Control device switching system

Abstract

Control device switching system comprising: a plurality of control devices (1, 2, ..., n) in a vehicle, and connected to each other via a common communication line (6), wherein the control devices (1, 2, ..., n) include a communication control device (1) which performs transmission and reception of data with control devices other than itself, and a plurality of substitute candidate devices (2, 3, ..., n) capable of taking over a data transmission process to be performed by the communication control device (1), where: the communication control device (1) comprises a substitute transmission acceptance determination unit (13) configured to determine whether or not each of the substitute candidate devices (2, 3, ..., n) is in a state in which the data transmission process can be adopted, and a replacement request transmission unit (12) configured to transmit a replacement request to the replacement candidate device assigned to take over the data transmission process; and wherein the communication control device (1) determines the replacement candidate device assigned to take over the data transmission process based on a result of the determination by the replacement transmission acceptance determination unit (13), and transmits the replacement request from the replacement request transmission unit (12) to the assigned replacement candidate device before the communication control device (1) itself stops the data transmission process; and each of the replacement candidate devices (2, 3, ..., n) comprises a replacement transmission unit (21) configured to take over the data transmission process, and takes over the data transmission process using the replacement transmission unit (21) when the replacement request is received from the communication control device (1).

Description

BACKGROUND OF THE INVENTIONField of InventionThe present invention relates to a control device switching system for switching a control device that performs communication between a plurality of control devices included in a vehicle and connected to each other via a common communication line.Description of the Prior ArtA plurality of control devices described as ECU (Engl. Electronic control units) are included in a vehicle. These control devices perform transmission and reception of information via a common communication line to achieve the operations of the vehicle in cooperation with each other. These control devices are supplied with electric power from a battery, an alternator / motor, and the like mounted on the vehicle. However, as the number of control devices accommodated in a vehicle increases as in recent years, the amount of electric power consumed by the control devices accordingly tends to increase. As the power consumption amount increases, the power amount to be generated by the alternator and the like also increases, resulting in deteriorated fuel consumption of the vehicle. For this reason, there is a need for lower power consumption for vehicles, and the control devices must also meet the need for lower power consumption.Conventionally, various techniques have been employed for the control devices to meet the demand for lower power consumption. Primary examples of the techniques include disabling the power device to the control devices that do not need to be powered up and placing the control devices in a sleep state. However, in a network equipped with an abnormality sensing device, a control device that does not perform data reception for a predetermined period may be considered problematic, and an abnormality process may be started therefor.To solve such a problem, Patent Document 1 provides a transmission-reception control device having a function of stopping the transmission and reception function of another control device among a plurality of control devices connected to a network to which the power of the other control device is cut off or this is brought into a sleep state. The transmission-reception control device performs, as a substitute, the data transmission that should be performed by the target control device whose transmission and reception are stopped. The power consumption of a vehicle is thereby reduced without causing the abnormality sensing device for sensing a data abnormality in the network to sense an abnormality.Patent Document 1: JP-A-2013-6454In Patent Document 1, the transmission-reception control device stops transmission and reception of the target control device, and thereafter, performs the data transmission that should be performed by the target control device as explained above. However, when the transmission-reception control device is out of operation or under a high processing load, or when it executes other important processes, an event occurs that the transmission-reception control device cannot replace the data transmission. This event is detected by the anomaly sensing device as a network fault. Moreover, when the transmission-reception control device is forced to take over the data transmission to be originally performed by the target control device while the transmission-reception control device is under a high processing load or performs an important process, the transmission-reception control device loses its real-time behavior, resulting in an error in the behavior of the vehicle.US 2010 / 0 106 323 A1 discloses an HVAC data processing and communication network having a first subnetwork and a second subnetwork. The first subnet includes a first demand unit, a first comfort sensor, and a first subnet controller. The second subnet includes a second subnet with a second demand unit, a second comfort sensor, and a second subnet controller. The second subnet controller is configured to control operation of the first subnet.US 2005 / 0 134 115 A1 discloses a method for protecting against theft in working machines. Thus, one or more operating systems may be controlled and different levels of access to work machines may be provided. The corresponding methods and systems can react to bridging attempts in order to ensure robust theft protection. One or more control modules embedded in a work machine may be used to perform anti-theft services. Corresponding methods and systems may further enable a first control module to restrict access to a first operating system in a work machine and enable a second control module to restrict access to a second operating system in the work machine. The first control module may identify the replacement of a new control module with the second control module and automatically configure the new control module to restrict access to the second operating system in the work machine.DE 41 28 922 A1 describes an electronic controller for a vehicle with memories for control sequences and data values and pointers for selecting appropriate control sequences and data values. Therefore, control can be applied to a variety of different types of vehicles. A portable programmer is in communication with a host computer and programs the controllers. The possibility of selecting wrong control is thereby eliminated.SUMMARY OF THE INVENTIONThis invention is to solve the above-described problems, and an object of the invention is to obtain a control device switching system including a plurality of control devices connected to a common communication line that reliably performs a data transmission process that should be performed by a communication control device entering a sleep state or a shutdown state, so as not to cause errors in a network or abnormalities in the behavior of a vehicle.The invention provides a control device switching system including: a plurality of control devices in a vehicle and connected to each other via a common communication line, the control devices including a communication control device that performs transmission and reception of data with control devices other than itself, and a plurality of replacement candidate devices capable of adopting a data transmission process to be performed by the communication control device, wherein: the communication control device includes a replacement transmission acceptance determination unit configured to determine whether or not each of the replacement candidate devices is in a state in which the data transmission process can be adopted, and a replacement request transmission unit configured to transmit a replacement request to the replacement candidate device assigned to adopt the data transmission process; Wherein the communication control device determines the replacement candidate device assigned to take over the data transmission process based on a result of the determination by the replacement transmission acceptance determination unit, and transmits the replacement request from the replacement request transmission unit to the assigned replacement candidate device before the communication control device itself stops the data transmission process; and each of the replacement candidate devices includes a replacement transmission unit configured to take over the data transmission process, and takes over the data transmission process using the replacement transmission unit when the replacement request is received from the communication control device.In another preferred embodiment, the invention provides a control device switching system including: a plurality of control devices included in a vehicle and connected to each other via a common communication line, the control devices including a communication control device that performs transmission and reception of data with control devices other than itself, and a plurality of replacement candidate devices that can take over a data transfer process to be performed by the communication control device, wherein: the communication control device includes a replacement request transmission unit configured to simultaneously transmit a provisional replacement request to all the replacement candidate devices and transmit a real replacement request to the replacement candidate device assigned to take over the data transfer process before the communication control device itself stops the data transfer process; wherein each of the substitute candidate devices includes a third substitute transmission acceptance determination unit configured to determine whether or not the substitute candidate device itself is in a state in which the data transmission process can be adopted when the substitute candidate device receives the provisional substitute request from the communication control device, and a substitute transmission unit configured to adopt the data transmission process when the substitute candidate device receives the real substitute request from the communication control device, to perform the determination by the third substitute transmission acceptance determination unit, and to transmit the determination result to the communication control device when it is determined as in a state in which the data transmission process can be adopted; and wherein the communication control device determines a substitute candidate device assigned to take over the data transmission process based on the determination results transmitted from the substitute candidate devices and transmits the genuine substitute request to the assigned substitute candidate device from the substitute request transmission unit.In this invention, the substitution request is transmitted to the substitute candidate device determined by the substitute transmission acceptance determination unit of the communication control device to be able to take over the data transmission process before going to the communication control device in a sleep state or a power-off state. As a result, the data transfer process to be performed by the communication control device can be reliably adopted, so that it is possible to obtain a control device switching system that does not cause network errors or abnormalities in vehicle behavior.Moreover, the provisional replacement request is transmitted to all the replacement candidate devices, and the genuine replacement request is transmitted to the replacement candidate device determined by the third replacement transmission acceptance determination unit to be able to adopt the data transmission process before the communication control device enters a sleep state or a shutdown state. As a result, the data transfer process to be performed by the communication control device can be reliably adopted, so that it is possible to obtain a control device switching system that does not cause network errors or abnormalities in vehicle behavior.The above and other objects, features, aspects and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings.BRIEF DESCRIPTION OF THE DRAWINGSFIG. 