WO1995013205A1

WO1995013205A1 - Device and process for protecting automobiles

Info

Publication number: WO1995013205A1
Application number: PCT/EP1994/003670
Authority: WO
Inventors: Michael Josef Wallinger
Original assignee: Michael Josef Wallinger
Priority date: 1993-11-08
Filing date: 1994-11-08
Publication date: 1995-05-18
Also published as: AU8061594A; DE9317049U1

Abstract

The invention pertains to a protection device and process for automobiles, with a first key device (41) used to open and operate the vehicle in the conventional manner and, preferably, a second key device (54), e.g. in the form of a chip card that is not carried in the vehicle, but rather is only used to set limits on operating parameters, such as time period, distance, etc., in the form of a credit balance. Before these limits are exceeded, the second key device must be operated again, since otherwise the functioning of a control device, which controls the relevant functions of the vehicle, will be interrupted. Selected individual sensors (20-27) and actuating elements (30, 31, 32) enable the control device (11) to be individualized for the specific vehicle, so that an exchange is possible only with the support of the manufacturer. If the vehicle were to be lost due to theft, carjacking or fraud, it will cease to function in a short time as a result of the limits being exceeded. By presenting the second key device (54) the owner can prove that he did not support the misappropriation of the vehicle.

Description

Device and method for securing motor vehicles

The present invention relates to an apparatus and a method for protecting motor vehicles against unauthorized use by third parties.

Security devices for protecting motor vehicles against unauthorized use by third parties have been known for a long time

A first group of known security devices, such as door locks, alarm systems, etc., are aimed at preventing unauthorized persons from entering the vehicle.

In a second group of safety devices, the use of the motor vehicle is to be prevented after it has penetrated into the interior of the motor vehicle. These include e.g. the ignition lock, the steering wheel lock and similar devices.

The problem with these known safety devices, however, is that they generally offer protection only for a short time, ie the time for the vehicle to break open and for its in- Commissioning extended. The number of thefts can thus be limited, but, as the theft statistics show, it cannot be significantly reduced.

It would be desirable to have an improved device or a method for securing motor vehicles, which brings about a securing that cannot be overcome or can only be overcome with great effort by well-equipped specialists.

It is the object of the present invention to provide such a safety device.

This object is achieved by the subject matter of claim 1.

The method according to the invention is the subject of claim 26.

Preferred developments of the invention are the subject of the dependent claims.

The safety device according to the invention has a control device which controls at least one relevant function of the motor vehicle. A first key receiving device is also provided, which interacts with a first key device. The key receiving device is to be understood to mean a device that can receive a key device and / or can receive a signal transmitted by a key device. Furthermore, a test device is provided, which is preferably part of this control device, or is particularly preferably integrated into it, and which checks whether the correct key device is in the key Receiving device is received, or cooperates with this. If this is not the case, the control device interrupts the control of this at least one relevant function of the motor vehicle, so that the operation of the vehicle is only possible to a limited extent or preferably not at all.

As the relevant control function to be interrupted, a function is preferably used which is to be assigned to the drive area of the vehicle, i.e. in particular one or more functions which facilitate the operation of the engine and / or a transmission, e.g. of an automatic transmission, controls or control. As a result, it is not possible to use the vehicle without a correct key device. Here, as in the following, control is to be understood to mean both a control in the sense of an open control circuit (open-loop control) and a closed control loop (closed-loop control).

The first described embodiment of the invention can reliably prevent a parked motor vehicle from being used by a third person.

However, the first embodiment of the invention is not able to prevent unauthorized use of a vehicle if the unauthorized user has acquired the key device. This is the case when the driver of the vehicle is forced, for example by threatening violence, to surrender both the vehicle and the key device. However, this is also the case, for example, if a rented vehicle is stolen or if the owner and "thief" work together for the purpose of insurance fraud. It is therefore the particular concern of a development of the invention to provide further protection in order to make the robbery of a motor vehicle, theft of a rental car, theft of one's own vehicle and the like unattractive for third parties.

When the first key device is used, the test device outputs a first key control signal to the control device, which enables the engine to be started etc. and thus the vehicle to be started up. In addition to this key control signal, an activation event is defined, when it occurs a second key control signal is transmitted to the control device. In contrast to the first key control signal, this activation event does not occur every time the vehicle is started. Rather, the use of the activation event serves to specify certain operating parameters in the form of a credit, and to enable the vehicle to be operated until the credit has been used up. The operating parameters are the time, the distance covered by the vehicle, the number of operating hours, etc. Preferably two or three operating parameters can also be combined. The combination of the time and the distance covered by the vehicle is particularly preferred.

In a preferred embodiment of the invention, a second key receiving device and a second key device are used to trigger the activation event.

The second key device is connected to a second test device, which checks whether the second device The key receiving device cooperating with the key device belongs to the corresponding one in the vehicle. If this is not the case, depending on the version, at least one relevant control function, which is preferably assigned to the drive area again, is interrupted immediately or at the next restart.

The interruption of this relevant function caused by the second test device does not occur depending on the presence or absence of the second key device, but takes place when this has at least one limit value for a predetermined operating parameter such as the time, the distance covered by the motor vehicle, or the loading ¬ driving hours of the motor vehicle is exceeded.

This second key device is not carried by the user during the operation of the motor vehicle, but is kept in a safe place away from the vehicle. The second key device is only used to define new limit values for the operating parameters.

The user inserts the second key device into the corresponding key receiving device or activates the second key receiving device, whereupon the limit value for the corresponding operating parameters is then redefined. Be: In a first variant, the limit value or values for the -criebspara eter are fixed. In a second preferred variant, the limit values for the operating parameters and possibly also the operating parameters can be specified by the user if the second key device is inserted into the key receiving device. The authorized user thus inserts the second key device into the key receiving device and enters, for example, 14 days as the limit value for the parameter. After this period of time, the corresponding controlled function is interrupted, and the operation of the vehicle is only limited or, preferably, completely impossible. Operation is made possible again when the second key device is inserted into the second key receiving device. The authorized user can prevent the controlled relevant function from being interrupted by reinserting the second key device into the key receiving device before this, for example, 14 days. The user can also be promptly reminded of the insertion of the second key device by a corresponding display or other optical or acoustic warning device.

