32C3: Dieselgate — Inside the VW’s ECU

[Daniel Lange] and [Felix Domke] gave a great talk about the Volkswagen emissions scandal at this year’s Chaos Communication Congress (32C3). [Lange] previously worked as Chief architect of process chain electronics for BMW, so he certainly knows the car industry, and [Domke] did a superb job reverse-engineering his own VW car. Combining these two in one talk definitely helps clear some of the smog around the VW affair.

[Lange]’s portion of the talk basically concerns the competitive and regulatory environments that could have influenced the decisions behind the folks at VW who made the wrong choices. [Lange] demonstrates how “cheating” Europe’s lax testing regime is fairly widespread, mostly because the tests don’t mimic real driving conditions. But we’re not sure who’s to blame here. If the tests better reflected reality, gaming the tests would be the same as improving emissions in the real world.

As interesting as the politics is, we’re here for the technical details, and the reverse-engineering portion of the talk begins around 40 minutes in but you’ll definitely want to hear [Lange]’s summary of the engine control unit (ECU) starting around the 38 minute mark.

[Domke] starts off with a recurring theme in our lives, and the 32C3 talks: when you want to reverse-engineer some hardware, you don’t just pull the ECU out of your own car — you go buy another one for cheap online! [Domke] then plugged the ECU up to a 12V power supply on his bench, hooked it up, presumably to JTAG, and found a bug in the firmware that enabled him to dump the entire 2MB of flash ROM into a disassembler. Respect! His discussion of how the ECU works is a must. (Did you know that the ECU reports a constant 780 RPM on the tacho when the engine’s idling, regardless of the actual engine speed? [Domke] has proof in the reverse-engineered code!)

The ECU basically takes in data from all of the car’s sensors, and based on a number of fixed data parameters that physically model the engine, decides on outputs for all of the car’s controls. Different car manufacturers don’t have to re-write the ECU code, but simply change the engine model. So [Domke] took off digging through the engine model’s data.

Long story short, the driving parameters that trigger an emissions reduction exactly match those that result from the EU’s standardized driving schedule that they use during testing — they’re gaming the emissions tests something fierce. You’ve really got to watch the presentation, though. It’s great, and we just scratched the surface.

And if you’re interested in our other coverage of the Congress, we have quite a collection going already.

Tech Journos Link Samsung To Volkswagen, Somehow

On Thursday The Guardian published information linking Samsung to the current Volkswagen emissions fiasco. Samsung is accused of installing a ‘defeat device’ on some televisions that uses less energy during official testing conditions than would be found during real-world use.

“The apparent discrepancy between real-world and test performance of the TVs is reminiscent of the VW scandal that originated in the US last week,” wrote [Arthur Nelson] of The Guardian. This report was based on an unpublished lab test by the research group ComplianTV which found discrepancies between real-world and test performance when measuring power consumption. According to ComplianTV, this is due to the ‘motion lighting’ setting included in some Samsung TVs. Samsung vehemently denies this ‘motion lighting’ saying that it is not a method of cheating the consumption tests.

Typical results recognized during testing. Source
Typical results recognized during testing. Source

Not one to let a good controversy go to waste, the BBC reports a Samsung TV will reduce its power draw shortly after the start of the test. A graph of the power draw of a TV – not explicitly a Samsung television – demonstrating this functionality was found in a PDF of a ComplianTV workshop from last year labeled as, “Typical results recognized during testing” with a decrease in power consumption being a recognized behavior when the appropriate test video was found.

This is not the first time ComplianTV tested a Samsung TV equipped with a ‘motion lighting’ setting. Earlier this year, ComplianTV measured the power consumption of the Samsung UE55H8090 television, and found this TV was compliant with energy regulations. Incredibly, all Samsung TVs listed on the ComplianTV database were found to be compliant with the relevant energy directives.

Samsung’s rebuttal to the Guardian article states the ‘motion lighting’ technology is an ‘out of the box’ feature, active in both the lab and at home. Unlike Volkswagen’s ‘defeat device’ for their diesel engines which is only active during emissions testing, the ‘motion lighting’ technology is active whenever it is enabled in the TV’s settings menu.

Anyone in the US who has shopped for a television in the last four years will have noticed cost-per-year estimates for operating the appliance. This is only an issue if the televisions don’t actually meet that advertised benchmark. Until we see a published study we’re raising our eyebrows at The Guardian, easily one of the most trusted journalistic institutions on the planet, and reserving judgement for Samsung.

