Benz remotely controlled vehicle stuck in cruise control mode for 1h at 120km/h | Hacker News Reader

Benz remotely controlled vehicle stuck in cruise control mode for 1h at 120km/h

facebook.com

55 pointsLiweiZ104 comments

Nothing about this story makes sense, and it's so sketchily sourced I'm surprised to see it here on HN.

For starters if the problem was with cruise control, how would opening the drivers side door 'slightly' slow the car to half it's speed? Setting aside the physics here, cruise control would simply increase the throttle until it got back to it's set speed.

Also questionable is the idea that MB would be able to remotely control the vehicle when every system other than the throttle had failed. Brakes failed, ignition failed, transmission failed, but the throttle and cruise control were still hunky-dory? That sounds a lot more like either a complete fabrication or someone who screwed up while trying to hack their car's CAN-BUS...

FWIW, it was in the Daily Mail too with more detail. That probably still falls under the general category of "sketchy sources" but there are enough specifics it's not obviously totally made up out of whole cloth. But I'd put a lot less faith in any of the details.

http://www.dailymail.co.uk/news/article-5509373/Horror-ride-...

The story is sketchy and if true as written I would have by now expected the major networks to have it on front pages -- with a catchy title this is a sure way to increase views.

But to me that idea that opening the door slows the fly-by-wire car is not outlandish. In fact, this (and unbuckling for a few seconds) were first thoughts I had on how I would have tried to break out of the stuck fly-by-wire mode or at least activate a safer "limp to safety" mode.

Actually, if the cruise control system had some how locked up it would make sense that the throttle was set to some fixed position. Any changes to the aerodynamics of the car would effect the speed at a fixed throttle.

That said, this really is just low quality sensational spam.

>Also questionable is the idea that MB would be able to remotely control the vehicle when every system other than the throttle had failed.

None of these things failed per se, they just weren't under user control.

Cruise control on both of my cars is closer to "set throttle" than "set speed". Neither will increase throttle to keep speed when going up a hill for example.

That's not typical for cruise control; even cars in the 80s with cruise control would increase throttle uphills.

Agreed. I don't think any modern car works on a fixed throttle.

2009 Pontiac and a 2013 Fiat, so relatively modern.

Couple of possibilities then, I suppose:

* They do work towards a set speed, but I'm too impatient and reset the cruise control before they achieve it.

* Cruise control operates differently on cars with manual transmissions. I've never actually observed cruise control behavior in an automatic because it's been broken on the automatics I've previously owned.

I have a 2001 Porsche Boxster (manual transmission). It will maintain speed as long as their is sufficient torque to do so in the current gear (or engine braking depending on uphill or down hill).

Is it possible that you don't have much excess engine power at highway cruising speed and the car is only slowly responding to change in incline?

Quite possible! I'm currently in Kansas or I'd be out finding some hills right now to test this further.

Which is and always has been a downright awful and dangerous feature. Going up a steep hill? Put the pedal to the metal so we can fly past other cars at 65 MPH.

Or would be a lot safer and more efficient if everyone just went a constant speed on the freeways. My cruise control also operates he brakes so my set speed is held going up and down hills.

You're really describing a more general issue with traditional cruise control and one of the reasons I rarely use it, especially on roads with any amount of traffic. Cruise control encourages you to keep to a set speed even when that makes you deviate from keeping in the flow of traffic.

That's not cruise control then, it's... 'throttle hold'? Even the cruise control on my 30-year-old Toyota will vary the throttle as required to maintain the set speed.

Throttle lock. That's what most motorcycles have in lieu of the CC electronics. It's also what happens if you, say, remove the return spring on your throttle body.

I've never seen a cruise control that worked like that. Set speed or min/max speed and the tachometer is nailed.

How old is your car? Cruise control in every automatic transmission car I've owned (dating back to the 70's) will use enough throttle to downshift the transmission and maintain speed on any freeway hill.

In a manual transmission, then sometimes it needs a downshift and any use of the clutch switches off the cruise control.

As mentioned in my other comment, 2009 Pontiac Vibe and 2013 Fiat 500. The Pontiac actually has manual windows, so I wouldn't be surprised if other corners were cut for simpler systems..