A maximum operating parameter specification is preferred, at which time e.g. defined two or three months. In this case, the second test device prevents, by repeated use of the second key device, a "credit" in operating parameters that exceeds the predetermined maximum values, for example by the second key device being able to be used again only a certain time before this time has expired.

The use of this second key device has considerable advantages.

Since the second key device is not carried with the vehicle, its release cannot be blackmailed. A potential robber can briefly take control of the vehicle, but since the function of the vehicle is interrupted after a certain time or a certain distance or the like has been exceeded, the use of the vehicle is limited to a short period of time.

When renting a vehicle, the renter only receives the first key device. By choosing the operating parameters, the lessor ensures that the vehicle is operational for a sufficient time.

In the event of theft, the lawful user of the vehicle can present the second key device to the authorities and in particular to his insurance company, and can thus prove that he did not support or enable the theft of the vehicle. The insurance in turn will retain the second key facility. On the one hand, this prevents abuse and, on the other hand, prevents the owner of the vehicle from being forced to return the second key device after the theft.

The user can preferably select the limit values of the operating parameter or parameters. This makes it possible to specify sufficient time and / or distance even for a longer trip, so that he is not then forced to carry the second key device with him.

Since the second key receiving device can be used in conjunction with a conventional first key receiving device, a production change is an ongoing one Series or retrofitting of vehicles already delivered is possible.

In addition, a personal code number can also be entered via the input keyboard when using the second key device, which increases security when the second key device is stored carelessly, but is not decisive for the function of the present invention.

The control device is preferably designed such that it can only be manufactured by the automobile manufacturer himself or on his behalf, so that the control device can only be replaced if the plant has checked the identity and legal ownership of the respective user.

In order to prevent control devices from decommissioned vehicles from being used in stolen vehicles, it is also conceivable that the manufacturer takes special measures, for example the payment of a special remuneration, a kind of deposit, that is, when the control device is returned to the factory if the vehicle is unusable or has been retired.

However, it is also a further concern of the present invention to complicate or largely prevent the activation of a stolen vehicle whose control device is blocked by installing another control device for another vehicle of the same type etc.

To this end, the invention proposes in a further development to individualize the control device, that is to say that also Identical vehicles generally have non-identical control devices, so that the exchange from a control device from one vehicle to another vehicle is not or hardly possible. This becomes applicable in a development of the present invention, which can be used both in the embodiment with only one key device and without monitoring the operating parameters (first embodiment) and in the embodiment with one or two key devices and monitoring the limit values of predetermined operating parameters (second embodiment) is achieved by the control device being connected to one or more sensors and / or to actuating devices which have an individual nature and in particular an individual characteristic.

In a preferred development of the invention, the control device is provided, for example, for controlling engine operation in a motor vehicle with an internal combustion engine based on the Otto or Diesel principle using predefined calculation rules, for example a map or the like. Operating variables, for example the speed of the engine, temperatures of the engine, the cooling water, the engine oil, the temperature of the intake air, the load, for example measured via the throttle valve angle position or the intake speed of the air, etc., are recorded for the control. Individual sensors with individual characteristics are now used for a motor. This respective characteristic is stored in the control device and used to determine the corresponding variables. If a control device from another vehicle is now used which has different sensor characteristics, the engine control becomes so faulty that the operation of the vehicle with this wrong control device becomes impossible.

In addition to the sensors, actuators such as Pressure control valves can be individualized.

By individualizing several sensors, the number of possible combinations of the characteristics in the manner of an encryption can be increased to so many combinations that it is completely or practically impossible for two otherwise identical vehicles to have an identical control device.

If an unauthorized third party wanted to adapt the characteristics of the sensors of a stolen vehicle to a control device from another vehicle, he would have to change or replace the corresponding sensors, which is very complex and can also be complicated or prevented by design measures.

If the control device is limited in its function to the engine only, it would be conceivable that unauthorized use is possible in a vehicle after the engine and key receiving devices have been replaced. In order to prevent this and to further increase safety, the invention proposes in a preferred development that further functions of the vehicle control system are included in the control device. Depending on the vehicle type and equipment, further functions can be considered: the function control of a charger (turbocharger, compressor or the like. the function control of an anti-lock braking system; the function control of an automatic slip control; the function control of an automatic transmission; the function control of a power steering device; the function control of one or more differentials, e.g. the axle differentials in uniaxially driven vehicles and the axle and / or center differentials in two-axle drive; the function control of a four-wheel steering; the function control of shock absorbers; the function control of a semi-active or active chassis; the function control of a service interval device; the function control of a central locking system; the function control of auxiliary devices, such as Alternator, heating, air conditioning, seat adjustment, airbag, radio, etc.

Depending on the nature of the particular motor vehicle, one or more of these functions can be selected.

These function controls are effected by function control devices, which are also spatially integrated in the control device in a first further development. In this case too, sensors and actuating elements that are required for the selected function control device (s) can be individualized. According to a further preferred development of the invention, all or some of the selected function control devices for the anti-lock braking system etc. are retained as autonomous devices. However, they are intended to exchange control data for identification with a third test device, which is preferably integrated in the control device. If the third test device determines that one of these function control devices does not correspond to a predetermined individual function control device, the control of the relevant vehicle function (s) is interrupted. In this case too, the function control devices are preferably at least partially connected to individualized sensors and / or actuating elements.

The first and possibly the second key receiving device itself is preferably (in all embodiments) such that identification data which identify the key receiving devices themselves can be exchanged with the test or control device.

If, in the latter case, a vehicle is stolen according to the second embodiment by theft or robbery, the unauthorized third party would have to procure and replace, for example, the following components as soon as one of the specified parameters in the control device has been exceeded: control device, first and possibly second key receiving device , the sensors of the engine control, the actuation elements of the engine control, the sensors of the automatic transmission, the function control device of the automatic transmission, the function control device of the anti-lock braking system, the actuation devices for the anti-lock braking system, etc. It is easy to understand, that the effort is so high that the theft is no longer attractive even with expensive vehicles. In addition, it is relatively easy to monitor the delivery of all or some of these functional parts by the factory, so that safety-relevant functional parts are not available on the market.

