Car Module

Abstract

The invention relates to a car module (10) comprising a tamper detecting electronic control unit (1), wherein the electronic control unit (1) is configured to control at least one electrically controllable function of a vehicle, for instance a light function such as low beam or high beam of a vehicle headlight, said electronic control unit (1) comprising—at least one carrier (2), in particular a printed circuit board, comprising an electric circuit (2a) for performing the controlling by the electronic control unit (1),—a housing (3) enclosing the at least one carrier (2), wherein the housing (3) comprises at least two parts (3a, 3b), wherein a first part (3a) of the housing (3) is holding the carrier (2), and wherein a second part (3b) of the housing (3) is attached to the first part (3a) in order to close the housing (3) and as such enclose the carrier (2) within the housing (3), and—a system (4) for detecting opening of the housing (3).

Claims

1. A car module (10) comprising a tamper detecting electronic control unit (1), wherein the electronic control unit (1) is configured to control at least one electrically controllable function of a vehicle, for instance a light function such as low beam or high beam of a vehicle headlight, said electronic control unit (1) comprising: at least one carrier (2), in particular a printed circuit board, comprising an electric circuit (2a) for performing the controlling by the electronic control unit (1); a housing (3) enclosing the at least one carrier (2), wherein the housing (3) comprises at least two parts (3a, 3b), wherein a first part (3a) of the housing (3) is holding the carrier (2), and wherein a second part (3b) of the housing (3) is attached to the first part (3a) in order to close the housing (3) and as such enclose the carrier (2) within the housing (3); and a system (4) for detecting opening of the housing (3), wherein the system (4) for detecting opening of the housing (3) comprises: a first electrode (5a) arranged on the carrier (2), a second electrode (5b) arranged on the carrier (2) or on the housing (3), said second electrode (5b) being spaced apart from the first electrodes (5a), electric relevant material (6) that is initially distributed at least partially randomly between the first (5a) and second electrode (5b), wherein the distribution of said material (6) affects at least one electric parameter (P) measurable between the first and second electrode (5a, 5b), said initial distribution of the electric relevant material (6) being referred to as car module (10) individual initial finger print (FP), wherein the electric relevant material (6) is mechanically connected at least to the second part (3b) of the housing (3) in a manner that removal of the second part (3b) of the housing affects the distribution of the electric relevant material (6) between the first (5a) and the second electrode (5b), thus turning the car module (10) individual initial finger print (FP) into a manipulated finger print (FP′), and a tamper detection unit (7) connected to the electric circuit (2a), wherein the tamper detection unit (7) is configured to measure and store a car module (10) unique value of the electric parameter (P), in particular electrical resistance, impedance and/or capacity, measured between the first (5a) and the second electrode (5b) and associated with the car module (10) individual initial finger print (FP), wherein the car module (10) unique value serves as a reference value (V.sub.ref), said reference value (V.sub.ref) representing the initial distribution of the electric relevant material (6), and wherein the tamper detection unit (7) is furthermore configured to measure at least at every start-up of the electronic control unit (1) the actual value of the electric parameter measured between the first (5a) and the second electrode (5b), namely a real value (V.sub.real), and wherein the tamper detection unit (7) is configured to evaluate differences between the real value (V.sub.real) and the reference value (V.sub.ref) in order to detect tampering of the housing (3) and as such tampering of the electronic control unit (1).

2. The car module (10) according to claim 1, wherein the tamper detection unit (7) is configured to emit a verification signal in the event that the real value (V.sub.real) is within a predefineable range with regard to the reference value (V.sub.ref), wherein the electronic control unit (1) is configured to receive the verification signal of the tamper detection unit (7) upon start of the electronic control unit (1), wherein in absence of the verification signal the electronic control unit (1) is configured to initiate a failure routine.

3. The car module (10) according to claim 1, wherein at least parts of the first (5a) and second electrode (5b) are shaped in a fork-like configuration.

4. The car module (10) according to claim 1, wherein at least parts of the first and second electrode are shaped in a star-like configuration.

5. The car module (10) according to claim 1, wherein the second electrode (5b) is also arranged on the at least one carrier (2).

6. The car module (10) according to claim 1, wherein the second electrode (5b) is arranged on the housing (3), in particular by way of a component of the housing (3) or the physical structure of the housing (3) itself.