1 is a diagram for illustrating the configuration of a control device switching system according to a first preferred embodiment of the invention. FIG. 2 shows the configuration of a communication control device and a substitute candidate device in the control device switching system according to the first preferred embodiment of the invention. FIG. 3 is a diagram for illustrating an example of a substituteable processing load size table in the control device switching system according to the first preferred embodiment of the invention. FIG. 4 is a diagram illustrating an example of the process flow in which a communication control device determines an actual replacement device among replacement candidate devices in the control device switching system according to the first preferred embodiment of the invention. FIG. 5 is a diagram for illustrating an example of a substituteable process importance level table in the control device switching system according to the first embodiment of the invention. FIG. 6 is a diagram illustrating an example of the process flow in which a communication control device determines an actual replacement device among replacement candidate devices in the control device switching system according to the first embodiment of the invention. FIG. 7 is a flowchart illustrating an example of the process flow in which a communication control device determines a replacement device among replacement candidate devices in the control device switching system according to the first preferred embodiment of the invention. FIG. 8 is a diagram for illustrating the priority of substitute candidate devices in the control device switching system according to the first embodiment of the invention. FIG. 9 is a flowchart illustrating an example of the process flow in which a communication control device determines a replacement device among replacement candidate devices in the control device switching system with the first preferred embodiment of the invention. FIG. 10 is a diagram for illustrating the configuration of a control device switching system according to a second preferred embodiment of the invention. FIG. 11 is a diagram for illustrating the configuration of a substitute candidate device in the control device switching system according to the second preferred embodiment of the invention. FIG. 12 is a flowchart illustrating an example of the process flow in which a replacement device determines a next replacement device in the control device switching system according to the second preferred embodiment of the invention. FIG. 13 is a flowchart illustrating an example of the process flow in which a replacement device determines a next replacement device in the control device switching system according to the second preferred embodiment of the invention. FIG. 14 is a diagram for illustrating another configuration of the control device switching system according to the second preferred embodiment of the invention. FIG. 15 is a flowchart illustrating an example of the process flow in which a monitoring control device determines a next spare device in the control device switching system according to the second preferred embodiment of the invention. FIG. 16 is a diagram for illustrating the configuration of a control device switching system according to a third preferred embodiment of the invention. FIG. 17 shows the configuration of a communication control device and a substitute candidate device in the control device switching system according to the third preferred embodiment of the invention. FIG. 18 is a diagram illustrating a spare ECU queue in the control device switching system according to the third preferred embodiment of the invention. FIG. 19 is a flowchart illustrating an example of the process flow in which a communication control device determines a replacement device among replacement candidate devices in the control device switching system according to the third preferred embodiment of the invention. FIG. 20 is a diagram illustrating the configuration of a substitute candidate device in a control device switching system according to a fourth preferred embodiment of the invention. FIG. 21 shows tables stored in a storage device provided in a substitute candidate device of the control device switching system according to the fourth preferred embodiment of the invention. FIG. 22 is a diagram illustrating the configuration of a substitute candidate device of a control device switching system according to a fifth preferred embodiment of the invention. FIG. 23 is a diagram for illustrating the functions of a data adjustment unit provided in a substitute candidate device of the control device switching system according to the fifth preferred embodiment of the invention. FIG. 24 is a diagram illustrating the configuration of a substitute candidate device according to a sixth preferred embodiment of the invention. FIG. 25 is a diagram for illustrating the functions of a control period adjustment unit provided in a substitute candidate device of the control device switching system according to the sixth preferred embodiment of the invention. FIG. 26 is a diagram showing the configuration of a substitute candidate device of a control device switching system according to a seventh preferred embodiment of the invention. FIG. 27 is a diagram for illustrating the functions of a clock frequency adjusting unit provided in a substitute candidate device of the control device switching system according to the seventh preferred embodiment of the invention. FIG. 28 is a diagram illustrating the configuration of a substitute candidate device of a control device switching system according to an eighth preferred embodiment of the invention. FIG. 29 is a diagram for illustrating the functions of a data synchronization unit provided in a substitute candidate device of the control device switching system according to the eighth preferred embodiment of the invention. FIG. 30 is a diagram illustrating the configuration of a communication control device in a control device switching system according to a ninth preferred embodiment of the invention. FIG. 31 is a flowchart illustrating a process flow at the time when a communication control device in the control device switching system according to the ninth preferred embodiment of the invention resumes a data transmission process. FIG. 32 shows the configuration of a communication control device and a substitute candidate device in a control device switching system according to a tenth preferred embodiment of the invention. FIG. 33 is a flowchart illustrating an example of the process flow in which a communication control device manages replacement with a replacement device with respect to time in the control device switching system according to the tenth preferred embodiment of the invention. FIG. 34 is a diagram illustrating the configuration of a substitute candidate device in a control device switching system according to an eleventh preferred embodiment of the invention. FIG. 35 is a diagram for illustrating the functions of a data communication period adjustment unit provided in a substitute candidate device of the control device switching system according to the eleventh preferred embodiment of the invention. FIG. 36 is a diagram illustrating the configuration of a substitute candidate device in a control device switching system according to a twelfth preferred embodiment of the invention. FIG. 37 is a diagram for illustrating the functions of a data communication period adjustment unit and a vehicle condition sensing unit provided in a substitute candidate device of the control device switching system according to the twelfth preferred embodiment of the invention. FIG. 38 is a diagram for illustrating the functions of a data communication period adjustment unit provided in a substitute candidate device of the control device switching system according to the twelfth preferred embodiment of the invention.DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTFirst Preferred EmbodimentNext, a control device switching system according to a first preferred embodiment of the invention will be explained with reference to the drawings. FIG. 1 is a diagram for illustrating the configuration of a control device switching system according to the first preferred embodiment. Note that the same or corresponding component portions are denoted by the same reference numerals throughout the drawings referred to hereinafter to avoid repetitive description.A control device switching system 100 according to the first preferred embodiment is one in which a plurality of control devices ECUs 1 to n (n>3) included in a vehicle are connected to each other via a network 6 which is a common communication line. These control devices include a communication control device that performs transmission and reception of data with control devices other than itself, and a plurality of substitute candidate devices that can adopt a data transmission process to be performed by this communication control device. In the following description, it is assumed that the ECU 1 is the communication control device, and it is assumed that the ECUs 2 to m (m<n) are the substitute candidate devices. A spare device that actually executes a spare process is allocated among the ECUs 2 to m.Each of the substitute candidate devices ECU 2 to m is a control device that executes a predetermined process with respect to a vehicle. The substitute candidate devices may be, for example, a drive-related ECU involved in a motor, an engine, and the like; a safety-related ECU involved in an airbag and the like; a body-related ECU involved in adjustment and the like of seats and lights; and an information-related ECU involved in a navigation device and the like. These ECUs 2 to m do not give their intrinsic processes even if they are allowed to take over the data transfer process performed by the ECU 1, and they process the replacement process together with their intrinsic processes for which they are responsible.FIG. 2A shows the configuration of the communication control device ECU 1, and FIG. 2B shows the configuration of the substitute candidate device ECU 2. The configurations of the other substitute candidate devices ECUs 3 to m are the same as those of the ECU 2, and the drawings and explanations thereof are therefore not repeated. Note that although each of the communication control device and the substitute candidate devices has different functions other than those shown in FIG. 2, only the components related to the function that allows a substitute candidate device to take over the data transmission process of the communication control device are shown here.The ECU 1 includes a communication reception execution / stop unit 11, a replacement request transmission unit 12, a replacement transmission acceptance determination unit 10, a sleep condition setting determination unit 14, a sleep process unit 15, and a wake-up process unit 16. The data transmission reception execution / stop unit 11 performs data transmission and reception with external devices, and also stops data transmission and reception with the external devices when it is set to a sleep state or power is turned off. The conditions for which the communication reception execution / stop unit 11 stops the communication and reception include a case where a sleep request is transmitted from an ECU other than the ECU 1 via the network 6, such as partial networking, in addition to the sleep process and the self-shutdown.The replacement request transmission unit 12 transmits a replacement request to a replacement candidate device assigned to adopt the data transmission process performed by the ECU 1 itself. The substitute transmission acceptance determination unit 13 determines whether or not each of the substitute candidate devices ECUs 2 to m is in a state in which the takeover of the data transmission process is possible. The sleep condition establishment determination unit 14 determines whether or not the sleep condition of the ECU 1 itself is established. The sleep processing unit 15 executes a process for establishing a sleep state after the sleep condition establishment determination unit 14 determines that the sleep condition is established and the communication reception execution / stop unit 11 has stopped the communication and the reception. The waking process unit 16 executes a process of returning from the sleep state.Meanwhile, the ECU 2 includes a substitute transmission unit 21 configured to adopt the data transmission process to be performed by the ECU 1, and starts adopting the data transmission process using the substitute transmission unit 21 when receiving a substitute request from the ECU 1.Next, the operations of the ECU 1 and the ECUs 2 to m in the control device switching system 100 according to the first preferred embodiment will be described with reference to FIG. 1. When a sleep condition of the ECU 1 is established, for example, by a dedicated timer process, the ECU 1 allows a substitute transmission acceptance determination unit 13 to perform a substitute transmission acceptance determination 13 ato determine whether or not each substitute candidate device ECUs 2 to mis in a state in which the data transmission process can be adopted before the ECU 1 stops the data transmission process (the criteria for the determination will be explained later). The ECU 1 determines a substitute candidate device assigned to take over the data transmission process based on the determination result by the substitute transmission acceptance determination unit 13.When the ECU 1 determines the substitute candidate device allowed to act as a substitute (ECU 3 in FIG. 1 ), the ECU 1 notifies the substitute request transmission unit 12 thereof. The ECU 1 further transmits a substitution request 12 afrom the substitution request transmission unit 12 to the ECU 3 via the network 6. The ECU 3 that has received the replacement request 12 afrom the ECU 1 serves as a replacement device and starts to adopt the data transmission process using the replacement transmission unit 21.In the first preferred embodiment, the substitute transmission acceptance determination unit 13 of the ECU 1 uses one of the current processing load amount, the process importance level, or the failure determination result of each of the substitute candidate devices ECUs 2 to m as the determination criterion to determine whether or not each of the substitute candidate devices ECUs 2 to m is in a state in which the data transmission process can be adopted. These determination criteria may be used in combination in making the determination.In the case where the substitute transmission acceptance determination unit 13 of the ECU 1 makes a determination regarding the substitute acceptance based on the current processing load amount of the ECUs 2 to m, the ECU 1 has a substituteable processing load amount table as shown in FIG. 3. The substituteable processing load size table stores the processing load threshold value PL th, which is set based on the upper limit of the processing load size for each of the ECUs 2 to m.In a microcomputer incorporated in the