If the identity of individual components, e.g. of the radio, a car telephone and the like. Checked by the control device, this device can be designed in such a way that, conversely, it can only function if it has received corresponding data from the control device, this data preferably during each identification process to be changed. This also effectively protects the individual components against theft.

In order to prevent counterfeiting or copying of the key device (s), according to a development of the invention, at least one, and here, if available, in particular the second key device, but preferably both, is provided with a data memory, from which data is transmitted to the test device and from can be transferred back to the test facility. Appropriate structure of security data makes it practically impossible to manufacture or copy the key device without authorization.

In particular, the invention proposes that every time the key device is used, relevant data are changed in the key device, so that it is not possible to predict which data will be used by the key device. direction for transmission to the key receiving device are expected.

Key receiving device in the sense of the present invention is also to be understood as a receiving device or a transmitting / receiving device which receives or transmits signals transmitted wirelessly by the assigned key device. A transmission with electromagnetic waves (radio waves), ultrasound, infrared or light is preferably selected for the wireless transmission.

As stated, in the second embodiment, when the first key device is present, the first test device generates a first key control signal, which must be triggered each time the vehicle is started, and the second key device generates an activation event that is only queried periodically. The functions of the activation event can also be effected in another way within the scope of the present invention:

Two different first key devices are used. Before the operating parameter or parameters are exceeded, the other key device must be changed. The user does not carry the other key device when operating the motor vehicle.

Furthermore, it is also possible that only a key device provided with a microprocessor and a correspondingly designed key receiving device are used, but that a data memory of the key device is in each case in a data output belonging to the vehicle but not carried in it. Exchange device is changed such that the activation event is triggered the next time the vehicle is started up.

Instead of just a second key device, two or more second key devices can also be present, which must be used alternately or at different times.

In a preferred embodiment of the invention, the second key device is designed as an intelligent code card, i.e. as a code card, which has a microprocessor and a data memory, such as e.g. is the case with telephone cards and the like. The second key receiving device is then designed as a corresponding code card reader.

Although the invention is described here in particular in relation to passenger vehicles, it can also be used in the same way in all other motor vehicles in the broadest sense, such as trucks, buses, motorcycles and also in non-land vehicles, such as boats, ships, planes, etc.

Further advantages, features and possible uses of the present invention result from the following description of exemplary embodiments in connection with the drawing. This shows in a highly schematic way:

Fig. 1 is a block diagram of a first embodiment of the invention; Fig. 2 is a block diagram of a second embodiment of the invention;

3 shows a data arrangement for explaining a method for data exchange;

4 shows a block diagram of a further exemplary embodiment of the invention;

FIG. 5 shows a sectional illustration of a control device according to the exemplary embodiment according to FIG. 4;

6 shows a block diagram of a further exemplary embodiment of the invention.

The first embodiment of the invention will now be described with reference to FIG. 1.

The exemplary embodiment is designed for a conventional multi-cylinder internal combustion engine based on the Otto principle, which is equipped with a characteristic-controlled gasoline injection, the mixture formation taking into account the values of a lambda sensor which is arranged in the exhaust gas area of the engine.

1 shows a control device 10 which is accommodated in a housing 11 and which in this embodiment serves to control the motor functions.

The components of the control device are summarized in FIG. 1 in function blocks. However, it should be understood that the division into function blocks is not absolutely necessary in practice, or can be done in another way. It is also possible to combine individual function blocks into individual separate assemblies with a separate housing, so that the control device consists of two or more individual structural units. This also applies to the other exemplary embodiments described later.

In the embodiment shown in Fig. 1, the individual function blocks are partially autonomous, which means that each function block has a memory device in which data can be stored digitally and / or changeably, as well as a decentralized microprocessor device through which data can be processed . This presentation is done for the sake of clarity. It is of course possible to combine the function of the memory device from one or more of the function blocks into one or more memory devices or to use only one or more central microprocessor devices instead of several decentralized microprocessor devices.

In the left part of the control device 10, the detection device 14 is arranged as a function block.

This detection device 14 is connected to sensors which detect physical quantities and convert them into electrical signals. In the exemplary embodiment, the sensor 20 is a speed sensor for detecting the engine speed. This speed sensor preferably has a pulse generator with a pulse counter, the pulse generator emitting a predetermined number of pulses per revolution of the crankshaft of the engine. The sensor 21 is a sensor that detects the load acting on the motor. In the exemplary embodiment, this sensor is designed as an angle encoder which detects the angular position of the throttle valve.

The sensor 22 is a lambda probe which is arranged in the exhaust system in the usual way.

The sensor 23 is a first temperature sensor which measures the oil temperature, the sensor 24 a second temperature sensor for detecting the water temperature and the sensor 25 a pressure sensor for detecting the oil pressure. A knock sensor 26 is also provided. The use of further sensors e.g. to check the valve control is possible.

The signals from these sensors are fed to the control device 10, where they are detected in the detection device 14 and in engine operating data, e.g. current speed, etc., converted and transmitted to an engine function control device 16.

The individual sensors can be standard sensors, which means in the present application that all vehicles of a corresponding type are equipped with the same sensors.

However, it is particularly preferred that at least some of the sensors are individualized. This means that the characteristic curve, ie that the relationship between the physical quantity to be detected and the electrical signal output by the sensor is different for corresponding sensors of the same vehicle type. This is achieved, for example, in that the speed sensor in different vehicles has different pulse generators which each output a certain, different number of pulses per crankshaft revolution. Correspondingly, different temperature and pressure sensors with different characteristics can be used.

The characteristics of all sensors are stored in the detection device 14, so that in the case of individualized sensors, the correct values for speed, angle of rotation, temperature, pressure, etc. are calculated.

The individualized sensors are preferably divided into different classes, for example 10, 20 or more classes per sensor, from which sensors are then put together for the individual vehicles of a series, for example at random. As a result, several thousand sensor groups can be formed, so that a correspondingly large number of different types of detection devices are created and the chance that two particular vehicles have the same detection device is very small.