7. The car module (10) according to claim 1, wherein the first (5a) and the second electrode (5b) each comprise a number of locally distributed electrode sub-groups (5a′, 5a″, 5b′, 5b″), wherein the locally distributed electrode sub-groups of each electrode are associated and electrically connected either with the first electrode (5a) or the second electrode (5b), wherein some electrode sub-groups (5a′, 5b′) are distributed on an upper side (2′) of the carrier (2) and other electrode groups (5a″, 5b″) are distributed on an opposing lower side (2″) of the carrier (2).

8. The car module (10) according to claim 1, wherein the housing (3) furthermore comprises at least one protrusion (8) extending towards a section of the carrier (2) comprising at least a part of the first electrode (5a), wherein electric relevant material (6) is distributed between the protrusion (8) and at least a part of the first electrode (5a), physically contacting at least the protrusion.

9. The car module (10) according to claim 1, wherein the electric relevant material (6) comprises a dielectric material.

10. The car module (10) according to claim 1, wherein the electric relevant material (6) comprises an adhesive (6b).

11. The car module (10) according to claim 1, wherein the electric relevant material (6) is at least partially electrically conductive (6a).

12. The car module (10) according to claim 1, wherein the first and second electrodes (5a, 5b) are covered with an isolating layer (9).

13. The car module (10) according to claim 1, wherein the first and second electrodes (5a, 5b) are directly in contact with the electrical relevant material (6) with no separation layer in between.

14. A vehicle headlight comprising a car module (10) according to claim 1.

15. A method for using a car module (10) according to claim 1, wherein during a manufacture and configuration process of the car module (10) a setup procedure is executed for determining the initial finger print (FP) and saving the corresponding reference value (V.sub.ref) in the car module (10) and in a memory that is separated from the car module (10).

16. The method according to claim 15, wherein in the event that no tampering was detected upon start of the electronic control unit (1) the measured real value (V.sub.real) is stored and replaces the preceding initial reference value (V.sub.ref).

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In the following, in order to further demonstrate the present invention, illustrative and non-restrictive embodiments are discussed, as shown in the drawings, which show:

[0038] FIG. 1a a schematic cross-sectional view of a car module according to the invention,

[0039] FIG. 1b a detail of FIG. 1a regarding electrical relevant material disposed between the housing and the electrodes,

[0040] FIG. 2a to FIG. 2d the arrangement of FIG. 1b with different compositions of electric relevant material and arrangement of electrodes,

[0041] FIG. 3a to FIG. 3c an exemplary event of manipulation of a finger print,

[0042] FIG. 4a and FIG. 4b different electrode configurations,

[0043] FIG. 5a and FIG. 5b exemplary at least partially randomized distributions of electric relevant material on the electrodes,

[0044] FIG. 6 an exemplary layout of functional blocks of a tamper detection unit,

[0045] FIG. 7 an exemplary view of a finger print of a car module,

[0046] FIG. 8a a schematic cross-sectional view of a car module according to the invention, wherein the housing comprises protrusions, and

[0047] FIG. 8b a detail of FIG. 8a regarding electrical relevant material disposed between the housing and the electrodes.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

[0048] In the following, identical reference signs used in the figures depict identical features if not stated otherwise.

[0049] FIG. 1a shows a schematic cross-sectional view of a car module 10 according to the invention. The car module 10 comprises a tamper detecting electronic control unit 1, wherein the electronic control unit 1 is configured to control at least one electrically controllable function of a vehicle, for instance a light function such as low beamor high beamof a vehicle headlight.

[0050] The electronic control unit 1 comprises at least one carrier 2, in particular a printed circuit board, comprising an electric circuit 2a for performing the controlling by the electronic control unit 1. Moreover, the electronic control unit also comprises a housing 3 enclosing the carrier 2. The housing 3 comprises at least two parts 3a, 3b. A first part 3a of the housing 3 is holding the carrier 2 and a second part 3b of the housing 3 is attached to the first part 3a in order to close the housing 3 and as such enclose the carrier 2 within the housing 3.

