Secured control unit for a system in a vehicle

Abstract

The invention relates to a secured control unit (100) for a system in a vehicle, wherein the control unit (100) comprises control electronics (110) and a housing (120) enclosing the control electronics (110), and the control electronics (110) are designed to ascertain an opening of the housing (120) and to carry out a securing function on the basis thereof.

Description

[0001] 2024PF00124 19.09.2024

[0002] 1

[0003] DESCRIPTION

[0004] Secure control unit for a system in a vehicle

[0005] The present invention relates to a secured control unit for a system in a vehicle, a vehicle with a secured control unit, a method for securing a control unit for a system in a vehicle, and in particular to making access more difficult or preventing access to control units to improve cybersecurity.

[0006] Control units, or electronic control units (ECUs), for systems such as the braking or steering systems in a vehicle comprise control electronics designed to perform functions that control the system. The ECUs are enclosed in a housing whose components are typically screwed together with conventional screws or clipped or clamped together using a snap-fit ​​mechanism. The ECUs are mounted to the vehicle using the same methods. In recent years, particularly in commercial vehicles, ECUs have increasingly been installed in easily accessible locations to facilitate installation, maintenance, and repair.

[0007] Conventional control units often provide insufficient protection against unauthorized access to the control electronics. As a result, control units or control electronics can be relatively easily stolen. Since circuit boards in particular are unprotected and physically accessible within the housing, unauthorized individuals can also manipulate both hardware and software. Manipulations can range from simply reading data and altering functions to destroying the control electronics.

[0008] For these reasons, there is a need to protect control units and, in particular, control electronics from unauthorized access.

[0009] A contribution to this is made by a secured control unit according to one of claims 1, 5 or 9, a vehicle with a secured control unit according to claim 13 and a method for securing a control unit according to one of claims 14 or 15 2024PF00124 2. The dependent claims define further advantageous embodiments of the subject matter of the independent claims.

[0010] The present invention relates to a secure control unit for a system in a vehicle, wherein the control unit comprises control electronics and a housing enclosing the control electronics. The control electronics are configured to detect an opening of the housing and to perform a security function based on this detection.

[0011] The vehicle can be a commercial vehicle. The commercial vehicle can be a truck, a tractor unit, a tractor unit, or a trailer. The system can be a braking system, a steering system, or a system for operating another vehicle function. The system can be a driver assistance system, such as lane keeping assist or adaptive cruise control, or a semi- or fully automatic system or autonomous system of the vehicle, such as a parking system or autonomous driving. The system can also be designed for a specific function of the vehicle; for example, the system can be a storage system, a lifting system, or a security system, such as for controlling a loading hatch or other vehicle access.

[0012] The control unit is designed to monitor or control the system or a part of the system. The control unit can be part of the system itself. The control unit can also be designed to control multiple systems or parts of multiple systems.

[0013] Control is based on the control electronics. In exemplary embodiments, the control electronics are designed to perform functions and, based on these, to control the system as intended. The control electronics can comprise one or more printed circuit boards and / or integrated circuits. The control electronics generally include at least one electronic component (and not merely electrical elements). The control electronics can comprise one or more electronic components. The electronic components can be integrated circuits or arrangements of one or more electronic components and electrical conductors. The control electronics can comprise one or more printed circuit boards. 2024PF00124 3

[0014] Opening the housing can generally refer to any opening of the closed housing surrounding the control electronics. However, it can be advantageous to exclude certain types of opening or opening processes, i.e., to disable the safety function in certain cases. This might, for example, allow for maintenance or repair of the control electronics.

[0015] The security function is not, or not necessarily, a function for controlling the system. In exemplary embodiments, the security function relates solely to the control unit itself. The security function protects the control unit, in particular, completely or partially, against access, especially unauthorized access. The security function makes electronic or physical manipulation of the control electronics more difficult or impossible. The security function may, in particular, be designed to prevent the control electronics from performing its intended function, or from performing it correctly.

[0016] In exemplary embodiments, the control electronics are configured to detect opening based on a change in a mechanical component. The mechanical component can be arranged as a connection between a first housing part or part of the housing and a second housing part. The mechanical component can act as a closure mechanism for the housing, i.e., it can be designed to offer mechanical resistance to opening the housing. However, this is not necessary; the mechanical component may, for example, be insufficiently strong or unsuitable for closing the housing. The mechanical component can, for example, comprise a wire, a spring, or a thread. The change can involve bending, tearing, or breaking the mechanical component.The control electronics may include a circuit designed to interrupt or establish a current flow by changing the mechanical component. Based on this, the control electronics may be configured to detect when the housing is opened and initiate the execution of the safety function. 2024PF00124 4.

