Electronic control device, determination method, determination program product, transmission method, and transmission program product

Abstract

The invention relates to an electronic control device, a determination method, a determination program product, a transmission method, and a transmission program product. The electronic control device functions as a second device in an in-vehicle network system. A vehicle-mounted network system is provided with a first device, a second device, and a third device as electronic control devices having a network management function. The first device sends a periodic message. The second device performs a failure determination based on receipt of a periodic message from the first device. The third device has a local network function. An in-vehicle network system is provided with a first communication bus connected to a first device, a second communication bus connected to a second device and a third device, and a relay device for relaying messages exchanged between a plurality of communication buses. The second device stops the failure determination when the NM message as the operation notification is no longer transmitted.

Description

Technical Field

[0001] This disclosure relates to electronic control devices, determination methods, determination program products, transmission methods, and transmission program products. Background Technology

[0002] Japanese Patent Application Publication No. 2024-22118 discloses an in-vehicle network system. This in-vehicle network system comprises multiple electronic control units (ECUs). Hereinafter, the electronic control units will be referred to as ECUs.

[0003] In the aforementioned patent documents, as ECUs, it is disclosed that an ECU of the receiving party acknowledges a message when it receives a message from another ECU, and an ECU of the receiving party does not acknowledge a message.

[0004] In vehicle network systems, there exists a mix of ECUs that acknowledge a message received from another ECU and ECUs that do not acknowledge the message.

[0005] An ECU has an operating state where it can communicate with other ECUs, and a standby state where communication is stopped to reduce power consumption. The ECU has a network management function that switches from standby to operating state when requested to operate by a communication partner via a message. Hereinafter, the network management function will be referred to as the NM function. Furthermore, among ECUs with the NM function, there are ECUs with local network functionality and ECUs without local network functionality. Hereinafter, the local network functionality will be referred to as the PN function.

[0006] An ECU with PN functionality sends a PN message containing information indicating the recipient to a communication target. PN messages are also sent to activate other ECUs with PN functionality. Upon receiving a PN message, an ECU with PN functionality acknowledges the recipient of that message. Furthermore, an ECU with PN functionality only activates if the message identifies itself as the recipient.

[0007] An ECU without PN functionality sends an NM message to a communication target. An NM message is sent to activate other ECUs without PN functionality. For an ECU without PN functionality, regardless of whether the received message is an NM or PN message, it does not confirm that the recipient has entered an operational state.

[0008] In vehicle network systems, sometimes an ECU with PN (Network Controller) functionality and an ECU without PN functionality are connected to a single communication bus. An ECU without PN functionality connected to such a communication bus will become operational even if it doesn't receive an NM (Noise, Mean, Message) message, due to the receipt of a PN message. In this case, there are situations where an ECU without PN functionality connected to other communication buses may remain in standby mode because it hasn't received an NM message.

[0009] Thus, for ECUs without PN functionality, there's a possibility that even if other ECUs without PN functionality are in standby mode, they might still be considered operational. ECUs with NM functionality have the ability to determine if the monitored ECU has malfunctioned when the periodic reception of messages from the monitored ECU is interrupted. Therefore, in such a situation where only a portion of ECUs are operational, the ECUs without PN functionality that are operational might mistakenly determine that the monitored ECU in standby mode has malfunctioned. Summary of the Invention

[0010] According to one aspect of this disclosure, an electronic control device is provided, which is included in an in-vehicle network system and has network management functions. The network management functions include: (i) periodically sending, electronically, a message requesting operation, i.e., an operation notification, to the communication object during periods when communication with the communication object is required; (ii) upon receiving the operation notification electronically from the communication object, switching from a standby state (no communication) to a communicable operation state; and (iii) continuing the operation state during periods of periodically receiving the operation notification electronically. The in-vehicle network system includes: a first device having the network management functions and configured to send periodically sent messages, i.e., periodic messages; and a second device having the network management functions and configured to execute... A fault determination is made based on the interruption of receiving the periodic message from the first device, indicating that the first device has malfunctioned; a third device has the network management function and a local network function that does not switch from the standby state to the operating state when the operating notification is received if the operating notification does not identify the third device as the recipient; a first communication bus is connected to the first device; a second communication bus is connected to the second device and the third device; and a relay device is connected to the first communication bus and the second communication bus and is configured to electronically relay messages exchanged between multiple communication buses, wherein the electronic control device is the second device and is configured to stop the fault determination based on the cessation of sending the operating notification.

[0011] According to one aspect of this disclosure, an electronic control device is provided, which is included in an in-vehicle network system and has a network management function. The network management function includes: upon receiving an electronic message requesting operation, i.e., an operation notification, switching from a standby state (no communication) to a communication-enabled operation state. The in-vehicle network system comprises: a first device having the network management function and configured to send periodically sent messages, i.e., periodic messages; a second device having the network management function and configured to perform a fault determination based on an interruption in the reception of the periodic messages from the first device, indicating a malfunction in the first device; and a third device having the network management function and, upon receiving the operation notification, when the operation notification does not... The local network function that does not switch from the standby state to the operating state when the third device is the receiver; a first network configured to relay the periodic messages and having a first communication bus connected to the first device and a second communication bus connected to the second and third devices; a relay device connected to the first and second communication buses and configured to electronically relay messages exchanged between multiple communication buses; and a second network, different from the first network, connecting the first device and the second device, wherein the electronic control device is the second device, configured to stop the fault determination based on sensing that the first device has switched to the standby state through communication with the first device via the second network.

[0012] According to one aspect of this disclosure, an electronic control device is provided, which is included in an in-vehicle network system and has network management functions. The network management functions include: (i) periodically sending, electronically, a message requesting operation, i.e., an operation notification, to the communication object during periods when communication with the communication object is required; (ii) upon receiving the operation notification electronically from the communication object, switching from a standby state (no communication) to a communicable operation state; and (iii) continuing the operation state during periods of periodically receiving the operation notification electronically. The in-vehicle network system includes: a first device having the network management functions and configured to send periodically sent messages, i.e., periodic messages; and a second device having the network management functions and configured to execute the periodic messages received from the first device. The fault determination is based on the interruption of message reception, indicating that the first device has malfunctioned; the third device has the network management function and a local network function that does not switch from the standby state to the operating state when the operation notification is received and the operation notification does not designate the third device as the recipient; a first communication bus is connected to the first device; a second communication bus is connected to the second device and the third device; and a relay device is connected to the first communication bus and the second communication bus and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is different from the first device and the second device and is configured to replace the first device in sending the periodic message to the second device when the first device has switched to the standby state.

[0013] According to one aspect of this disclosure, a determination method is provided, which is executed by an electronic control device included in an in-vehicle network system and having network management functions. The network management functions include: (i) periodically sending, electronically, a message requesting operation, i.e., an operation notification, to the communication object during periods when communication with the communication object is required; (ii) upon receiving the operation notification electronically from the communication object, switching from a standby state (no communication) to a communicable operation state; and (iii) continuing the operation state during periods of periodically receiving the operation notification electronically. The in-vehicle network system includes: a first device having the network management functions and configured to send periodically sent messages, i.e., periodic messages; and a second device having the network management functions and configured to execute the periodic message based on the message received from the first device. The fault determination method includes determining that the first device has malfunctioned due to the interruption of message reception; a third device having the network management function and a local network function that does not switch from the standby state to the operating state when the operating notification is received and the operating notification does not designate the third device as the recipient; a first communication bus connected to the first device; a second communication bus connected to the second device and the third device; and a relay device connected to the first communication bus and the second communication bus and configured to electronically relay messages exchanged between multiple communication buses, wherein the electronic control device is the second device, and the determination method includes stopping the fault determination performed by the second device based on the fact that the second device has stopped sending the operating notification.

[0014] According to one aspect of this disclosure, a determination procedure product is provided, which is executed by an electronic control device included in an in-vehicle network system and having network management functions. The network management functions include: (i) periodically sending, electronically, a message requesting operation, i.e., an operation notification, to the communication object during periods when communication with the communication object is required; (ii) upon receiving the operation notification electronically from the communication object, switching from a standby state (no communication) to a communicable operation state; and (iii) continuing the operation state during periods of periodically receiving the operation notification electronically. The in-vehicle network system includes: a first device having the network management functions and configured to send periodically sent messages, i.e., periodic messages; and a second device having the network management functions and configured to execute the periodic messages received from the first device. The fault determination is based on the interruption of message reception, which determines that the first device has malfunctioned; a third device has the network management function and a local network function that does not switch from the standby state to the operating state when the operating notification is received and the operating notification does not designate the third device as the recipient; a first communication bus connected to the first device; a second communication bus connected to the second device and the third device; and a relay device connected to the first communication bus and the second communication bus and configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is the second device. When the determination program is executed by the processing circuit of the second device, the processing circuit performs the process of stopping the fault determination based on the situation that the second device has stopped sending the operating notification.

[0015] According to one aspect of this disclosure, a determination method is provided, which is executed by an electronic control device included in an in-vehicle network system and having a network management function. The network management function includes, upon receiving an electronic message requesting operation, i.e., an operation notification, switching from a standby state (no communication) to a communicable operation state. The in-vehicle network system comprises: a first device having the network management function and configured to send periodically transmitted messages, i.e., periodic messages; a second device having the network management function and configured to perform a fault determination based on an interruption in the reception of the periodic messages from the first device, indicating that the first device has malfunctioned; and a third device having the network management function and, when receiving the operation notification, if the operation notification does not designate the third device as a recipient... The local network function does not switch from the standby state to the operating state; a first network configured to relay the periodic messages and having a first communication bus connected to the first device and a second communication bus connected to the second device and the third device; a relay device connected to the first communication bus and the second communication bus and configured to electronically relay messages exchanged between multiple communication buses; and a second network, different from the first network, connecting the first device and the second device, wherein the electronic control device is the second device, and the determination method includes sensing that the first device has switched to the standby state based on the second device's communication with the first device through the second network, and the processing circuit of the second device stopping the fault determination process performed by the second device.

