Switching between different operating modes of a control unit

Abstract

The invention relates to switching between different operating modes (B1, B2) of a control unit (2) for a vehicle (1). In a first operating mode (B1), a memory entry is irrevocably created in a memory unit (4) at each elapsed time interval (Δt) of a predetermined time period defined for the first operating mode (B1). Upon reaching the predetermined maximum value (Max) of memory entries, which corresponds to the number of time intervals (Δt) in the predetermined time period, the system automatically switches from the first operating mode (B1) to a different second operating mode (B2).

Description

[0001] The invention relates to a method for switching between different operating modes of a control unit. The invention also relates to a control unit for switching between different operating modes of the control unit.

[0002] Many functions of an electronic control unit (ECU), such as security functions, depend on a specific lifecycle or state of the ECU. The lifecycle refers, for example, to the state of the ECU during production, at a supplier's site, or at a customer's site, to name just a few examples. Typically, these different lifecycles are implemented in an ECU in such a way that they can only be traversed in a defined direction. This is relatively easy to achieve technically by defining different operating modes for the ECU, each representing one of these lifecycles.

[0003] Different functions are enabled in the various operating modes. For example, in production mode, certain safety functions are typically deactivated, and certain diagnostic services, such as commissioning diagnostic services, are activated to simplify the use of the control unit in production. However, the safety functions should be active in customer mode, while the commissioning diagnostic services are not needed here.

[0004] For example, different diagnostic services are active in customer mode than in production mode.

[0005] If the associated lifecycle changes, the respective operating mode must be actively exited so that only the functions authorized for that lifecycle can be used. Setting or switching to the new operating mode can be done by an operator, for example. This can be forgotten, leading to control units being used with functions not authorized for the respective lifecycle. This can be misused.

[0006] Therefore, an automatic switching or changeover between different operating modes would be desirable. Several possibilities for this are known from the current state of the art.

[0007] For example, DE 199 42 368 A1 discloses a motor vehicle with control units that can be operated in different modes. The control units can be switched between a logistics mode and a normal operating mode by means of central commands. Switching occurs, for example, when the vehicle has been in logistics mode for a certain predetermined time or when a certain mileage on the vehicle's odometer has been exceeded.

[0008] German patent DE 10 2020 216 048 A1 discloses a method for operating a motor vehicle control unit. In this method, a state variable is irreversibly stored in a non-volatile memory device, depending on the control unit's operating phase. The state variable is used to enable or disable the execution of a computer program for controlling test software from an external unit.

[0009] From DE 10 2005 025 880 A1, an electronic control unit for controlling a function of a vehicle is defined, comprising an input for receiving control-relevant data from a sensor, a computer unit for processing the control-relevant data and generating control commands, and an output for sending the control commands to an actuator, furthermore comprising a device for temporal and / or functional restriction of the operation of the control unit.

[0010] The object of the present invention is to make switching between different operating modes of a control unit safer.

[0011] The problem is solved by the subject matter of the independent patent claims. Advantageous embodiments of the invention are disclosed by the dependent patent claims, the description, and the figures.

[0012] According to one aspect, the invention relates to a method for switching between different operating modes of a control unit. In a first operating mode, a memory entry is irrevocably created in a storage unit during each elapsed time interval of a predetermined time period, which is defined for the first operating mode. Upon reaching a predetermined maximum value of memory entries, which corresponds to the number of time intervals in the predetermined time period, the system automatically switches from the first operating mode to a different second operating mode.

[0013] In other words, a time period is defined for the first operating mode and divided into meaningful time intervals. The time is then measured while the control unit is operating in this first mode. Whenever a time interval has elapsed, specifically at or after the expiration time, a memory entry is created. This can be done, for example, by changing the state value of a memory cell in the storage unit. The storage unit can comprise one or more data storage devices. It can also be referred to as a storage medium. The storage unit is preferably a non-volatile storage device. This means that at least one data storage device is non-volatile. Therefore, the memory entry is irrevocable, i.e., permanently created. The memory entry cannot be deleted or modified. Consequently, the memory entry is independent of whether the control unit is switched on or off.

[0014] The storage unit is limited to a predetermined number of memory entries. This number is specified by the maximum value. The maximum value thus limits the number of memory cells that may be written to with the entry. The maximum value, i.e., the number of available memory entries, preferably corresponds to the division of the time span into time intervals. In particular, the number of time intervals can correspond to the maximum value. That is, the number of time intervals is preferably adapted to the number of available memory cells.