[0017] In these or other embodiments, the control electronics for detecting when the housing is opened can also include an electronic component. This electronic component is then a sensor configured to detect the opening. The sensor can, for example, include a photodiode configured to detect light inside the housing or at one or more specific locations within the housing. As with the mechanical component, the control electronics can include a circuit configured to open or close a circuit based on the electronic component when the housing is opened, thus detecting the opening.

[0018] To prevent certain types of opening, the housing may have different access points or openings, each secured differently. In particular, the mechanical and / or electronic component may be attached to only one specific opening among several in the housing. Alternatively or additionally, the control electronics may have a signal connection accessible from outside the housing and configured to receive signals. Based on these signals, the control electronics may be configured to disable the locking function and / or the opening detection. For example, the control electronics may be configured to receive signals via the signal connection that temporarily or permanently suspend or prevent the locking function and / or the opening detection.Suppression can involve interrupting a power or energy connection between the electronic component and a control electronics circuit.

[0019] Advantageously, the control electronics are configured to receive only specific signals for such suppression. In particular, the control electronics can include an electronic memory in which a code is stored, and the control unit can be configured to compare the code with the signals or a portion thereof, and to execute or refrain from executing the suppression depending on the result of this comparison. Thus, the control electronics can be configured to refrain from executing the security function when a predetermined code or password is entered. 2024PF00124 5

[0020] Optionally, the control electronics include an electronic data storage device containing stored data, and the backup function includes data erasure. The electronic data storage device can be a permanent storage device designed to retain data indefinitely, without any specific time limit. For example, the data storage device could be an HDD, SSB, or other flash memory. Alternatively, the electronic data storage device can be a temporary storage device in which data is only stored temporarily. For example, the data storage device could be a rolling memory or RAM.

[0021] The data can include configuration data that customizes the control unit. The data can also be a prerequisite for one or more functions of the control unit for controlling the system. In this case, the data can include or be software or firmware program data.

[0022] Deleting the data may result in the electronic control unit no longer being able to control the system as intended, either wholly or partially, temporarily or permanently.

[0023] Deleting the data can offer particularly good protection if the data is present in the same or similar form on several control units of the type presented here. This applies especially to data relating to the basic functions of the control electronics.

[0024] Alternatively or additionally, the security function can also include data encryption. This can be particularly advantageous if data generated by the control unit during its intended use is not to be destroyed, but only rendered inaccessible. The electronic control unit can be configured to encrypt the data in such a way that the encrypted data can be decrypted again with a key or code that is not stored in the electronic control unit.

[0025] Both data deletion and data encryption may require the control unit to undergo a reset process. It may be stipulated that the reset process is performed by the owner of the control unit and / or by a manufacturer of the control unit.

[0026] Alternatively or additionally, the safety function can also include issuing an alarm. The alarm can be directed at a driver and / or intended for remote transmission. In exemplary embodiments, the alarm can, for example, include the illumination of a lamp in the cab of a commercial vehicle. This lamp can be one that is also used elsewhere in the system during normal operation. For example, for a control unit in an ABS system, the alarm can include the illumination of an ABS warning light. The lamp can illuminate in a specific pattern. Alternatively or additionally, the control electronics can be configured to transmit an alarm signal from the vehicle to an infrastructure remote from the vehicle via a V2I communication interface. Advantageously, the transmission is wireless.Unlike the previously described interference with control electronics data, the alarm can offer the advantage of immediately displaying or forwarding information about access to the control unit and / or the control electronics.

[0027] Optionally, the safeguard function includes the destruction of at least part of the control electronics. This part of the control electronics can comprise a printed circuit board with its components, integrated circuits and / or wiring, or a conductor architecture on a printed circuit board. The term "conductor architecture" can refer to the arrangement of conductors on the printed circuit board. Destroying the conductor architecture can render a circuit's function unrecognizable.

[0028] The destruction can be caused or triggered by a voltage or current and may involve a combustion or oxidation process. For this purpose, the control electronics can be configured to draw energy from an energy source for the control unit and to execute the destruction based on this energy. In these or other embodiments, the control unit can also include an energy storage device configured to store the energy for destroying the control electronics, wherein the control electronics are configured to execute the destruction based on the energy in the energy storage device. The energy in the energy storage device can be electrostatic in nature. In particular, the energy storage device can include capacitors. The energy storage device can be configured to draw energy from the energy source of the control unit, i.e., to recharge itself automatically from a battery or a fuel cell in the vehicle.