Ethics in Engineering: Volkswagen’s Diesel Fiasco

Every so often – and usually not under the best of circumstance – the field of engineering as a whole is presented with a teaching moment. Volkswagen is currently embroiled in a huge scandal involving emissions testing of 11 Million diesel cars sold in recent years. It’s a problem that could cost VW dearly, to the tune of eighteen Billion dollars in the US alone, and will, without a doubt, end the careers of more than a few Volkswagen employees. In terms of automotive scandals, this is bigger than Unsafe at Any Speed. This is a bigger scandal than the Ford Pinto’s proclivity to explode. This is engineering history in the making, and an enormously teachable moment for ethics in engineering.

Continue reading “Ethics in Engineering: Volkswagen’s Diesel Fiasco”

Using old phones as an intercom in your VW bus (or anywhere else)

In case you haven’t noticed from my many comments on the subject, I drive a VW bus. It is a 1976 Westfalia camper with sage green paint and green plaid upholstery. I absolutely love it and so does the rest of my family. We go for drives in the country as well as camping regularly. We have found that the kids have a hard time communicating with us while we’re going higher speeds. These things aren’t the quietest automobiles in the world. Pushing this bread loaf shaped hunk of steel down the road with an engine that might top out at 75hp results in wind noise, engine noise, and of course, vibration.

I decided to employ a really old hack to put two functional telephones in the bus so my kids can talk to my wife (or whoever the passenger is) without screaming quite so loud. This hack is extremely easy, fairly cheap, and can be done in just a few minutes. The result is a functional intercom that you could use pretty much anywhere!

Continue reading “Using old phones as an intercom in your VW bus (or anywhere else)”

Fixing the control scheme for an aftermarket headlight assembly

The headlight enclosures on [Bill Porter’s] 2004 Passat had yellowed with age and were not outputting the kind of light they should. He decided to replace them with some aftermarket modules that also incorporated LED strips. When they arrived he was surprised at how easy there were to drop into place. But when testing he was certainly not satisfied with how they worked. The day-driving mode used the HID bulbs at full power, where the factory assembly had dimmed them during the day. He set out to alter the electronics to work as he prefers.

Always the mad scientist, [Bill] started off by making a truth table showing how the lights reacted to the various states of the ignition and headlight switches. What he came up with is an AND gate built from a relay and diode. It allows him to have the LEDs on as the running lights (without the HIDs on at all), and leaves the rest of the functionality unaffected.

Enhance your key fob via CAN bus hacking

[Igor] drives a 4th generation Volkswagen Golf, and decided he wanted to play around with the CAN bus for a bit. Knowing that the comfort bus is the most accessible and the safest to toy with, he started poking around to see what he could see (Google translation).

He pulled the trim off one of the rear doors and hooked into the comfort bus with an Arudino and a CAN interface module. He sniffed the bus’ traffic for a bit, then decided he would add some functionality to the car that it was sorely lacking. The car’s windows can all be rolled down by turning the key in any lock for more than a few seconds, however this cannot be done remotely. The functionality can be added via 3rd party modules or through manipulating the car’s programming with some prepackaged software, but [Igor] wanted to give it a go himself.

He programmed the Arduino to listen for longer than normal button presses coming from the remote. Once it detects that he is trying to roll the windows up or down, the Arduino issues the proper window control commands to the bus, and his wish is the car’s command.

It’s a pretty simple process, but then again he has just gotten started. We look forward to seeing what else [Igor] is able to pull off in the future.  In the meantime, continue reading to see a quick video of his handiwork.

If you are interested in seeing what you might be able to do with your own car, check out this CAN  bus sniffer we featured a while back.

Continue reading “Enhance your key fob via CAN bus hacking”

Tailgating this car carries a heavy penalty

This hack seems simple enough:

  1. 1. Open hatchback
  2. 2. Insert jet engine
  3. 3. Profit

Actually, the guy who added a jet engine to a VW Beetle has a PhD in Mechanical Engineering from Stanford. He claims this is street legal, and even has a snapshot of the police trying to figure out what to charge him with after stopping him on the road. There’s plenty of details and we’re not questioning [Ron Patrick’s] competence, but having the intake for the turbine inside the cab of the vehicle seems a bit insane. He remarks that “it’s a little windy but not unbearable”… yeah.

One the same page you’ll find his dual-jet modified scooter. The starting cost there is considerably less, especially if you build your own ram jets.

[Thanks Goldscott]