On the basis of the operating data, the engine function control device 16 calculates the optimal control of the engine, for example based on a map and on adaptive correction methods known in the prior art, and outputs the values by means of which time and length of the injection process and the time of the Ignition can be controlled. The values are output via an output device 18, which is also part of the control device 10. If the motor is provided accordingly, the control can also include the control of valve opening times or valve lift.

The values are output to an injection device 30, to an ignition device 31 and, if appropriate, to the valve timing valve lift control device 32.

These devices 30 to 32 can also be individualized, that is to say that devices of the same vehicles are of different types, and the corresponding characteristics can be stored in the output device 18. However, individualization is only necessary if security is particularly important.

In the control device 10 there is also a first test device 15 which interacts with a key receiving device 40.

Furthermore, the control device 10 has a timer 17 which specifies a time cycle according to which the control device 10 operates as a whole.

The control device is powered externally via the vehicle's on-board voltage. A long-term battery 12, for example a lithium battery, is preferably arranged in the housing, which ensures at least the operation of the timer and the maintenance of the memory contents, if appropriate modules are used, if the control device is not connected to the on-board voltage. Then at least at least some of the memory areas required for the control are designed as volatile memories, so that after an intentionally caused interruption of the power supply, the control device becomes inoperable.

The Steuereinrichti- j ^~ 10 is preferably designed so that it is not possible to read important for the function of the security device data with external devices. This can be achieved by arranging the control device or individual parts thereof in a housing which is completely filled with suitable plastic or the like.

The function of the first test device 15 will now be explained in connection with the function of the key device of the first key receiving device 40.

The first key receiving device 40 receives a key device 41 and is arranged inside the vehicle, for example as an ignition lock, in the region of the driver's instrument panel. The key receiving device can be designed in such a way that it receives a conventional key, as is generally known today as a vehicle key and as it is also used to open doors, trunk, lids and the like. Other designs are also possible (see below).

With this design of the first key receiving device, the receiving device 40 determines after inserting the key 41 whether the key is correct and then outputs a corresponding signal to the test device 15. If the key is correct, the test device 15 gives the operation of the Control device 10 free, ie that values are output to the outside via the output device 18 which control the operation of the engine.

If the key is not correct, the correct signal is not output and the test device leaves the control device in the passive state or deactivates it, so that no control signals are output to the engine. This means that the motor vehicle cannot be started up.

In addition, as is known, the ignition current to the starter etc. can also be interrupted, which can also be carried out via the control device 10, if the design is appropriate.

For safety reasons, the control device 10 can be designed in such a way that the functional blockage is only interrupted when the vehicle is at a standstill.

A design of the key receiving device and the key device is preferred, by means of which data can be exchanged with the first test device 15. This is possible in that a conventional key is additionally equipped with a processor and data storage device which is electrically connected to the test device when the key device is inserted into the key receiving device. A key device in the form of a card provided with such a processor in a similar form to e.g. a calling card or the like can be used.

The data stored in the key is preferably checked by the test device 15 each time the key is used changed, as will be explained later with reference to FIG. 3, so that the test device 15 only activates the control device 10 when the complete identity of the key device has been established. Several first key devices are preferably available for the vehicle, so that different people can use the vehicle. In this case, the test device is designed in such a way that it recognizes the key used in each case.

The function and advantages of this first embodiment are summarized as follows:

The driver uses the first key in the usual way to open the vehicle door and then inserts the key into the key receiving device 40. The control device is switched to a test mode, and the first test device, as will be explained later with reference to FIG. 3, queries control data from the first key device, compares it with control data or calculation rules for calculating the control data contained in the Test facility are stored. If the key is identical to one of the keys that authorize the use of the vehicle, the control device 10 is switched to the operating mode and the vehicle can be started and used in the usual way.

It is not possible for an unauthorized third party who does not have the correct key to start the vehicle. This can reliably prevent the theft of the vehicle. There is also no chance for an unauthorized third party to start the vehicle if he has sufficient time, specialist knowledge and equipment.

Attempting to open the control device or its safety-relevant parts, if this is poured out with plastic, leads to the destruction of the control device, so that it can no longer perform its function.

It is also not possible to read out the data from the control device, since two-way data communication only takes place via the test device. However, the test device cannot output data relating, for example, to the detection device.

As a result of the individualization of the sensors, it is also not possible to replace the control device with a control device originating from another vehicle. In this case, the unauthorized third party would have to replace all the sensors, which is at least very complex and as a result of which this other vehicle, from which the sensors and the control device are removed, itself becomes unusable.

A second embodiment of the invention will now be described with reference to FIG. 2, which further increases the security compared to the first embodiment.

With regard to the structure of the control devices and the function of the sensors, etc., the second embodiment of the invention is largely identical to the first embodiment and the ones described there. same variants. Identical reference symbols are therefore also used in the drawing.

The control device 45 is additionally connected to a sensor 27 which e.g. is arranged on the output shaft of the transmission and outputs a signal which corresponds to the distance traveled by the vehicle.

In contrast to the first embodiment, a second key receiving device 50 is also provided here, which is connected to a second test device 19.

This second key receiving device 50 additionally has a display 51 and an input device 52, by means of which inputs can be made by two, three or more keys or the like.

The second key receiving device 50 is intended to receive a second key device 54.

This second key receiving device 54 preferably has a data memory, the content of which is at least partially changeable. A chip card, the size of a conventional plastic card, such as is used for telephone cards, credit cards and the like, is used as the second key device. However, other forms of a second key device are also possible.

In any case, however, the key device should be designed in such a way that it is not possible to copy the key device and record its content. The second key device is not carried during normal vehicle operation. It is only used from time to time to release the vehicle for a specified period of time, a specified distance or a combination of these two variables. The values can be predefined, but it is preferred that these values can be entered by the user himself.

As far as the rest of the structure and the first key device are concerned, the function of this second embodiment corresponds to the function described above. Therefore, only the function of the second key device is explained.