[0051] Furthermore, the electronic control unit 1 comprises a system 4 for detecting opening of the housing 3. With view on FIG. 1b, it is denoted that this system 4 comprises a first electrode 5a arranged on the carrier 2, a second electrode 5b arranged on the carrier 2 or on the housing 3, said second electrode 5b being spaced apart from the first electrodes 5a and electric relevant material 6 that is initially distributed at least partially randomly between the first 5a and second electrode 5b. The distribution of said material 6 affects at least one electric parameter P measurable between the first and second electrode 5a, 5b, said initial distribution of the electric relevant material 6 being in the following referred to as car module 10 individual initial finger print FP. FIG. 1b shows one detail FP.sub.1 of the finger print FP. The finger print FP as such is determined based on the sum of all the local finger prints, for instance FP.sub.1, that are connected to the same electrodes. Thus, distribution of a number of local finger prints and connecting into one global finger print FP allows for a higher randomization of the finger print and higher security standards since the manipulation detection is also more likely to detect partial opening of the housing 3.

[0052] The electric relevant material 6 is mechanically connected at least to the second part 3b of the housing 3 in a manner that removal of the second part 3b of the housing 3 affects the distribution of the electric relevant material 6 between the first 5a and the second electrode 5b, thus turning the car module 10 individual initial local finger prints FP.sub.1 to FP.sub.4 (see FIG. 1a), and in sum the overall finger print FP, into a manipulated finger print FP′ (see FIGS. 3b and 3c).

[0053] The system 4 further comprises a tamper detection unit 7 (for details see FIG. 6), that is connected to the electric circuit 2a, wherein the tamper detection unit 7 is configured to measure and store a car module 10 unique value of the electric parameter P, in particular electrical resistance, impedance, inductivity and/or capacity, measured between the first 5a and the second electrode 5b and associated with the car module 10 individual initial finger print FP. The measurement of the parameter P can be for instance within a range of a few kHz up to a number of MHz which will lead for instance to capacities in the range of 0.1 to 100 pF, in particular 5 to 20 pF. The car module 10 unique value serves as a reference value V.sub.ref, said reference value V.sub.ref representing the initial distribution of the electric relevant material 6. The tamper detection unit 7 is furthermore configured to measure at least at every start-up of the electronic control unit 1 the actual value of the electric parameter measured between the first 5a and the second electrode 5b, namely a real value V.sub.real. The tamper detection unit 7 is configured to evaluate differences between the real value V.sub.real and the reference value V.sub.ref in order to detect tampering of the housing 3 and as such tampering of the electronic control unit 1.

[0054] The electric relevant material 6 disclosed in FIG. 1b is for instance electrically conductive adhesive 6a (for instance by mixing electrically conductive particles with non-conductive adhesive). In this embodiment, this adhesive 6a is covered with an electrically non-conductive adhesive 6b that allows mechanical fixation to the upper part of the housing 3b. This electrical non-conductive adhesive can be made of dielectric material. As will be discussed later on, choice of the electric relevant material will affect the finger print FP and the value of the parameters related to the finger print FP.

[0055] FIG. 2a to FIG. 2d show the arrangement of FIG. 1b with different compositions of electric relevant material 6 and different arrangement of electrodes 5a and 5b. FIG. 2a shows a configuration, wherein only electrically conductive adhesive 6a is applied as electrical relevant material. Both electrodes 5a and 5b are arranged on the carrier 2 and covered with an insulating layer 9. FIG. 2b shows a configuration that is basically similar to FIG. 1b with one exception: The electrodes 5a and 5b are not covered by an insulating layer 9 and thus directly contact the electrically conductive adhesive 6a. As such, the ohmic resistance between the electrodes 5a and 5b will be highly reduced depending mostly on the distribution and composition of the electrically conductive adhesive 6a resulting in a reliably parameter for manipulation detection. FIG. 2c shows a configuration wherein the housing 3 itself serves as second electrode 5b. In this case, the housing 3 has to comprise electrically conductive material and has to be in electrical contact with the system 4, in particular with the tamper detection unit 7. It is favourable when the housing is in this case not electrical connected with ground potential but has floating potential instead in order to avoid electrical influence of components which are not related to the car module itself. An electrically non-conductive adhesive 6b is applied between the two electrodes 5a and 5b. Lastly, FIG. 2d shows a variant wherein the second electrode 5b is applied on the housing 3. In this case, the housing 3 itself can be electrically non-conductive. The second electrode 5b has to be connected to the tamper detection unit 7 and for this purpose comprises a connection part 5b′ that extends towards the tamper detection unit 7.