Interesting all of the minor variations between cars. Both cars (manual transmission) will also shut off cruise control if I even think about pressing the clutch, although rarely the Pontiac will forget to do that until the clutch is disengaged and the engine is revving high. :)

My car has a manual transmission and factory cruise control and using the clutch does not disable the cruise control. The cruise control even rev matches shifts.

Depends on the car; a VW with automatic transmission has a "speed set" cruise control, the car will change gear and vary throttle at will to keep the speed; won't brake though, except by downshifting.

Dang, even my old hoopty from the 80s would do a reasonable job of keeping speed, and that was in a GM crapbox. There's no chance a modern MB doesn't do so as well.

So I'd be really interested in knowing how a failure like this happens in a human-safety-critical application.

I assume every software engineer under the age of ~50 would have learned about events like the Therac-25 incidents during their education. Is there genuinely no robust software quality regime in place for critical systems like this in vehicles?

There are so many worrying things here: such a bad failure occurring in the first place; the lack of any physical fallback or failsafe; the ability of the dealer to remotely control the car's operation (!!) – any of these by themselves fills me with dread.

There have been a lot of revolutions in the practice of software development but by and large, self reflection has evaded us.

One of the leads and myself are the only people who call out the fact that we are humans and we will make mistakes. And on a 24/7 operation that means production issues will happen.

The other lead insists we all act like robots and he gets frustrated when people don’t like his proposals.

Or the owner attempted to flash his own ECU and messed it up. Granted, this is more common in the rice-burning crowd than the Benz driving crowd, but there is still some overlap.

Edit: Just saw that the driver was an "amateur car racer", which exponentially increases the chances that he re-flashed his ECU.

That's interesting, in the sense that it might explain a software failure, but it doesn't really explain why this wasn't failsafe anyway (given the possibility of a non-flashed ECU failing) nor why remote access was possible. I guess something doesn't add up here.

It's possibly Benz went to the trouble of doing a rigorous analysis of their ECU to verify that there were no faulting conditions that would impact safety and thus decided to use it as the backstop. The safety guarantee from the software could be compromised by an unauthorized modification.

Personally I don't like trusting safety systems entirely to software, but I could see it being a decision a big corporation makes to simplify manufacturing (cut costs).

> the ability of the dealer to remotely control the car's operation (!!)

This could be misleading. From the small article at least, the only action I assume that was done was the cruise control being disengaged from it's faulty state. There is no evidence that a rogue service employee could play real life mario kart from afar (although it wouldn't surprise me).

I also somewhat expected this from a high end car manufacturer in this day and age. Why is this inherently a bad thing? Surely it would do more good than bad, would it not?

What bothers me is the poor response time.

inb4 privacy concerns, big brother, etc. I'm thinking engine shutdowns during car chases (expensive vehicles are a target), etc.

It's quite possible that there's no ability to actually drive the vehicle as such, but remote access is inherently a massive security hole regardless. Remember the remote Jeep hack from a couple of years ago, where the vehicle could be remotely controlled over DAB? (https://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4...)

Reliability is expensive and slow. Companies hate expensive and slow, especially when you have a demo that basically does what you want sans edge cases.

Oh actually, let say you compute a+b with a computer. Believe it or not, you aren't 100% sure the computer is gonna gives you the right answer. There is 3 types of failures that could happen, 1) a hardware failure, 2) a software failure, 3) a bit could be flipped by a cosmic particle.

Right, but surely every engineer working on safety-critical systems would be aware of that, right? There are mitigations available, that I guess I naïvely assumed would be in place for a system that could end up killing dozens of people if it went wrong.

Oh? https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle...

Agreed.

You say that and yet people are letting self-driving software on Android phones control their vehicles. I don't get it either.

Feels difficult to believe. He reduced speed by 60kmh by opening a door “slightly”? Why did the cruise control not compensate for it? Both brake systems failed at the same time? In addition, the automatic gearbox was somehow stuck in D? Sorry, but I’m sure it’s either human error or a publicity stunt

Edit: I didn’t know the C class has any remote control capabilities. Does anyone know more?