[0016] According to one aspect of this disclosure, a determination procedure product is provided, which is executed by an electronic control device included in an in-vehicle network system and having network management functions. The network management functions include a process of switching from a standby state (no communication) to a communicable operating state when an operation request message (i.e., an operation notification) is received electronically. The in-vehicle network system comprises: a first device having the network management functions and configured to send periodically transmitted messages (i.e., periodic messages); a second device having the network management functions and configured to perform a fault determination based on an interruption in the reception of the periodic messages from the first device, indicating that the first device has malfunctioned; and a third device having the network management functions and, when receiving the operation notification, if the operation notification does not identify the third device as a recipient... The following are the functions of a local network that does not switch from the standby state to the operating state under certain circumstances: a first network configured to relay the periodic messages and having a first communication bus connected to the first device and a second communication bus connected to the second and third devices; a relay device connected to the first and second communication buses and configured to electronically relay messages exchanged between multiple communication buses; and a second network, different from the first network, connecting the first and second devices, wherein the electronic control device is the second device, and the determination program product, when executed by the processing circuit of the second device, causes the processing circuit to execute the fault determination to stop based on the second device sensing that the first device has switched to the standby state through communication with the first device via the second network.

[0017] According to one aspect of this disclosure, a transmission method is provided, which is executed by an electronic control device included in an in-vehicle network system and having network management functions. The network management functions include: (i) periodically sending, electronically, a message requesting operation, i.e., an operation notification, to the communication object during periods when communication with the communication object is required; (ii) upon receiving the operation notification electronically from the communication object, switching from a standby state (no communication) to a communicable operation state; and (iii) continuing the operation state during periods of periodically receiving the operation notification electronically. The in-vehicle network system includes: a first device having the network management functions and configured to transmit periodically transmitted messages, i.e., periodic messages; and a second device having the network management functions and configured to handle situations where reception of the periodic messages from the first device is interrupted. The system includes: a fault determination indicating that the first device has malfunctioned; a third device having the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient; a first communication bus connected to the first device; a second communication bus connected to the second device and the third device; and a relay device connected to the first and second communication buses and configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is different from the first and second devices. The transmission method includes: processing by which the processing circuit of the electronic control device causes the electronic control device to replace the first device and send the periodic message to the second device when the first device switches to the standby state.

[0018] According to one aspect of this disclosure, a transmitting program product is provided, which is executed by an electronic control device included in an in-vehicle network system and having network management functions. The network management functions include: (i) periodically sending, electronically, a message requesting operation, i.e., an operation notification, to the communication object during periods when communication with the communication object is required; (ii) upon receiving the operation notification electronically from the communication object, switching from a standby state (no communication) to a communicable operating state; and (iii) continuing the operating state during periods of periodically receiving the operation notification electronically. The in-vehicle network system includes: a first device having the network management functions and configured to transmit periodically transmitted messages, i.e., periodic messages; and a second device having the network management functions and configured to perform a judgment based on an interruption in the reception of the periodic messages from the first device. The system includes: a fault determination indicating that the first device has malfunctioned; a third device having the aforementioned network management function and a local network function that, when receiving the aforementioned operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient; a first communication bus connected to the first device; a second communication bus connected to the second device and the third device; and a relay device connected to the first and second communication buses and configured to electronically relay messages exchanged between multiple communication buses. The electronic control device differs from the first and second devices. When the transmission program product is executed by the processing circuit of the electronic control device, the processing circuit performs the process of replacing the first device to send the periodic message to the second device based on the situation where the first device switches to the standby state. Attached Figure Description

[0019] Figure 1 This is a schematic diagram showing the configuration of the vehicle network system according to the first embodiment.

[0020] Figure 2 This is a schematic diagram showing the way in which the electronic control device in the first communication bus of the vehicle network system in the first embodiment switches to a standby state.

[0021] Figure 3 This is a schematic diagram showing the configuration of the second device according to the first embodiment.

[0022] Figure 4 This is a timing diagram illustrating the communication method in the vehicle network system of the first embodiment.

[0023] Figure 5 This is a schematic diagram illustrating the configuration of the vehicle network system according to the second embodiment.

[0024] Figure 6 This is a schematic diagram showing the configuration of the second device according to the second embodiment.

[0025] Figure 7 This is a timing diagram illustrating the communication method in the vehicle network system of the second embodiment.

[0026] Figure 8 This is a schematic diagram showing the configuration of the relay device in the third embodiment.

[0027] Figure 9 This is a timing diagram illustrating the communication method in the vehicle network system of the third embodiment.

[0028] Figure 10 It means Figure 7 The timing diagram shows a change example of the communication method shown. Detailed Implementation

[0029] (First Implementation)

[0030] The following is for reference Figures 1-4 The vehicle network system of the first embodiment will be described.

[0031] <Composition of the In-Vehicle Network System 100>

[0032] like Figure 1 As shown, the vehicle network system 100 consists of multiple electronic control units (ECUs). Hereinafter, the electronic control unit will be referred to as an ECU. The ECUs in the vehicle network system 100 are divided into ECUs with network management functions and relay devices 10. Hereinafter, the network management function will be referred to as the NM function. Figure 1 In the diagram, each ECU is represented by a quadrilateral.

[0033] When an ECU with NM (Network Management) function receives an operation notification, it transitions from a standby state (where no communication is possible) to a communicative operation state. The operation notification is a message requesting the ECU to operate. ECUs with NM function can be either those with local network functionality or those without. Hereinafter, the local network functionality will be referred to as the PN (Network Function).

[0034] In the vehicle network system 100, the ECUs with PN function are the first PN device 31, the second PN device 32, and the third PN device 33.

[0035] In the vehicle network system 100, the ECUs that do not have PN function are the first NM device 21, the second NM device 22, the third NM device 23, the fourth NM device 24, the fifth NM device 25, and the sixth NM device 26.

[0036] like Figure 1 As shown, the vehicle network system 100 includes a first communication bus 41, a second communication bus 42, and a third communication bus 43. The first communication bus 41 is connected to the first NM device 21, the second NM device 22, and the third NM device 23. The second communication bus 42 is connected to the fourth NM device 24, the fifth NM device 25, and the first PN device 31. The third communication bus 43 is connected to the second PN device 32, the third PN device 33, and the sixth NM device 26.

[0037] The ECUs in the vehicle network system 100 are connected to enable communication involving the transmission and reception of messages via a communication bus. In the vehicle network system 100, the first NM device 21, the second NM device 22, and the third NM device 23 transmit and receive messages via the first communication bus 41. In the vehicle network system 100, the fourth NM device 24, the fifth NM device 25, and the first PN device 31 transmit and receive messages via the second communication bus 42. In the vehicle network system 100, the second PN device 32, the third PN device 33, and the sixth NM device 26 transmit and receive messages via the third communication bus 43.

[0038] In the vehicle network system 100, the relay device 10 is connected to the first communication bus 41, the second communication bus 42, and the third communication bus 43. The relay device 10 relays messages exchanged between the first communication bus 41, the second communication bus 42, and the third communication bus 43. For example, the relay device 10 receives a message sent by the first NM device 21 via the first communication bus 41. Then, the relay device 10 sends the message received from the first NM device 21 to the ECUs connected to the second communication bus 42 and the third communication bus 43.

[0039] The ECUs in the vehicle network system 100 communicate with other ECUs while performing specific functions in the vehicle. The combination of ECUs performing these specific functions in the vehicle network system 100 varies depending on the function to be performed. Furthermore, in the vehicle network system 100, ECUs with PN (Power Node) functionality communicate with other ECUs with PN functionality to perform specific functions. Conversely, in the vehicle network system 100, ECUs without PN functionality communicate with other ECUs without PN functionality to perform specific functions.

[0040] When performing a specific function, each ECU in the vehicle network system 100 sends an operation notification to other ECUs that need to operate in order to achieve that function. In other words, when each ECU in the vehicle network system 100 needs to communicate with other ECUs, it sends an operation notification to those other ECUs.

[0041] like Figure 1As shown, an ECU with PN functionality sends PN message 51 as an operation notification. An ECU with PN functionality sends PN message 51 to request other ECUs with the same PN functionality to operate. In this case, the ECU with PN functionality attaches the identification information of the receiving ECU requesting operation when sending PN message 51.

[0042] On the other hand, such as Figure 1 As shown, an ECU without PN function sends NM message 50 as an operation notification. An ECU without PN function sends NM message 50 to request other ECUs that also lack PN function to operate. In this case, unlike ECUs with PN function, the ECU without PN function sends NM message 50 without attaching identification information of the receiving ECU requesting operation.

[0043] The ECU with PN function in the ECU that receives the operation notification acknowledges the recipient of the operation notification. Then, if the operation notification is a PN message 51 in which its own identification information is attached as the recipient's, the ECU with PN function switches from standby state to operation state. On the other hand, if the operation notification is an NM message 50 and its own identification information is not attached as the recipient's PN message 51, the ECU with PN function does not switch to operation state.

[0044] An ECU without PN function that receives an operation notification does not acknowledge receipt of the notification and will switch from standby to operation. That is, when an ECU without PN function receives an operation notification, regardless of whether the notification is NM message 50 or PN message 51, it will switch from standby to operation.

[0045] Thus, when an ECU with PN function sends PN message 51, the ECUs without PN function that receive the message and the ECUs with PN function that are the recipients of PN message 51 switch to the operating state. On the other hand, when an ECU without PN function sends NM message 50, only the ECUs without PN function that receive the message switch to the operating state.

[0046] As described above, the relay device 10 relays messages exchanged between multiple communication buses. The relay device 10 transmits the PN message 51 sent by an ECU with PN functionality to the communication bus connected to other ECUs with PN functionality. For example, if the first PN device 31 sends the PN message 51, the relay device 10 transmits the PN message 51 to the communication bus connected to the second PN device 32 and the third PN device 33, i.e., the third communication bus 43.