[0056] FIG. 3a to FIG. 3c show an exemplary event of manipulation of a finger print FP. The finger print FP of FIG. 3a is also referred to as initial finger print, i.e. the finger print that has been originally applied by the manufacturer of the car module 10. This finger print FP is associated with a specific value of an electric parameter P as discussed before resulting in a reference value V.sub.ref. FIG. 3b shows the effect of opening the housing 3, i.e. removal of the upper part 3b from the lower part 3a. The electrically conductive adhesive 6a, that has weaker mechanical strength than the electrically non-conductive adhesive 6b, is torn into two parts, thus affecting the electrical parameter measured between the electrodes 5a and 5b. This results in a manipulated finger print FP′ that differs from the initial finger print FP. This difference is also measurable by comparing the real value V.sub.real of the electric parameter P with the reference value V.sub.ref. Even in case that the housing 3 is properly closed according to FIG. 3c, the distribution of the electrically conductive adhesive 6a will remain different from its original distribution according to FIG. 3a thus resulting in a real value V.sub.real that is significantly different from the reference value V.sub.ref. Consequently, manipulation of the housing 3 will be detected by the electronic control unit 1.

[0057] FIG. 4a and FIG. 4b show different electrode configurations. FIG. 4a shows a star-shaped configuration whereas FIG. 4b shows a fork-shaped configuration. FIG. 5a and FIG. 5b show exemplary at least partially randomized distributions of electric relevant material 6 on the electrodes, thus resulting in a number of local finger prints FP.sub.1 to FP.sub.x.

[0058] FIG. 6 shows an exemplary layout of functional blocks of a tamper detection unit 7 for detection of opening of a housing 3. Such a tamper detection unit 7 will be connected with the electrodes 5a and 5b and measure at least one electrical parameter P, compare the values V.sub.ref and V.sub.real and determine based on this comparison if a manipulation has taken place. In the event that manipulation is detected a manipulation control routine can be triggered. In particular, the tamper detection unit 7 can be configured to emit a verification signal in the event that the real value V.sub.real is within a predefineable range with regard to the reference value V.sub.ref, wherein the electronic control unit 1 is configured to receive the verification signal of the tamper detection unit 7 upon start of the electronic control unit 1, wherein in absence of the verification signal the electronic control unit 1 is configured to initiate a failure routine. Such a failure routine can comprise deactivating the function of the ECU, sending a warning message to the driver screen, sending a security warning, putting the ECU back into a safe state with limited functionality, etc.

[0059] FIG. 7 shows an exemplary view of a number of local finger prints FP.sub.1 to FP.sub.x arranged on a car module 10. For the sake of easier view, the housing 3 is not shown. Of course, these finger prints are connected with the housing 3. These finger prints are covering the electrodes 5a and 5b, which comprise a number of locally distributed electrode sub-groups 5a′, 5a″, 5b′, 5b″ etc., which are schematically indicated in FIG. 7 by a rectangular shaped dotted line. The locally distributed electrode sub-groups of each electrode are associated and electrically connected either with the first electrode 5a or the second electrode 5b. Although in the present figures all the electrodes are arranged on the upper side 2′ of the carrier 2, the electrodes and finger prints can also be distributed on an opposing lower side 2″ of the carrier 2.

[0060] FIG. 8a shows a schematic cross-sectional view of a car module 10, wherein the housing comprises protrusions 8 extending towards a section of the carrier 2 comprising at least a part of the first electrode 5a (see FIG. 8b), wherein electric relevant material 6 is distributed between the protrusion 8 and at least a part of the first electrode 5a, physically contacting at least the protrusion 8.

[0061] The invention also relates to a vehicle headlight (not shown in the figures) comprising a car module 10 according to the invention.

[0062] Furthermore, the present invention also relates to a method for using a car module 10 according to the invention, wherein during the manufacture and configuration process of the car module 10 a setup procedure is executed for determining the initial finger print FP and saving the corresponding reference value in the car module 10 and in a memory that is separated from the car module 10. In the event that no tampering was detected upon start of the electronic control unit 1 the measured real value can be stored and replaces the preceding initial reference value.

[0063] Of course, the invention is not limited to the examples given in this specification. The scope of protection is outlined by the claims that follow.