The user inserts the second key device 54 into the key receiving device 50 and then uses the input keyboard 52 to select a period within which the vehicle is to be functional. This period may be one or two weeks in normal use. Alternatively or additionally, he can enter a distance which, for example, is 1000 kilometers in normal operation.

The set values are shown on the display 51 during the setting process. The second key device is then removed from the receiving device and stored in a safe place outside the vehicle.

The vehicle can now be used for a week or for a distance of 1000 kilometers exclusively with the first key device. As soon as the specified time or the specified distance has been exceeded, the Output of engine control data interrupted, and it is then no longer possible to start the vehicle with the first key device.

In one embodiment variant, however, the user is made aware of the elapsing time by the display 51 or an acoustic or visual warning device, and uses the second key device again in good time to enter a new time and / or a new route.

If the vehicle is to be used for a longer period outside the usual location, for example during a vacation trip, the user will increase the predetermined time accordingly, for example to four weeks, in order to be able to start the vacation trip without a second key device.

The embodiment with the second key device brings considerable advantages for security:

First, protection against unauthorized use and theft is the same as that of the first embodiment. In contrast to the first embodiment, however, it is not possible in this embodiment to use the vehicle if the unauthorized person has obtained the first key by force or in some other way. An unauthorized person can rob the vehicle by forcing the owner to surrender the vehicle and the first key device. The use of the vehicle is made impossible after a short time or a short distance due to the lack of the second key device. It also becomes impossible to use a legally received vehicle, such as a rental car, beyond the specified period.

It is also easy for the vehicle owner to prove, for example to the authorities or to an insurance company, that he did not support the theft by presenting the second key device to the authorities or the insurance company. If the insurance company then withholds the corresponding key device, there is also no possibility later of starting the vehicle again by using the second key device.

The display 51 is preferably controlled such that the remaining distance and / or the remaining operating time is only displayed if the vehicle has not been used for several hours. As a result, if the vehicle is robbed, it cannot initially be determined how long the time / distance is sufficient, which increases the risk.

In a further exemplary embodiment, which corresponds to the second embodiment according to FIG. 2, the second key receiving device is identical to the first key receiving device. First of all, effort is saved here by omitting the second key receiving device. Otherwise the function is the same. A second key device is also provided here, which works in the same way as in the example according to FIG. 2. The test device differentiates which key device is inserted. Here, the user uses the first key device in the manner described above to use the vehicle. The second key setup device is not carried with the vehicle but only, if necessary, inserted into the key receiving device in order to release the vehicle as described for a certain distance and / or duration.

Preferably, however, the first and second key devices are designed very differently with respect to the part that is not inserted into the key receiving device, so that there can be no confusion.

If a data exchange takes place between the key receiving device and the key device in the exemplary embodiments described above, this exchange should be designed in such a way that it offers a high degree of security of the identity check and with regard to the unauthorized reading of the corresponding program routines in the control device 10 and 45.

Such a method will now be explained with reference to FIG. 3.

The following describes how the data exchange between the key device, which may be the first and the second key device, and the associated test device is carried out.

When checking the identity of the key device, the test device first outputs an activation signal AK1, which must be recognized by the key device. As soon as the key device recognizes that the activation value AK1 is present, the control device outputs the control value KOI, the identity of which is again checked by the test device. If the KOI value is the value that the test device expects, it outputs the second activation characteristic AK2.

The key device, when it has received the activation characteristic value AK2, outputs the control value K02, the identity of which is checked by the test device. If the value K02 is identical to the value that the test device expects, an activation value AK3 is output. If this is not the case, the further course of the procedure is blocked and the control device remains passive. In order to prevent the values from being read out by “trying out”, the testing device simultaneously specifies a time period within which the testing procedure is not repeated. This period of time is still short on the first attempt and is greatly increased on each subsequent attempt.

To prevent transmission errors, it can be provided in the test procedure that the value AK2 is output a predetermined number, for example five times in succession, and the key device is given a predetermined period of time, for example a certain number of seconds, in order to return the control value K02. If this is not the case after these five attempts, the test device and thus the control device are blocked for the predetermined period of time.

Since the second control value must be output within a fixed period of time after the first control value has been issued and the second activation value has been received, it is not possible to find the value by trying it out. To increase security, a third activation characteristic value is output by the test device after the second control value has been entered, and the key device in turn outputs a third control value in a predetermined time frame. Only when all the control values have been checked for their identity will the control device 10, 45 be released.

Before the control device is released, or shortly after, the test device preferably transmits data to the key device which changes the stored activation characteristic values and the control values.

These values can be transferred in an identical way. To further increase security, however, it is preferable that the values transmitted by the test device are converted in the key device so that the transmitted values and the values transmitted back to the test device during the next test process are not identical. The conversion can be carried out according to a fixed scheme, but it is preferred that a variable conversion is carried out, which is based, for example, on the number n of the test procedures carried out for the respective key device, this value n then in the test device and in the key device ¬ device is stored in a non-readable manner.

The above-described method offers the possibility of checking the identity of the key device in such a way that a forgery of the key device or also the production of an unauthorized copy is made difficult or impossible. Instead of this method, other known ones can also be used Methods for data encryption and data protection can be used with the device according to the invention.

In the embodiments described above, the control device was used to control the operation of a gasoline engine provided with a catalyst. The operation of other motors, for example of diesel motors, electric motors, turbines and other drive sources, can also be controlled by appropriate design.

In addition to the described control of the engine, other functions of the vehicle can also be controlled as an alternative or in addition.

For example, it is possible to control the motor in the usual way and, on the other hand, to control the automatic transmission via a corresponding control device 10, 45. In addition, other control functions can be used as an alternative or in addition to the control.

Such a comprehensive control device, which otherwise corresponds in its construction to the previously described exemplary embodiments (FIGS. 1 to 3), can be provided for a vehicle with a gasoline engine and automatic transmission, which is also equipped with an anti-lock braking system and a power steering system Taxes.

Additional sensors are then provided, which are required to control the further functions of the vehicle. The sensors for detecting the wheel speed are mentioned as an example, namely a sensor for the left front wheel for the front right, for left rear, and for rear right. Additional sensors for system pressure etc. can be provided, but are not listed here for reasons of simplicity.