[0029] Optionally, the safety function includes supplying or introducing energy into at least one electronic component of the control electronics to cause a defect in that component. The defect can occur through deliberate overheating or as an overvoltage damage. The electronic component can be a diode, a transistor, or even a microcontroller.

[0030] For example, a deliberate overvoltage can cause a defect in one or more input and / or output pins of a microcontroller. This overvoltage can be generated from the power supply in the control unit or from an additional energy storage device. As a result, sensors or necessary safety signals would no longer be readable, or actuators could no longer be controlled.

[0031] Exemplary embodiments also relate to a secured control unit for a system in a vehicle, wherein the control unit comprises control electronics and a housing enclosing the control electronics, and the control electronics have a potting compound around at least part of the control electronics.

[0032] The control unit can also have the features described above. In particular, the control unit can also be designed to detect when the housing has been opened and to perform a safety function.

[0033] The potting compound is designed to make visual inspection and direct physical access to the control electronics, or to the entire control electronics assembly, difficult. In this way, the potting compound protects the control electronics from unauthorized access. 2024PF00124 8

[0034] In some embodiments, the potting compound can be designed to completely fill the housing. In other embodiments, the potting compound is designed so that part of the housing remains free or filled with air. The potting compound can enclose a printed circuit board or one or more electronic components on a printed circuit board. In advantageous embodiments, the control electronics include an electronic data storage device, and the potting compound is designed to enclose the electronic data storage device.

[0035] Optionally, the potting compound encloses at least one of the following parts of the control electronics: a microcontroller, a conductor architecture, a power management IC, a transceiver IC, a gate driver IC.

[0036] In particular, encapsulation around a conductor architecture or a circuit architecture can offer the advantage that a function of the control electronics can no longer be detected by optical inspection.

[0037] Optionally, the potting compound can be one of the following materials: epoxy, polybutadiene, polyurethane, foam resin, silicone, or a thermoplastic polymer. The potting compound can be applied by overmolding or as a hot-melt adhesive around the control electronics or a portion thereof.

[0038] Potting materials that are difficult to remove and / or not transparent are particularly advantageous in order to prevent access to and visual inspection of the control electronics.

[0039] Optionally, the potting compound is thermally insulating, and the destruction described above is based on heat generation in the part of the control electronics surrounded by the potting compound.

[0040] In state-of-the-art electronics potting applications, a high thermal conductivity of the potting material is often advantageous, as this enables efficient heat transfer and prevents overheating of the potted electronics. In contrast, the potting compound in the control unit presented here can have a significantly lower thermal conductivity. Here, it can be advantageously utilized that materials with lower thermal conductivity often have a comparatively low viscosity, which facilitates application and distribution of the material to the desired areas.

[0041] In particular, the potting compound in the control unit presented here can be applied only locally around a part of the control electronics that generates very little heat during normal operation (for example, around an electronic data storage device, a conductor architecture, or another specific part of the circuit board). Energy conducted to this part of the control electronics as part of the protection function can then be just high enough that, due to the thermal insulation provided by the potting compound, a defect or destruction occurs in this part of the control electronics, while other parts of the control electronics are not affected or are only minimally affected by the destruction. Thus, by appropriately designing the potting compound, the destruction of the control electronics can be more reliably limited to a local area.

[0042] Exemplary embodiments also relate to a secured control unit for a system in a vehicle, wherein the control unit comprises control electronics and a housing enclosing the control electronics, with a first housing part and a second housing part that can be connected to each other to close the housing. The first housing part and the second housing part are connected by a safety connection.

[0043] The control unit may also have the features described above. In particular, the control unit may also be designed to detect when the housing has been opened and to perform a safety function, and / or it may have a potting compound around at least part of the control electronics.

[0044] The first and second housing parts can essentially be two halves. The first and second housing parts can also be connected by a hinge. The second housing part can be a flap within the otherwise monolithic first housing part (or vice versa). 2024PF00124 10

[0045] The security connection is designed to provide greater resistance to unauthorized access to the control electronics compared to a connection using conventional screws or snap-in mechanisms.