ECU, generally, the microcomputer is designed with many interrupt processes with tolerance (narrow. Margin) in the processing load size is used when there is no interrupt. However, when there are many interrupts, the processing load size becomes nearly 100%. The number of interrupts varies from one ECU to another, so that the upper limit of the processing load size is set in consideration of the number of interrupts according to the above-described guidance. Alternatively, when the upper limit of the processing load amount of each microcomputer is configured to include a certain tolerance, the tolerance amount may be used for the substitution process.The substitute transmission acceptance determination unit 13 of the ECU 1 acquires the current processing load amount of each of the ECUs 2 to m via the network 6, and determines a substitute ECU by looking up the substituteable processing load amount table. This prevents an ECU having a high processing load from being assigned as a replacement device, and changes the intrinsic process and the replacement process of the ECU assigned as the replacement device from exceeding the original control period.With reference to a flowchart of FIG. 4, the following describes the flow of the process in which the substitute transmission acceptance determination unit 13 of the ECU 1 determines the substitute device based on the processing load amount of the substitute candidate devices ECUs 2 to m in the control device switching system 100 according to the first preferred embodiment. Note that the same step number indicates the same process in all the following flowcharts, and the description will not be repeated.In step 10 (S 10), the ECU 1 first determines whether or not the sleep condition exists using the sleep condition establishment determination unit 10. If the sleep condition is set at S 10 (Yes), the substitute transmission acceptance determination unit 13 is notified and the process proceeds to step 20 (S 20).At S 20, the substitute transmission acceptance determination unit 13 of the ECU 1 acquires the current processing load amount of the ECU 2 and compares it with the value in the substituteable processing load table (FIG. 3 ). When the current processing load amount of the ECU 2 detected by the ECU 1 does not exceed the substituteable processing load amount PL th2(60%) in the substituteable processing load table (Yes), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 2 can act as a substitute, and the substitute request transmission unit 12 of the ECU 1 transmits a substitute request to the ECU 2 in step 30 (S 30).On the other hand, when the processing load amount of the ECU 2 exceeds the substituteable processing load amount PL th2 of the ECU 2 at S 20 (NO), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 2 is unable to act as a substitute, and the process proceeds to step 201 (S 201). At S 201, the current processing load amount of the ECU 3 is acquired, and it is determined whether or not the acquired current processing load amount is equal to or less than the substituteable processing load amount PL th3(40%) of the substituteable processing load table.At S 201, when the processing load amount of the ECU 3 does not exceed the substituteable processing load amount PL th3 of the ECU 3 (YES), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 3 is capable of acting as a substitute, and the substitute request transmission unit 12 of the ECU 1 transmits a substitute request to the ECU 3 at step S 202 (S 202).On the other hand, when the processing load amount of the ECU 3 exceeds the substituteable processing load amount PL th3 of the ECU 3 at S 201 (No), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 3 is unable to act as a substitute, and performs the same determination for one by one of the other substitute candidate devices ECUs 4 to m. The ECU 1 finally transmits a substitute instruction to one of the substitute candidate devices ECU m in step 203 (S 203).Subsequently, in step 40 (S 40), the ECU 1 stops the data transmission and reception using the data transmission reception execution / stop unit 11 and starts a sleep process using the sleep process unit 15.In the case where the substitute transmission acceptance determination unit 13 of the ECU 1 makes a determination regarding the substitute acceptance based on the process importance level in the ECUs 2 to m, the ECU 1 has a substituteable process importance level table as shown in FIG. 5. The substituteable process importance level table stores the maximum value of a process importance level PI for each of the ECUs 2 to m.The process importance level is the importance level (engl. Import Level) of Process Executed by ECUs 2 to m. For example, when a period acquisition process is executed for a sensor value assumed to change little from the previous value, the process importance level is low, and is set as "1", for example. On the other hand, when a process having a high execution feasibility is executed, such as a hardware interrupt, the process importance level is high and is set as "10", for example. As the process importance level is higher, it is less desirable to interrupt the process and it is more difficult to execute another process.The substituteable process importance level table stores the maximum value of the process importance level at which the ECUs can act as a substitute, and when the current process is equal to or less than the level, a judgment is made that the ECU can act as a substitute. The substitute transmission acceptance determination unit 13 of the ECU 1 acquires the importance level of the process currently executed by each of the ECUs 2 to m via the network 6, and determines a substitute ECU by looking up the substituteable process importance level table. This can prevent a process having a high importance level from being interrupted.FIG. 6 is a flowchart illustrating the flow of a process until the substitute transmission acceptance determination unit 13 of the ECU determines a substitute device based on the process importance level in the ECUs 2 to m, which are substitute candidate devices, in the control device switching system 100. In step 21 (S 21), the substitute transmission acceptance determination unit 13 of the ECU 1 acquires the process importance level of the ECU 2 and compares it with the value in the substituteable process importance level table (FIG. 5 ). When the process importance level of the ECU 2 detected by the ECU 1 does not exceed the substituteable process importance level PI th2 in the substituteable process importance level table (Yes), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 2 can act as a substitute, and the process proceeds to step 30 (S 30).On the other hand, when the process importance level of the ECU 2 exceeds the substituteable process importance level PI th2 at S 21 (NO), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 2 is unable to act as a substitute, and the process proceeds to step 211 (S 211). At S 211, the process importance level of the ECU 3 is detected, and it is determined whether or not the detected process importance level is equal to or lower than the substituteable process importance level PI th3 of the substituteable process importance level table. At S 211, when the process importance level of the ECU 3 does not exceed the substituteable process importance level PI th3 of the ECU 3 (YES), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 3 is capable of acting as a substitute, and the substitute request transmission unit 12 of the ECU 1 transmits a substitute request to the ECU 3 at step 212 (S 212).On the other hand, when the process importance level of the ECU 3 exceeds the substituteable process importance level PI th3 of the ECU 3 at S 211 (No), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 3 is unable to act as a substitute, and performs the same determination sequentially for the other substitute candidate devices ECUs 4 to m. The ECU 1 end-transmits a substitute instruction to a substitute candidate device ECU m in step 213 (S 213). The subsequent process is the same as that shown in FIG. 4, so the description thereof will not be repeated.FIG. 7 is a flowchart illustrating the processing flow until the substitute transmission acceptance determination unit 13 of the ECU 1 determines a substitute device based on the failure determination result for the substitute candidate devices ECUs 2 to m in the control device switching system 100 according to the first preferred embodiment. In step 22 (S 22), the substitute transmission acceptance determination unit 13 of the ECU 1 detects the failure determination result for the ECU 2 via the network 6. when the failure determination result for the ECU 2 indicates "no failure" (Yes), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 2 is capable of acting as a substitute, and the process proceeds to step 30 (S 30).On the other hand, when the failure determination result for the ECU 2 indicates a "failure" (No) at S 22, the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 2 is unable to act as a substitute, and the process proceeds to step 221 (S 221). At S221, the failure determination result for the ECU 3 is detected, and if the result indicates "no failure" (Yes), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 3 is capable of acting as a substitute. In step 222 (S222), the substitute request transmission unit 12 of the ECU 1 transmits a substitute request to the ECU 3.On the other hand, when the failure determination result for the ECU 3 indicates a "failure" at S 221 (No), the substitute transmission acceptance determination unit 13 of the ECU 1 determines that the ECU 3 is unable to act as a substitute, and performs the same determination sequentially for the other substitute candidate devices ECUs 4 to m. The ECU 1 finally transmits a substitute instruction to one of the substitute candidate devices ECU m in step 223 (S 223). The subsequent process is the same as that shown in FIG. 4, so the description thereof will not be repeated.Moreover, when determining whether or not each of the ECUs 2 to m is in a state in which the data transmission process can be adopted, the substitute transmission acceptance determination unit 13 of the ECU 1 may sequentially perform the determination in an ascending order from the ECU having the lowest process importance level in which the process importance level is looked up by each of the ECUs. That is, an ECU executing a process having a high importance level should primarily execute the original process, and an ECU executing a process having a lower importance level should adopt the process.FIG. 8 shows an example of the process importance levels of the ECUs that are substitute candidate devices. The substitute transmission acceptance determination unit 13 has a table storing process importance levels of the ECUs as shown in FIG. 8, and determines the order of determination as to whether or not each of the substitute candidate devices ECUs 2 to m is in a state in which they can act as a substitute, based on the process importance level of each of the ECUs.While the vehicle is running, an ECU related to the running involved in the running and an ECU related to the safety necessary for preventing accidents have higher process importance levels. Here, it is assumed that the ECU 5 is a body-related ECU involved in seat adjustment, light adjustment, or the like, the ECU 4 is an information-related ECU involved in a navigation device, smartphone integration, or the like, and the ECU 3 is a safety-related ECU involved in an ADAS (Engl. In addition, the advanced driving assistance system), the airbag, and the like are involved, and the ECU 2 is a traveling-related ECU involved in a motor in an engine. The relevant levels of importance are then in the order shown in Figure 8.On the other hand, while the vehicle is stationary, the importance level of the ECU 5, which is a body-related ECU, is higher because body-related devices such as lights and a keyless entry system are expected to be used. Therefore, while the vehicle is stationary, the importance level of the ECU 5 is increased and the importance level of the ECU 2, which is a traveling-related ECU, is decreased.FIG. 9 is a flowchart illustrating the process flow until the substitute transmission acceptance determination unit 13 of the ECU 1 determines a substitute device based on the process importance level in the ECUs 2 to m in the control device switching system 100 according to the first preferred embodiment. In FIG. 9, it is assumed that the vehicle is traveling, and the process importance levels of the ECUs are as shown in FIG. 8.In step 23 (S 23), the substitute transmission acceptance determination unit 13 of the ECU 1 determines whether or not the ECU 5 having the lowest process importance level is in a state in which the data transmission process can be adopted. The processing load amount, the process importance level, and the failure determination result of the ECU 5 described above are used for the determination criteria at this time. When it is determined at S 23 that the ECU 5 is able to act as a substitute (Yes), the process proceeds to step 31 (S 31), and the substitute request transmission unit 12 of the ECU 1 transmits a substitute request to the ECU 5.On the other hand, when it is determined at S 23 that the ECU 5 is unable to act as a substitute (No), the process proceeds to step 231 (S 231), and it is determined whether or not the ECU 4 having the next lowest process importance level is in a state in which the data transmission process can be adopted. When it is determined at S 233 that the ECU 4 is able to act as a substitute (Yes), the process proceeds to step 232 (S 232), and the substitute request transmission unit 12 of the ECU 1 transmits a substitute request to the ECU 4. When it is determined at S 233 that the ECU 4 is unable to act as a substitute, the same determination is made for the ECU 3 having the next lowest process importance level, and the ECU 1 transmits, at the end, a substitute instruction to the ECU 2 having the highest process importance level at step 233 (S 233).Thus, when the substitute transmission acceptance determination unit 13 performs a substitute process acceptance determination in consideration of the process importance levels of the ECUs 2 to m, the driving-related ECU and the safety-related ECU that have high importance levels during driving can be prevented from assuming the process, thereby stabilizing the behavior of the vehicle. Moreover, each of the ECUs 2 to m can execute a desired process depending on the operation of changing the order of determination made by the substitute transmission acceptance determination unit 13 for driving and standstill.With the control device switching system 100 according to the first preferred embodiment, as described above, a substitution request is transmitted to an ECU among the substitute candidate devices ECUs 2 to m determined by the substitute transmission acceptance determination unit 13 to be able to take over the data transmission process before the communication control device ECU 1 enters a sleep state or a shutdown state. Therefore, the data transmission process performed by the ECU 1 can be reliably adopted.Moreover, the substituteable processing load amount, the substituteable process importance level, or the failure determination result at each of the ECUs is used as the determination criterion when the substitute transmission acceptance determination unit 13 of the ECU 1 determines a substitute device or the ECUs 2 to m, and the determination is also made in the order that takes into account the process importance level of each of the ECUs while the vehicle is running or at a standstill. As a result, failures in the network 6 or abnormal behavior of the vehicle can be prevented.Second Preferred EmbodimentFIG. 