[0047] Additionally, the relay device 10 transmits the NM message 50 sent by the ECU that does not have PN function to the communication bus connected to other ECUs that do not have PN function. For example, if the first NM device 21 sends the NM message 50, the relay device 10 transmits the NM message 50 to the second communication bus 42 connected to the fourth NM device 24 and the fifth NM device 25, and to the third communication bus 43 connected to the sixth NM device 26.

[0048] The relay device 10 also sends NM message 50 and PN message 51. While receiving PN message 51 from other ECUs, the relay device 10 relays the PN message 51 and also sends PN message 51 itself to the communication bus connected to the ECU with PN function. Therefore, as... Figure 1 As shown, while receiving PN message 51 from other ECUs, relay device 10 sends PN message 51 to the second communication bus 42 and the third communication bus 43.

[0049] While receiving NM messages 50 from other ECUs, relay device 10 relays the NM messages 50 and also sends NM messages 50 itself to the communication bus connected to ECUs that do not have PN functionality. Therefore, as... Figure 1 As shown, while receiving NM messages 50 from other ECUs, the relay device 10 sends NM messages 50 to the first communication bus 41, the second communication bus 42, and the third communication bus 43.

[0050] like Figure 1 As shown, in addition to PN message 51 and NM message 50, each ECU in the vehicle network system 100 also sends control messages 52. Control messages 52 are messages sent by each ECU to exchange information needed to achieve specific functions. For example, each ECU sends information such as the engine speed in the vehicle to other ECUs as a control message 52. Control messages 52 refer to all messages sent by each ECU in the vehicle network system 100 except for operation notifications.

[0051] In the vehicle network system 100, the second NM device 22 and the third NM device 23 send periodic messages. These periodic messages are control messages 52 that are periodically sent by the second NM device 22 and the third NM device 23. The second NM device 22 and the third NM device 23 also send driving speed information as periodic messages. This driving speed information indicates the driving speed of the vehicle equipped with the vehicle network system 100.

[0052] In the vehicle network system 100, the fifth NM device 25 receives periodic messages. When the reception of periodic messages from the second NM device 22 is interrupted, the fifth NM device 25 determines that the second NM device 22 has malfunctioned. Similarly, when the reception of periodic messages from the third NM device 23 is interrupted, the fifth NM device 25 determines that the third NM device 23 has malfunctioned. Thus, the fifth NM device 25 independently determines faults for both the second NM device 22 and the third NM device 23.

[0053] Hereinafter, in the vehicle network system 100, the second NM device 22 will be referred to as the first device 61. Furthermore, in the vehicle network system 100, the third NM device 23 will be referred to as the fourth device 64. The first device 61 and the fourth device 64 send periodic messages.

[0054] Hereinafter, in the vehicle network system 100, the ECU that performs fault determination will be referred to as the second device 62. In the vehicle network system 100, the fifth NM device 25 is the second device 62.

[0055] Hereinafter, in the vehicle network system 100, the ECU with PN function connected to the same communication bus as the second device 62 is referred to as the third device 63. In the vehicle network system 100, the first PN device 31 is the third device 63.

[0056] <Methods for putting the ECU into standby mode in the vehicle network system 100>

[0057] As described above, each ECU sends an operation notification to other ECUs that need to operate to achieve that function when performing a specific function. Each ECU periodically sends operation notifications until the specific function is completed. Then, the ECU that has completed the specific function stops sending operation notifications.

[0058] Figure 2 It indicates that in Figure 1 This describes the method used in the vehicle network system 100 shown, where an ECU without PN function performs a specific function. That is, in... Figure 2 In this process, all ECUs that do not have PN functionality stop sending NM message 50.

[0059] As described above, the relay device 10 also sends NM messages 50 and PN messages 51. While receiving NM messages 50 from other ECUs, the relay device 10 also periodically sends NM messages 50 to the communication bus connected to ECUs that do not have PN functionality. Additionally, while receiving PN messages 51 from other ECUs, the relay device 10 also periodically sends PN messages 51 to the communication bus connected to ECUs that have PN functionality.

[0060] If all ECUs without PN function stop sending NM message 50, the relay device 10 will no longer receive NM message 50 from other ECUs. The relay device 10, which no longer receives NM message 50, will also stop sending NM message 50 itself.

[0061] Each time an ECU that has been switched to the operating state receives an operating notification, it will maintain the operating state for a certain period of time. Moreover, when it no longer receives operating notifications from other ECUs, it will switch from the operating state to the standby state. That is, when the ECUs of the vehicle network system 100 have not received operating notifications from other ECUs for a certain period of time, they will switch from the operating state to the standby state.

[0062] exist Figure 2 In the example shown, because all ECUs without PN functionality and relay device 10 stop sending NM messages 50, the ECUs connected to the first communication bus 41 no longer receive NM messages 50. Furthermore, as described above, relay device 10 does not relay PN messages 51 to the ECUs connected to the first communication bus 41. Thus, in Figure 2 In the example shown, the ECU connected to the first communication bus 41 no longer receives operation notifications. Therefore, in Figure 2 The ECU, enclosed by a quadrilateral, switches from operating to standby mode. Thus, in Figure 2 In the example shown, the first device 61 and the fourth device 64 are switched to standby mode.

[0063] On the other hand, Figure 2 In the example shown, similar to the ECU connected to the first communication bus 41, the ECU connected to the second communication bus 42 no longer receives the NM message 50. However, as Figure 2 As shown, a first PN device 31, which functions as an ECU, is connected to the second communication bus 42. Therefore, a PN message 51 is sent to the ECU connected to the second communication bus 42. Thus, in... Figure 2 In the example shown, the ECU connected to the second communication bus 42 continues to receive operation notifications even when NM messages 50 are no longer being sent. Therefore, in Figure 2 In the example shown, the fourth NM device 24 and the fifth NM device 25, which are ECUs without PN function, continue to operate even when NM messages 50 are no longer sent. Thus, in Figure 2 In the example shown, the second device 62, which is connected to the second communication bus 42, maintains its operating state even when it is no longer receiving NM messages 50 because the third device 63 is connected to the communication bus it is connected to.

[0064] exist Figure 2In this scenario, the first device 61 and the fourth device 64 switch to standby mode, while the second device 62 remains operational. In this case, the first device 61 and the fourth device 64, which are already in standby mode, stop sending periodic messages. At this point, the second device 62, no longer receiving periodic messages, mistakenly determines that the first device 61 and the fourth device 64 have malfunctioned.

[0065] <Composition of the second device 62>

[0066] Figure 3 The configuration of the second device 62 is shown. (As shown) Figure 3 As shown, the second device 62 includes a processing circuit 71 and a storage device 72.

[0067] The processing circuit 71 executes the program stored in the storage device 72 to perform various processes. The processing circuit 71 includes a processor.

[0068] like Figure 3 As shown, the storage device 72 stores a determination program PD. By executing the determination program PD, the processing circuit 71 can perform and stop the fault determination process. The second device 62 can suppress false fault determinations by executing the determination program PD through the processing circuit 71.

[0069] <Communication methods performed in the vehicle network system 100>

[0070] Figure 4 This illustrates the communication method performed by the first device 61 or fourth device 64, the second device 62, and the relay device 10 in the vehicle network system 100 for fault determination performed by the second device 62. Specifically, the second device 62 and the relay device 10 communicate with each ECU of the first device 61 and the fourth device 64 via… Figure 4 Communication is performed in the manner shown. The second device 62 executes the decision program PD through the processing circuit 71 to perform the communication. Figure 4 The processing performed by the second device 62.

[0071] exist Figure 4 As a prerequisite, the second device 62 sends NM messages 50 to other ECUs that do not have PN functions in order to achieve a specific function.

[0072] like Figure 4 As shown in the upper layer, the first device 61 and the fourth device 64 transmit driving speed information as periodic messages during operation. At this time, the first device 61 and the fourth device 64 transmit the driving speed information by including information, i.e., an identifier, for identifying the ECU of the transmitting source. That is, the first device 61 transmits driving speed information including an identifier representing the first device 61. Additionally, the fourth device 64 transmits driving speed information including an identifier representing the fourth device 64.

[0073] like Figure 4 As shown in the upper layer, the relay device 10 relays the driving speed information sent by the first device 61 and the fourth device 64 toward the second device 62.

[0074] like Figure 4 As shown in the upper layer, the second device 62, which receives the driving speed information, confirms the identifier contained in the driving speed information. Then, the second device 62 performs a fault determination on the ECU indicated by the identifier. For example, if the second device 62 receives driving speed information containing an identifier representing the first device 61, it determines that the first device 61 has not malfunctioned.

[0075] The first device 61 and the fourth device 64 send NM messages 50 in an operational state during periods when a specific function needs to be performed. Furthermore, even if the second device 62 sends an NM message 50, the first device 61 and the fourth device 64 continue to operate even if they themselves do not send an NM message 50.

[0076] On the other hand, as shown Figure 2 As explained, when the first device 61 and the fourth device 64 switch from the operating state to the standby state, the second device 62 stops sending the NM message 50. That is, in situations where it is possible to cause a situation as shown... Figure 2 When the fault is misjudged as described, the second device 62 does not send an NM message 50.

[0077] like Figure 4 As shown in the middle layer, the second device 62 stops fault determination when it stops sending NM messages 50. That is, the second device 62 stops fault determination if it has completed the implementation of a specific function.

[0078] The second device 62 performs fault determination on each of the first device 61 and the fourth device 64. Figure 4 In the middle layer, the second device 62 stops determining the faults of both the first device 61 and the fourth device 64.

[0079] Thus, in order to suppress false fault determinations, the second device 62 executes a determination method that includes stopping fault determination when it stops sending NM messages 50.

[0080] When the second device 62 resumes the periodic transmission of NM message 50 after stopping its transmission, the first device 61 and the fourth device 64 become operational. If an ECU other than the second device 62 transmits NM message 50 before the second device 62 resumes transmission, the first device 61 and the fourth device 64 become operational based on that NM message 50. Furthermore, this is because even if no ECU other than the second device 62 transmits NM message 50 before the second device 62 resumes transmission, the first device 61 and the fourth device 64 become operational based on the NM message 50 transmitted by the second device 62.