[0046] Optionally, the safety connection is based on a releasable connecting element, which is designed to be released by a key tool. This means that the releasable connecting element offers significantly greater resistance to tools other than the key tool when attempting to release it, and / or cannot be released at all, because the connecting element and tool are not positively locked. The releasable connecting element thus has a locking function in addition to its connecting function. In exemplary embodiments, the releasable connecting element can be a screw whose head is designed so that it can only be turned with the special key tool. Such screws are known in the prior art, for example, from wheel locks.In these or other advantageous embodiments, the releasable connecting element can also have an elastic part that engages in a correspondingly shaped blind hole in the first and / or the second housing part, wherein the connecting element does not extend to the end of the blind hole in an insertion direction. A suitable key tool can then be designed to stretch the connecting element in the blind hole and thus release the elastic part from its engaged state, thereby releasing the releasable connecting element.

[0047] Optionally, the safety connection includes a permanent bond using an adhesive and / or a rivet. The rivet can create a joining connection between the first and second housing parts.

[0048] Alternatively or additionally, the safety connection includes a non-detachable connection achieved by hot-stitching the first housing part to the second housing part or by welding the first housing part to the second housing part. The non-detachable connection can then be a permanent positive-locking, force-locking, and / or material-locking connection. 2024PF00124 11

[0049] In exemplary embodiments, the non-removable connection can only be undone by accepting damage or destruction of the joined parts, in particular the first housing part and the second housing part.

[0050] Optionally, the control electronics are designed to detect that the housing has been opened based on the release of the detachable connecting element and / or the breaking of the non-detachable connection.

[0051] In particular, the detachable connecting element itself can be designed to close or open a circuit of the control electronics when in use. For example, the connecting element can be made of metal and be designed to protrude from the interior of the housing, thereby permanently actuating a switch and thus establishing or breaking an electrical contact, or to lie between two conductor ends and thus closing an electrical contact.

[0052] In these or other embodiments, a wire or thread is inserted in an area of ​​the non-removable connection. This wire or thread is connected to a circuit in the control electronics and is designed to mechanically interrupt or close a circuit in the control electronics if the non-removable connection breaks in that area. Alternatively or additionally, a photodiode can be directed towards the area of ​​the connection and designed to detect when the housing is opened in that area.

[0053] Exemplary embodiments also relate to a vehicle with a secured control unit according to one of the preceding claims. The vehicle can, in particular, be a commercial vehicle. The commercial vehicle can be a truck with or without a trailer, a tractor-trailer combination, a tractor unit, or a trailer. Especially in such commercial vehicles, electronic control units are often more easily accessible without detection than in passenger cars.

[0054] In exemplary embodiments, the control unit is attached to the vehicle by a fastening means, and the vehicle is designed to make it difficult to bring a tool close to a locking element of the housing. In particular, the control unit can be attached to a frame of a commercial vehicle or to a part of the driver's cab of the commercial vehicle. Bringing the tool close can be made more difficult, in particular, by obscuring the locking element of the housing by a part of the frame or the driver's cab.

[0055] Alternatively or additionally, the fastening device is designed to be released with a key tool. The fastening device can be of one of the types previously described for closing the housing.

[0056] Exemplary embodiments also relate to a method for securing a control unit for a system in a vehicle, wherein the control unit comprises control electronics and a housing enclosing the control electronics. The method includes detecting whether the housing has been opened. The method further includes executing a securing function. Advantageously, both the detection of the opening and the execution of the securing function are based on automatic processes for which the control electronics of the control unit itself are designed. The method can be carried out, in particular, in or with a control unit of the type described above.

[0057] Exemplary embodiments also relate to a method for securing a control unit for a system in a vehicle, wherein the control unit comprises control electronics and a housing enclosing the control electronics. The method includes potting at least a portion of the control electronics. The resulting potting can also completely enclose the control electronics. The housing can be completely or partially filled by the potting. The potting can be based on a material comprising epoxy, polybutadiene, polyurethane, a foam resin, silicone, or a thermoplastic polymer. In exemplary embodiments, the potting provides, in particular, protection against optical inspection of the potted portion of the control electronics.

[0058] Alternatively or additionally, the method includes connecting the first and second housing parts by a safety connection. The safety connection can offer greater resistance to damage or loosening than a simple conventional screw, a simple snap-in mechanism, or a conventional pin. This allows for a secure control device of the type described above. The safety connection can be achieved, in particular, by a releasable fastener that can only be removed with a key tool. For example, the releasable fastener could be a wheel bolt. Alternatively or additionally, the safety connection can be achieved by a non-releasable fastener. The non-releasable fastener could, for example, be a rivet or an adhesive.The first housing part and the second housing part can be joined by hot riveting or welding.