[0015] When the maximum value is reached during the writing process to the memory cells, meaning the last available memory cell is filled with the entry, the switchover is triggered automatically. This means the system switches from the first operating mode to the second operating mode without any operator intervention.

[0016] In this way, it is possible to implement a safe counter or timer for automatically advancing the lifecycle state of an electronic control unit (ECU). The method operates without external information, such as mileage or distance traveled, and can therefore autonomously manage transitions between different lifecycle states, i.e., operating modes. The safe counter or timer is designed so that it can only be started once and cannot be reset. This ensures that the ECU does not revert to a previous operating mode in which, for example, functions or services are active that are not desirable for the current lifecycle.

[0017] The control unit can be understood as a data processing device, for example, for performing arithmetic operations. For this purpose, the control unit can include a processor circuit configured to execute an embodiment of the method according to the invention. The processor circuit can comprise at least one microprocessor and / or at least one microcontroller and / or at least one FPGA (Field Programmable Gate Array) and / or at least one DSP (Digital Signal Processor). In particular, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or an NPU (Neural Processing Unit) can be used as the microprocessor. Furthermore, the processor circuit can include program code configured to execute the embodiment of the method according to the invention when performed by the processor circuit.The program code can be stored in a data memory of the processor device. The processor device can be based, for example, on at least one circuit board and / or on at least one SoC (System on Chip).

[0018] The control unit is preferably used as a control unit or Electronic Control Unit (ECU) of a vehicle, such as a motor vehicle.

[0019] The time intervals are preferably chosen to be constant for the entire time period. That is, the time intervals preferably have identical dimensions. Counting the time for the time intervals can be implemented, for example, using an integrated counter unit of the control unit. The counter unit can, for instance, function as a system clock within a microcontroller of the control unit. To measure time intervals, i.e., the time intervals, so-called interrupts can be triggered, for example, in an interrupt routine. This would involve, for instance, incrementing a variable that represents the passage of time.

[0020] The invention includes embodiments that offer additional advantages.

[0021] In one embodiment, an OTP (one-time programmable) memory unit is provided. Of course, in addition to the OTP memory unit, one or more further memory units, for example, non-volatile and / or volatile memory, can be provided.

[0022] One-Time Programmable Memory (OTP memory) is a type of non-volatile memory that can only be written to once. Once written, the data cannot be erased or modified. This makes OTP memory resistant to unauthorized changes or manipulation. There are various types of OTP memory, such as Floating-Gate-Based OTP, where the memory cells are based on a floating-gate transistor structure. Another type is Anti-Fuse OTP, where the memory cells are based on an anti-fuse transistor structure. This involves a special transistor whose electrical resistance can be irreversibly changed by applying a specific voltage. The corresponding information is stored in the memory cell by changing the resistance.

[0023] In one embodiment, an overcurrent protection of an electronic fuse, which is assigned to each memory cell of the OTP storage unit, is triggered to create the memory entry.

[0024] This means the OPT memory is designed as a so-called eFuse-OTP. An eFuse is an electronic fuse that permanently opens when a certain voltage or current threshold is exceeded and cannot be closed again afterward. Therefore, when using eFuse technology, the fuse is deliberately or intentionally blown in order to write to the memory cell.

[0025] In one embodiment, the cryptographic protection method is implemented in a security module of the control unit. The security module can therefore be designed as a cryptography module.

[0026] The security module is implemented in hardware and supported, for example, by software. For instance, the security module can be implemented as a so-called hardware security module (HSM) or as a so-called trust zone. Of course, other hardware- or software-based security modules can also be used to protect the process.

[0027] An HSM is a specialized hardware component that performs cryptographic operations and ensures that sensitive data is not accessible outside the security module. The HSM, for example, has encrypted storage, which can be configured as the storage unit.

[0028] A trust zone creates a secure environment on a single chip by dividing the chip's hardware into two areas: a secure area and a non-secure area. The secure area is called the trust zone and is an isolated area, for example, within the processor, reserved for safety-critical applications. The non-secure area is the processor's normal operating mode, where most applications run.

[0029] In one embodiment, at least partially different functions or services of the control unit are enabled in the operating modes. That is, in each operating mode, some functions are deactivated or blocked, while other functions are activated or enabled for the intended operation of the control unit. The activated and deactivated functions differ completely or partially from one operating mode to the next. In particular, the activated and deactivated functions are selected depending on the technical or logical lifecycle of the control unit.