This is a somewhat misleading title. The car was intentionally set to cruise control by the owner, but the cruise control could not be turned off until Mercedes remotely found a way to disable it about 100km later.

Personally that's exactly what I got from the title; it says it was stuck in cruise control. To me that indicates cruise control had been enabled, and then became stuck on.

I believe I was misled by "remotely controlled vehicle stuck in cruise control," which (to me) implies that the remote control feature was somehow relevant to not being able to disable the cruise control. The article did not talk about remote control until it mentioned using it to disable the cruise control.

That headline is misleading. I read it as them controlling it for 1 hour which wasn't the case.

I am a little surprised that the brakes didn't work. Are brakes "fly-by-wire" now? Otherwise you should be able to slam the brakes even if the car is full throttle. I have tried this with several cars and the brakes we always stronger than the engine.

I agree, I'd like to see the incident report on this. According to the subtitles both the brakes and the shifter failed. The shifter could be one of those flappy paddle deals where it's entirely plausible that a computer crash would disable it.

Brake-by-wire seems like a bad idea. I really want to have those physical lines in there as a final redundancy, like the physical control lines on a 737.

These kinds of stories are only going to get more common as we put more and more automation (and complexity!) into our vehicles. This would require way too many improbable events to happen at once on an old manual transmission car.

Clutch lines fail, shifter somehow gets stuck in gear, brake lines snap, ignition has an electrical fault that prevents the car from being turned off, cruise control somehow short circuits...all at once. Impossible without an elaborate sabotage.

Brakes are fly-by-wire on new cars because slamming the brake is not the most optimal strategy for stopping the car as fast as you can. And it can also damage the car.

No - ABS works without drive-by-wire, and was available in cars for decades before DBW systems were.

I'd choose damaging the car over this scenario any day.

I also don't know how braking hard would damage the car.

No one is trying to make that argument

>because

Would government getting control over our cars be that much more unbelievable than of our phones?

Kinda. It's a manual system with electronic controls in parallel. If a piece of code decides it doesn't want you pushing the brake you're not gonna push the brake. On a new car basically all vehicle systems are this way where the car can ignore or override your input if a piece of code tells it to do that.

> Are brakes "fly-by-wire" now?

Absolutely not. Cars have dual redundant hydraulic systems which are operated mechanically by the brake pedal. Other systems affect this (such as vacuum assist, ABS, AEB etc.) but the foot brakes should still work (poorly) even if the car is totally unpowered.

The handbrake / e-brake are all electronic and “break-by-wire” on many new vehicles. Many hybrids also use break by wire for their main breaks.

https://en.m.wikipedia.org/wiki/Brake-by-wire

I'm not sure how much i believe a post from facebook from "People's Daily, China". The video can for sure be named: "Police high speed chase through toll booth"

Lots of stuff is completely off with this. If you're stuck in cruise control at 120km/h for an hour you will drive 120km, not 100km.

Also, what about just turning the engine off? Or... break.

> Also, what about just turning the engine off? Or... break.

It says the brakes didn't work, and push-button start cars don't have an easy way to "just turn the engine off".

Your breaks will always work, regardless of any electrical systems. You might lose boosters, but I doubt it, given that the car still has electrical power.

Some newer cars come with electrical parking break, and those will refuse to engage if you're moving. A lot of people in this thread seems to confuse this with actual breaks.

Mine has a "hold button for 5 seconds" type override - don't know if that's universal though.

Don't tell me it's the ACPI hard shutdown signal, that would be scary.

I believe you need to push the break when turning off a car with push button starts.

More and more vehicles are shipping with electrical controls which replace physical levers, switches, etc. It could be possible that the brake lever was really an electrical control which happened to fail and become unresponsive.

> Xue, an amateur car racer himself, tried opening the car door slightly to help slow the car down, which slowed to 60km/h, but nothing else could be done

And likely push-button ignite --- otherwise you can just pull the key out.

I would like to see a better source for this, but this point is explained in the post, saying the driver opened the door slightly, managing to bring the car's speed down to 60km/h, which sounds weird too, but I sure have never tried.

