Abstract:
An engine control unit for a vehicle control unit arrangement is preconfigured to perform a plurality of functions and configures its own range of functions by activating selected preconfigured functions as well as a method for the manipulation-proof configuration of the engine control unit. To activate a preconfigured function, the engine control unit issues a signal for detecting the presence of component control units connected to it. It then requests an item of information for activating a function preconfigured in the control unit from a component control unit that was detected. After receiving an item of activation information, it activates the corresponding preconfigured function.

Description:
FIELD OF THE INVENTION 
     The present invention relates to a control unit and a method for the manipulation-proof configuration of a vehicle control unit. 
     BACKGROUND INFORMATION 
     A control unit is described in European Patent No. 376983 which is preconfigured for performing a plurality of functions and which, after being installed in the vehicle for the first time, is configured according to the functions needed in the vehicle in response to an activation command. Unneeded functions remain inactive. The control unit can be used as a universal control unit for a wide variety of vehicle types. However, the basic fact that available, yet non-activated, functions are provided generally makes it possible for unauthorized personnel to expand the original range of functions supplied by the manufacturer and, for example, to use components that are not approved by the manufacturer. All that is needed to do this is to manipulate the non-volatile memory in which the valid control unit configuration is stored. 
     SUMMARY OF THE INVENTION 
     An object of the present invention is to provide a control unit as well as a method for configuring a control unit arrangement which provides better protection against unauthorized modification of a configuration once the latter has been defined. 
     By providing at least one further component in the vehicle in addition to the vehicle control unit in order to activate a preconfigured function, the control unit according to the present invention makes an unauthorized change of a defined configuration much more difficult because at least two vehicle elements must now be manipulated in a coordinated manner. An immobilizer, i.e., a control unit which prevents the vehicle from being driven away, which is usually provided, in any case, in new vehicles, is especially suitable as the component for storing information to activate functions preconfigured in the control unit. Functions that are suitable for providing protection according to the present invention include, for example, cruise control and anti-spin control. It is advantageous to store a configuration only upon receiving an acknowledgment signal to be entered from the outside, thereby enabling test operation of the vehicle or the control unit arrangement. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 shows a block diagram of a vehicle control unit arrangement according to the present invention. 
     FIG. 2 shows a flowchart of a configuration operation according to the present invention. 
    
    
     DETAILED DESCRIPTION 
     FIG. 1 shows a vehicle control unit  10 , referred to below as an engine control unit, which is connected via a bus, such as a CAN bus, to further component control units present in the vehicle, such as an immobilizer  11 , an antilock brake control unit, an air-conditioner control unit  12 , or an intelligent transmission control unit  13 . Control units of this type can also be components which do not perform an actual controlling function, such as a radio. Engine control unit  10  has a central processing unit  20  for performing the vehicle functions implemented by engine control unit  10  as well as a memory  15  in which the functions are stored in the form of digital information. In addition to indispensable operating functions, in particular, those needed for controlling the engine itself, memory  15  also contains a directory of control units  11 ,  12 ,  13  connected via bus  14 , as well as a wide variety of optional preconfigured functions which are activated depending on the special design of the vehicle in which control unit  10  is installed. Such optional functions include for example an immobilizer, a cruise control device, or an anti-spin control device. Different versions of each of these functions can be provided. In the case of immobilizer functions, for example, versions contemplated by the present invention include, for example, a vehicle without an immobilizer, a vehicle with an immobilizer and a model-specific code, or a vehicle with an immobilizer and a vehicle-specific code. Likewise, cruise control versions with different characteristics can also be provided. Furthermore, an optional function can be used to activate a component control unit connected to the bus. The above-mentioned examples of preconfigured functions do not constitute a complete list, and any other functions and groups of functions can be provided. In addition, each of the preconfigured functions is assigned a location in memory  15  where information can be entered, indicating whether a function was activated and, if the function involves the connection of an additional component to bus  14 , whether the component is present. 
     Each component control unit  11 ,  12 , and  13  connected to engine control unit  10  also has a central processing unit (which is not illustrated in the interest of clarity) as well as a memory  16 ,  17 ,  18 . In each memory one item of information is entered which can be used to activate an optional function provided in engine control unit  10 . For example, memory  16  of immobilizer  11  can contain an item of information which is used to activate the optional preconfigured cruise control function in engine control unit  10 , as shown in FIG.  1 . Or memory  18  of transmission control unit  13  can contain an item of information which can be used to activate the preconfigured anti-spin control (ASC) function. Likewise, memory  17  of air-conditioner control unit  12  can contain an item of information for activating a further optional function “X”. Bus  14  has an interface  21  for connecting an external device  22  which can be used by an authorized person to access memories  15 ,  16 ,  17 ,  18 , with access being protected by a code. 