[0059] Alternatively or additionally, the method includes mounting the control unit at a location on the vehicle where it is difficult to bring a tool close to a locking device on the housing. In particular, the control unit can be mounted on the frame of a commercial vehicle or on part of the driver's cab of the commercial vehicle. Bringing the tool close can be made more difficult, in particular, if the locking device of the housing is obscured by part of the frame or the driver's cab.

[0060] Alternatively or additionally, the method includes attaching the control unit to the vehicle with a fastener designed to be released with a key tool. The fastener may, in particular, be a releasable connecting element, as previously described for the safety connection.

[0061] Important aspects of the secured control unit, the vehicle, and the procedure can also be represented as follows.

[0062] In the current state of the art, the housings of control units or control devices are clipped together or screwed in place with conventional screws. Conventional control electronics, especially printed circuit boards (PCBs), are unprotected within the housing of conventional control units and directly accessible to "hackers," making it easy to manipulate the hardware or software. The problem with conventional control units and their installation in vehicles is that the 2024PF00124 14

[0063] Control units are easily accessible from the outside and their hardware and software can be easily manipulated.

[0064] All the presented variants of the secured control unit, the vehicle, and the procedure have in common that they make access to the control electronics within the control unit's housing difficult or impossible. A problem that all the presented variants of the secured control unit, the vehicle, and the procedure solve therefore relates to cybersecurity.

[0065] Exemplary embodiments include, in particular, bonding and / or riveting and / or hot-stitching the control unit housing. Alternatively or additionally, exemplary embodiments include the use of screws with special screw heads (similar to wheel locks). Alternatively or additionally, exemplary embodiments include potting the control electronics or a part thereof, in particular a PCB, with, for example, epoxy resin, by potting, encapsulation, or hot melt. Alternatively or additionally, exemplary embodiments include self-destruction of hardware and / or software.

[0066] In particular, a combination of the features described for the secured control unit, the vehicle, and the method makes direct physical access to the control electronics (hardware and / or software) more difficult or impossible. Advantageous embodiments therefore combine features of the presented variants of the secured control unit, the vehicle, and the method.

[0067] In one embodiment, the housing of the control unit, which is, for example, part of a vehicle's steering system, can therefore be glued and riveted together. The rivets are positioned so that they are inaccessible when installed in the vehicle, for example, to be drilled out. Additionally, the control electronics or a circuit board inside the housing are encased in a hot melt adhesive. Furthermore, hardware and / or software within the control electronics detects when the housing is opened and self-destructs, either partially or completely.

[0068] It is precisely through a combination of these various measures that the control electronics are protected and cannot be manipulated, or only with great difficulty. 2024PF00124 15

[0069] The advantages of the secured control unit, the vehicle, and the method therefore each include the fact that the control electronics are protected by the presented features and can no longer be easily manipulated.

[0070] The embodiments of the present invention are better understood from the following detailed description and the accompanying drawings of the different embodiments, which, however, should not be understood as limiting the disclosure to the specific embodiments, but merely serve for explanation and understanding.

[0071] Fig. 1 shows a secured control unit according to the present invention, in which a control electronics is configured to perform a safety function when a housing is opened.

[0072] Fig. 2 shows another secured control unit according to the present invention, in which the control electronics have a potting compound around part of the control electronics.

[0073] Fig. 3 shows another secured control unit according to the present invention, in which a first housing part and a second housing part are connected by a safety connection.

[0074] Fig. 4 shows a vehicle with an embodiment of the secured control unit.

[0075] Fig. 5 shows steps of a procedure for securing a control unit.

[0076] Fig. 6 shows further steps of a procedure for securing the control unit.

[0077] Fig. 1 shows a secured control unit 100 for a system in a vehicle. The vehicle can be, in particular, a commercial vehicle. The system can be, for example, a steering or a braking system of the vehicle. The control unit 100 comprises control electronics 110 and a housing 120 that encloses the control electronics 110. The housing 120 comprises a first housing part 123 and a second housing part 125. The second housing part 125 closes the first housing part 123. The control electronics 110 comprises a printed circuit board 111 with conductive traces arranged on it and exemplary electronic components 115. The printed circuit board 111 is fixed in the first housing part 123. The 2024PF00124 16

[0078] The control electronics 110 can comprise one or more integrated circuits. The control electronics 110 are configured to perform functions for controlling the system. The control electronics 110 are also configured to detect if the housing 120 has been opened and, based on this detection, to perform a safety function.