I'm skeptical:

During a tense time of waiting and praying, Xue, an amateur car racer himself, tried opening the car door slightly to help slow the car down, which slowed to 60km/h, but nothing else could be done

If the car was trying to maintain 120kph, I'm skeptical that opening a door partially (or even all the way) slowed it to 60kph.

While this newish whiz-bang Mercedes Benz might be too modern to have a physical ignition lock these stories always make me wonder: why do all these people who are confronted with runaway vehicles forget the simple solution of switching off the engine? Just turn the key in the lock to the 'off' position but don't remove it, the engine will switch off and the car or motorbike will come to a halt. I've done this several times with my motorbike when one of the Bowden cables between the throttle grip and a carburetor froze during travel (as in 'water in cable freezes to ice', I ride the thing in wintertime here in Sweden). By switching the lock between 'on' and 'off' I've used it in a similar way as the 'blip switch' in early airplanes with rotary engines which lacked an adjustable throttle, they were either 'on' or 'off' and could be pulsed on landing by using the 'blip switch'.

When I mention this people often start about losing power steering but that is of no concern, power steering is only effective at lower speeds anyway. Servo brakes are powered by the intake vacuum so that won't be an issue either, even it the vacuum fails or the power comes from another source (e.g. an electric or engine-driven pump) there is generally a pressure reservoir which holds enough pressure for several brake actions. And even in case the servo totally fails the brakes still work, as does the parking brake.

To conclude, as long as you're in a vehicle with a physical ignition lock the first thing to try is just to switch off the engine. As long as you keep the key in the lock the steering lock should not engage (something to test next time you turn off the engine).

Sorry for the misleading title. I tried my best to contain the title short enough to submit. Please change the title for a better one. Or suggest a better one, I will change it ASAP. Thanks.

In the "good" old days there were several things you could do:

- turn off the ignition (now purely software-controlled in keyless systems)

- put transmission to neutral (a physical link doesn't necessarily exist anymore in automatic transmissions, still possible in manuals)

- jump on the brake pedal as hard as you can (I suspect that a hydraulic link to brakes must still exist, possibly by law, but there are ABS and stability control units in between that can add to or remove from the brake pressure so it's not entirely driver controlled anymore, could lead to a failure path)

- use parking brake to assist in braking (now often controlled by an electric motor automatically, doesn't engage while driving)

There were occasional similar failures like the accelerator pedal getting stuck under the floor mat or throttle cable getting stuck but you could do a number of things listed above. Cruise controls systems were heavily designed to disengage at the slightest disturbance because they were separate control modules: early vacuum-operated designs could—plausibly, I don't have first hand knowledge—have a microswitch in the brake pedal that would just pull a relay to shut off current from the control module, restoring normal accelerator operation. Pretty much bullet proof.

Software is indeed capable of creating failure modes that were pretty much unimaginable previously.

I'd start pulling fuses, Die Hard style.

I'm not sure what is more disturbing here, the fact that the car had such a dangerous malfunction in the first place, the fact that there was no reliable hardware-based mechanism to bring it safely to a halt when the software failed catastrophically, or the fact that the service team could remote in and take control of the vehicle. Everything about this is not just bad in itself but betrays a more fundamental lack of safe and secure design.

Totally agreed. Why can't he just slam the brakes? I thought they are supposed to be stronger than the engine?!

Electronic control - it’s not a direct physical connection anymore.

Follow on for mechanics/mechanical engineers: if the accelerator is down and you’re already moving, can the brakes stop a car? It seems like you’d either not stop or “break” abs and force the wheels to lock which is also bad at speed...

The ABS system is based on monitoring the way the wheels move and comparing it to how a car can move, in particular since the car is either moving or not, if just one wheel is stopping but the others are not, that's clearly wrong and the ABS tries to prevent that by reducing braking for that wheel. Going from some minimum speed to zero on all wheels is fine, that means now the car is stopped (or, for example, you went off a cliff and are actually now flying through the air - ABS can't help you in this case).

This is complete nonsense, go into any car without starting it and pump the breaks.