Furthermore, sensors are provided which detect the state of the automatic transmission, namely a first sensor for detecting the input speed of the torque converter, a sensor for detecting the output speed of the torque converter, a sensor for detecting the output speed of the transmission and others, for reasons the simplicity not listed sensors for detecting the switching states and pressure states in the various areas of hydraulic control of the automatic transmission.

Furthermore, a sensor is provided which detects the turning angle of the steering wheel of the vehicle, and a sensor which detects the rotational speed of the steering wheel movement, a sensor which detects the turning angle of the front wheels and, if the vehicle has all-wheel steering, also the turning angle the rear wheels. Furthermore, pressure sensors are provided which detect the pressure in the hydraulic area of the power steering control.

In vehicles which have at least one controlled differential, speed sensors can also be provided in order to detect the input speed and output speed of the respective differential gear, specifically in a uniaxially driven vehicle, the speeds in the axle distribution differential and in a two-axle driven vehicle, each according to the design, the speeds of the front axle differential, the rear axle differential and the center differential. If the vehicle has a device for influencing the spring / damper behavior, for example a semi-active or an active chassis control, sensors can also be provided which determine the relative speed of the chassis components with respect to the body, the acceleration values of the body, and acquire the yaw acceleration values, roll acceleration values and pitch acceleration values.

At least some of these sensors are preferably individualized. In the detection device, the operating data of the various devices are converted from the transmitted signal based on the regulations stored there in accordance with the respective characteristics. The required control variables are calculated in the function control device in accordance with stored calculation rules and characteristic fields and output via the data output device. The function of the first and second test devices is the same as in the previously described exemplary embodiments, with an alternative design with only one key device being possible here as well.

Since in this exemplary embodiment a very large number of sensors can be individualized and very complex control routines for the individual functions are stored in the control device, a particularly high degree of security is achieved here even when the control device is replaced.

4 and 5 show a further exemplary embodiment which can be combined with all of the exemplary embodiments described above. The exemplary embodiment is described here in accordance with the second embodiment of the invention, and the same reference numerals are used for the same parts as in FIGS. 1 and 2.

In this exemplary embodiment, a detection device 12 and a data output device 18 are provided in the control device 200.

However, the structure of the function control device is changed. A part of the function control device is arranged in module 210, a second part in module 211 and a third part in module 212. All computation rules, maps and the like which are necessary to calculate the engine control values from the data made available by the detection device are stored in module 211.

5 shows a schematic sectional illustration of such a control device. The control device 200 is completely filled with plastic and has a cavity 213 in which a base 214 with a plurality of electrical connections is provided for receiving the module 211, which is held against the cover 215 by a spring 218.

The module 211 can therefore be ^'removed and replaced. This design has the following advantage:

The "control device 200 here contains, preferably in an integrated manner, the regulations according to which the sensor values are converted, which are for the control are decisive, as well as devices that are required to control the operation of the engine from control signals.

By replacing the module 211, it is possible to change the control of the engine if this is due to the technical development, to adapt to modified components of the engine, or to modified components of the vehicle, to adapt to the regulations in different countries, etc is necessary without the control device having to be replaced or without reducing security.

In the same way as described here, the control devices for other functions of the vehicle, for example for the anti-lock braking system, the transmission, etc., can also be divided.

A control device is then conceivable, for example, as it corresponds in the exemplary embodiment according to FIG. 4, and in which interchangeable components influence or largely take over control of the engine, the anti-lock braking system, the transmission, the chassis, the power steering, etc., while in particular, the common or correspondingly divided detection device (s) is or are individualized for the individual vehicle.

Another embodiment will now be explained with reference to FIG. 6.

The embodiment according to FIG. 6 can be designed in accordance with the first embodiment according to FIG. 1 or the second embodiment according to FIG. 2. 6 is the selected second embodiment, in which the control device 300 is provided with two test devices and is connected to two key receiving devices. The sensors 20 to 27 and the actuating devices 30 to 32 as well as the detection device 14 and the output device 18 have the same function as in the second exemplary embodiment according to FIG.

2 and are also provided with the same reference symbols.

In this embodiment of the safety device, a function control device for an anti-lock braking system 302 with sensors 322, for an automatic transmission 303 with sensors 323 and for a power steering device 304 with sensors 324 are provided. Other function control devices, as already listed, can also be used.

The control device 300 has a third test device 3210, which data with the function control devices 302, 303,

304 can exchange.

The function control devices can be implemented as standard devices, i.e. that they have the same structure for each vehicle, but they can also be individualized, i.e. that at least individual sensor devices and individual actuating devices are specifically adapted to the respective function control device.

The individual function control devices can be constructed as shown in FIGS. 4 and 5, so they can have interchangeable components in order to influence the function control itself. An identification device is provided in each function control device, which is provided for exchanging data with the third test device 310.

The test device 310 carries out a data exchange with these identification devices, which e.g. at regular intervals, or each time the engine is started or each time the second key device (in the second embodiment) is used. With this data exchange, the control device 300 determines whether the respective function control device is the specific function control device provided for this vehicle. If this is not the case, the output of signals by the control device 300 to the motor etc. is interrupted.

Here, too, data exchange procedures are preferably used again, which rule out that the data transmission between the function control devices and the control device 300 can be manipulated.

This embodiment has the following advantage: in this case, the control device 300 only needs to control the function of the engine. If an unauthorized person in a stolen vehicle wants to replace the control device with a control device originating from another vehicle, for example by exchanging both the motor and control device, the operation of the new control device is also blocked by the corresponding identification data of the individual function control devices are not correct. The control device will therefore not be able to perform its function in the other vehicle. The replacement of all functional Control devices to enable the operation of the vehicle are very complex and can also be made practically impossible if the functional devices are customized with regard to their sensors and / or actuating devices.

A corresponding individualization and a corresponding identification is also to be preferred for the first and, if one is used, also for the second key receiving device, this preferably also being able to be used in all of the above-described embodiments and exemplary embodiments (FIGS. 1 to 5) .