[0079] To detect when the housing 120 is opened, the control electronics 110 includes a circuit with a photodiode 113. The photodiode 113 acts as a sensor to detect when the housing 120 is opened. The photodiode 113 is designed to detect light entering the housing 120 when it is opened. The photodiode 113 does not necessarily need to be designed to detect visible light. Advantageously, the housing 120 is particularly opaque in the wavelength range in which the photodiode 113 detects light. When light falls on the photodiode 113 when the housing 120 is opened, the photodiode 113 detects the light, and the control electronics circuit 110 is configured to detect when the housing 120 is opened.

[0080] The control electronics 110 can include an electronic data storage device with data stored thereon. The backup function can include data deletion or data encryption. Deletion is provided in advantageous embodiments for parts of the software and / or firmware implemented on the circuit board 111. Encryption is provided in advantageous embodiments for configuration data that individualizes the control unit 100. This can also include data that the control unit 100 has generated through its intended use.

[0081] Furthermore, the control electronics 110 can be configured to issue an alarm as a safety function. The alarm can include a light signal to the driver of the vehicle. The control electronics 110 can also be configured to send an alarm message to a receiver located away from the vehicle. For this purpose, the control electronics 110 can include a wireless transmission device 2024PF00124 17. The transmission can be based, for example, on a Wi-Fi, Bluetooth, or NFC standard.

[0082] The control electronics 110 can also be configured to destroy at least part of itself as part of its safety function. For this purpose, the control electronics 110 can include an energy storage device containing sufficient energy to destroy part of the circuit architecture, specific electronic components, or the entire circuit board 111. The energy storage device can be based on static electrical energy and may, for example, include capacitors. Alternatively, the energy storage device can include a chemical explosive. The explosive can be detonated, for example, by a discharge of electrical energy.

[0083] The destruction can also include the application of energy to an electronic component, which may be, for example, an electronic component 115, part of an integrated circuit, or a conductor architecture on the printed circuit board 111, in order to cause a defect in the electronic component. The electronic component may, in particular, include a microcontroller. The defect may prevent the function of the electronic component or the control electronics 110 from being detected during an optical or electronic inspection.

[0084] Fig. 2 shows a secured control unit 100 for a system in a vehicle. Details of the control unit 100 not described below can be implemented as in the embodiment shown in Fig. 1. The control unit 100 comprises control electronics 110 and a housing 120 enclosing the control electronics 110.

[0085] The control electronics 110 have a potting 130 around a part of the control electronics 110. The potting 130 is designed to prevent functions of the control electronics 110 from being detected by optical inspection.

[0086] The portion of the control electronics 110 enclosed by the potting compound 130 includes some of the electronic components 115 on the printed circuit board 111. The potting compound 130 can, in particular, enclose a conductor architecture. 2024PF00124 18

[0087] The potting compound 130 can consist of epoxy, polybutadiene, polyurethane, a foam resin, silicone or a thermoplastic or thermosetting polymer.

[0088] The potting compound 130 can be thermally insulating. The control electronics 110 can be configured as described for Fig. 1, with a safety feature that allows the part of the control electronics 110 enclosed by the potting compound 130 to be destroyed. Energy can be conducted into this enclosed part of the control electronics 110, generating heat which, due to the thermal insulation of the potting compound 130, primarily affects the encapsulated part of the control electronics 110, causing it to be destroyed or damaged.

[0089] Fig. 3 shows a secured control unit 100 for a system in a vehicle, wherein the control unit 100 comprises control electronics 110 and a housing 120 enclosing the control electronics 110, the housing having a first housing part 123 and a second housing part 125, which can be connected to each other to close the housing 120, the first housing part 123 and the second housing part 125 being connected by a safety connection. Details of the control unit 100 not described below can be implemented as in the embodiments shown in Fig. 1 and / or Fig. 2.

[0090] The safety connection is achieved here based on a releasable connecting element 140. This releasable connecting element 140 is designed to be released by a key tool. The releasable connecting element 140 is a screw. The screw 140 comprises a head 141, which is made of a very strong material and has a profile 143 that allows the screw 140 to be turned with the key tool designed for the profile 143. The head 141 is designed so that it cannot be gripped and turned by any means other than the key tool, or only with great difficulty. The screw 140 also has a recess 145, which is circular and movable around the head 141 or the profile 143, thus further hindering the screw 140 from being gripped.