[0030] In one embodiment, the first operating mode is a production mode for manufacturing a system that includes the control unit. The second operating mode is, for example, a customer mode for customer use of the system. In contrast to the customer mode, in the production mode, predetermined safety functions of the control unit are deactivated and predetermined diagnostic services of this control unit are activated. These diagnostic services include, for example, services intended for commissioning.

[0031] In the "production" lifecycle, functions or services are activated that, in the "customer" lifecycle, must be enabled for security reasons, for example, or should be disabled to prevent misuse. Security functions can be deactivated, for instance, to facilitate production. This might involve disabling or at least modifying the encrypted communication that the control unit can perform with other control units. For example, the authenticity of the transmitted data would then no longer be verified. Furthermore, an immobilizer, for instance, could be deactivated. Diagnostic services for commissioning are used, for example, to commission a control unit. These should be activated in production but generally deactivated for the customer.Otherwise, the customer could, for example, access internal or confidential data of the control unit and misuse it.

[0032] Of course, the first and second operating modes can also refer to other operating modes for a given lifecycle of the control unit. For example, there might be a manufacturer's mode, which the control unit enters during production at the manufacturer's facility. There might also be a supplier or logistics mode, which is implemented while the unit is with a supplier or in a logistics environment. Naturally, the operating mode could also be a recall mode (field return), which the control unit enters, for example, when it is returned to the manufacturer or supplier by the customer due to technical problems. However, no automated switching to a subsequent operating mode should be implemented for such a recall mode, as the recall mode should represent the final lifecycle of the corresponding control unit. That is, the recall mode can only be the second operating mode.

[0033] In one embodiment, the time interval is selected based on a pre-known duration of the respective lifecycle of the control unit in the first operating mode. The number of time intervals is selected accordingly, depending on the number of freely available memory cells of the memory unit, in particular the OTP memory.

[0034] This means that the time period is determined based on typical timeframes during which the control unit is in its respective lifecycle. Accordingly, the time period is divided into time segments depending on how many memory cells of the storage unit are not occupied by other processes, for example.

[0035] For production as a life cycle, the time span can, for example, be in the range of a few days, such as two to four days. The time interval can be selected to reflect a practical usage time in the control unit's operational use and adapted to the number of memory cells. For example, a time interval in the range of minutes, such as 15 to 30 minutes or up to 60 minutes, can be chosen. By selecting the time intervals appropriately, the limited and expensive storage capacity of a corresponding non-volatile memory unit, such as an OTP memory, can be optimally utilized.

[0036] The time span and the respective time interval, as well as the number of available memory cells, are determined, for example, at compile time (the time of compiling) of the control unit's program code by the control unit manufacturer. These can be based, for example, on requirements from an OEM (original equipment manufacturer) or another end user of the control unit.

[0037] In one embodiment, the respective time interval is only completed if the control unit is operational. Operational here means that the control unit is supplied with electrical power, i.e., switched on. If the control unit is switched off, the process is interrupted and the respective time interval ends. When the control unit is switched back on, the respective time interval restarts, for example.

[0038] This means the system clock only counts when the corresponding control unit is active. If, for example, production has to stop for an extended period – for whatever reason – the system clock will not continue to run. Therefore, it is of secondary importance whether the defined total time corresponds to the actual time elapsed or is exceeded or shortened by + / - 50 percent.

[0039] In one embodiment, the method is terminated if the control unit is manually switched to the second operating mode within the specified time period while in the first operating mode.

[0040] This means that if an operator, for example a production worker, manually switches to the second operating mode, the method according to the invention is interrupted or terminated. Only if, for example, the switchover is forgotten during production, i.e., in the previous operating mode, does the method continue for the specified time period, and the switchover occurs automatically.

[0041] For use cases or application situations that may arise during the procedure and are not explicitly described here, it may be provided that, according to the procedure, an error message and / or a request for user feedback is issued and / or a default setting and / or a predetermined initial state is set.

[0042] According to a further aspect, the invention relates to a control unit for switching between different operating modes. The control unit comprises at least one memory unit configured to irrevocably create a memory entry for the at least one memory unit during each elapsed time interval of a predetermined time period defined for the first operating mode. The control unit is further configured to automatically switch from the first operating mode to a different second operating mode when a predetermined maximum value of memory requests, which corresponds to the number of time intervals within the predetermined time period, is reached.

[0043] The control unit according to the invention can therefore be used to execute or carry out the method according to the invention. In particular, the control unit according to the invention executes the method according to the invention.