A further exemplary embodiment is now described with reference to FIG. 2, which can also be combined with the aforementioned exemplary embodiments. With this structure, the design is the same as in the exemplary embodiment according to FIG. In contrast to this, however, two second key devices are provided here, namely a copy 54A and a copy 54B.

The testing device 19 recognizes the difference between the copies and only allows the selection of new parameters if the copies are used alternately. With each copy, if the other copy is not available, the operating parameters can only be specified once. This design has the following advantage:

If he has to specify new parameters, the user only inserts the copy required in each case into the second key receiving device. If the vehicle is stolen during this process, the thief has this one copy of the second Key setup, since the other parameter is required for the next parameter selection, the control of the relevant functions is interrupted after the corresponding limit values have been exceeded. This also makes insurance fraud even more difficult, since in this case the owner must always have a copy of the second locking device. Which copy is required for the extension is preferably shown on the display 51.

The exemplary embodiments described above for the second embodiment can be varied even further.

When using a second key device with or without a second key receiving device, a higher number of second key devices can also be used, e.g. are staggered in time. For example, a copy can extend the operating parameter time by e.g. allow one, two or three months, while a second copy must also be used every six months or every year. It is also possible to specify a number of cards for certain periods, e.g. one for each year.

If only one key receiving device is used in the second embodiment, groups (eg three groups) of two keys belonging together can also be formed. Each key of a group can then always be used for a certain time, and must then be exchanged for the other key of the same group. This allows multiple users to use the same motor vehicle. The test facility distinguishes between the individual groups and specifies the operating parameters individually for each group. This is if, as in all exemplary embodiments, time is used as at least one of the operating parameters, each of the users is forced to exchange the keys belonging to his group with one another.

With the security device according to the invention, a device is created which, with reasonable effort, offers a high degree of security against unauthorized use of the vehicle. The safety device can be manufactured in different ways, which makes it possible to adapt the safety device to the conditions of the individual vehicle. Thus, in a simple vehicle, the risk of theft of which may be lower, the security device will be made simpler, while in the case of a very high-quality vehicle, a correspondingly higher outlay for the security device is to be recommended and justified. The individualization of the control device, sensors and, where appropriate, the individual function control devices ensures that an exchange of such devices between individual vehicles is very difficult or practically impossible. The automobile manufacturer can also ensure that no corresponding control devices and possibly also function control devices are brought onto the market in an uncontrolled manner, so that it is also very difficult to overcome the safety device in this regard. If an exchange of safety-relevant elements, such as the control device, has to be carried out, a corresponding new control device will be supplied by the automobile manufacturer itself, which can check the authorization of the respective owner and retains the control device to be replaced itself. The automobile manufacturer can do it with relatively little Effort for individualized components, save and archive the corresponding functional data of the components with the required security against unauthorized access by third parties, so that the corresponding components can be manufactured and exchanged even after a long time.

The automobile manufacturers can also create additional facilities, e.g. a kind of master key in the form of a code card, which e.g. to automobile clubs, etc., and which once allows, in the second embodiment, the operating parameters for a short time, e.g. to specify two days so that operation is possible even if you forget to use the second key device etc. in good time. In this case, however, the associated test device is preferably designed such that this master key function can only be used once before the second key device is used again.

Claims

Safety device for a motor vehicle, which is driven by an engine, with:

a control device which controls at least one relevant function of the motor vehicle,

at least one key receiving device;

at least one key device which is intended to cooperate with this key receiving device and which is individually assigned to a specific motor vehicle;

a test device, which checks whether the key device interacting with this key receiving device is assigned to this particular motor vehicle, and which outputs a key control signal to the control device, thereby causing the control to enable at least one relevant function, if the key device is assigned to this specific motor vehicle and that the control of this at least one relevant function is interrupted if the key device is assigned to this specific motor vehicle is not assigned.

1 . Security device according to claim 1, characterized gekenn¬ characterized in that a second test device is provided which checks the occurrence of a defined activation event and outputs a corresponding second key control signal to the control device, the control device controlling at least one relevant function interrupts when this activation event has not occurred and at least one limit value of a predetermined operating parameter of the motor vehicle has been exceeded.

5. Security device according to claim 2, characterized in that a second key receiving device is provided which interacts with a second individual key device which is assigned to this specific motor vehicle, the interaction of this second key device with this second key ¬ receiving device is recognized as this defined activation event by the second test device.

1. Security device according to claim 2, characterized in that only one key receiving device is provided which interacts with at least one group of at least two different individual key devices which are assigned to this specific motor vehicle, with a change the interaction of the key receiving device from one of these at least two different key devices to another key device of the same group as this defined activation event is recognized by the second test device.

5. Security device according to claim 2, characterized in that only one key receiving device is provided, which interacts with at least one individual key device which is assigned to this specific motor vehicle, at least one property of this key device being that which acts separately from the motor vehicle The device can be changed and the change in this at least one property is recognized as this defined activation event by the second test device.

6. Safety device according to at least one of claims 2-5, characterized in that the or at least one of the predetermined operating parameters is selected from a group of parameters which are the time, the number of operating hours, the distance traveled, the number of courses Belwelle revolutions, the fuel consumed, the number of revolutions of a transmission component or the number of operations of an actuating element to be assigned to the drive area.

7. Safety device according to at least one of claims 1-6, characterized in that the control device is connected to at least one sensor generating an electrical signal in order to detect at least one current operating variable of the vehicle, and that the control of this at least one relevant function on the basis this detected operating variable (s) takes place. 8. Safety device according to claim 7, characterized in that at least one sensor for detecting the current operating variables used for the control has an individual characteristic assigned to the respective motor vehicle, and that the control device has a detection device in which a regulation is stored , on the basis of which the current operating variable detected with this sensor can be calculated from the signal of this individual sensor fed to the detection device.

9. Safety device according to at least one of the preceding claims, characterized in that it is at least a relevant function which is controlled by the control device, a function in the interruption of which the drive device of the vehicle is no longer functional .

