Immobilizer for Preventing Unauthorized Starting of a Motor Vehicle and Method for Operating the Same

This application is a continuation of international application Ser. No. PCT/DE94/00917, filed Aug. 9, 1994.

1. Field of the Invention

The invention relates to an immobilizer for a motor vehicle and a method for operating the same.

An immobilizer is a control unit which protects a motor vehicle against unauthorized use. For that purpose, a user code is sent to the immobilizer by an ignition key having a transponder or by a portable transponder in the form of a smart card. The vehicle can be started only if the user is authorized. The engine control unit is activated, for example, when the user code corresponds to an authorization code. In contrast, if it is attempted to achieve that by using unauthorized keys or transponders or by bypassing the immobilizer, the engine control unit is not enabled.

Nevertheless, the motor vehicle can be used permanently by exchanging the engine control device and bypassing the immobilizer.

2. Summary of the Invention

It is accordingly an object of the invention to provide an immobilizer for a motor vehicle and a method for operating the same, which overcome the hereinafore-mentioned disadvantages of the heretofore-known devices and methods of this general type and which offer the highest security against unauthorized use of a motor vehicle, even if control devices are exchanged, with it being the intention to ensure the availability of the motor vehicle.

With the foregoing and other objects in view there is provided, in accordance with the invention, an immobilizer for a motor vehicle, comprising a common data line; control devices of a motor vehicle each storing or generating an identification code word with the aid of an algorithm and each being connected to the common data line; and at least one test unit of the motor vehicle storing or calculating desired code words with the aid of an algorithm identifying the control devices; the at least one test unit being connected through the common data line to the control devices; the at least one test unit transmitting a request signal, at least during every engine starting operation, through the data line to at least some of the control devices, causing the at least some control devices to transmit back their identification code words; the at least one test unit comparing the identification code words being sent back with the desired code words; the at least one test unit leaving at least one of the control devices in an inactive state, for preventing starting or driving of the motor vehicle if fewer than a prescribed number of the control devices reply with their identification code word in the event of an interrogation for the identification code words; and the at least one test unit enabling all of the control devices if at least the prescribed number of the control devices reply with their identification code word in the event of the interrogation.

In accordance with another feature of the invention, the at least one test unit and one of the control devices form a structural unit.

In accordance with a further feature of the invention, the identification code words or the algorithm for calculating the identification code words are stored in at least one of the control devices or in at least one portable user code generator.

In accordance with an added feature of the invention, there is provided a user code generator storing or generating a user code word with the aid of an algorithm, and an initiation device for transmitting the user code word by radio to the at least one test unit causing the request signal to be initiated if the user code word corresponds to an authorization code word stored in the at least one test unit.

In accordance with an additional feature of the invention, there is provided a steady-state identification code generator in which all of the identification code words are stored and with the aid of which either all of the control devices or only the control devices having been exchanged for defective control devices, are re-initialized.

With the objects of the invention in view, there is also provided a method for operating an immobilizer for a motor vehicle, which comprises transmitting a request signal from a test unit through a data line to at least some control devices, at least during every engine starting operation, causing the at least some control devices to transmit back identification code words; comparing the identification code words being sent back with the desired code words, in the test unit; leaving at least one of the control devices in an inactive state, with the test unit, for preventing starting or driving of a motor vehicle if fewer than a prescribed number of the control devices reply with their identification code word in the event of an interrogation for the identification code words; and enabling all of the control devices, with the test unit, if at least the prescribed number of control devices reply with their identification code word, in the event of the interrogation.

In accordance with another mode of the invention, there is provided a method which comprises placing at least one of the control devices into an inactive state, with the test unit, after a predetermined time period, if more than the prescribed number of control devices, but not all of the control devices, reply with their identification code word in the event of the interrogation for the identification code words.

In accordance with a further mode of the invention, there is provided a method which comprises carrying out a first initialization, with the test unit, if the test unit recognizes that at least a majority of the control devices being connected to the data line are in a basic state, and carrying out a re-initialization, with the test unit, if it is recognized that at least one of the control devices is in the basic state and remaining control devices as well as at least one user code generator are assigned to the immobilizer as being authorized.

In accordance with a concomitant mode of the invention, there is provided a method in which the test unit or the user code generator detects the number of engine starting operations with the aid of at least one counter and places the motor vehicle into an inactive state after a predetermined number of engine starting operations, for preventing the motor vehicle from being moved, if the counter is not reset to zero by an external RESET unit.