Its not. https://en.wikipedia.org/wiki/Drive_by_wire

I mean even Formula 1 cars have the breaking system being outside of the computer control. Like we have totally solved this problem before. Why would you remove hardware override is beyond me...

https://www.formula1.com/en/championship/inside-f1/rules-reg...

I'd really like to know what else the remote access allows them to control.

I assume the entire ECU, that said maybe they treated it as stolen and triggered a remote stop through an anti theft mechanism?

Why couldn't you just hit the ignition to turn the engine off?

New cars these days don't all have this option: electronic starters have keyless ignition, activated when the key is nearby.

http://www.worldwidemotors.com/blog/how-to-use-push-button-s...

Personally, I'm concerned there is no manual brake override.

If I drove a Mercedes I'd test using manual ignition, maybe pulling the key out would stop the car.

There is no such thing as "manual break override". You will always be able to use breaks in any car, regardless of what systems they're running. You might be without a booster, but still.

You can also just shut the engine down with the ignition switch.

That isn't true. There are many models with no mechanical linkages for the breaks.

You're confusing the parking brake for the hydraulic braking system.

The brake pedal is alway mechanically connected to a split/redundant hydraulic braking system.

Park break, yes. Regular breaks, no.

At least in Audi’s, holding the start stop button will turn off the car at any speed.

Source: Don’t rest your hand in the center console on the freeway.

One would assume some sort of molly-guard, precisely against that.

>activated when the key is nearby.

throw the key out the window?

I tested this when my dad got one of the push-button start cars. Doesn't work, at least not in his Acura.

Give it a few minutes and it will start to complain, and then you will lose engine, but not electrical power.

Doesn't help on any keyless car I've ever used - the car will beep at you when the key leaves the vehicle, but the engine won't shut off until you hit the stop/start button. And in this case, that button apparently did not work.

I've never been in a car with a push-button ignition that would let you turn the engine off while the car was moving. Too easy to bump the button.

You typically have to hold it for multiple seconds

Interestingly this has nothing to do with self driving. Though, if the dealer could control is remotely why did it take an hour to do so?

May be the (designed) logic flaw. My guess is on a safety override that painted itself into a corner. For example, no remote override of a cruise control while moving.

What I mostly took away from this is that automakers can remotely force stop your vehicle if they so desire. Kind of creepy.

I don't find it more or less creepy than what we discover companies doing under the hood on our smartphone apps, computers, sharing personal info, etc.

Reminds me of reading the Fortean times when I was younger. Sounds like a made up or exaggerated story.

Telltale statement > “According to a local media report”. So this is a report of a report. Hmmmm.

FWIW, this happened to a friend's Ford explorer with faulty electronics, self driving cars don't have a monopoly on automobile malfunctions

The fact that it was able to be remotely controlled is exposing it to a whole world of bugs and hacks

Covert intelligence operation (hit-job) gone awry? Maybe the driver was a target of the CIA ..

This makes me want less software control in my vehicle. Ideally none.

So carburetors and no abs or traction control?

Im not saying I agree with OP, but you picked three things that existed in cars before computers.

ABS uses software, I'm not aware of a mechanical ABS.

Limited slip differentials in all their varieties still don't do what stability control and traction control do. You need software for the systems to perform in a way we have come to expect.

A car without any software at all would be carbureted and have no ABS or traction/stability control.

https://en.wikipedia.org/wiki/Anti-lock_braking_system#Early...

https://en.wikipedia.org/wiki/Fuel_injection#Mechanical_inje...

I'm not saying computers don't do these things better.

From your link:

> A fully mechanical system saw limited automobile use in the 1960s in the Ferguson P99 racing car, the Jensen FF, and the experimental all wheel drive Ford Zodiac, but saw no further use; the system proved expensive and unreliable.

Those systems were used in aircraft, not cars. The operation was significantly different as well.

Anyone who owns a car with mechanical fuel injection will tell you how much more reliable carburetors are.

My point is simple: we have used software in automotive systems for decades and those systems have proven to be reliable. Removing all software from a car will not make it safer just because new automation systems are poorly built.

ABS is a solved problem without requiring software.

I may have missed something but please point me to an ABS system that does not use sensors and software to actuate the pressure modulator.

Reply on news.ycombinator.com