[0044] The invention also includes further developments of the control unit according to the invention, which have features already described in connection with the further developments of the method according to the invention. For this reason, the corresponding further developments of the control unit according to the invention are not described again here.

[0045] Particularly preferably, the invention provides a vehicle with a plurality of control units according to the invention. Preferably, at least one of the plurality of control units is configured to carry out the method according to the invention. That is, either the plurality of control units can each carry out the method according to the invention, or a central control unit can be provided which carries out the method and controls the other control units for switching with a corresponding switching signal.

[0046] The vehicle is preferably designed as a motor vehicle, preferably as a motor car, in particular as a passenger car or truck, or as a passenger bus or motorcycle.

[0047] The invention also includes combinations of the features of the described embodiments. The invention therefore also includes realizations that each exhibit a combination of the features of several of the described embodiments, provided that the embodiments have not been described as mutually exclusive.

[0048] The following are exemplary embodiments of the invention described. This is illustrated by: Fig. 1. A schematic representation of a vehicle with a large number of control units for switching between different operating modes; and Fig. 2 A schematic process flow diagram for a procedure for switching between different operating modes of a control unit for a vehicle.

[0049] The exemplary embodiments described below are preferred embodiments of the invention. In these exemplary embodiments, the described components each represent individual features of the invention that can be considered independently of one another and each further develops the invention independently.

[0050] Therefore, the disclosure should also include combinations of features of the embodiments other than those shown. Furthermore, the described embodiments can also be supplemented by further features of the invention already described.

[0051] In the figures, identical reference symbols denote functionally equivalent elements.

[0052] Fig. Figure 1 shows a schematic representation of a vehicle 1. Vehicle 1 is, for example, a passenger car. Vehicle 1 comprises a number of control units 2 (ECUs: Electronic Control Units). Here, for example, five such control units 2 are shown, although vehicle 1 can, of course, contain more or fewer control units 2. Each control unit 2 can control vehicle functions assigned to it. For this purpose, control unit 2 can, for example, include at least one microcontroller or microprocessor.

[0053] According to the embodiment in Fig. One of the control units 2 is configured as a central control unit 3. The central control unit 3 is used, for example, for data exchange with the other control units 2 and can analyze the data they transmit, which, for example, indicates the vehicle's status. The other control units 2 could be, for example, a transmission control unit, an engine control unit, a door control unit, and a driver assistance system control unit, to name just a few examples of vehicle control units.

[0054] The control units 2 should now be configured to switch or change their operating mode as needed. Specifically, the respective operating mode B1 or B2 should always be switched or changed when the lifecycle of the respective control unit 2 changes. The lifecycle indicates the technical or logical state in which the respective control unit 2 currently finds itself, based on its operational time over its entire lifespan. In different lifecycles, and therefore also in operating modes B1 and B2, at least partially different functions or services of the respective control unit 2 should be enabled or activated.

[0055] For example, the following operating modes can be used for the control units 2, according to the embodiment in Fig. 1. The following modes are given: a manufacturer mode, a supplier mode, a production mode, a customer mode, and a field return mode. These modes are only examples and can, of course, be selected differently, for example, depending on the system in which the respective control unit 2 is used. These operating modes, and thus the life cycles, are traversed for each control unit 2, specifically only in a defined direction and sequence.

[0056] The following section will examine production mode and customer mode as different operating modes. Production mode, for example, is a first operating mode B1 that the control units 2 exhibit or can assume when the vehicle 1 is in production, i.e., at a vehicle manufacturer's production facility. To facilitate production, certain security functions are typically deactivated in production mode. For example, encrypted communication may be restricted, or an immobilizer may be deactivated. Certain diagnostic services for commissioning the vehicle 1 and / or the control units 2 are also activated.

[0057] Depending on the production parameters, different methods are possible for activating the production mode. For example, the supplier of the respective control unit 2 can activate this mode as the final step in the "delivery or logistics" lifecycle. Since the control unit is then de-energized, i.e., deactivated, the activated production mode only resumes during production, for example, at the original equipment manufacturer (OEM). Another option is for the production mode to be activated at the OEM at the start of production.

[0058] In customer mode, a second operating mode (B2), the security functions activated in production mode should be enabled, while the diagnostic services for commissioning should be disabled. This is to ensure data security in vehicle 1 and prevent data misuse. Therefore, it is important that after the "production" lifecycle is complete, production mode is deactivated and customer mode is activated to enable or disable the necessary functions.