10. Safety device according to claim 9, characterized in that this control device controls at least one further function of the vehicle, which is selected from a group, the functions of controlling a drive motor, a charger control, a transmission, an anti-lock control, an anti-slip control of drive wheels, a power steering device, an axle differential, a center differential, an all-wheel steering, a shock absorber device, a semi-active or active chassis, an alternator, an air conditioner and an audio device, such as a car radio. 11. Safety device according to at least one of the preceding claims, characterized in that a third test device is provided which checks the identity of at least one function control device and causes the control of this at least one relevant function to be interrupted by the control device, if this function control device is not identical to a specific function control device, this function control device being selected from a group comprising the function control device of a drive motor, a charger control, a transmission, an anti-lock control, an anti-slip control of drive wheels, a power steering device, an axle differential, a center differential, an all-wheel steering, a shock absorber device, a semi-active or active chassis, an alternator, an air conditioning system, and an audio device such as a radio ätes, includes.

12. Safety device according to at least one of claims 1 to 11, characterized in that the control device controls relevant functions of the engine, wherein as rele¬ vant function at least one function is selected from a group of functions which the beginning of the fuel injection, the Duration of the fuel injection, the ignition point in gasoline engines, the actuation of a second throttle valve in engines with driving force control, the valve opening time in engines with variable valve opening times and the valve lift in engines with variable valve lift. 13. Safety device according to claim 12, characterized in that the control device is connected to at least one sensor which is selected from a group of sensors which have a sensor for detecting the engine speed, a sensor for detecting the throttle valve position, a sensor for detecting the temperature of the intake air, a sensor for detecting the pressure in the intake system, a sensor for detecting the boost pressure in a charged engine, a knock sensor, a lambda sensor, a sensor for detecting an engine temperature, one Sensor for detecting the cooling water temperature in water-cooled engines, a sensor for detecting the oil temperature and a sensor for detecting the oil pressure.

14. Security device according to at least one of claims 1 to 13, characterized in that at least one key device has a data memory in order to store data and that the assigned key receiving device is provided for receiving data from the key device and sending it to the assigned test device ¬ direction to transmit.

15. Security device according to claim 14, characterized in that these data are stored digitally in the at least one key device and that these data are digitally transmitted from the assigned key receiving device to the assigned test device.

16. The safety device according to claim 15, characterized in that at least part of the at least one Data stored in the key device can be changed if the key device interacts with the assigned key receiving device and that the change in the data stored in the key device is controlled by the assigned test device or the key device or the key receiving device.

17. Security device according to claim 3 and at least one of claims 6 to 16, characterized in that both key devices are provided with data memories.

18. Security device according to at least one of claims 1 to 17, characterized in that at least one key receiving device has a data memory, and that this associated test device exchanges control data with this key receiving device in order to determine whether these key receiving devices are assigned to a specific individual motor vehicle Key receiving device corresponds, and that the assigned test device causes the control of this at least one relevant function to be interrupted if the key receiving device does not correspond to this individual key receiving device.

19. Safety device according to any one of claims 9 to 18, characterized in that the respective P ^'rüf- means for identifying a key device, a key receiving device, or radio ions- controller data with the direction to be identified Ein¬ exchanges, wherein the testing device the one to iden- Activating signals are transmitted to the tifying device and transmitted back by the control signals, and that the test device interrupts the output of the activation signals and the control of these at least one relevant function for a predetermined period of time if a predetermined time period and / or a predetermined number of permissible inputs between the output of a first correct control signal of the device to be identified and the output of a second correct control signal is exceeded.

20. Safety device according to claim 19, characterized in that this predetermined period of time is significantly increased after each failed attempt.

21. Safety device according to at least one of the preceding claims, characterized in that at least individual components of the control device and the test device (s) are arranged in a housing which is such that reading out of the stored and processed data is not possible is.

22. Safety device according to claim 21, characterized in that part of the data and regulations required for controlling this at least one relevant function is stored in a component which is exchangeable.

23. Security device according to at least one of the preceding claims, characterized in that at least one key device in the form of a conventional auto- key is designed, wherein a data processing device with a data memory is arranged in the head of the key.

24. Security device according to at least one of the preceding claims, characterized in that at least one key device is designed in the form of a code card which contains a data processing device and a data memory.

25. Security device according to at least one of the preceding claims, characterized in that at least one key receiving device is designed as a receiving device or as a transmitting / receiving device, which receives a signal transmitted wirelessly by the assigned key device and transmits it to the assigned test device, wherein this signal is preferably transmitted by means of radio waves, ultrasound, infrared or light waves.

26. A method of securing a motor vehicle driven by an engine in which:

a control device controls at least one relevant function of the motor vehicle,

at least one key receiving device is provided, and at least one key device which interacts with this key receiving device and which is individually assigned to a specific motor vehicle; a test device checks whether the key device interacting with this key receiving device is assigned to this specific motor vehicle and outputs a key control signal to the control device, which has the effect that the control of at least this at least one relevant function is made possible if the key device is assigned to a particular motor vehicle and that the control of this at least one relevant function is interrupted if the key device is not assigned to this specific motor vehicle.

27. A method of securing a motor vehicle according to claim

26, characterized in that a second test device checks the occurrence of a defined activation event and outputs a corresponding second key control signal to the control device, the control device interrupting the control of at least one relevant function if this activation event has not occurred and at least one Limit of a predetermined operating parameter of the motor vehicle has been exceeded.

28. A method of securing a motor vehicle according to claim

27, characterized in that a second key receiving device interacts with a second individual key device which is assigned to this specific motor vehicle, the interaction of this second key device with this second key The receiving device is recognized as this defined activation event by the second test device.

29. A method for securing a motor vehicle according to claim 27, characterized in that a key receiving device interacts with at least one group of at least two different individual key devices which are assigned to this specific motor vehicle, with a change in the interaction of the key receiving device from one of these at least two different key devices of a group to another of the same group as this defined activation event is recognized by the second test device.

30. A method of securing a motor vehicle according to claim 27, characterized in that a key receiving device interacts with at least one individual key device which is assigned to this specific motor vehicle, at least one property of this key device being changeable by a device which acts separately from the motor vehicle and the change of this at least one property is recognized as this defined activation event by the second test device.