In this method and device, a plurality of control devices, for example for controlling the air quantity, the fuel injection, the ignition, the gearbox, an airbag or the central locking system, each have an identification code which, upon request, is sent by the immobilizer through a data line to a test unit and is compared there with a desired code. If at least a predetermined number of control devices do not reply with their identification code or do not reply at all, then all or some of the control devices remain in an inactive state, with the result that the motor vehicle cannot be started or driven.

Indeed, all of the control devices would have to be exchanged for the purpose of unauthorized use of the motor vehicle, and that involves a very high outlay.

In this case, the test unit can be accommodated in a control device. The control devices or exchanged control devices can be initialized by using an identification code generator. The situation in which control devices that are not absolutely necessary for the operation of the motor vehicle have failed, is temporarily tolerated in the case of this immobilizer, but those control devices must be exchanged after a period of time, since otherwise the motor vehicle is placed into an inactive state by the test unit. This has the advantage of permitting the motor vehicle to still be started and taken to a service station when a control device, that is a control device which is not absolutely necessary for operation, or the test unit itself, is defective and must be exchanged. The test unit may be an independent control device which is absolutely necessary for the operation of the motor vehicle. However, it may also be accommodated in a control device which is present anyway.

The number of starting operations can be added up by a counter. The test unit places the motor vehicle into an inactive state if the counter reading is not occasionally reset to zero by an external and authorized RESET unit.

Other features which are considered as characteristic for the invention are set forth in the appended claims.

Although the invention is illustrated and described herein as embodied in an immobilizer for a motor vehicle and a method for operating the same, it is nevertheless not intended to be limited to the details shown, since various modifications and structural changes may be made therein without departing from the spirit of the invention and within the scope and range of equivalents of the claims.

The construction and method of operation of the invention, however, together with additional objects and advantages thereof will be best understood from the following description of specific embodiments when read in connection with the accompanying drawings.

FIG. 1 is a fragmentary, diagrammatic, side-elevational view of an immobilizer according to the invention;

FIG. 2 is a block circuit diagram of the immobilizer; and

FIG. 3 is a flow diagram of a method for operating the immobilizer.

Referring now to the figures of the drawing in detail and first, particularly, to FIG. 1 thereof, there is seen an immobilizer for a motor vehicle which can prevent the intended use of the motor vehicle by an unauthorized user. FIG. 1 shows a test unit P of the immobilizer which may be disposed in a housing on an ignition lock Z of the vehicle. As soon as an ignition key ZS is inserted in the lock and actuated, the immobilizer checks the authorization of the user in the test unit P.

For this purpose, a user code word (referred to below as a user code) is communicated wirelessly or by radio to a transmitting and receiving antenna E of the immobilizer by a transponder G (user code generator) which is connected to the ignition key. If a plurality of users are to be authorized, then they all have a dedicated ignition key ZS with respectively dedicated user codes. The test unit P compares the user code with an authorization code word (referred to below as an authorization code) which is stored in the test unit P. In the event of correspondence, the vehicle can be enabled for the intended use. For this purpose, for example, the engine control device which is inhibited in the untested state can be unlocked, with the result that the engine can be started.

In order to ensure that the immobilizer may not be circumvented solely by exchanging an engine control unit, the test unit P is connected to further control devices S.sub.i and F.sub.j in the motor vehicle through a data line BUS. In FIG. 2, where i=1 to m and j=1 to n, the control devices S.sub.i are operationally pertinent control devices, such as the engine control unit, and the control devices F.sub.j are non-operationally pertinent control devices such as an air bag control device, for example. All of the control devices S.sub.i and F.sub.j are present anyway, for example in the form of an ignition, ABS, central locking system, gearbox, level control device, etc., and are checked by the immobilizer when an attempt is made to start the motor vehicle. In the case of unauthorized use, the operationally pertinent control devices remain inhibited, with the result that the motor vehicle cannot be started. All of the control devices S.sub.i and F.sub.j would then have to be exchanged in order to circumvent the immobilizer.

The immobilizer is a security system including the test unit P with its transmitting and receiving unit E, the control devices S.sub.i and F.sub.j which are connected to the test unit P through the data line BUS, as well as a plurality of portable user code generators.

An identification code word (referred to below as an identification code) which is stored in each control device S.sub.i and F.sub.j is respectively interrogated by the test unit P in order to prevent the control devices S.sub.i and F.sub.j provided with an identification code from being exchanged impermissibly with non-coded control devices. If the identification codes are checked and they are all authorized, then the motor vehicle can be started by activating at least one operationally pertinent control device S.sub.i. The immobilizer and the method for operating it are explained in more detail with reference to FIGS. 2 and 3.