     The flowchart in FIG. 2 illustrates one possible means according to the present invention of operating the arrangement shown in FIG.  1 . After complete control unit configurations  10 ,  11 ,  12 ,  13  have been installed in the vehicle, the configuration operation is initiated by a start command, which is suitably supplied by an operator via interface  21  (step  100 ). Engine control unit  10  subsequently checks whether an immobilizer function should be activated. To do this, it sends a command to establish the presence of an immobilizer  11  based on the first preconfigured immobilizer type (WFS  1 ) to bus  14  (step  101 ). If a positive response is not received, i.e., if first immobilize type WFS  1  is not present, engine control unit  10  checks whether an immobilizer of second type  2  (WFS  2 ) is available. If necessary, it continues and checks the remaining preconfigured immobilizer types (step  103 ). If an interrogation signal is met with a positive response, engine control unit  10  sets a flag, indicating that an immobilizer  11  of the correct type is present in memory  15 . 
     Engine control unit  10  then checks the presence of the next component control unit on bus  14 , e.g., a transmission control unit  13  (step  110 ). It follows the same procedure used in determining the presence of an immobilizer. In the same manner, engine control unit  10  subsequently checks the presence of all further control units that can be connected to control unit  10  (steps  112 ,  114 ). It flags any detected control units  12 ,  13  in memory  15 . 
     After determining all component control units connected to bus  14 , engine control unit  10  checks which of the optional preconfigured functions should actually be activated. To do this, it sends a request signal relating to the first optional function entered in memory  15 , e.g., the cruise control function, to a first of the detected control units, e.g., immobilizer  11 , prompting the latter to send an item of information for activating the optional function back to engine control unit  10  (step  116 ). The control unit to which the request signal is sent is determined by the preconfigured function. If the interrogated control unit, e.g., immobilizer  11 , contains an item of activation information and sends this information back to engine control unit  10 , the latter activates the function involved, i.e., the cruise control function. 
     Instead of storing an item of activation information in a component control unit permanently assigned to the optional function, i.e., cruise control activation in immobilizer  11 , it is also contemplated by the present invention to store this information in one of multiple control units, for example, either in immobilizer  11  or in transmission control unit  13 . In this case, engine control unit  10  checks whether a certain item of activation information is present in another detected control unit when it receives a negative response from the first component control unit checked. For example, it checks whether an item of information for activating the cruise control function is present in transmission control unit  13  if this information is not stored in immobilizer  11  (step  118 ). 
     In the same manner as described above for the cruise control function, engine control unit  10  subsequently checks whether items of activation information exist for the further functions preconfigured in control unit  10 . For example, it checks air-conditioner control unit  12  to see whether an item of activation information exists for the preconfigured ASC function (step  120 ) and, if this check is negative and the information can be stored in another component control unit, it subsequently checks whether the corresponding activation information is present in a different component control unit (step  122 ). 
     Multiple items of information for activating different functions preconfigured in engine control unit  10  can also be stored in the same control unit, for example, in immobilizer  11  (step  124 ). 
     Engine control unit  10  flags all precorifigured functions in memory  15  for which it detects the presence of activation information, thus activating these functions. The control unit configuration that is fully defined after checking all preconfigured functions is subsequently protected so that it cannot be deleted (step  128 ). To do this, an acknowledgment signal is entered from external operator console  22  (step  126 ). Alternatively, storage of the configuration can be triggered by the presence of a specific component control unit. When the configuration is permanently recorded, the configuration stored in memory  15  is suitably displayed on external operator console  22 . 
     The configuration operation carried out upon initial startup can be repeated during subsequent routine operation of the vehicle at the specific request of a user or on a regular basis with the goal of verification. If this action reveals a variance from the configuration stored in memory  15 , an error message or further actions limiting vehicle operation can be provided. This makes it possible to determine, for example, whether a control unit  11 ,  12 ,  13  containing an item of activation information has been replaced by an unauthorized control unit which does not contain any activation information. 
     As an alternative to the individual checks described above to determine the presence of the corresponding component control units (steps  101  through  103 ), component control units  11 ,  12 ,  13  can inform engine control unit  10  directly of their types in response to a test signal (step  107 ). For example, immobilizer  11  responds by sending type Information WFS  1 , WFS  2 , etc. In addition, the procedure described above does not have to be carried out solely under the control of engine control unit  10 . It can be transferred in the same manner to any other component control unit as well as to other groups of control units and intelligent components located in a vehicle.