10 shows the configuration of a control device switching system 100A according to a second preferred embodiment of the invention. FIG. 11 shows the configuration of a substitute candidate device ECU 2 in the second preferred embodiment. The configuration of the communication control device ECU 1 in the second preferred embodiment is the same as that in the first preferred embodiment described above, so a description thereof will be made with reference to FIG. 2A again.In the control device switching system 100A, each of the substitute candidate devices ECUs 2 to m includes a substitute request transmission unit 22, which is the second substitute request transmission unit, and a substitute transmission acceptance determination unit 23, which is the second substitute transmission acceptance determination unit. The replacement request transmission unit 22 transmits a replacement request to a replacement candidate device other than the own dedicated to adopting the data transmission process. The substitute transmission acceptance determination unit 23 determines whether or not the substitute candidate device itself and the other substitute candidate devices are in a state in which they can take over the data transmission process.The operation of the ECU 1 and the ECUs 2 to m in the control device switching system 100A according to the second preferred embodiment will be explained with reference to FIG. 10. Upon receiving a substitute request 12 afrom the ECU 1 for which the sleep condition has been established, the ECU 2 starts to adopt the data transmission process and thereafter determines whether or not the ECU 2 itself is in a state in which the data transmission process can be adopted using the substitute transmission acceptance determination unit 23 thereof. Note that the substituteable processing load amount and the substituteable process importance level of each of the ECUs can be used as the criterion of determination by the substitute transmission acceptance determination unit 23, similarly to the first preferred embodiment.When it is determined that the ECU itself is not in a state in which the data transmission process can be adopted, the substitute transmission acceptance determination unit 23 performs a substitute transmission acceptance determination 23 afor a substitute candidate device other than itself (here, for the ECU 3). When it is determined that the ECU 3 is able to act as a substitute, the substitute request transmission unit 22 of the ECU 2 transmits a substitute request 22 ato the ECU 3. The ECU 3 that has received the substitute request 22 afrom the ECU 2 serves as the next substitute device and starts to adopt the data transmission process.FIG. 12 is a flowchart illustrating the processing flow until the substitute transmission acceptance determination unit 23 of the substitute device ECU 2 determines a next substitute device based on the processing load amount of the other substitute candidate devices ECUs 3 to m in the control device switching system 100A. The substituteable processing load size table looked up by the substitute transmission acceptance determination unit 23 in FIG. 12 is the same as that in the above first preferred embodiment, and the description thereof is therefore not repeated (see FIG. 3 ).In step 11 (S 11), the substitute device ECU 2 starts to act as a substitute for the communication control device ECU 1. Subsequently, in step 24 (S 24), the substitute transmission acceptance determination unit 23 of the ECU 2 acquires the own processing load quantity PL th2, and when the acquired value does not exceed the substituteable processing load quantity PL th2 in the substituteable processing load table (Yes), the ECU 2 further acts as a substitute.On the other hand, when the processing load amount of the ECU 2 exceeds the substituteable processing load amount (No) at S 24, the substitute transmission acceptance determination unit 23 of the ECU 2 determines that the ECU 2 can no longer act as a substitute, and the process proceeds to step 241 (S 241). At S 241, the substitute transmission acceptance determination unit 23 of the ECU 2 acquires the processing load amount of the ECU 3. If the acquired value does not exceed the substituteable processing load amount PL th3 in the substituteable processing load table (Yes), it is determined that the ECU 3 is able to act as a substitute, and the substitute request transmission unit 22 is notified of this.In step 242 (S 242), the replacement request transmission unit 22 of the ECU 2 subsequently transmits the replacement request 22 ato the ECU 3. In step 243 (S 243), the ECU thereafter stops acting as a replacement, and in step 244 (S 244), the ECU 3 starts acting as a replacement.On the other hand, when the processing load amount of the ECU 3 exceeds the substituteable processing load amount PL th3 at S 241 (No), the substitute transmission acceptance determination unit 23 of the ECU 2 determines that the ECU 3 is unable to act as a substitute, and performs the same determination sequentially for the other substitute candidate devices ECUs 4 to m. The ECU 2 transmits, in the end, a substitute instruction to a substitute candidate device ECU m in step 245 (S 245). In step 246 (S246), the ECU 2 stops acting as a substitute, and in step 247 (S247), the ECU m starts acting as a substitute.FIG. 13 is a flowchart illustrating a process flow until the substitute transmission acceptance determination unit 23 of the substitute device ECU 2 determines a next substitute device based on the processing importance level of the other substitute candidate devices ECUs 3 to m in the control device switching system 100A. The substituteable process importance level table looked up by the substitute transmission acceptance determination unit 23 in FIG. 13 is the same as that in the above first preferred embodiment, and the description thereof is therefore not repeated (see FIG. 5 ).The ECU 2 starts acting as a substitute for the ECU 1 at S 11. In step 25 (S 25), the substitute transmission acceptance determination unit 23 of the ECU 2 acquires the process importance level PI th2 of itself, and when the acquired value does not exceed the substituteable process importance level PI th2 in the substitute level process importance level table (Yes), the ECU 2 continues the substitute transmission.On the other hand, when the process importance level of the ECU 2 exceeds the backup level process importance level at S 25 (NO), the backup transmission acceptance determination unit 23 of the ECU 2 determines that the ECU 2 cannot continue the backup transmission, and the process proceeds to step 251 (S 251). At S 251, the substitute transmission acceptance determination unit 23 of the ECU 2 detects the process importance level of the ECU 3. When the detected value does not exceed the substituteable process importance level PI th3 in the substituteable process importance level table (Yes), it is determined that the ECU 3 is able to act as a substitute, and the substitute request transmission unit 22 is notified thereof.On the other hand, when the process importance level of the ECU 3 exceeds the substituteable process importance level PI th3 at S 251 (No), the substitute transmission acceptance determination unit 23 of the ECU 2 determines that the ECU 3 is unable to act as a substitute. Subsequent steps S 252 to S 157 are the same as S 242 to S 247 shown in FIG. 12, so the description thereof will not be repeated.FIG. 14 shows another configuration of the control device switching system according to the second preferred embodiment. A control device switching system 100B shown in FIG. 14 uses at least one (ECU m in FIG. 14 ) of the replacement candidate devices ECUs 2 to m as a monitoring control device, and detects a fault in the communication control device ECU 1 and the replacement candidate devices ECUs 2 to (m- 1) using the monitoring control device.The monitoring control device includes at least an error determination unit, a backup transmission continuation determination unit, and a third backup request transmission unit (all not shown). The failure determination unit performs failure determination (indicated as 23 bin FIG. 14 ) as to whether or not a failure is in the ECU 1 and the ECUs 2 to (m- 1). The substitute transmission continuation determination unit determines whether or not the substitute candidate device that adopts the data transmission process (the ECU 2 in FIG. 14 ) can further act as a substitute, based on the result of the determination by the failure determination unit. The third replacement request transmission unit is a replacement request 22 bfor the data transmission process to a replacement candidate device determined by the failure determination unit not to have a failure (the ECU 3 in FIG. 14 ).FIG. 15 is a flowchart illustrating a process flow until the next spare device is determined based on the failure determination result by the monitoring control device ECU m in the control device switching system 100B. In step 26 (S 26), the failure determination unit of the monitoring control device of the ECU m determines whether or not there is a failure in the replacement device ECU 2. When it is determined that there is no error (Yes), the backup transmission continuation determination unit of the ECU m determines that it is possible for the ECU 2 to further act as a backup, and the ECU 2 continues the backup transmission.On the other hand, when it is determined at S 26 that there is a failure in the ECU 2 (No), the substitute transmission continuation determination unit of the ECU m determines that it is not possible for the ECU 2 to continue acting as a substitute, and the process then proceeds to step 261 (S 261). At S 261, the failure determination unit of the ECU m determines whether or not there is a failure in the ECU 3. When it is determined that there is no fault (Yes), the third substitute request transmission unit of the ECU m transmits a substitute request 22 bto the ECU 3 in step 262 (S 262). In step 263 (S263), the ECU 2 stops acting as a substitute thereafter, and in step 264 (S264), the ECU 3 starts acting as a substitute.On the other hand, when it is determined at S 261 that there is a failure in the ECU 3 (No), the ECU m performs the same failure determination sequentially for the next substitute candidate devices ECUs 4 to (m- 1). Finally, the ECU m transmits a substitution instruction to the substitute candidate device ECU (m-1) in step 265 (S 265). In step 266 (S266), the ECU 2 stops acting as a substitute, and in step 267 (S267), the ECU (m-1) starts acting as a substitute.The control device switching system 100A according to the second preferred embodiment can achieve the same advantageous effects as those obtained by the above-explained first preferred embodiment. Each of the substitute candidate devices ECUs 2 to m further includes the substitute request transmission unit 22 and the substitute transmission acceptance determination unit 23. Therefore, when a spare device is no longer able to continue to take over the data transfer process, the next spare device can be determined without using the ECU 1 that is in a sleep state, so that the reliability of the system can be improved. The monitoring control device ECU m is further provided to detect a failure in the ECUs 2 to (m- 1). It is therefore possible to detect a failure in the replacement device at an early stage, and moreover, a replacement candidate device having a failure can be prevented from acting as a replacement.Third preferred embodiment FIG. 16 shows the configuration of a control device switching system 100C according to the third preferred embodiment of the invention. FIG. 17A shows the configuration of a communication control device ECU 1, and FIG. 17B shows the configuration of a substitute candidate device ECU 2. The related drawings and explanations are not repeated because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2.The communication control