With reference to the circuit of FIG. 2 and the flow diagram of FIG. 3, it is seen that if a user having a user code generator G.sub.k (where k=1 to 3 in the exemplary embodiment), for example in the form of an ignition key ZS having a transponder G, or in the form of a smart card having a transponder, would like to use the vehicle, then a dialog must take place between the immobilizer and the user code generator G.sub.k. The dialog can be initiated, for example, by turning the ignition key ZS in the ignition lock Z. In this case, a check is performed as to whether or not the user code generator G.sub.k is authorized to start the vehicle. For this purpose, the user code is compared with the authorization code in the test unit P.

If the two codes correspond, then a request signal is in turn sent through the data line BUS to all or only some of the connected control devices S.sub.i and F.sub.j. The latter receive the request signal and are obliged thereby to reply with their identification code. It is then recorded in the test unit P whether or not and with which identification code the control devices S.sub.i and F.sub.j have replied. For this purpose, the received identification codes are compared with desired code words (desired codes). If all of the control devices S.sub.i and F.sub.j have replied correctly, an enable signal is sent, under the control of the test unit P, to the control device or devices S.sub.i, as a result of which starting of the motor vehicle is enabled. Otherwise, the control devices S.sub.i remain in an inactive state.

The operationally pertinent control devices S.sub.i, that is to say the control devices which are absolutely necessary for the operation of the motor vehicle, are put into an inactive state when the motor vehicle is turned off. The test unit P which is likewise inhibited in the quiescent state of the motor vehicle also belongs to the operationally pertinent control devices. The inactive state can be cancelled again only by an authorized user.

If one of the control devices F.sub.j which is not absolutely necessary for the operation of the motor vehicle is defective and must be replaced, then it cannot reply at all to the request signal or can reply only with an incorrect identification code. This is recognized by the test unit P. The driver is given a warning through the use of an optical or acoustical indication and his or her attention is drawn to the requirement that the motor vehicle still be in operation only for a short period, for example for a specific trip length, a predetermined time duration or a number of starting operations. Consequently, the motor vehicle can, for example, be brought home from a vacation so that it may be repaired in the local service station and the defective control device F.sub.j can be exchanged. If the defective control device F.sub.j is not exchanged, the motor vehicle will be rendered inoperative by the test unit P after expiration of the period.

For this reason, it is sufficient if not all, but at least a prescribed number of the control devices S.sub.i and F.sub.j reply with their identification code when the interrogation for the identification codes is made. If, for example, four control devices S.sub.i and F.sub.j are interrogated, then it is sufficient if three reply with a valid identification code. Consequently, the availability of the motor vehicle is ensured at all times. Therefore, the situation cannot occur wherein the motor vehicle can no longer be moved at all due to a defective and exchanged control device which is not absolutely necessary for the operation of the motor vehicle.

However, if fewer than the prescribed number of control devices S.sub.i and F.sub.j reply with their identification code, then the test unit P leaves at least one control device S.sub.i in an inactive state, with the result that starting or driving of the motor vehicle is prevented. Accordingly, the inactivated control device S.sub.i must be an operationally pertinent control device, since otherwise the immobilizer would not be effective.

New control devices S.sub.i and F.sub.j are at first in a basic state (initial mode). The initial mode is recognized by the test unit P. If all or the majority of the control devices S.sub.i and F.sub.j are in the initial mode, then all of the control devices S.sub.i and F.sub.j are provided with an identification code and the user code generator G.sub.k is provided with a user code (first initialization). This can occur, for example, after the production of the motor vehicle, that is to say at the end of the assembly line at the site of the automobile manufacturer, with the aid of an authorized non-illustrated identification code generator. The latter stores the identification codes of all of the control devices S.sub.i and F.sub.j which are present in the motor vehicle. During the first initialization, the test unit P establishes which control devices S.sub.i and F.sub.j must actually be tested by the immobilizer.

The first initialization is irreversible, that is to say it cannot be reversed by a thief. Therefore, it is no longer possible to subsequently carry out the first initialization of the control devices S.sub.i and F.sub.j.

After the first initialization, the control devices S.sub.i and F.sub.j move into an operating mode. The motor vehicle can be started only in the operating mode, when starting has been initiated by an authorized user code generator G.sub.k and a minimum number of control devices S.sub.i and F.sub.j are connected to the test unit P through the data line BUS.