[0091] Inside the housing 120, screw 140 also protrudes from a

[0092] The housing wall is removed. The control electronics 110 includes a switching element 117, shown in 2024PF00124 19, which presses the screw 140. The switching element 117 is configured to switch when the screw 140 is removed, or when there is no longer any contact with the screw 140. The control electronics 110 is configured to detect (or assume) the opening of the housing 120 based on the switching of the switching element 117 and to perform the locking function as described, for example, for Fig. 1. In this way, the control electronics 110 can be configured to detect the opening of the housing 120 based on the release of the releasable connecting element 140. To open the housing 120, for example for maintenance or repair, the control electronics 110 can have a signal connection and be configured to receive signals with a code or password from outside the housing 110 and to operate based on the code or password.Password to suppress the execution of the security function.

[0093] Fig. 4 shows a vehicle 200, in particular a commercial vehicle, with an embodiment of the secured control unit 100. The control unit 100 is attached to the vehicle 200 with at least one fastening means 160.

[0094] The vehicle 200 is designed to make it difficult to bring a tool close to a locking element of the housing 120. Specifically, the vehicle 200 is a commercial vehicle, for example, a truck or a tractor-trailer. The commercial vehicle 200 has a frame 210 that includes a projection 213. The control unit 100 comprises a first housing part 123 and a second housing part 125, which are connected here as locking elements by non-removable connecting elements 150, in this case, rivets. The control unit 100 is arranged such that at least some of the rivets 150 are covered by the projection 213. This prevents, for example, the rivets 150 from being drilled out.

[0095] Furthermore, the fasteners 160 are designed to be loosened using only a wrench. The fasteners 160 can be screws of the type of releasable fasteners 140 in Fig. 3. The screws 160 connect the housing 120 of the control unit 100 directly to the frame 210 of the commercial vehicle 200. 2024PF00124 20

[0096] Other possible mounting options for the control unit include, for example, installation in or under a vehicle cabin, which in each case makes access to the control unit even more difficult.

[0097] Fig. 5 shows steps of a method for securing a control unit 100 for a system in a vehicle 200, wherein the control unit 100 comprises control electronics 110 and a housing 120 enclosing the control electronics 110. The method includes detecting S110 that the housing 120 has been opened and executing S120 a security function. Advantageously, the method is carried out using a secured control unit 100 of the type described above. The security function can be executed as described above. In particular, the method can thus include deleting data stored in the control electronics, encrypting such data, and / or issuing an alarm. Alternatively or additionally, the method can also include destroying at least part of the control electronics.In particular, the method may involve supplying energy to an electronic component in order to cause a defect in the electronic component.

[0098] Fig. 6 shows steps of a method for securing a control unit 100 for a system in a vehicle 200, wherein the control unit 100 comprises control electronics 110 and a housing 120 enclosing the control electronics 110. The method first comprises potting S130 of at least part of the control electronics 110. The potting S130 can, in particular, conceal a conductor architecture or an electronic component and thus protect it from visual inspection. The method further comprises connecting S140 the first housing part 123 and the second housing part 125 by means of a security connection, for example, a wheel lock 140, a rivet 150, or by hot riveting or welding the housing 120. The method further comprises attaching S150 the control unit 100 to a location on the vehicle 200 where it is difficult to bring a tool close to a locking element of the housing 120.For example, rivets 160 can be partially concealed by projections 123 of a frame to which the control unit 100 is attached. Furthermore, the method includes attaching S160 of the control unit 100 to the 2024PF00124 21.

[0099] Vehicle 200 with at least one fastening device 160 designed to be released with a key tool. The fastening device 160 may, for example, be or comprise a wheel lock.

[0100] The features of the invention disclosed in the description, claims and figures may be essential for the realization of the invention, either individually or in any combination.