[0059] Switching between operating modes B1 and B2 can be done manually by a production worker, for example. However, the worker might forget to do this, meaning that vehicle 1, with control units 2, arrives at the customer's location still in production mode and thus remains in the "customer" lifecycle. To prevent this, the following section presents a method for automatically or autonomously switching between production modes B1 and B2.

[0060] In the present embodiments according to Fig. 1 and Fig. 2. The switching is carried out by each control unit 2 itself. However, it can also be provided that, for example, the central control unit 3 initiates or controls the switching.

[0061] For the sake of clarity, the structure of the control units is as follows: Fig. Figure 1 is shown only for the central control unit 3. However, the structure can be assumed to be identical for all control units 2. To implement the switching, each control unit 2 comprises a first storage unit 4 and a first processing unit 5. The first storage unit 4 is configured as a non-volatile storage unit, specifically as an OTP memory. Preferably, it is an OTP memory based on eFuse technology (eFuse: electronic fuse). The first processing unit 5 can be configured, for example, as a microcontroller, microprocessor, or FPGA. Of course, other OTP storage technologies can also be used. The first storage unit 4 and the first processing unit 5 are implemented, for example, in a protected environment within the central control unit 3. The protected environment can be configured, for example, as a security module 6, specifically as a hardware security module.Of course, a security module can also be implemented in other ways to create a protected environment, such as a trust zone or other technical implementations in hardware or software. Data processed and stored in the protected area is safeguarded against unauthorized access, for example, through encryption or cryptographic methods.

[0062] In addition, each control unit 2 also includes a second processing unit 7 and a second storage unit 8. The second processing unit 7 can, for example, be configured analogously to the first processing unit 5. The second storage unit 8, however, does not need to be OTP memory, but can, for example, be another type of data storage, such as volatile or non-volatile data storage, like flash memory or RAM. Of course, the second storage unit can also include OTP memory as non-volatile data storage.

[0063] Unlike the first processing unit 5 and the first storage unit 4, the second processing unit 7 and the second storage unit 8 are not implemented in the protected environment. They are, for example, a normal area within control unit 2, where most non-safety-critical applications are executed or implemented.

[0064] Using the first processing unit 5 and the first storage unit 4, an intelligent counter is implemented, enabling automatic switching between operating modes B1 and B2. This implementation is based on two concepts: firstly, a meaningful operating time is defined for the practical use of the respective control unit 2, in this case, specifically the vehicle 1; and secondly, there is a limited memory area that can only be written to once, which is achieved primarily through the OPT memory.

[0065] An exemplary implementation of the switching process is described below using the following examples: Fig. 2 explained in more detail. Fig. Figure 2 shows a schematic process flow diagram for a procedure for switching between different operating modes B1, B2 of a control unit 2 for a vehicle 1.

[0066] In step S1, the control units 2 are all in the first operating mode B1, i.e., the production mode. Vehicle 1 is therefore, for example, currently in production. It is known that production typically takes two to four days for a given vehicle 1. This is defined as the corresponding time period for the "production" lifecycle. For example, three days, or 72 hours, can be defined as the time period. A suitable, practical usage time in the vehicle's operational use is, for example, a time interval in the minute range. For example, the usage time can be defined as 15 to 30 minutes, or 60 minutes or more. This usage time is defined as the time interval Δt of the time period. In the present embodiment, a time interval of 15 minutes can be assumed as the minimum practical usage time.

[0067] In step S2, the time from the start of the first operating mode B1 is measured. For this purpose, the first processing unit 5 can, for example, have an integrated time unit or system clock with a counter module. Whenever the predefined time interval Δt, in this case, for example, 15 minutes, has elapsed, a memory entry for the first storage unit 4 is irrevocably created in step S3. That is, in step S2, the first processing unit 5 checks whether the time interval Δt has elapsed. If the time interval Δt has not yet elapsed, step S2 is repeated. If, however, the time interval Δt has elapsed (Y), step S3 is executed.

[0068] Preferably, the system clock only runs when the corresponding control unit 2 is active. If production is interrupted, for example due to a power outage or holiday period, the system clock does not continue running but restarts, for example, at the beginning of the defined time interval Δt.