[0081] like Figure 4 As shown in the lower layer, the second device 62 restarts fault determination when it sends the NM message 50. That is, after stopping fault determination, the second device 62 restarts fault determination when it resumes the periodic sending of the NM message 50 to achieve a specific function.

[0082] <Function of the First Embodiment>

[0083] The second device 62 may mistakenly determine that the first device 61 has malfunctioned during fault diagnosis when the first device 61 is in standby mode and the second device 62 is in operation mode. In this situation, the second device 62 does not send an operation notification. The second device 62 does not perform fault diagnosis without sending an operation notification.

[0084] <Effects of the First Implementation>

[0085] (1-1) The second device 62 can suppress the misjudgment of faults.

[0086] (1-2) After stopping the fault determination, the second device 62 starts the fault determination again when the operation notification is sent.

[0087] Preferably, fault determination is restarted after the first device 61 has already been switched to the operating state. When the second device 62 sends an operation notification, the first device 61, which was in standby mode, switches to the operating state. When the second device 62 resumes sending the operation notification, fault determination is restarted. Thus, even if fault determination is temporarily suspended, the second device 62 can still detect faults in the first device 61.

[0088] (1-3) In addition to the first device 61, the second device 62, and the third device 63, the vehicle network system 100 also includes a fourth device 64, which serves as an electronic control device with network management functions, for sending periodic messages. The second device 62 performs fault determination on the first device 61 based on the periodic messages received from the first device 61. The second device 62 performs fault determination on the fourth device 64 based on the periodic messages received from the fourth device 64. When the second device 62 stops sending operation notifications, it ceases fault determination on both the first device 61 and the fourth device 64.

[0089] The second device 62 independently performs fault determination for each of the multiple electronic control devices. Furthermore, the second device 62 ceases fault determination for each electronic control device when it no longer sends operation notifications. Thus, the second device 62 is capable of performing fault determination for multiple electronic control devices and suppressing false fault determinations for these devices.

[0090] (1-4) The second device 62 receives a message containing information representing the driving speed of the vehicle equipped with the vehicle network system 100 as a periodic message. Therefore, the second device 62 can perform the fault determination of the first device 61 based on the information representing the vehicle's driving speed.

[0091] (1-5) The above-described determination method prevents the second device 62 from performing fault determination when the second device 62 does not send an operation notification. Therefore, the above-described determination method can suppress the second device 62 from making false fault determinations.

[0092] (1-6) The decision procedure PD prevents the second device 62 from performing fault determination if the second device 62 does not send an operation notification. Thus, the decision procedure PD can suppress the second device 62 from making false fault determinations.

[0093] (Second Implementation)

[0094] The following is for reference Figures 5-7 The second embodiment will be described. The second embodiment differs from the first embodiment in that the vehicle network system 100 includes a communication bus in addition to the first communication bus 41, the second communication bus 42, and the third communication bus 43. Hereinafter, the description will focus on the differences from the first embodiment, and similar points will be simplified or omitted.

[0095] <Composition of the In-Vehicle Network System 100>

[0096] Figure 5 The configuration of the vehicle network system 100 in the second embodiment is shown.

[0097] like Figure 5As shown, in the second embodiment, the vehicle network system 100 further includes a fourth communication bus 44, a fifth communication bus 45, and a sixth communication bus 46 in addition to the first communication bus 41, the second communication bus 42, and the third communication bus 43. The fourth communication bus 44 is connected to the first NM device 21, the second NM device 22, and the third NM device 23. The fifth communication bus 45 is connected to the fourth NM device 24, the fifth NM device 25, and the first PN device 31. The sixth communication bus 46 is connected to the second PN device 32, the third PN device 33, and the sixth NM device 26.

[0098] In the vehicle network system 100 of the second embodiment, the first NM device 21, the second NM device 22, and the third NM device 23 are also capable of sending and receiving messages via a fourth communication bus 44, in addition to the first communication bus 41. In the vehicle network system 100 of the second embodiment, the fourth NM device 24, the fifth NM device 25, and the first PN device 31 are also capable of sending and receiving messages via a fifth communication bus 45, in addition to the second communication bus 42. In the vehicle network system 100 of the second embodiment, the second PN device 32, the third PN device 33, and the sixth NM device 26 are also capable of sending and receiving messages via a sixth communication bus 46, in addition to the third communication bus 43.

[0099] like Figure 5 As shown, in the vehicle network system 100 of the second embodiment, there are two networks, a first network 81 and a second network 82, which are networks composed of a communication bus.

[0100] like Figure 5 As shown, the first network 81 is composed of a first communication bus 41, a second communication bus 42, and a third communication bus 43. The first network 81 is formed by grouping the first communication bus 41, the second communication bus 42, and the third communication bus 43 provided in the vehicle network system 100 of the first embodiment. That is, similar to the first embodiment, the first network 81 relays NM messages 50, PN messages 51, and control messages 52 containing periodic messages exchanged between ECUs.

[0101] When relay device 10 receives a message via a communication bus constituting the first network 81, it forwards the message to other communication buses constituting the first network 81. For example, if the first NM device 21 forwards a message to the first communication bus 41, relay device 10 forwards the message to the second communication bus 42 and the third communication bus 43.

[0102] like Figure 5As shown, the second network 82 consists of a fourth communication bus 44, a fifth communication bus 45, and a sixth communication bus 46. The ECUs in the vehicle network system 100 can exchange messages through the second network 82, in addition to the first network 81.

[0103] like Figure 5 As shown, relay device 10 is connected to the fourth communication bus 44, the fifth communication bus 45, and the sixth communication bus 46. When relay device 10 receives a message through a communication bus constituting the second network 82, it forwards the message to the other communication buses constituting the second network 82. For example, if the first NM device 21 forwards a message to the fourth communication bus 44, relay device 10 forwards the message to the fifth communication bus 45 and the sixth communication bus 46.

[0104] <Composition of the second device 62>

[0105] Figure 6 The configuration of the second device 62 in the vehicle network system 100 according to the second embodiment is shown.

[0106] Compare Figure 3 and Figure 6 It is understood that the second device 62 stores a determination program PD2 in the storage device 72 to replace the determination program PD. By causing the processing circuit 71 to execute the determination program PD2, the processing circuit 71 can perform fault determination and stop. The second device 62 can suppress false fault determinations by having the processing circuit 71 execute the determination program PD2.

[0107] <Communication methods performed in the vehicle network system 100>

[0108] Figure 7 This illustrates the communication method performed by the first device 61 or fourth device 64, the second device 62, and the relay device 10 in the vehicle network system 100 of the second embodiment for fault determination by the second device 62. The second device 62 and the relay device 10 communicate with each ECU of the first device 61 and the fourth device 64 via… Figure 7 The method shown is used to perform communication instead Figure 4 As shown. The second device 62 executes the determination program PD2 through the processing circuit 71. Figure 7 The processing performed by the second device 62.

[0109] like Figure 7 As shown in the upper layer, the first device 61 and the fourth device 64 send driving speed information as periodic messages during operation. At this time, the first device 61 and the fourth device 64 send the driving speed information through the first network 81. Figure 4 Similarly, the speed information includes an identifier.

[0110] like Figure 7 As shown in the upper layer, the relay device 10 relays the driving speed information sent by the first device 61 and the fourth device 64 toward the second device 62.

[0111] like Figure 7 As shown in the upper layer, the second device 62, which receives the driving speed information, confirms the identifier contained in the driving speed information. Then, the second device 62 performs a fault determination on the ECU indicated by the identifier. This process is related to... Figure 4 The processing performed by the upper-level second device 62 is the same.

[0112] Figure 7 The middle layer shows the communication method performed when the fault-determined object can switch to a standby state. The fault-determined objects are the first device 61 and the fourth device 64.

[0113] As described above, when the ECU of the vehicle network system 100 does not receive an operation notification from other ECUs for a certain period of time, it switches from the operating state to the standby state.

[0114] When the first device 61 has not received an operation notification from other ECUs for a certain period of time, it sends a sleep notification to the second device 62. The sleep notification is a signal indicating that the source of the notification has switched from an operating state to a standby state. The first device 61 sends the sleep notification containing information, i.e., an identifier, used to identify the ECU that is the source. That is, the first device 61 sends a sleep notification containing an identifier representing the first device 61.

[0115] The first device 61 sends a sleep notification via the second network 82. That is, the first device 61 sends a sleep notification to the fourth communication bus 44. Then, the second device 62 receives the sleep notification via the fifth communication bus 45.

[0116] After sending a hibernation notification, the first device 61 switches from the operating state to the standby state.

[0117] If the fourth device 64 does not receive an operation notification from other ECUs for a certain period of time, it sends a sleep notification to the second device 62. The fourth device 64 sends a sleep notification containing an identifier representing the fourth device 64.

[0118] The fourth device 64 sends a sleep notification via the second network 82. That is, the fourth device 64 sends a sleep notification to the fourth communication bus 44. Then, the second device 62 receives the sleep notification via the fifth communication bus 45.

[0119] After sending a hibernation notification, the fourth device 64 switched from the operating state to the standby state.

[0120] like Figure 7As shown in the middle layer, the relay device 10 relays the hibernation notifications sent by the first device 61 and the fourth device 64 toward the second device 62.

[0121] like Figure 7 As shown in the middle layer, the second device 62, upon receiving the hibernation notification, confirms the identifier contained in the hibernation notification. Then, the second device 62 perceives that the ECU indicated by the identifier has entered standby mode. That is, if the identifier in the hibernation notification represents the first device 61, the second device 62 perceives that the first device 61 has transitioned from an operating state to a standby state. Furthermore, if the identifier in the hibernation notification represents the fourth device 64, the second device 62 perceives that the fourth device 64 has transitioned from an operating state to a standby state.

[0122] like Figure 7 As shown in the middle layer, the second device 62 stops fault determination for the ECU that has switched from the operating state to the standby state. For example, if the second device 62 senses that the first device 61 has switched from the operating state to the standby state, it stops fault determination for the first device 61.