New control devices S.sub.i and F.sub.j which have been exchanged for defective control devices S.sub.i and F.sub.j are likewise in the initial mode at the start. This is recognized by the test unit P. In this case, only the new control device S.sub.i or F.sub.j can be initialized for the first time (re-initialization), if it is recognized by the test unit P that the remaining control devices S.sub.i and F.sub.j reply with their identification code and at least one authorized user code generator G.sub.k is present.

The first initialization and the re-initialization can also be carried out through a diagnostic interface D, which is present anyway in the motor vehicle and is connected to the data line BUS. By using a non-illustrated diagnostic device which is connected to the diagnostic interface D, it is possible to provide the individual control devices S.sub.i and F.sub.j, for example, with the identification codes, if this is authorized by an authorized identification code generator.

New control devices S.sub.i and F.sub.j are always in the initial mode. The initial mode is recognized both during the first initialization and during the re-initialization. A situation in which an unauthorized user exchanges only one control device S.sub.i or F.sub.j and then initializes all of the control devices S.sub.i and F.sub.j of the motor vehicle anew, must be precluded during the re-initialization.

It is also possible to interconnect a plurality of test units P in the immobilizer. A second test unit P can then assume the functioning of the first test unit P if the latter is defective and this is established when the first attempt at starting is made.

The identification codes and the user codes can be stored at least in one other test unit P, in a central computer located at the site of the manufacturer, in a control device S.sub.i or F.sub.j or in each user code generator G.sub.k, from where they can be read in the event of authorized access for the purpose of re-initialization of the control devices S.sub.i and F.sub.j if the test unit P should have failed. The authorization for re-initialization can be proved through the use of a transponder which is with the registration document.

The test unit P does not necessarily have to be constructed as a separate device. It can be accommodated in a control device S.sub.i (indicated in FIG. 2 by reference symbol P/S1 and dashed line) and at that location can share components, such as the microprocessor or memory elements, of the control device S.sub.i which are present anyway in the control device.

In order to prevent car theft, the immobilizer may be constructed in such a way that, for example, the number of engine starts or the distance driven is detected, through the use of incrementing or decrementing, by a counter in the test unit P or in a plurality of counters in the respective control devices S.sub.i and F.sub.j. In the case of a predetermined counter reading, the motor vehicle is rendered inoperative if the counter has not previously been reset to zero by an external and separate RESET unit.

A RESET can only be carried out with the use of a RESET code which is stored centrally at the site of the manufacturer or in a dedicated transponder which is affixed to the registration document. The RESET unit can be disposed, for example, at home in the garage. It can influence the counter reading by radio. The RESET can also be carried out at an authorized service station by presenting the registration document every time the vehicle is serviced.

A stolen vehicle thus becomes unusable after a while if the counter reading is not reset to zero using by an authorized RESET unit.

A counter may also be present in the user code generator G.sub.k. Every time the user code generator G.sub.k is actuated, the counter is increased or decreased by one. The user code generator G.sub.k can be used only up to a prescribed counter reading. Therefore, the counter must occasionally be set to zero.

The identification codes, user codes and the like may be so-called permanent codes which are permanently stored in each case in memory units. They may also vary constantly (so-called changing codes). In this case, the codes are calculated in accordance with a mathematical algorithm, for the determination of which data are stored in the respective memory units. The code is changed after every interrogation operation. This is used for security against tapping. However, it is irrelevant to the invention whether the immobilizer operates by using permanent codes or by using changing codes. In the case of changing codes, all of the data which are used for calculating the codes are stored in the relevant unit, such as the test unit P or the control device, and the codes are stored in the case of the permanent codes.

The request signal can be transmitted during every starting operation. In addition, request signals can be generated continuously at specific time intervals. All of the control devices S.sub.i and F.sub.j connected to the data line BUS or only some of the control devices S.sub.i and F.sub.j can be interrogated, these being established beforehand, for example in accordance with a random principle. The interrogation may also alternate, so that first of all some, for example the first three, of the control devices S.sub.i and F.sub.j and, during the next interrogation operation, some others, namely the next three control devices S.sub.i and F.sub.j, are interrogated for their identification code. As a result, the immobilizer is secure against the exchange of individual control devices S.sub.i and F.sub.j.

The random alternation of the interrogation of the control devices S.sub.i and F.sub.j makes it more difficult to steal the motor vehicle, since all of the control devices S.sub.i and F.sub.j would have to be exchanged in every case in order to start the motor vehicle. However, any purchase of all of the control devices S.sub.i and F.sub.j can be readily monitored by a spare parts store.