device ECU 1 in the third preferred embodiment includes the data transmission reception execution / stop unit 11, the replacement request transmission unit 12, the sleep condition establishment determination unit 14, the sleep unit 15, and the waking process unit 16. Moreover, the ECU 1 includes a temporary storage device 7 (see FIG. 18 ) configured to temporarily store the results of the determination by a replacement request transmission unit 22A transmitted from the ECUs 2 to m. The ECU 1 also does not include the substitute transmission acceptance determination unit 13 provided in the ECU 1 in the first and second preferred embodiments.Before the ECU 1 stops the data transmission process, the replacement request transmission unit 12 simultaneously transmits a provisional replacement request to all the replacement candidate devices ECUs 2 to m, and also transmits a genuine replacement request to a replacement candidate device assigned to take over the data transmission process (the ECU 2 in FIG. 16 ).The substitute candidate device ECU 2 in the third preferred embodiment includes the substitute transmission unit 21, a substitute request transmission unit 22A which is a third substitute request transmission unit, and a substitute transmission acceptance determination unit 23A which is a third substitute transmission acceptance determination unit. The substitute transmission acceptance determination unit 23A determines whether or not the ECU 2 itself is in a state in which the data transmission process can be adopted when the provisional substitute request is received from the ECU 1. The replacement request transmission unit 22A transmits a replacement request to a replacement candidate device other than itself assigned to take over the data transmission process. The substitute transmission unit 21 takes over the data transmission process when the genuine substitute request is received from the ECU 1.The operations of the ECU 1 and the ECUs 2 to m in the control device switching system 100C according to the third preferred embodiment will be explained with reference to FIG. 16. When a sleep condition of the ECU 1 is established, for example, by a timer process of its own, the ECU 1 transmits the provisional replacement request 12 ato all of the replacement candidate devices ECUs 2 to m using the replacement request transmission unit 12 before the ECU 1 stops the data transmission process.Each of the ECUs 2 to m that received the provisional replacement request 12 afrom the ECU 1 determines whether or not the ECU itself is in a state in which the data transmission process can be adopted by the replacement transmission acceptance determination unit 23A, and when it is determined to be able to act as a replacement, each of the ECUs 2 to m transmits the determination result 23 cto the ECU 1. Note that the replaceable processing load amount and the replaceable process importance level of each of the ECUs can be used as the criterion of the determination by the replacement transmission acceptance determination unit 23A, similarly to the first preferred embodiment. The ECU 1 stores the determination results transmitted from the ECUs 2 to m in the temporary storage device 7.The ECU 1 determines a substitute candidate device assigned to take over the data transmission process (the ECU 2 in FIG. 16 ) based on the determination result 23 ctransmitted from the ECUs 2 to m, and transmits a genuine substitute request 12 bfrom the substitute request transmission unit 12 to the ECU 2. The substitute transmission unit 21 of the ECU 2 receives the genuine substitute request 12 bfrom the ECU 1, and starts taking over the data transmission process.In the temporary storage device 7, a substitute ECU wait loop is used as shown in FIG. 18. The substituteable ECU queue is a list in which the ECUs 2 to m capable of acting as a substitute register the own identification information. Note that the substitute ECU waiting loop may be shared among the ECUs 2 to m in addition to the ECU 1. The spare ECU wait loop can thus be used when the spare device determines the next spare device in the control device switching system 100A according to the second preferred embodiment.The substituteable ECU queue is a queue having a priority level, and the identification data of the substitute candidate devices determined to be able to act as a substitute as a result of the determination by the substitute transmission acceptance determination unit 23A, stored sequentially from that having the lowest process importance level, in an ascending order of the process importance level. In FIG. 18, the process importance level is in the following order: ECU 2, ECU 4,... and so on. The substitute request transmission unit 12 of the ECU 1 transmits the genuine substitute request 12 bin sequence according to the order stored in the substituteable ECU wait loop. The identification data of the ECUs is thus stored in the wait loop in an ascending order of the process importance level from the lowest, and the genuine substitute request 12 bis transmitted in this order. This allows an ECU having a lower process importance level to be selected as the spare device, so that an ECU performing a process having a high importance level is less likely to be assigned as the spare device.FIG. 19 is a flowchart illustrating the process flow in which the ECU determines a substitute device among the ECUs 2 to m in the control device switching system 100C according to the third preferred embodiment of the invention. First, when the sleep condition of the ECU 1 is established at S 10 (Yes), the replacement request transmission unit 12 of the ECU 1 simultaneously transmits the provisional replacement request 12 ato the ECUs 2 to m at step 32 (S 32).Next, in step 33 (S 33), the ECUs 2 to m that have received the provisional replacement request 12 adetermines whether or not they are in a state in which they can act as a replacement using the own replacement transmission acceptance determination unit 23A, and the ECUs that have been determined to be able to act as a replacement register their own identification numbers in the replacementable ECU queue. In step 34 (S 34), the ECU 1 looks up the ECU spare queue, and judges whether or not data is stored in the queue.If data is stored (Yes) at S34, the process goes to step 35 (S35), and the substitute request transmission unit 12 of the ECU 1 transmits the genuine substitute request 12b to the ECU 2 stored in the substituteable ECU queue first, and makes a notification to the sleep processing unit 15 to put the ECU 1 in sleep. Subsequently, the ECU 2 starts to act as a substitute in step 36 (S 36), and the process proceeds to step 37 (S 37). On the other hand, if there is no stored data at S 34 (No), the process proceeds to step 341 (S 341) and waits for data to be stored. When it is determined 10 times or more that there is no stored data (Yes), it is determined that there is no ECU that can act as a substitute, and no ECU is assigned as a substitute.At S 37, the ECU 2, which is the substitute device, determines whether or not the ECU 2 itself is in a state of being able to act as a substitute using the own substitute transmission acceptance determination unit 23A, and when it is determined that it is able to act as a substitute (Yes), it continues to act as a substitute. On the other hand, when it is determined that the ECU 2 is unable to act as a substitute (No), the process proceeds to step 38 (S 38), and performs look-up in the substitute ECU waiting loop.If data is stored in the queue (Yes) at S38, the substitute request transmission unit 22A of the ECU 2 transmits a substitute request to the ECU 4 whose identification information is stored in the substituteable ECU queue. In step 39 (S 39), the ECU 4 that has received the substitute request subsequently starts acting as a substitute, and the ECU 2 stops acting as a substitute. On the other hand, if no data is stored at S38 (No), steps S37 and S38 are repeated to wait for an ECU that can act as a substitute to be registered in the wait loop.Note that, despite the fact that the number of times of checking the loops is set to up to 10 times in FIG. 19, it is possible to check the loop after the 11th time as long as it occurs within the time, in the real time of the microcomputer at the time when the sleep condition of the ECU 1 is set. In the third preferred embodiment, the substitute ECU queue is a queue having a priority level in which the data is stored in an ascending order of the process importance level of the ECUs. However, it is also possible to use a queue which simply stores data in the order registered therein.In the third preferred embodiment, the provisional replacement request 12A is simultaneously transmitted to all of the replacement candidate devices ECUs 2 to m, and the real replacement request 12 bis transmitted to the replacement candidate device determined to be able to act as a replacement by the replacement transmission acceptance determination unit 23A before the communication control device ECU 1 enters a sleep state or a shutdown state. Therefore, the data transmission process performed by the communication control device can be reliably adopted.Moreover, it is not necessary to provide the ECU 1 with a specific substitute transmission acceptance determination unit, and the number of processes by the ECU 1 can be reduced. Therefore, the time to enter the sleep state from the establishment of the sleep condition can be shortened. The waiting loop having a priority level, wherein the identification data of the ECUs are stored in an ascending order of the process importance level from the lowest, is further used as the temporary storage device 7 for storing the results of the replacement process acceptance determination by the ECUs 2 to m. An ECU that performs a process with a high level of importance is therefore less likely to be assigned than the substitute device, and it is less likely to cause misbehavour in the behavior of the vehicle.Fourth Preferred EmbodimentFIG. 20 shows the configuration of a substitute candidate device ECU 2 in the fourth preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m are the same as those of the ECU 2. The configurations of the communication control device ECU 1 in the fourth preferred embodiment are the same as those in the first preferred embodiment described above, so the description thereof refers to FIG. 2A again.Each of the substitute candidate devices ECUs 2 to m in the fourth preferred embodiment includes a storage device 24 and a substitute data deriving unit 25. the storage device 24 is a storage unit for storing received data from the communication control device ECU 1 at a predetermined timing and a separate internal variable at that timing. The substitute data deriving unit 25 compares the internal variable with the received data of the substitute candidate device at the predetermined timing, and derives transmission data transmitted when the substitute candidate device performs the data transmission process.The storage device 24 stores the data until the communication control device ECU 1 stops transmission and reception by the sleep state. The data stored in the storage device 24 is the received data from the ECU 1 and the data of its own internal variables such as global variables. The frequency of storing data is determined from, for example, the tolerance level of the processing load of each of the substitute candidate devices ECUs 2 to m. The substitute data deriving unit 25 derives the correlation between the global variable and the history of the corresponding received data from the ECU 1 from the data stored in the storage device 24, and determines the transmission data to be transmitted by the substitute candidate device itself as a substitute according to the correlation. This allows the transmission data acquired by the substitute candidate device to coincide with the data transmitted by the ECU 1.FIGS. 21A and 21B show the tables stored in the storage device 24 of the spare device ECU 3. FIG. 21A shows the received data from the ECU 1 in a normal state and the internal variables B of the ECU 3 at the respective timings, and FIG. 21B shows the transmitted data by the ECU 3 when acting as a substitute and the internal variables B of the ECU 3 at the respective timings. In a normal state, the ECU 3 stores the received data from the ECU 1 at predetermined timings (ECU 1 signal A) and the internal variables B of the ECU 3 at the timings, and makes a table of the signal A corresponding to the variables B. When acting as a substitute, the substitute data deriving unit 25 derives the transmission data transmitted from the substitute device (ECU 3 signal A) based on the received data from the ECU 1 and the own internal variable at the respective timings.Specifically, as shown in FIG. 21A, at time t 1 the signal of the ECU 1 is A1 and the variable B of the ECU 3 is B1; at time t 2 the signal of the ECU 1 is A2 and the variable B of the ECU 3 is B2; at time t 3 the signal of the ECU 1 is A3 and the variable B of the ECU 3 is B3; and so on. Here, when the signal A of the ECU 1 and the variable B of the ECU 3 are in a one-to-one relationship, the signal of the data transmitted by the ECU 3 acting as a substitute becomes as shown in FIG. 21B. Specifically, when the variable B of the ECU 3 at time t is n B3, the signal of the transmission data that the ECU 3 takes in is A3, and when the variable B of the ECU 3 at time t is n+1 B1, the signal of the transmission data that the ECU 3 takes in is A1.Note that, for the example shown in FIGS. 21A and 21B, an example of a case where the history of the output data from the ECU 1 corresponding to the data output by the ECU 3 and the internal variable of the ECU at that time in a one-to-one relationship has been explained. However, the data derivation method by the substitute data derivation unit 25 is not limited thereto, and this is sufficient as long as a correlation between the two data can be obtained. For example, when the value of the signal A varies sequentially according to a variable B, it is possible to employ a statistical method or a method of averaging the values of the signal A according to a certain variable B 1.In the fourth preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the substitute data deriving unit 25, and the substitute device can therefore output the values in the vicinity of the data originally transmitted by the communication control device ECU 1. As a result, when another ECU receives the resultant data, the data fluctuates only within a predetermined range and is thus unlikely to be detected as a network fault. Moreover, when there is an ECU that uses the resulting data to perform processing such as arithmetic processing, it is possible to reduce the influence on the results of such processing.Fifth Preferred EmbodimentFIG. 