[0123] Thus, in order to suppress false fault determinations, the second device 62 executes a determination method that includes stopping fault determination when it senses through communication in the second network 82 that the object of fault determination has switched to standby mode.

[0124] Figure 7 The lower level shows the communication method performed when the object for fault determination has switched to an operational state.

[0125] When the first device 61 transitions from a standby state to an operating state, it sends a wake-up notification to the second device 62. The wake-up notification is a signal indicating that the source of the notification has transitioned from a standby state to an operating state. The first device 61 sends the wake-up notification containing information, i.e., an identifier, used to identify the ECU of the source device. That is, the first device 61 sends a wake-up notification containing an identifier representing the first device 61.

[0126] The first device 61 sends a wake-up notification via the second network 82. That is, the first device 61 sends a wake-up notification to the fourth communication bus 44. Then, the second device 62 receives the wake-up notification via the fifth communication bus 45.

[0127] When the fourth device 64 has switched from standby mode to operating mode, it sends a wake-up notification to the second device 62. The fourth device 64 sends a wake-up notification containing an identifier representing the fourth device 64.

[0128] The fourth device 64 sends a wake-up notification via the second network 82. That is, the fourth device 64 sends a wake-up notification to the fourth communication bus 44. Then, the second device 62 receives the wake-up notification via the fifth communication bus 45.

[0129] like Figure 7 As shown in the lower layer, the relay device 10 relays the wake-up notifications sent by the first device 61 and the fourth device 64 toward the second device 62.

[0130] like Figure 7 As shown in the lower layer, the second device 62, upon receiving the wake-up notification, confirms the identifier contained in the wake-up notification. Then, the second device 62 perceives that the ECU indicated by the identifier has switched to an operating state. That is, if the identifier in the wake-up notification represents the first device 61, the second device 62 perceives that the first device 61 has switched from a standby state to an operating state. Furthermore, if the identifier in the wake-up notification represents the fourth device 64, the second device 62 perceives that the fourth device 64 has switched from a standby state to an operating state.

[0131] like Figure 7 As shown in the lower layer, the second device 62 resumes fault determination for the ECU, which has transitioned from standby to operation. For example, if the second device 62 senses that the first device 61 has transitioned from standby to operation, it resumes fault determination for the first device 61.

[0132] <Function and Effects of the Second Embodiment>

[0133] (2-1) When the second device 62 senses through the second network 82 that the first device 61 has switched to standby mode, it stops fault determination. Thus, the second device 62 is able to suppress false fault determination.

[0134] (2-2) After the second device 62 stops fault determination, when it senses that the first device 61 has switched to the operating state through communication with the first device 61 via the second network 82, it starts fault determination again.

[0135] Preferably, fault determination is restarted only after the first device 61 has been switched to an operating state. The second device 62 restarts fault determination when it detects that the first device 61 has been switched to an operating state via the second network 82. Thus, the second device 62 can detect faults in the first device 61 even if fault determination is temporarily suspended.

[0136] (2-3) In addition to the first device 61, the second device 62, and the third device 63, the vehicle network system 100 also includes a fourth device 64 as an electronic control device with network management functions. The fourth device 64 is connected to the second device 62 via the first network 81 and the second network 82, and sends periodic messages via the first network 81. The second device 62 performs fault determination on the first device 61 based on the periodic messages received from the first device 61. The second device 62 performs fault determination on the fourth device 64 based on the periodic messages received from the fourth device 64. When the second device 62 senses that the first device 61 has entered a standby state based on communication with the first device 61 via the second network 82, it stops fault determination on the first device. When the second device 62 senses that the fourth device 64 has entered a standby state based on communication with the fourth device 64 via the second network 82, it stops fault determination on the fourth device 64.

[0137] The second device 62 independently performs fault determination on each of the multiple electronic control devices. Furthermore, when the second network 82 detects that an electronic control device subject to fault determination has switched to standby mode, the second device 62 stops performing fault determination on that electronic control device. Thus, the second device 62 can perform fault determination on multiple electronic control devices and suppress false fault determinations for multiple electronic control devices.

[0138] (2-4) The second device 62 of the second embodiment has the same effect as (1-4) in the first embodiment.

[0139] (2-5) The above-described determination method stops the fault determination performed by the second device 62 when the second device 62 senses through the second network 82 that the first device 61 has switched to standby mode. Thus, the above-described determination method can suppress the second device 62 from making false fault determinations.

[0140] (2-6) When the second device 62 senses through the second network 82 that the first device 61 has switched to standby mode, the above-mentioned determination procedure PD2 causes the second device 62 to stop the fault determination. Thus, the above-mentioned determination procedure PD2 can suppress the second device 62 from making false fault determinations.

[0141] (Third Implementation)

[0142] The following is for reference Figure 8 and Figure 9 The third embodiment will be described. The third embodiment differs from the first embodiment in that the relay device 10 performs processing for stopping fault determination. Hereinafter, the description will focus on the differences from the first embodiment, and similar points will be simplified or omitted.

[0143] <Composition of Relay Device 10>

[0144] Figure 8 The configuration of the relay device 10 in the vehicle network system 100 according to the third embodiment is shown. Figure 8 As shown, the relay device 10 includes a processing circuit 11 and a storage device 12.

[0145] The processing circuit 11 executes programs stored in the storage device 12 to perform various processes. The processing circuit 11 includes a processor.

[0146] like Figure 8 As shown, the storage device 12 stores a transmission program PS. The processing circuit 11 performs periodic message transmission by executing the transmission program PS.

[0147] In the vehicle network system 100 of the third embodiment, the transmission program PS is executed by the processing circuit 11 of the relay device 10, which can suppress the second device 62's misjudgment of faults. Furthermore, in the vehicle network system 100 of the third embodiment, the second device 62 does not need to store the judgment program PD.

[0148] <Communication methods performed in the vehicle network system 100>

[0149] Figure 9 This illustrates the communication method performed by the first device 61 or fourth device 64, the second device 62, and the relay device 10 in the vehicle network system 100 of the third embodiment for fault determination by the second device 62. The second device 62 and the relay device 10 communicate with each ECU of the first device 61 and the fourth device 64 via… Figure 9 The method shown is used to perform communication instead Figure 4 As shown. The relay device 10 executes the transmission program PS through the processing circuit 11 to perform the transmission. Figure 9 The processing performed by the relay device 10.

[0150] like Figure 9 As shown in the upper layer, the first device 61 and the fourth device 64 send driving speed information to the second device 62 as periodic messages during operation. This processing and... Figure 4 The processes performed by the first device 61 and the fourth device 64 in the upper layer are the same.

[0151] like Figure 9 As shown in the upper layer, the relay device 10 relays the driving speed information sent by the first device 61 and the fourth device 64 toward the second device 62.

[0152] like Figure 9As shown in the upper layer, the second device 62, which receives the driving speed information, confirms the identifier contained in the driving speed information. Then, the second device 62 performs a fault determination on the ECU indicated by the identifier. This process and in Figure 4 The processing performed by the upper-level second device 62 is the same.

[0153] Figure 9 The middle layer illustrates the communication method performed when relay device 10 stops sending NM message 50 to the fault-determined object. The fault-determined objects are the first device 61 and the fourth device 64.

[0154] As described above, the relay device 10 relays the NM message 50 while receiving it from other ECUs, and also sends the NM message 50 itself to the communication bus connected to the ECU that does not have the PN function. Therefore, the relay device 10's failure to send the NM message 50 indicates that the NM message 50 has not been sent in the vehicle network system 100.

[0155] When relay device 10 stops sending NM message 50, the first device 61 and the fourth device 64, no longer receiving NM message 50, switch from the operating state to the standby state. Figure 9 The communication method shown in the middle layer is performed when the first device 61 and the fourth device 64 have switched from the operating state to the standby state.

[0156] When relay device 10 stops sending NM messages 50 to the object being fault-determined, it determines that the first device 61 has switched from the operating state to the standby state based on the fact that it no longer sends NM messages 50 to the first communication bus 41. Figure 9 As shown in the middle layer, the relay device 10, having determined that the first device 61 has switched from an operating state to a standby state, sends driving speed information as a periodic message to the second device 62. At this time, the relay device 10 sends driving speed information containing an identifier representing the first device 61.

[0157] If the relay device 10 stops sending NM messages 50 to the object being fault-determined, it determines that the fourth device 64 has switched from the operating state to the standby state based on the fact that it no longer sends NM messages 50 to the first communication bus 41. Figure 9 As shown in the middle layer, the relay device 10, having determined that the fourth device 64 has switched from the operating state to the standby state, sends driving speed information as a periodic message to the second device 62. At this time, the relay device 10 sends driving speed information containing an identifier representing the fourth device 64.

[0158] like Figure 9As shown in the middle layer, the second device 62, which receives the driving speed information, confirms the identifier contained in the driving speed information. Then, the second device 62 performs a fault determination on the ECU indicated by the identifier. That is, if the relay device 10 sends the driving speed information with an identifier representing the first device 61 attached, the second device 62 performs a fault determination on the first device 61. In addition, if the relay device 10 sends the driving speed information with an identifier representing the fourth device 64 attached, the second device 62 performs a fault determination on the fourth device 64.

[0159] Thus, when the object of fault determination has been switched to standby mode, the relay device 10 replaces the ECU that has been switched to standby mode to send periodic messages to the second device 62. Moreover, even if the object of fault determination has been switched to standby mode, the second device 62 performs fault determination based on the periodic messages received from the relay device 10.

[0160] The vehicle network system 100 periodically executes after the relay device 10 stops sending NM messages 50. Figure 9 The communication is as shown in the middle layer until execution. Figure 9 The process continues until the next layer is executed. That is, after stopping the transmission of NM message 50, the relay device 10 periodically sends driving speed information until execution is completed. Figure 9 The process continues until the next layer is processed. Then, the second device 62 performs fault determination based on the driving speed information sent by the relay device 10, until the process continues. Figure 9 Until the processing shown in the lower layer.

