, wherein: the reading period is less than or equal to one half of the transmission period, the electronic control unit further comprising: a third abnormality determiner, wherein: when the data frames stored in the buffer are not determined to be abnormal by the first abnormality determiner and are read by the reader in a row, the third abnormality determiner determines that the data frames are abnormal; and the second abnormality determiner performs the abnormality detection process on each data frame stored in the buffer that is not determined to be abnormal by the third abnormality determiner. ### Claim 8 (depends on 1) The electronic control unit according to claim 1, wherein: the plurality of data frames includes at least one first data frame transmitted at first transmission periods; the receiver receives, in addition to the at least one first data frame, at least one second data frame transmitted at second transmission periods; the buffer stores the at least one first data frame and the at least one second data frame; and the first abnormality determiner determines whether the at least one second data frame is abnormal, in addition to determining whether the at least one first data frame is abnormal, the electronic control unit further comprising a third abnormality determiner, wherein: when the at least one first data frame and the at least one second data frame are not determined to be abnormal by the first abnormality determiner, a total of the number of the at least one first data frame stored in the buffer and the number of at least one second data frame stored in the buffer exceeds a given total threshold, the third abnormality determiner determines that the at least one first data frame and the at least one second data frame are both abnormal; and the second abnormality determiner performs the abnormality detection process on any data frame of the at least one first data frame and the at least one second data frame not determined to be abnormal by the third abnormality determiner. ### Claim 9 (depends on 1) The electronic control unit according to claim 1, further comprising a flag generator that generates a flag when the number of data frames stored in the buffer exceeds the given threshold, wherein: when the flag is generated, the first abnormality determiner determines that the particular data frame is abnormal. ### Claim 10 (depends on 1) The electronic control unit according to claim 1, wherein the transmission source electronic control unit is one of a plurality of transmission source electronic control units connected via the communication network, each of the transmission source electronic control units of the plurality of transmission source electronic control units transmits data frames of the plurality of data frames at respective given transmission periods, the buffer stores the data frames of the plurality of data frames transmitted by each of the transmission source electronic control units, and the reading period and the given threshold or the capacity are set for each of the transmission source electronic control units. ### Claim 11 (depends on 1) The electronic control unit according to claim 1, wherein the first abnormality determiner determines, at every time point where the reader reads the data frame stored in the buffer, whether the number of data frames written into the buffer exceeds the given threshold or whether the capacity of the buffer would be exceeded, and the first abnormality determiner records a log indicating reception of an abnormal data frame in response to determining that the particular data frame is abnormal. ### Claim 12 (depends on 1) The electronic control unit according to claim 1, wherein the second abnormality determiner performs the abnormality detection process only in response to the first abnormality determiner determining that the particular data frame is not abnormal. ### Claim 13 A non-transitory storage medium storing an abnormality determination program executed in an electronic control unit connected to a transmission source electronic control unit via a communication network, the program causing the electronic control unit to perform: receive a plurality of data frames transmitted at given transmission periods from the transmission source electronic control unit; writing the received plurality of data frames into a buffer; determining, by a first abnormality determination, that a particular data frame of the plurality of data frames received is abnormal in response to determining that at least one of (i) the number of data frames written into the buffer exceeds a given threshold after writing the particular data frame into the buffer, or (ii) a capacity of the buffer would be exceeded by writing the particular data frame into the buffer; reading each of the plurality of data frames stored in the buffer at given reading periods; deleting each data frame from the buffer once each data frame is read; and performing, by a second abnormality determination, an abnormality detection process to determine whether there is an abnormality in all data frames received that are not already determined to be abnormal by the first abnormality determination, wherein: the given threshold or the capacity is set based on a maximum number of data frames transmitted at the given transmission periods and received during the reading period. ### Claim 14 An abnormality determination method executed in an electronic control unit connected to a transmission source electronic control unit via a communication network, the method comprising: receiving a plurality of data frames transmitted at given transmission periods from the transmission source electronic control unit; writing the received plurality of data frames into a buffer; determining, by a first abnormality determination, that a particular data frame of the plurality of data frames received is abnormal in response to determining that at least one of (i) the number of data frames written into the buffer exceeds a given threshold after writing the particular data frame into the buffer, or (ii) a capacity of the buffer would be exceeded by writing the particular data frame into the buffer; reading each of the plurality of data frames stored in the buffer at given reading periods; deleting each data frame from the buffer once each data frame is read; and performing, by a second abnormality determination, an abnormality detection process to determine whether there is an abnormality in all data frames received that are not already determined to be abnormal by the first abnormality determination, wherein: the given threshold or the capacity is set based on a maximum number of data frames transmitted at the given transmission periods and received during the reading period. ### Claim 15 An electronic control unit comprising: a receiver that receives a plurality of data frames transmitted at given transmission periods from a transmission source electronic control unit connected via a communication network; a buffer that stores the plurality of data frames; a writer that writes the plurality of data frames received by the receiver into the buffer; a reader that reads each of the plurality of data frames stored in the buffer at given reading periods and deletes each data frame from the buffer once each data frame is ready by the reader; and an abnormality determiner that determines that a particular data frame of the plurality of data frames received by the receiver is abnormal in response to determining that at least one of (i) the number of data frames written into the buffer and not yet deleted from the buffer exceeds a given threshold after writing the particular data frame into the buffer, or (ii) a capacity of the buffer would be exceeded by writing the particular data frame into the buffer.