22 shows the configuration of a substitute candidate device ECU 2 in a fifth preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2. The configuration of the communication control device ECU 1 in the fifth preferred embodiment is the same as the first preferred embodiment described above, so explanation thereof will be made again with reference to FIG. 2A.Each of the substitute candidate devices ECUs 2 to m in the fifth preferred embodiment includes an unnecessary data determination unit (not shown) configured to determine data that is not necessarily to be transmitted at a predetermined timing, and a data adjustment unit 26 configured to adjust the content of the transmission data by thinning out the transmission data based on a determination result by the unnecessary data determination unit when the substitute candidate device performs the data transmission process.FIG. 23 is a time chart for illustrating the changes in the data transmission process of the communication control device ECU 1 and the backup device ECU 3 before and after the establishment of the sleep condition of the ECU 1. The horizontal axis in FIG. 23 indicates the time, and the time t 1 indicates the time at which the sleep condition of the ECU 1 is established. Reference numeral "D 1" shows a data transfer process directed to the ECUs other than the ECU 1, reference numeral "D 2" shows a data transfer process directed to the ECU 1, and reference numeral "D 3" shows a data transfer process directed to the ECUs other than the ECU 3.At time t 1, when the sleep condition of the ECU 1 is established, the unnecessary data determination unit of the ECU 3 that has received the replacement request and has become a replacement device determines that the data transmission process directed to the ECU 1 "D 2" in FIG. 23 is not required. After receiving the substitute request from the ECU 1, the data adjustment unit 26 stops "D 2" of the ECU 3 based on the determination result by the unnecessary data determination unit, and allocates "D 1" to be originally performed by the ECU 1 to the transmission data portion that has been eliminated.Due to the function of reducing and allocating the transmission data by the data adjustment unit 26, the data amount transmitted when the ECUs 2 to m become spare devices is not changed or decreases before and after the ECU 1 enters a sleep state when the data amount received by the ECUs 2 to m from the ECU 1 (i.e., the data amount to be transmitted by the spare device) is equal to or less than the data amount to be transmitted from the ECUs 2 to m to the ECU 1.In the fifth preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the data adjustment unit 26. It is therefore possible to adopt the data transmission process of the communication control device ECU 1 without adversely affecting the control period of the spare device. This enables suppression of an increase in the processing load of the replacement device, and prevention of an event in which the processing load of the replacement device does not fit within a predetermined control period and the system loses the real-time behavior.Sixth Preferred EmbodimentFIG. 24 shows the configuration of a substitute candidate device ECU 2 in a sixth preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2. The configuration of the communication control device ECU 1 in the sixth preferred embodiment is the same as that in the first preferred embodiment described above, so the description refers to FIG. 2A again.Each of the substitute candidate devices ECUs 2 to m in the sixth preferred embodiment includes a control period adjustment unit 27 configured to adjust the own control period, and sets the own control period longer than in a normal state using the control period adjustment unit 27 when the substitute request is received from the ECU 1.FIG. 25 is a time chart for illustrating the changes in the data transmission process of the communication control device ECU 1 and the backup device ECU 3 before and after the setting of the sleep condition of the ECU 1. In FIG. 25, the horizontal axis indicates the time, and the time t 1 indicates a time at which the sleep condition of the ECU 1 is set. Reference numeral "D 1" represents a data transfer process directed to the ECUs other than the ECU 1, and reference numeral "D 3" represents a data transfer process directed to the ECUs other than the ECU 3. These are the data transfer processes assigned to the backup device for the ECU 1.At time t 1, when the sleep condition of the ECU 1 is set, the control period adjustment unit 27 of the ECU 3 that has received the substitution request and has become a substitute device changes the own control period to a processing period 2 longer than a processing period 1 in a normal state. At this time, the processing period 2 is set such that the ECU 3 can adopt the data transmission process originally performed by the ECU 1 in addition to performing the arithmetic processing of the ECU 3 in a normal state. This allows the ECU 3 to end the processing within the processing period 2 even when the ECU 3 performs the data transmission process to be originally performed by the ECU 1.In the sixth preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the control period adjustment unit 27. Therefore, when the replacement candidate device becomes the replacement device, it may set the control period to be longer, and thus may end both of the intrinsic arithmetic processing and the data transfer process as the replacement device within the control period even when the acting as replacement is started. Moreover, when there is a tolerance amount in the processing load, setting a longer control period means an increase in the idle time within the control period. Power consumption can therefore be reduced.Seventh Preferred EmbodimentFIG. 26 shows the configuration of a substitute candidate device ECU 2 in a seventh preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2. The configuration of the communication control device ECU 1 in the seventh preferred embodiment is the same as that in the first preferred embodiment described above, so the description thereof refers to FIG. 2A again.Each of the substitute candidate devices ECUs 2 to m in the seventh preferred embodiment includes a clock frequency adjustment unit 28 configured to adjust its own operation clock frequency when it is detected that the ECU 1 enters a sleep state. When the substitute candidate device receives the substitute request from the ECU 1, the substitute candidate device sets its own clock frequency to be lower than a normal state by the clock frequency adjustment unit 28.FIG. 27 is a time chart showing changes in the data transmission process of the backup device ECU 3 before and after the establishment of the sleep condition of the ECU 1. In FIG. 27, the horizontal axis represents time, and time t 1 indicates the time at which the sleep condition of the ECU 1 is set. The reference numeral "D 3" also represents a data transfer process directed to the ECUs other than the ECU 3, and here are the data transfer processes assigned to the substitute device for the ECU 1.When the sleep condition of the ECU 1 is set at time t 1, the clock frequency adjustment unit 28 of the ECU 3 that has received the substitution request and has become a substitute device sets the clock frequency to be lower than in a normal condition before time t 1, for example, to half the clock frequency in a normal condition. As the clock frequency is decreased, the time required for the processing becomes longer. In decreasing the clock frequency of the ECU 3, the clock frequency is set such that the ECU 3 can perform the substitution for the data transmission process to be normally performed by the ECU 1 within the normal processing period 1, in addition to the arithmetic processing of the ECU 3 in a normal condition.In the seventh preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the clock frequency adjustment unit 28. Consequently, although the power consumption increases due to the decrease in the idle time when the replacement candidate device is assigned to the replacement device, the power consumption can be decreased by reducing the clock frequency, so that the total power consumption can be suppressed.Eighth Preferred EmbodimentFIG. 28 shows the configuration of a substitute candidate device ECU 2 in an eighth preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2. The configuration of the communication control device ECU 1 in the eighth preferred embodiment is the same as that in the first preferred embodiment described above, so the description thereof refers to FIG. 2A again.Each of the substitute candidate devices ECUs 2 to m in the eighth preferred embodiment includes a data synchronization unit 29 so that it can start the data transmission process in a next data transmission control period when the substitute request is received from the ECU 1.FIG. 29 is a time chart showing changes in the data transmission reception signals of the communication control device ECU 1 and the backup device ECU 3 before and after the establishment of the sleep condition of the ECU 1. In FIG. 29, the horizontal axis represents time, and time t 1 represents time at which the sleep condition of the ECU 1 is established.When the sleep condition of the ECU 1 is set at time t 1, the ECU 3 receives the substitution request in a reception period (s 1) at time t 2 later than time t 1. The data synchronization unit 29 of the ECU 3 that has received the substitution request and thereby became a substitute device starts acting as a substitute in a transmission period (s 2) at time t 3 that is immediately after the reception period (s 1). That is, the data transmission process is performed as a substitute for the ECU 1 in the first transmission period after the substitute request is received.In the eighth preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the data synchronization unit 29. Therefore, the time from the stop of communication of the communication control device to the start of replacement with the replacement device can be shortened, so that detection as a network failure is prevented.Ninth Preferred EmbodimentFIG. 30 shows the configuration of a communication control device ECU 1 in a ninth preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the substitute candidate devices ECUs 2 to m in the ninth preferred embodiment is the same as that in the eighth preferred embodiment described above.The communication control device ECU 1 in the ninth preferred embodiment includes a replacement stop request transmission unit 17 configured to cause the replacement device to stop the data transmission process. When the ECU 1 restarts from a sleep state and restarts the data transmission process, the ECU 1 transmits a replacement stop request to the replacement device using the replacement stop request transmission unit 17.FIG. 31 is a flowchart illustrating the process flow in which the ECU 1 of the control device switching system according to the ninth preferred embodiment makes the replacement device ECU 3 stop acting as a replacement. In step 12 (S 12), when the ECU 1 that was in a sleep state is released from the sleep state and the condition for enabling the data transmission process is set (Yes), the process proceeds to step 121 (S 121), and the replacement stop request transmission unit 17 of the ECU 1 transmits a replacement stop request to the replacement transmission unit 21 of the ECU 3.Subsequently, in step 122 (S122), the ECU 1 restarts the data transmission and reception using the data transmission reception execution / stop unit 11. in step 123 (S123), the substitute transmission unit 21 of the ECU 3 stops the data transmission that has been performed as a substitute in response to the substitute stop request.In the ninth preferred embodiment, the communication control device ECU 1 includes the substitute stop request transmission unit 17. This allows the ECU 1 to stop the replacement process by the replacement device upon restarting the data transmission process, and prevents the data transmitted by the ECU 1 from being overwritten by the replacement device.Tenth Preferred EmbodimentFIG. 