[0161] Thus, in order to suppress the second device 62's false fault determination, the relay device 10 executes a determination method that includes sending a periodic message to replace the fault determination object that has been switched to standby mode.

[0162] Figure 9 The lower layer shows the communication method performed when the relay device 10 sends an NM message 50 to the fault-determined object.

[0163] If relay device 10 sends an NM message 50 to the object being fault-checked, the object being fault-checked will switch from standby state to operating state. That is, Figure 9 The communication in the manner shown in the lower layer is performed when the first device 61 and the fourth device 64 have switched from standby state to operating state.

[0164] like Figure 9 As shown in the lower layer, relay device 10 stops periodically transmitting driving speed information. Figure 9At the lower level, the object of fault determination changes from standby state to operating state. Since the relay device 10 resumes transmitting driving speed information even if it stops transmitting driving speed information, it can still perform fault determination normally because the object of fault determination has become operating state.

[0165] <Function and Effects of the Third Implementation>

[0166] (3-1) When the first device 61 has switched to standby mode, the relay device 10 takes over from the first device 61 to send periodic messages. As a result, the relay device 10 can suppress the second device 62 from misjudging faults.

[0167] (3-2) The relay device 10 relays the operation notification while other electronic control devices are sending operation notifications to the first device 61, and also periodically sends operation notifications to the first device 61 itself. When the relay device 10 stops sending operation notifications to the first device 61, it determines that the first device 61 has entered standby mode and sends a periodic message to the second device 62.

[0168] When the first device 61 has switched to standby mode, the relay device 10 takes over from the first device 61 to send periodic messages. As a result, the relay device 10 can suppress the second device 62 from misjudging faults.

[0169] (3-3) After the relay device 10 starts sending periodic messages, it stops sending periodic messages to the second device 62 when it sends an operation notification to the first device 61.

[0170] With the first device 61 already in operation, it resumes sending periodic messages to the second device 62. Therefore, the relay device 10 does not need to replace the first device 61 in sending periodic messages when the first device 61 is already in operation.

[0171] When relay device 10 sends an operation notification to first device 61, first device 61 enters an operational state. When relay device 10 sends the operation notification to first device 61, it stops sending periodic messages. Therefore, relay device 10 can reduce the communication load in the vehicle network system 100.

[0172] (3-4) In addition to the first device 61, the second device 62, and the third device 63, the vehicle network system 100 also includes a fourth device 64 as an electronic control device with network management functions, which transmits periodic messages. The relay device 10 is an electronic control device in the vehicle network system 100 that differs from the first device 61, the second device 62, and the fourth device 64. The second device 62 performs fault determination on the first device 61 based on periodic messages received from the first device 61. The second device 62 performs fault determination on the fourth device 64 based on periodic messages received from the fourth device 64. When the first device 61 is in standby mode, the relay device 10 replaces the first device 61 in sending periodic messages for fault determination of the first device 61 to the second device 62. When the fourth device 64 is in standby mode, the relay device 10 replaces the fourth device 64 in sending periodic messages for fault determination of the fourth device 64 to the second device 62.

[0173] When the electronic control device of the target of fault determination has switched to standby mode, the relay device 10 takes over the standby mode to send periodic messages. Thus, the relay device 10 enables the second device 62 to perform fault determination on multiple electronic control devices and suppresses false fault determinations by the second device 62.

[0174] (3-5) The first device 61 sends a message containing information indicating the speed of the vehicle equipped with the vehicle network system 100 as a periodic message. When the first device 61 has switched to standby mode, the relay device 10 sends a message containing information indicating the speed to the second device 62 as a periodic message.

[0175] When the first device 61 has been switched to standby mode, the relay device 10 takes over from the first device 61 to send information indicating the vehicle's speed to the second device 62. Thus, even when the first device 61 has been switched to standby mode, the relay device 10 enables the second device 62 to determine a fault based on the information indicating the vehicle's speed.

[0176] (3-6) In the above-described transmission method, when the first device 61 has been switched to standby mode, the relay device 10 replaces the first device 61 to transmit periodic messages. Therefore, the above-described transmission method can suppress the second device 62 from misjudging faults.

[0177] (3-7) When the first device 61 has switched to standby mode, the above-described transmission procedure PS causes the relay device 10, which is an electronic control device different from the first device 61 and the second device 62, to replace the first device 61 in transmitting periodic messages. As a result, the transmission procedure PS can suppress the second device 62 from misjudging faults.

[0178] (Other implementation methods)

[0179] The above embodiments can be modified as follows. The embodiments and the following modifications can be combined with each other within the scope of technical inconsistency.

[0180] (Composition of the vehicle network system 100)

[0181] In the aforementioned vehicle network system 100, the relay device 10 transmits PN messages 51 sent by ECUs with PN functionality to the communication bus connected to other ECUs with PN functionality. Additionally, the relay device 10 transmits NM messages 50 sent by ECUs without PN functionality to the communication bus connected to other ECUs without PN functionality.

[0182] On the other hand, the relay device 10 can also send operation notifications to all communication buses connected to the relay device 10, but will not send operation notifications to any communication bus only when the ECU connected to a certain communication bus is put into standby mode.

[0183] • If the above-described vehicle network system 100 includes a first communication bus 41 with a first device 61, a second communication bus 42 with a second device 62 and a third device 63, and a relay device 10, then the number of communication buses and the number of connected ECUs are not limited to the above-described embodiment. Furthermore, the topology of the vehicle network system 100 is also not limited to the above-described embodiment.

[0184] In the aforementioned vehicle network system 100, an ECU with PN function is not connected to the first communication bus 41. On the other hand, in the vehicle network system 100, an ECU with PN function can be connected to the first communication bus 41 to which the first device 61 is connected.

[0185] The relay device 10 can also be configured such that, upon receiving a PN message 51 from another ECU, it identifies the recipient of the PN message 51 and sends the PN message 51 only to the communication bus connected to the ECU that is the recipient. In this case, it is possible to consider a scenario where, even if an ECU with PN functionality is connected to the first communication bus 41, an operation notification is not sent to the first communication bus 41, but instead sent to the second communication bus 42.

[0186] The aforementioned vehicle network system 100 includes a first device 61 and a fourth device 64 as ECUs for sending periodic messages. The vehicle network system 100 may also omit the fourth device 64.

[0187] In the aforementioned vehicle network system 100, the first device 61 and the fourth device 64 may also send periodic messages without including an identifier. In this case, the second device 62 performs fault determination without acknowledging the identifier contained in the message. Then, when the reception of the periodic message is interrupted, the second device 62 determines that either the first device 61 or the fourth device 64 has failed.

[0188] In the aforementioned vehicle network system 100, the second device 62 independently performs fault determination on each of the first device 61 and the fourth device 64. Alternatively, the second device 62 may not independently perform fault determination on each of the first device 61 and the fourth device 64. In this case, when the reception of a periodic message is interrupted, the second device 62 determines that either the first device 61 or the fourth device 64 has failed.

[0189] In the above-described embodiment, the first device 61 and the fourth device 64 send driving speed information as periodic messages. However, the messages sent periodically by the first device 61 and the fourth device 64 may not be driving speed information. For example, the first device 61 and the fourth device 64 may also send a message indicating the engine speed of the vehicle as a periodic message. Alternatively, the first device 61 and the fourth device 64 may also send a message indicating that they are capable of sending messages normally as a periodic message.

[0190] In the vehicle network system 100 of the second embodiment, such as Figure 5 As shown, multiple communication buses constitute the second network 82, and the relay device 10 connects each communication bus to the others. The configuration of the second network 82 is not limited to... Figure 5 As shown in the diagram.

[0191] For example, the second network 82 may also be composed of a single communication bus that directly connects the first device 61, the second device 62, and the fourth device 64 without passing through the relay device 10. Alternatively, the second network 82 may also be composed of a communication bus that directly connects the first device 61 and the second device 62, and a communication bus that directly connects the second device 62 and the fourth device 64.

[0192] ( Figure 4 (Communication in the manner shown)

[0193] ·like Figure 4 As shown, in the first embodiment, the second device 62 restarts fault determination if an NM message 50 is sent after fault determination has been stopped. Alternatively, the second device 62 may be configured not to restart fault determination even if an NM message 50 is sent after fault determination has been stopped.

[0194] In the first embodiment, the fault determination performed by the second device 62 applies to the first device 61 and the fourth device 64. The second device 62 may also perform fault determination on three or more ECUs, for example. In this case, the second device 62 stops fault determination on all fault-determining objects when it stops sending the NM message 50.

[0195] In the first embodiment, the fourth device 64 is the third NM device 23 connected to the first device 61 on the same first communication bus 41. The fourth device 64 can also be an ECU connected to a different communication bus than the first device 61. For example, the fourth device 64 could be the fourth NM device 24 or the sixth NM device 26. Even in this case, the second device 62 stops fault determination for all fault-determining objects when it stops sending the NM message 50.

[0196] In the first embodiment, the second device 62 stops fault determination for both the first device 61 and the fourth device 64 when fault determination is stopped. Alternatively, the second device 62 may stop fault determination for only one of the ECUs (either the first device 61 or the fourth device 64) when fault determination is stopped. That is, the second device 62 may continue fault determination for all ECUs subject to fault determination when fault determination is stopped. Even in this case, false determinations for the ECUs whose fault determination has been stopped can be suppressed.

[0197] ( Figure 7 (Communication in the manner shown)

[0198] ·like Figure 7 As shown, in the second embodiment, the second device 62 restarts fault determination when the object of fault determination has switched to an operating state. The second device 62 may also be configured such that, after stopping fault determination, it does not restart fault determination even if the object of fault determination has switched to an operating state.