[0101] 2024PF00124 22

[0102] REFERENCE MARK LIST

[0103] 100 control units

[0104] 110 Control electronics

[0105] 111 Circuit board

[0106] 113 Photodiode

[0107] 115 electronic component

[0108] 117 Switching element

[0109] 120 cases

[0110] 123 first housing part

[0111] 125 second housing part

[0112] 130 potting

[0113] 140 detachable connecting element

[0114] 141 head

[0115] 143 Profile

[0116] 145 tub

[0117] 150 non-removable fasteners, rivets

[0118] 160 fasteners

[0119] 200 vehicles

[0120] 210 frames

[0121] 213 lead

[0122] S110, S120, S130, S140, S150, S160 Procedure steps

Claims

2024PF00124 23 PATENT CLAIMS 1. A secured control unit (100) for a system in a vehicle, wherein the control unit (100) comprises a control electronics (110) and a housing (120) enclosing the control electronics (110), characterized in that the control electronics (110) is configured to detect an opening of the housing (120) and to perform a security function based thereon.

2. The control unit (100) according to claim 1, wherein the control electronics (110) has an electronic data storage device with data stored thereon and the backup function comprises at least one of the following: - a deletion of the data, - encrypting the data, - issuing an alarm.

3. The control unit (100) according to one of claims 1 or 2, wherein the safeguarding function comprises destroying at least a part of the control electronics (110).

4. The control unit (100) according to claim 3, wherein the control electronics (110) comprises an electronic component, and the destruction comprises supplying energy to the electronic component in order to cause a defect in the electronic component.

5. A secure control unit (100) for a system in a vehicle, wherein the control unit (100) comprises a control electronics (110) and a housing (120) enclosing the control electronics (110), characterized in that the control electronics (110) has a potting (130) around at least a part of the control electronics (110).

6. The control unit (100) according to claim 5, wherein the part of the control electronics (110) surrounded by the potting compound (130) comprises at least one of the following: 2024PF00124 24 - a microcontroller, - a ladder architecture, - a power management IC, - a transceiver IC, - a gate driver IC.

7. The control unit (100) according to one of claims 5 or 6, wherein the potting compound (130) comprises one of the following materials: - Epoxy, - Polybutadiene, - Polyurethane, - Foam resin, - silicone, - a thermoplastic polymer.

8. The control unit (100) according to one of claims 5 to 7 and one of claims 3 or 4, wherein the potting compound (130) is thermally insulating and the destruction is based on heat generation in the part of the control electronics (110) surrounded by the potting compound (130).

9. A secure control unit (100) for a system in a vehicle, wherein the control unit (100) comprises a control electronics (110) and a housing (120) enclosing the control electronics (110) with a first housing part (123) and a second housing part (125) which can be connected to each other to close the housing (120), characterized in that the first housing part (123) and the second housing part (125) are connected by a safety connection (140, 150).

10. The control unit (100) according to claim 9, wherein the safety connection (140, 150) is achieved based on a releasable connecting element (140), wherein the releasable connecting element (140) is designed to be released by a key tool. 2024PF00124 25 11. The control unit (100) according to one of claims 9 or 10, wherein the safety connection (140, 150) comprises a non-releasable connection which is achieved based on one of the following: - an adhesive, - one rivet (150), - a hot caulking, - a welding process.

12. The control unit (100) according to one of claims 1 to 4 or 8 as well as according to one of claims 9 to 11, wherein the control electronics (110) is configured to detect the opening of the housing (120) based on a loosening of the releasable connecting element (140) and / or a breaking of the non-releasable connection.

13. A vehicle (200), in particular a commercial vehicle, with a secured control unit (100) according to one of the preceding claims, wherein the control unit (100) is attached to the vehicle (200) with a fastening means (160), and wherein - the vehicle (200) is designed to make it more difficult to bring a tool close to a locking means (150) of the housing (120), and / or - the fastening device (160) is designed to be loosened with a key tool.

14. A method for securing a control unit (100) for a system in a vehicle (200), wherein the control unit (100) comprises a control electronics (110) and a housing (120) enclosing the control electronics (110), characterized by: Detect (S110), based on the control electronics (110), an opening of the housing (120); and Execute (S120), based on the control electronics (110), a safety function. 2024PF00124 26 15. A method for securing a control unit (100) for a system in a vehicle (200), wherein the control unit (100) comprises a control electronics (110) and a housing (120) enclosing the control electronics (110), characterized by: - ​​potting (S130) at least a part of the control electronics (110), and / or - Connecting (S140) a first housing part (123) and a second housing part (125) by means of a safety connection (140, 150), and / or - Attaching (S150) the control unit (100) to a location on the vehicle (200) where it is difficult to bring a tool close to a locking means (150) of the housing (120), and / or - Attaching (S160) the control unit (100) to the vehicle (200) using a fastener (160) designed to be released with a key tool.

Images