[0069] To create the memory entry in step S3, an overcurrent protection circuit of the electronic fuse in the respective memory cell of the OTP memory is triggered. In the OTP memory, analogous to a punched card, the memory cell is irrevocably written by deliberately or intentionally blowing the fuse. This blowing, like punching a hole in a card, cannot be reversed, so the information or entry is permanently stored in the memory cell. The memory entry is created permanently and irreversibly.

[0070] Writing to the memory cells of the OTP memory preferably continues until the limited memory area is exhausted. In step S4, it is checked whether the number of memory entries reaches a predefined maximum value, Max. This maximum value, Max, is preferably assigned to the number of time intervals, Δt. For example, the number of time intervals, Δt, can correspond to the maximum value, Max. In this case, the maximum value can be, for example, 288, which results from the three-day production cycle and the 15-minute resolution of the time intervals, Δt. This number of memory locations is typically available in modern OTP memories.

[0071] If the maximum value is not reached in step S4 (N), the procedure is repeated from step S2 for the next time interval. If, however, the maximum value Max is reached (J), the procedure continues in step S5. In step S5, the system switches from the first operating mode P1 to the second operating mode P2, i.e., the customer mode. Each control unit 2 performs this switch itself.

[0072] However, if the switching is initiated, for example, by the central control unit 3, the central control unit 3 can send a switching signal U to the other control units 2 and, for example, the second processing unit 7. Upon receiving the switching signal, the control units switch their respective operating modes B1 and B2 according to the specifications. This activates the functions assigned to operating modes B1 and B2, while deactivating other functions.

[0073] Thus, the counter implemented in this way stores a corresponding information (memory entry) in the OTP memory during normal usage time (time span) when a defined step size, i.e., the maximum value, is reached. This entry immutably indicates that the step size has been exceeded. After all defined steps have elapsed, the defined time span, i.e., the usage time, has been exceeded, which in turn can be used to advance the lifecycle state of the respective control unit 2.

[0074] Overall, the exemplary embodiments demonstrate the realization of a safe counter for monitoring time and in a specific state of a vehicle 1.

Claims

[1] Method for switching between different operating modes (B1, B2) of a control unit (2) for a vehicle (1), wherein in a first operating mode (B1) a memory entry of a memory unit (4) is irrevocably created at each expiry of a predetermined time interval (Δt) of a predetermined time span which is defined for the first operating mode (B1), and when a predetermined maximum value (Max) of the memory entries, which is assigned to a number of time intervals (Δt) in the predetermined time span, is reached, the first operating mode (B1) is automatically switched to a different second operating mode (B2). [2] Method according to claim 1, wherein an OTP storage unit (OTP: One Time Programmable) is provided. [3] Method according to claim 2, wherein an overcurrent protection of an electronic fuse, which is assigned to each memory cell of the OTP storage unit, is triggered for the creation of the memory entry. [4] Method according to one of the preceding claims, wherein the method for cryptographic protection is carried out in a security module (5) of the control unit (2). [5] Method according to one of the preceding claims, wherein in the operating modes (B1, B2) at least partially different functions of the control unit (2) are enabled. [6] Method according to claim 5, wherein the first operating mode (B1) is a production mode for the production of a system comprising the control unit (2), and the second operating mode (B2) is a customer mode for the use of the system by a customer, wherein in the production mode, in contrast to the customer mode, predetermined safety functions of the control unit (2) are deactivated and predetermined diagnostic services of the control unit (2) are activated. [7] Method according to one of the preceding claims, wherein the time span is selected depending on a previously known time span of a respective life cycle of the control unit (2) in the first operating mode (B1), and the number of time intervals (Δt) is selected depending on a number of freely available memory cells of the storage unit (4). [8] Method according to one of the preceding claims, wherein the respective time period (Δt) is only completed when the control unit (2) is ready for operation. [9] Method according to one of the preceding claims, wherein the method is terminated when the control unit (2) in the first operating mode (B1) is manually switched to the second operating mode (B2) within the specified time period. [10] Control unit (2) for a vehicle (1) for switching between different operating modes (B1, B2) of the control unit (2), wherein the control unit (2) comprises at least one storage unit (4), wherein the at least one storage unit (4) is configured to irrevocably create a storage entry for the at least one storage unit (4) in a first operating mode (B1) of the control unit (2) at each elapsed time interval (Δt) of a predetermined time period defined for the first operating mode (B1), and the control unit (2) is configured to automatically switch from the first operating mode (B1) to a different second operating mode (B2) when a predetermined maximum value (Max) of the storage entries, which is assigned to the number of time intervals (Δt) in the predetermined time period, is reached.

Images