[0199] ·like Figure 7 As shown, in the second embodiment, the second device 62 stops fault determination when it receives a sleep notification from the object of fault determination via the second network 82. The method by which the second device 62 stops fault determination based on communication via the second network 82 is not limited to the method shown in the second embodiment. For example, the second device 62 periodically sends a message indicating that it is in an operating state via the second network 82 during the period when the object of fault determination is in an operating state. Then, the second device 62 may stop fault determination for ECUs that no longer send the message if it has not received the message from the object of fault determination for a certain period of time.

[0200] ·like Figure 7As shown, in the second embodiment, the second device 62 restarts fault determination when it receives a wake-up notification from the object of fault determination via the second network 82. The method by which the second device 62 restarts fault determination based on communication via the second network 82 is not limited to the method shown in the second embodiment. For example, the second device 62 periodically sends messages indicating that it is in an operating state via the second network 82 during the period when the object of fault determination is in an operating state. Then, the second device 62 can restart fault determination for that ECU when the object of fault determination resumes periodic message transmission.

[0201] ·like Figure 7 As shown, in the second embodiment, the second device 62 stops fault determination of the ECU indicated by the identifier in the hibernation notification when it receives a hibernation notification. Alternatively, the second device 62 may also stop fault determination of all ECUs that are subject to fault determination when it receives a hibernation notification. In this case, the identifier may not be attached to the hibernation notification.

[0202] ·like Figure 7 As shown, in the second embodiment, the second device 62, upon receiving a wake-up notification, resumes fault determination for the ECU indicated by the identifier in the wake-up notification. Alternatively, the second device 62 may also resume fault determination for all ECUs subject to fault determination upon receiving a wake-up notification. In this case, the identifier for the ECUs subject to fault determination may not be attached to the wake-up notification.

[0203] In the second embodiment, the fault determination performed by the second device 62 applies to both the first device 61 and the fourth device 64. The second device 62 may also perform fault determination on three or more ECUs, for example. In this case, the second device 62 independently performs fault determination on each fault-determination object based on an identifier contained in a periodic message. Furthermore, the second device 62 independently stops and restarts fault determination on multiple ECUs based on identifiers in messages received through the second network 82.

[0204] In the second embodiment, the fourth device 64 is the third NM device 23 connected to the first device 61 via the same first communication bus 41. The fourth device 64 can also be an ECU connected to a different communication bus than the first device 61. For example, the fourth device 64 could be the fourth NM device 24 or the sixth NM device 26. Even in such cases, the second device 62 independently stops and restarts fault determination for each ECU based on communication via the second network 82.

[0205] ·like Figure 7As shown, in the second embodiment, the second device 62 restarts fault determination upon receiving a wake-up notification from the object of fault determination. That is, the second device 62 in the second embodiment restarts fault determination based on communication via the second network 82. The method by which the second device 62 restarts fault determination is not limited to the embodiment described above.

[0206] For example, the second device 62 can also restart fault determination when it has sent the NM message 50. Figure 10 This illustrates the communication method performed by the first device 61 or fourth device 64, the second device 62, and the relay device 10 for fault determination by the second device 62, in the case of this modified example. For the second device 62 and the relay device 10 in this modified example, which is a modification of the second embodiment, the following is replaced... Figure 7 In the manner shown Figure 10 The method shown communicates with each ECU of the first device 61 and the fourth device 64. The second device 62 executes the decision program PD2 through the processing circuit 71 to perform... Figure 10 The processing performed by the second device 62.

[0207] exist Figure 10 The communication method executed at the upper layer and Figure 7 The method shown above is the same. That is, in Figure 10 At the upper level, either the first device 61 or the fourth device 64 sends driving speed information as a periodic message. Figure 10 At the upper layer, relay device 10 relays the driving speed information sent by the first device 61 and the fourth device 64 to the second device 62. Then, in Figure 10 At the upper level, the second device 62 performs fault determination based on the identifier contained in the periodic message.

[0208] exist Figure 10 The communication method of the middle layer execution and Figure 7 The middle layer is shown in the same way. That is, in Figure 10 In the middle layer, when the first device 61 or the fourth device 64 is able to switch to standby mode, it sends a hibernation notification through the second network 82. Figure 10 In the middle layer, relay device 10 relays the sleep notifications sent by the first device 61 and the fourth device 64 to the second device 62. Then, in Figure 10 In the middle layer, the second device 62 stops fault determination based on the identifier contained in the hibernation notification.

[0209] Figure 10 The lower layer shows the communication method performed when the second device 62 sends the NM message 50.

[0210] exist Figure 10In the middle layer, since the first device 61 and the fourth device 64 can switch to standby mode, therefore... Figure 10 At the intermediate level, the second device 62 does not send the NM message 50. When the second device 62 resumes the periodic transmission of the NM message 50 after stopping its transmission, the first device 61 and the fourth device 64 become operational. If an ECU other than the second device 62 sends the NM message 50 before the second device 62 resumes its transmission, the first device 61 and the fourth device 64 become operational based on that NM message 50. Furthermore, this is because even if an ECU other than the second device 62 does not send the NM message 50 before the second device 62 resumes its transmission, the first device 61 and the fourth device 64 become operational based on the NM message 50 sent by the second device 62.

[0211] like Figure 10 As shown in the lower layer, the second device 62 restarts fault determination when it sends the NM message 50. At this time, the second device 62 restarts fault determination for each of the first device 61 and the fourth device 64. Thus, even if the second device 62 stops fault determination, it can restart fault determination when the first device 61 and the fourth device 64 return to the operating state.

[0212] In this case, the second device 62 resumes fault determination after stopping fault determination when an operation notification is sent.

[0213] Preferably, fault determination is restarted after the first device 61 has already resumed operation. The first device 61 resumes operation after the second device 62 sends an operation notification. The second device 62 then restarts fault determination upon sending its own operation notification. Thus, the second device 62 can detect faults in the first device 61 even if fault determination is temporarily suspended.

[0214] ( Figure 9 (Communication in the manner shown)

[0215] ·like Figure 9 As shown, in the vehicle network system 100 of the third embodiment, the relay device 10 replaces the object of fault determination to send periodic messages. The ECU that replaces the object of fault determination to send periodic messages may not be the relay device 10. For example, in the vehicle network system 100 as... Figure 5In the case where the configuration with the second network 82 is adopted as shown, the fourth NM device 24 can also replace the fault-determined object in sending periodic messages. In this case, for example, the fourth NM device 24 can replace the fault-determined object in periodically sending periodic messages when it is sensed through communication via the second network 82 that the fault-determined object has entered a standby state. Moreover, the fourth device 64 can stop the periodic sending of periodic messages when it is sensed through communication via the second network 82 that the fault-determined object has entered an operating state.

[0216] ·like Figure 9 As shown, in the third embodiment, if the relay device 10 sends an NM message 50 to the object of fault determination after stopping fault determination, it stops sending the driving speed information. The relay device 10 may also be configured to continue sending the driving speed information even after sending the NM message 50.

[0217] In the third embodiment, the fault determination performed by the second device 62 applies to both the first device 61 and the fourth device 64. The second device 62 may also perform fault determination on more than three ECUs, for example. Even in this case, the relay device 10 replaces the individual ECUs that have already switched to operating status to send periodic messages.

[0218] In the third embodiment, the fourth device 64 is the third NM device 23 connected to the first device 61 on the same first communication bus 41. The fourth device 64 can also be an ECU connected to a different communication bus than the first device 61. For example, the fourth device 64 could be a fourth NM device 24 or a sixth NM device 26. Even in this case, the relay device 10 will take over the transmission of periodic messages when the fourth device 64 has been switched to standby mode.

[0219] ·like Figure 9 As shown, in the third embodiment, the relay device 10 sends the driving speed information sent by the fault-determined object as a periodic message. The relay device 10 may also send a message other than the driving speed information as a periodic message, even if the fault-determined object sends the driving speed information as a periodic message.

[0220] ·like Figure 9 As shown, in the third embodiment, when the relay device 10 stops sending NM messages 50 to the object being diagnosed, it determines that the object being diagnosed has entered a standby state and sends a periodic message. The basis for the relay device 10 to determine that the object being diagnosed has entered a standby state is not limited to the embodiments described above. For example, if the vehicle network system 100 has a second network 82, the relay device 10 can also determine that the object being diagnosed has entered a standby state based on communication through the second network 82.

[0221] In the third embodiment, the relay device 10 sends a periodic message that replaces the one sent by the first device 61 and a periodic message that replaces the one sent by the fourth device 64. Alternatively, the relay device 10 may not send a periodic message corresponding to each fault-determined object separately, but instead periodically send a single message containing an identifier representing the fault-determined object, replacing the periodic messages sent by each ECU. That is, the relay device 10 may periodically send a single message containing both an identifier representing the first device 61 and an identifier representing the fourth device 64.

[0222] The electronic control device includes a CPU (Central Processing Unit), RAM (Random Access Memory), and ROM (Read Only Memory). The electronic control device performs software processing. However, this is merely an example. For instance, the electronic control device may also include dedicated hardware circuitry for processing at least a portion of the software processing performed in the above embodiments. The dedicated hardware circuitry is, for example, an ASIC (Application Specific Integrated Circuit). That is, the electronic control device can be configured as any one of the following (a) to (c): (a) The electronic control device includes a processing unit that executes all processing according to a program, and a program storage device such as a ROM that stores the program. That is, the electronic control device includes a software execution unit. (b) The electronic control device includes a processing unit that executes a portion of the processing according to a program and a program storage device. Furthermore, the electronic control device includes dedicated hardware circuitry for executing the remaining processing. (c) The electronic control device includes dedicated hardware circuitry for executing all processing. Here, there may be multiple software execution units and / or dedicated hardware circuitry. That is, the above processing can be executed by a processing circuitry that includes at least one of the software execution unit and dedicated hardware circuitry. The processing circuit may include multiple software execution devices and dedicated hardware circuits. Program storage devices, i.e., computer-readable storage media, include any usable medium, i.e., storage devices, that can be accessed by a general-purpose or special-purpose computer. Programs can also be stored on non-volatile data storage media that can be read by a computer, such as CD-ROMs, and distributed as program products. Programs can also be provided as downloadable program products by information providers connected to networks such as the Internet.

