Researchers find computer code that VW used to cheat | Hacker News Reader

Researchers find computer code that VW used to cheat

phys.org

It looks like the same stuff that was presented in great detail at CCC over a year ago: https://media.ccc.de/v/32c3-7331-the_exhaust_emissions_scand...

Does anyone know how this research differs or builds upon the previous work?

And also 2 years ago in even greater detail. What I read so far, the Fiat 500X delay trick is new, the Fiat/Chrylser investigation is new and the rest is stricter, formally better, but the conclusions behind are lacking.

The CAN parametrization A2L cheat for the low temp trigger is missing/fixed, they identified it as acoustic mode. InjCrv_stNsCharCor, "Status der Akustikbedingung" All the other manifacturers they caught cheating are missing. But at least they confirmed now Bosch as the real culprit, in their EDC17 diesel ECU software. Major news and US law still is targeting VW only. In fairness I believe Bosch implemented the cycle detection as project for Audi, and the delay for Fiat/Chrysler.

"Notably, we find strong evidence that both defeat devices were created by Bosch and then enabled by Volkswagen and Fiat for their respective vehicles"

The real workflow for the 4 deactivating conditions is described better though, but the A2L is missing, which is what Bosch describes to their partners. How to activate the cheat.

Read here: http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf

[Update: The A2L is there, all clear.]

For explanation: Car manufacturers/customers get the basic ECU diagram/model pictures and the A2L files, which contains the descriptions what they can do with the controller software in the ECU. So for this "crime" there needs to be a partnership between the creator (Bosch) and the user (VW), which demanded that feature, and then Bosch describing it to VW how to activate or deactivate it. Under which name it is hidden.

Also note that under european law it is not a crime. European law only cares for emission testing during the test cycle, and also only for a few selected engines upfront. Under european emission law catching a real engine cheating with their NOx will have no consequences. US law is different. US regulations avoid the simple to detect cycles, and use a real driver on a chassis dyno. So the US is cheating by using specialized drivers who are experts like F1 drivers driving through the tests, while the Europeans and Asians use the test cycle detection SW.

Not Simulink diagram, ASCET (https://www.etas.com/en/products/ascet_software_products.php) diagram.

Also, it seems to me that the functions in question that enabled cheating can be seen as "dual use". The customer could have given some innocuous reason for their need for these customer specific functions, but then used them for cheating.

If I remember the CCC talks correctly, it was quite the nontrivial/involved feat for VW to configure the software in such a way that the cycle detection signal influences ad blue injection rates, although the EDC architecture is quite data-driven.

Agree with the plausible deniability. They obviously came up with some innocent names and only told co-conspirators the real meaning behind.

Interesting: https://www.etas.com/en/products/ascet_developer.php Generates C via models. I prefer SimuLink RealTime-Workshop (now Simulink Coder) though. You only need very few C there.

While there "must" be two parties to this, the enabling party (Bosch) and the performing party (the others), the act of enabling the cheat must be what is considered the bad part here, at least from a law point of view. I'd consider Bosch to have low ethics in this case, but it sounds like it is still within the boundary of law.

An analogy could be that I can build and give you a gun (assuming I by law am allowed to), but it is you that pull the trigger while pointing it at something you shouldn't point at.

Why is this even necessary? If they were found in court to be guilty of having this cheat mode, why weren't they also compelled to produce said code that enables it (and the cheat mode code respectively)? IIUC, the 5th is not applicable to legal entities, hence VW could not claim it so they should be able to be forced to produced it, under penalty of law otherwise.

(I do think that we should not trust whatever they would've produced as the full story though. As I learned in the military, the colloqial saying "Trust is good, control is better (as in checking the result)".)

So where is the code?

Reply on news.ycombinator.com