32A shows the configuration of a communication control device ECU 1 in a tenth preferred embodiment of the invention, and FIG. 32B shows the configuration of the substitute candidate device ECU 2. The related drawings and explanations are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2.The communication control device ECU 1 in the tenth preferred embodiment includes a wake-up timer setting unit 18 and a timer interrupt wake-up unit 19 as functions for managing the replacement process of the replacement device with time. On the other hand, each of the substitute candidate devices ECUs 2 to m includes a wake-up timer counting unit 30, which is a restart time measurement unit.The wake-up timer setting unit 18 included in the ECU 1 sets a wake-up timer value, which is the restart time, from the time when the ECU 1 starts sleeping until restart of the data transmission process becomes possible according to the sleep condition. The time required for overwriting a ROM of the microcomputer, for example, is set in the wake-up timer. When overwriting the ROM, the transmission and reception process of the microcomputer stops for a certain time. However, the time required for the overwriting is predictable, so that when the predicted time is set by the wake-up timer setting unit 18, the ECU 1 can restart once the overwriting is completed.The timer interrupt waking unit 19 starts the data transfer process of the ECU 1 after a predetermined restart time set by the wake timer setting unit 18. The ECU 1 transmits the substitution request and the restart time to the substitute candidate device, and wakes up due to the timer interrupt waking unit 19 after the restart time set by the wake timer setting unit 18 has elapsed to restart the data transmission process. The timer interrupt waking unit 19 may be implemented by, for example, an interrupt caused by timer interrupt hardware provided externally.On the other hand, the replacement device starts measuring the time using the wake-up timer counting unit 30 at the same time when receiving the replacement request and starts to adopt the data transfer process, and stops adopting the data transfer process after the predetermined restart time. The wake-up timer counting unit 30 is included in each of the replacement candidate devices ECUs 2 to m. This starts counting up after the replacement device receives the replacement request, and stops the replacement device from acting as a replacement when counting up to the value set by the wake-up timer setting unit 18.FIG. 33 is a flowchart illustrating the process flow in which the ECU 1 of the control device switching system according to the tenth preferred embodiment manages the substitution by the replacement device ECU 3 with respect to time. At S 10, the ECU 1 determines whether or not the sleep condition is set using the sleep condition setting determination unit 14. When the sleep condition is set (Yes), the process proceeds to step 101 (S 101), and the wake-up timer setting unit 18 sets a wake-up timer value WT th3 suitable for the sleep condition. The wake-up timer setting unit 18 notifies the replacement request transmission unit 12 that the setting is completed. If the sleep condition is not set at S 10, the process related to the substitution is not executed.Subsequently, in step 102 (S 102), the replacement request transmission unit 12 transmits the replacement request and the wake-up timer value to the ECU 3 which is the replacement device. In step 103 (S 103), the ECU 1 starts counting the time to wake-up using the time counting function of the timer interrupt wake-up unit 19, and the ECU 3 starts acting as a substitute. In step 104 (S 104), the ECU 3 that has started acting as a substitute then counts up to the set wake-up timer value WT th3 using the wake-up timer counting unit 30.If at S104 the wake-up timer count <WT th3 (Yes), the count-up is continued as it is. When the wake-up timer count value<WT is th3 (No), the process proceeds to step 105 (S 105). At S 105, the ECU 3 stops acting as a substitute using the substitute transmission unit 21, in synchronization with which the ECU 1 wakes up due to the timer interrupt waking unit 19, and restarts the data transmission process.When the value set by the wake-up timer setting unit 18 is set to the total time of the time until the ECU 3 receives the replacement request and the time that the ECU 1 stops the data transmission process due to sleep until the ECU 1 restarts the data transmission process, the time lag between the restart of transmission by the ECU 1 and the stop of replacement by the ECU 3 can be reduced.In the tenth preferred embodiment, the communication control device ECU 1 includes the wake-up timer setting unit 18 and the timer interrupt wake-up unit 19, and moreover, each of the replacement candidate devices ECUs 2 to m also includes the wake-up timer counting unit 30. Therefore, when the ECU 1 releases the sleep state and restarts the data transfer process, it does not need to transfer the replacement stop request to the replacement device, so that it can restart the normal data transfer process immediately.Eleventh Preferred EmbodimentFIG. 34 shows the configuration of a substitute candidate device ECU 2 in the eleventh preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2. The configuration of the communication control device ECU 1 in the eleventh preferred embodiment is the same as that in the first preferred embodiment described above, so the description thereof refers to FIG. 2A again.Each of the replacement candidate devices ECUs 2 to m in the eleventh preferred embodiment includes a data communication period adjustment unit 31 configured to adjust a self communication period, and sets the self communication period shorter than in a normal condition using the data communication period adjustment unit 31 when the replacement request is received from the communication control device ECU 1.The method for adjusting the data transmission period will now be described. When it is assumed that both the transmission periods of the communication control device ECU 1 and the backup device are 200 msec, and the transmission timing of the backup device is 50 msec later than the transmission timing of the ECU 1, the transmission timing of the backup device needs to be shifted by 50 msec or more than a previous timing in a normal condition. In order to make the transmission timing 50 msec earlier, it is necessary to set the transmission period to 150 msec or shorter, so that the transmission period should be multiplied by 150 / 200=0.75. However, the method for adjusting the data transmission period is not limited thereto.FIGS. 35A and 35B are time charts showing changes in the data transmission reception signals of the communication control device ECU 1 and the backup device ECU 3 before and after the sleep condition of the ECU 1 IS SET. FIG. 35A shows an undesirable example in which the period adjustment is not performed by the data communication period adjustment unit 31, and FIG. 35B shows a desirable example in which the period adjustment is performed by the data communication period adjustment unit 31. In FIG. 35, the horizontal axis represents time, and time t 1 represents time at which the sleep condition of the ECU 1 is set.In the case of FIG. 35A, when the sleep condition of the ECU 1 is set at time t 1, the ECU 3 receives the replacement request in the reception period (S 1) later than time t 1. The ECU 3 that has become a replacement device by the reception of the replacement request operates with a normal period, and thus performs data transmission including the data transmission process as a replacement for the ECU 1 in the next transmission period (S 2) at time t 4. In this case, the transmission period is later than the time t 3 which is the original transmission period (s 3) of the ECU 1, and a delay time (Δt) is caused.From this example, it is understood that the ECU 3 may not be able to transmit data at time t 3 when the ECU 1 should originally transmit data depending on the offset of the data transmission periods of the ECU 1 and the ECU 3, therefore there is a possibility that a network fault may be caused.In contrast, in the case of FIG. 35B, the sleep condition of the ECU 1 is set at time t 1, and the ECU 3 receives the substitution request with a reception period (s 1) after time t 1, and sets the data transmission period shorter than in a normal condition, e.g., to a 1 / 2 period, using the data communication period adjustment unit 31. this enables the data transmission including the data transmission process to be performed as a substitute for the ECU 1 in the next transmission period (s 2) at time t 2, which is timely for time t 3, which is the original transmission period (s 3) of the ECU 1.In the eleventh preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the data communication period adjustment unit 31. This enables the replacement device to adjust the timing of the data transmission process to be timely for the time when it should be originally transmitted by the communication control device ECU 1, thereby preventing the occurrence of a network fault.Twelfth Preferred EmbodimentFIG. 36 shows the configuration of a substitute candidate device ECU 2 in a twelfth preferred embodiment of the invention. The drawings and explanations thereof are omitted because the configuration of the other substitute candidate devices ECUs 3 to m is the same as that of the ECU 2. The configuration of the communication control device ECU 1 in the twelfth preferred embodiment is the same as that in the first preferred embodiment described above, so the description thereof refers to FIG. 2A again.Each of the substitute candidate devices ECUs 2 to m in the twelfth preferred embodiment includes a vehicle condition sensing unit 32 for sensing a vehicle condition or a vehicle surrounding condition in which the communication control device ECU 1 predictedly stops the data transmission process, in addition to the data communication period adjusting unit 31 described in the above eleventh preferred embodiments. The ECUs 2 to m are configured to set the data transmission period shorter than that in a normal condition by the data communication period adjustment unit 31 when the vehicle condition sensing unit 32 senses the vehicle condition at which the ECU 1 is predicted to stop the data transmission process.The vehicle condition sensed by the vehicle condition sensing unit 32 will be described below. For example, when the ECU 1 is an ECU related to the running gear that enters a sleep state during idling, the vehicle condition sensing unit 32 performs sensing of deceleration of the vehicle speed that occurs before the entry in an idling state. When the ECU 1 is an ECU related to the vehicle body that enters a sleep state during traveling, the vehicle condition sensing unit 32 performs sensing of deceleration of the vehicle speed that occurs before a traveling state enters from a standstill state.FIG. 37 is a time chart showing changes in the data transmission reception signals of the communication control device ECU 1 and the backup device ECU 3 before and after the sleep condition of the ECU 1 is set. In FIG. 37, the horizontal axis represents time, and time t 1 represents time at which the sleep condition of the ECU 1 is set. The ECU 3 receives data for predicting the sleep of the ECU 1 from the vehicle condition sensing unit 32 in the data receiving period (s 0) at time t 0. The ECU 3 that has received the sleep prediction data sets the data reception and transmission periods shorter than those in a normal condition, for example, to a 1 / 2 period, using the data communication period adjustment unit 31.The ECU 3 thus receives the replacement request for the ECU 1 in the reception period (s 1) set earlier than in a normal condition to start acting as a replacement. Moreover, it is possible to perform data transmission including the data transmission process as a substitute for the ECU 1 in the next transmission period (s 2) at time t 2, which is timely for time t 3, which is the original transmission period (s 3) of the ECU 1.Moreover, the data communication period adjustment unit 31 can not only shorten the data communication period but also extend the data communication period. After the substitute candidate device starts the takeover of the data transfer process, the data communication period adjustment unit 31 resets the data transfer period that has been set to be the original data transfer period, which is shorter than in a normal condition.FIG. 38 is a time chart showing changes in the data transmission reception signals of the communication control device ECU 1 and the backup device ECU 3 before and after the sleep condition of the ECU 1 is set. In FIG. 38, the horizontal axis represents time, and time t 1 is time when the sleep condition of the ECU 1 is set. The ECU 3 that has received the substitution request for the ECU 1 in the reception period (s 1) and started acting as a substitute sets the data transmission period to 1 / 2 of the normal period using the data communication period adjustment unit 31. At time t 5 at which the data transmission period has elapsed for a predetermined number of times, the ECU 3 thereafter sets the data transmission period to the normal period.In the case that the ECU 3 sets the data transmission period shorter than in the normal period using the data communication period adjustment unit 31, the load of the data transmission and reception at the ECU 3 increases when the just-mentioned state continues even after starting acting as a substitute. Consequently, the total processing load becomes high. When the data transmission period is reset to the original after a predetermined period, it is possible to prevent an increase in the processing load of the ECU 3 at the time of performing the substitution transmission.In the twelfth preferred embodiment, each of the substitute candidate devices ECUs 2 to m includes the data communication period adjustment unit 31 and the vehicle condition sensing unit 32. Therefore, the time from the reception of the replacement request until the replacement candidate device starts the data transmission process as a replacement device can be further shortened, and occurrence of a network fault can be prevented. The present invention may be within the scope of the invention, or any suitable combination of the embodiments, with a modified form of the embodiment omitted.Various modifications and alterations of this invention will become apparent to those skilled in the art without departing from the scope of this invention and it is understood that it is not limited to the embodiments illustrated herein.