Claims

1. An electronic control device, which is included in an in-vehicle network system and has network management functions, wherein, The network management functions include: (i) periodically sending operation requests, i.e., operation notifications, electronically to the communication object during periods when communication with the communication object is required; (ii) switching from a standby state (no communication) to a communicable operation state upon receiving the operation notification electronically from the communication object; and (iii) continuing the operation state during periods when the operation notification is periodically received electronically. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. A first communication bus is connected to the first device; A second communication bus is connected to the second device and the third device; and A relay device is connected to the first communication bus and the second communication bus, and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is the second device, configured to stop the fault determination based on the fact that the sending of the operation notification has been stopped.

2. The electronic control device according to claim 1, wherein, The fault determination is configured to restart after the fault determination has been stopped, based on the fact that the operation notification has been sent.

3. The electronic control device according to claim 1 or 2, wherein, The vehicle network system also includes a fourth device, which has the network management function and is configured to send the periodic messages. The electronic control device is configured as follows: The fault determination of the first device is performed based on the periodic message received from the first device. The fault determination of the fourth device is performed based on the periodic message received from the fourth device. The fault determination of the first device and the fourth device is stopped based on the fact that the sending of the operation notification has been stopped.

4. An electronic control device, which is included in an in-vehicle network system and has network management functions, wherein, The network management function includes: upon receiving an electronic message requesting operation, i.e., an operation notification, switching from a standby state (where no communication is required) to a communicable operational state. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. The first network is configured to relay the periodic messages and has a first communication bus connected to the first device and a second communication bus connected to the second device and the third device. A relay device, connected to the first communication bus and the second communication bus, and configured to electronically relay messages exchanged between multiple communication buses; and The second network, unlike the first network, connects the first device and the second device. The electronic control device is the second device, and is configured to stop the fault determination based on the fact that the first device has switched to the standby state by means of communication with the first device through the second network.

5. The electronic control device according to claim 4, wherein, The fault determination is configured to restart after the fault determination has been stopped, based on the fact that the first device has switched to the operating state by means of communication with the first device through the second network.

6. The electronic control device according to claim 4 or 5, wherein, The system is configured to restart the fault determination process after the fault determination has been stopped, based on the fact that the operation notification has been sent.

7. The electronic control device according to any one of claims 4 to 6, wherein, The vehicle network system further includes a fourth device, which has the network management function and is configured to connect to the second device via the first network and the second network, and to send the periodic messages via the first network. The electronic control device is configured as follows: The fault determination of the first device is performed based on the periodic message received from the first device. The fault determination of the fourth device is performed based on the periodic message received from the fourth device. The fault determination of the first device is stopped based on the fact that the first device has switched to the standby state, which is detected by communication with the first device through the second network. The fault determination of the fourth device is stopped based on the fact that the fourth device has switched to the standby state by means of communication with the fourth device through the second network.

8. The electronic control device according to any one of claims 1 to 7, wherein, The system is configured to receive a message containing information representing the speed of a vehicle equipped with the in-vehicle network system as the periodic message.

9. An electronic control device, which is included in an in-vehicle network system and has network management functions, wherein, The network management functions include: (i) periodically sending operation requests, i.e., operation notifications, electronically to the communication object during periods when communication with the communication object is required; (ii) switching from a standby state (no communication) to a communicable operation state upon receiving the operation notification electronically from the communication object; and (iii) continuing the operation state during periods when the operation notification is periodically received electronically. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. A first communication bus is connected to the first device; A second communication bus is connected to the second device and the third device; and A relay device is connected to the first communication bus and the second communication bus, and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is different from the first device and the second device, and is configured to send the periodic message to the second device instead of the first device when the first device enters the standby state.

10. The electronic control device according to claim 9, wherein, The electronic control device is the relay device. The system is configured to relay the operation notification during the period when a communication object of the first device sends the operation notification to the first device, and to periodically send the operation notification to the first device. The device is configured to determine that the first device is in standby mode based on the cessation of the transmission of the operation notification toward the first device, and to send the periodic message toward the second device.

11. The electronic control device according to claim 10, wherein, The system is configured such that, after the periodic message transmission has begun, the transmission of the periodic message to the second device is stopped if the operation notification has been sent to the first device.

12. The electronic control device according to any one of claims 9 to 11, wherein, The vehicle network system also includes a fourth device, which has the network management function and is configured to send the periodic messages. The electronic control device is different from the first device, the second device, and the fourth device. The second device is configured to perform fault determination on the first device based on the periodic message received from the first device, and to perform fault determination on the fourth device based on the periodic message received from the fourth device. The electronic control device is configured to, in response to the first device switching to the standby state, replace the first device in sending the periodic message for determining the fault of the first device to the second device. The electronic control device is configured to replace the fourth device in sending the periodic message for determining the fault of the fourth device to the second device, based on the situation where the fourth device switches to the standby state.

13. The electronic control device according to any one of claims 9 to 12, wherein, The first device is configured to send a message containing information representing the travel speed of a vehicle equipped with the vehicular network system as the periodic message. The electronic control device is configured to send a message containing information about the driving speed to the second device as a periodic message when the first device switches to the standby state.

14. A determination method, which is executed by an electronic control device included in an in-vehicle network system and having network management functions, wherein, The network management functions include: (i) periodically sending operation requests, i.e., operation notifications, electronically to the communication object during periods when communication with the communication object is required; (ii) switching from a standby state (no communication) to a communicable operation state upon receiving the operation notification electronically from the communication object; and (iii) continuing the operation state during periods when the operation notification is periodically received electronically. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. A first communication bus is connected to the first device; A second communication bus is connected to the second device and the third device; and A relay device is connected to the first communication bus and the second communication bus, and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is the second device. The determination method includes: based on the situation that the second device has stopped sending the operation notification, the processing circuit of the second device causes the fault determination performed by the second device to stop this processing.

15. A determination procedure product, executed by an electronic control device included in an in-vehicle network system and having network management functions, wherein, The network management functions include: (i) periodically sending operation requests, i.e., operation notifications, electronically to the communication object during periods when communication with the communication object is required; (ii) switching from a standby state (no communication) to a communicable operation state upon receiving the operation notification electronically from the communication object; and (iii) continuing the operation state during periods when the operation notification is periodically received electronically. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. A first communication bus is connected to the first device; A second communication bus is connected to the second device and the third device; and A relay device is connected to the first communication bus and the second communication bus, and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is the second device. When the determination procedure is executed by the processing circuit of the second device, the processing circuit performs the following: The fault determination process is stopped based on the fact that the second device has stopped sending the operation notification.

16. A determination method, which is executed by an electronic control device included in an in-vehicle network system and having network management functions, wherein, The network management function includes: upon receiving an electronic message requesting operation, i.e., an operation notification, switching from a standby state (where no communication is required) to a communicable operational state. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. The first network is configured to relay the periodic messages and has a first communication bus connected to the first device and a second communication bus connected to the second device and the third device. A relay device, connected to the first communication bus and the second communication bus, and configured to electronically relay messages exchanged between multiple communication buses; and The second network, unlike the first network, connects the first device and the second device. The electronic control device is the second device. The determination method includes: based on the fact that the second device senses that the first device has switched to the standby state through communication with the first device via the second network, the processing circuit of the second device causes the fault determination performed by the second device to stop this processing.

17. A determination procedure product, executed by an electronic control device included in an in-vehicle network system and having network management functions, wherein, The network management function includes: upon receiving an electronic message requesting operation, i.e., an operation notification, switching from a standby state (where no communication is required) to a communicable operational state. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. The first network is configured to relay the periodic messages and has a first communication bus connected to the first device and a second communication bus connected to the second device and the third device. A relay device, connected to the first communication bus and the second communication bus, and configured to electronically relay messages exchanged between multiple communication buses; and The second network, unlike the first network, connects the first device and the second device. The electronic control device is the second device. When the determination procedure is executed by the processing circuit of the second device, the processing circuit performs the following: based on the fact that the second device has sensed that the first device has switched to the standby state through communication with the first device via the second network, the fault determination process is stopped.

18. A transmission method, executed by an electronic control device included in an in-vehicle network system and having network management functions, wherein, The network management functions include: (i) periodically sending operation requests, i.e., operation notifications, electronically to the communication object during periods when communication with the communication object is required; (ii) switching from a standby state (no communication) to a communicable operation state upon receiving the operation notification electronically from the communication object; and (iii) continuing the operation state during periods when the operation notification is periodically received electronically. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. A first communication bus is connected to the first device; A second communication bus is connected to the second device and the third device; and A relay device is connected to the first communication bus and the second communication bus, and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is different from the first device and the second device. The sending method includes: based on the first device switching to the standby state, the processing circuit of the electronic control device causes the electronic control device to replace the first device in sending the periodic message to the second device.

19. A transmitting program product, executed by an electronic control device included in an in-vehicle network system and having network management functions, wherein, The network management functions include: (i) periodically sending operation requests, i.e., operation notifications, electronically to the communication object during periods when communication with the communication object is required; (ii) switching from a standby state (no communication) to a communicable operation state upon receiving the operation notification electronically from the communication object; and (iii) continuing the operation state during periods when the operation notification is periodically received electronically. The in-vehicle network system has the following features: The first device has the network management function and is configured to send periodically sent messages, i.e., periodic messages; The second device has the network management function and is configured to perform a fault determination based on the interruption of the reception of the periodic message from the first device, which determines that the first device has malfunctioned. The third device has the network management function and a local network function that, when receiving the operation notification, does not switch from the standby state to the operation state if the operation notification does not designate the third device as the recipient. A first communication bus is connected to the first device; A second communication bus is connected to the second device and the third device; and A relay device is connected to the first communication bus and the second communication bus, and is configured to electronically relay messages exchanged between multiple communication buses. The electronic control device is different from the first device and the second device. When the sending program is executed by the processing circuit of the electronic control device, the processing circuit performs the following process: replacing the first device to send the periodic message to the second device when the first device switches to the standby state.

Images