Claims

A control device switching system comprising: a plurality of control devices (1, 2,..., n) in a vehicle, and connected to each other via a common communication line (6), the control devices (1, 2,..., n) including a communication control device (1) that performs transmission and reception of data with control devices other than itself, and a plurality of substitute candidate devices (2, 3,..., n) capable of adopting a data transmission process to be performed by the communication control device (1), wherein: the communication control device (1) includes a substitute transmission acceptance determination unit (13) configured to determine whether or not each of the substitute candidate devices (2, 3,..., n) is in a state in which the data transmission process can be adopted, a replacement request transmission unit (12) configured to transmit a replacement request to the replacement candidate device assigned to take over the data transmission process; and wherein the communication control device (1) determines the replacement candidate device assigned to take over the data transmission process based on a result of the determination by the replacement transmission acceptance determination unit (13) and transmits the replacement request from the replacement request transmission unit (12) to the assigned replacement candidate device before the communication control device (1) itself stops the data transmission process; Each of the substitute candidate devices (2, 3,..., n) includes a substitute transmission unit (21) configured to adopt the data transmission process, and adopts the data transmission process using the substitute transmission unit (21) when the substitute request is received from the communication control device (1).The control device switching system according to claim 1, wherein the substitute transmission acceptance determination unit (13) determines whether or not the substitute candidate devices (2, 3,..., n) are in a state in which the data transmission process can be adopted, based on a processing load amount of the substitute candidate devices (2, 3,..., n).The control device switching system according to claim 1, wherein the substitute transmission acceptance determination unit (13) determines whether or not each of the substitute candidate devices (2, 3,..., n) is in a state in which the data transmission process can be adopted, based on a process importance level of the substitute candidate devices (2, 3,..., n).The control device switching system according to claim 1, wherein the substitute transmission acceptance determination unit (13) determines whether or not each of the substitute candidate devices (2, 3,..., n) is in a state in which the data transmission process can be adopted, based on an error determination result of the substitute candidate devices (2, 3,..., n).The control device switching system according to any one of claims 1 to 4, wherein when determining whether or not each of the substitute candidate devices (2, 3,..., n) is in a state in which the data transmission process can be adopted, the substitute transmission acceptance determination unit (13) looks up the process importance level of each of the substitute candidate devices (2, 3,..., n) and performs the determination sequentially in an ascending order of the process importance level from the substitute candidate device having the lowest process importance level.The control device switching system according to claim 1, wherein: each of the substitute candidate devices (2, 3,..., n) comprises a second substitute transmission acceptance determination unit (23) configured to determine whether or not the substitute candidate device itself and the other substitute candidate devices are in a state in which the data transmission process can be adopted, and a second substitute request transmission unit (22) configured to transmit a substitute request to the substitute candidate device other than itself that can adopt the data transmission process; Wherein the substitute candidate device (2, 3,..., n) that has started to adopt the data transmission process sends a substitute request from the second substitute request transmission unit (22) to the substitute candidate device except for it, which is determined by the second substitute transmission acceptance determination unit (23) as being in a state in which the data transmission process can be adopted, when the substitute candidate device itself is determined as being in a state in which the data transmission process cannot be adopted by the own second substitute transmission acceptance determination unit (23).The control device switching system according to claim 6, wherein the second substitute transmission acceptance determination unit (23) determines whether or not the substitute candidate device (2, 3,..., n) is in a state in which the data transmission process can be adopted, based on a processing load amount of the substitute candidate devices (2, 3,..., n).The control device switching system according to claim 6, wherein the second substitute transmission acceptance determination unit (23) determines whether or not each of the substitute candidate devices (2, 3,..., n) is in a state in which the data transmission process can be adopted, based on a process importance level of the substitute candidate devices (2, 3,..., n).The control device switching system according to claim 1, wherein: the control devices (1, 2,..., n) include a monitoring control device (m) configured to detect a failure in the communication control device (1) and the replacement candidate devices (2, 3, 4); and the monitoring control device (m) includes a failure determination unit configured to determine the presence or absence of a failure in the communication control device (1) and the replacement candidate devices (2, 3, 4), and a replacement transmission continuation determination unit configured to determine whether or not the replacement candidate device that takes over the data transmission process can continue to take over the data transmission process based on a determination result of the failure determination unit; and a third substitute request transmission unit configured to transmit a substitute request for the data transmission process to the substitute candidate device determined by the failure determination unit to have no failure.A control device switching system comprising: a plurality of control devices (1, 2,..., n) in a vehicle, and connected to each other via a common communication line (6), wherein the control devices (1, 2,..., n) include a communication control device (1) that performs transmission and reception of data with control devices other than itself, and a plurality of replacement candidate devices (2, 3,..., n) that can take over a data transfer process performed by the communication control device (1), wherein: the communication control device (1) includes a replacement request transmission unit (12) configured to simultaneously transmit a temporary replacement request to all the replacement candidate devices (2, 3,..., n) and transmit a real replacement request to the replacement candidate device that is allowed to take over the data transfer process, before the communication control device itself stops the data transmission process; each of the substitute candidate devices (2, 3,..., n) includes a third substitute transmission acceptance determination unit (23A) configured to determine whether or not the substitute candidate device itself is in a state in which the data transmission process can be adopted when the substitute candidate device receives the provisional substitute request from the communication control device (1), and a substitute transmission unit (21) configured to adopt the data transmission process when the substitute candidate device receives the real substitute request from the communication control device (1), wherein each of the substitute candidate devices is configured to perform the determination by the third substitute transmission acceptance determination unit (23A) and to transmit the determination result to the communication control device (1) when it is determined to be in a state in which the data transmission process can be adopted; The communication control device ( 1) determines the replacement candidate device that is allowed to take over the data transmission process based on a determination result transmitted from the replacement candidate devices ( 2, 3,..., n) and transmits the genuine replacement request from the replacement request transmission unit ( 12) to the assigned replacement candidate device.The control device switching system according to claim 10, wherein the communication control device (1) further comprises a temporary storage device (7) configured to temporarily store, by the third substitute transmission acceptance determination unit (23A), the determination results transmitted from the substitute candidate devices (2, 3,..., n), wherein the temporary storage device (7) stores the determination results one by one from the substitute candidate device having the lowest process importance level in an ascending order of the process importance level, and the substitute request transmission unit (12) transmits the genuine substitute request sequentially in the order stored in the temporary storage device (7).The control device switching system according to claim 1 or 10, wherein each of the substitute candidate devices (2, 3,..., n) comprises a storage unit (24) configured to store received data from the communication control device (1) at a predetermined time, and a substitute data deriving unit (25) configured to compare the received data and an internal variable of the substitute candidate devices (2, 3,..., n) at the predetermined time, and derive transmission data when the substitute candidate device (2, 3,..., n) adopts the data transmission process.The control device switching system according to claim 1 or 10, wherein each of the replacement candidate devices (2, 3,..., n) includes an unnecessary data determination unit configured to determine data that does not need to be transmitted at a predetermined time, and a data adjustment unit (26) configured to dilute transmission data based on a determination result by the unnecessary data determination unit when the replacement candidate device (2, 3,..., n) adopts the data transmission process.The control device switching system according to claim 1 or 10, wherein each of the replacement candidate devices (2, 3,..., n) includes a control period adjustment unit (27) configured to adjust a own control period to set the own control period longer than in a normal condition using the control period adjustment unit (27) when the replacement request is received from the communication control device (1).The control device switching system according to claim 1 or 10, wherein each of the replacement candidate devices (2, 3,..., n) includes a clock frequency adjusting unit (28) configured to adjust a self-operating clock frequency to decrease the self-clock frequency compared to a normal condition using the clock frequency adjusting unit (28) when the replacement request is received from the communication control device (1).The control device switching system according to claim 1 or 10, wherein each of the replacement candidate devices (2, 3,..., n) starts the data transmission process in a next data transmission control period upon receiving the replacement request from the communication control device (1).The control device switching system according to claim 1 or 10, wherein the communication control device (1) further comprises a replacement stop request transmission unit (17) configured to stop the data transmission process of a replacement device to transmit a replacement stop request to the replacement device through the replacement stop request transmission unit (17) when the communication control device (1) itself restarts the data transmission process, and wherein the replacement device receiving the replacement stop requests stops the data transmission process.The control device switching system according to claim 1 or 10, wherein: the communication control device (1) further comprises a timer interrupt waking unit (19) configured to restart the data transmission process after a predetermined restart time from the time the data transmission process was stopped, to transmit the replacement request and the restart time to the replacement candidate devices (2, 3,..., n) upon stopping the data transmission process, and restart the data transmission process using the timer interrupt waking unit (19) after the restart time has elapsed; and wherein each of the replacement candidate devices (2, 3,..., n) includes a restart time measurement unit (30) configured to count a restart time, start counting the time using the restart time measurement unit (30) at the same time as reception of the replacement request and start takeover of the data transfer process, and stop takeover of the data transfer process after the predetermined restart time.The control device switching system according to claim 1 or 10, wherein each of the replacement candidate devices (2, 3,..., n) comprises a data communication period adjustment unit (31) configured to adjust the own data transmission and reception period, and wherein each of the replacement candidate devices (2, 3,..., n) sets a data transmission period to be shorter than a normal condition using the data communication period adjustment unit (31) when the replacement request is received from the communication control device (1).The control device switching system according to claim 19, wherein each of the replacement candidate devices (2, 3,..., n) includes a vehicle condition sensing unit (32) configured to sense a vehicle condition at which the communication control device (1) predictably stops the data transmission process, and wherein each of the replacement candidate devices (2, 3,..., n) sets the data transmission period shorter than a normal condition using the data communication period adjusting unit (31) when sensing vehicle condition by the vehicle condition sensing unit (32).The control device switching system according to claim 19 or 20, wherein the data communication period adjustment unit (31) resets the data transmission period set to be shorter than in a normal condition to be the original data transmission period after the replacement candidate device (2, 3,..., n) starts the takeover of the data transmission process.

Images