
Researchers find computer code that VW used to cheat - cmrdporcupine
https://phys.org/news/2017-05-code-volkswagen-emissions.html
======
_wmd
It looks like the same stuff that was presented in great detail at CCC over a
year ago:
[https://media.ccc.de/v/32c3-7331-the_exhaust_emissions_scand...](https://media.ccc.de/v/32c3-7331-the_exhaust_emissions_scandal_dieselgate)

Does anyone know how this research differs or builds upon the previous work?

~~~
rurban
And also 2 years ago in even greater detail. What I read so far, the Fiat 500X
delay trick is new, the Fiat/Chrylser investigation is new and the rest is
stricter, formally better, but the conclusions behind are lacking.

The CAN parametrization A2L cheat for the low temp trigger is missing/fixed,
they identified it as acoustic mode. InjCrv_stNsCharCor, "Status der
Akustikbedingung" All the other manifacturers they caught cheating are
missing. But at least they confirmed now Bosch as the real culprit, in their
EDC17 diesel ECU software. Major news and US law still is targeting VW only.
In fairness I believe Bosch implemented the cycle detection as project for
Audi, and the delay for Fiat/Chrysler.

"Notably, we find strong evidence that both defeat devices were created by
Bosch and then enabled by Volkswagen and Fiat for their respective vehicles"

The real workflow for the 4 deactivating conditions is described better
though, but the A2L is missing, which is what Bosch describes to their
partners. How to activate the cheat.

Read here: [http://cseweb.ucsd.edu/~klevchen/diesel-
sp17.pdf](http://cseweb.ucsd.edu/~klevchen/diesel-sp17.pdf)

[Update: The A2L is there, all clear.]

For explanation: Car manufacturers/customers get the basic ECU diagram/model
pictures and the A2L files, which contains the descriptions what they can do
with the controller software in the ECU. So for this "crime" there needs to be
a partnership between the creator (Bosch) and the user (VW), which demanded
that feature, and then Bosch describing it to VW how to activate or deactivate
it. Under which name it is hidden.

Also note that under european law it is not a crime. European law only cares
for emission testing during the test cycle, and also only for a few selected
engines upfront. Under european emission law catching a real engine cheating
with their NOx will have no consequences. US law is different. US regulations
avoid the simple to detect cycles, and use a real driver on a chassis dyno. So
the US is cheating by using specialized drivers who are experts like F1
drivers driving through the tests, while the Europeans and Asians use the test
cycle detection SW.

~~~
_0ffh
Not Simulink diagram, ASCET
([https://www.etas.com/en/products/ascet_software_products.php](https://www.etas.com/en/products/ascet_software_products.php))
diagram.

Also, it seems to me that the functions in question that enabled cheating can
be seen as "dual use". The customer could have given some innocuous reason for
their need for these customer specific functions, but then used them for
cheating.

If I remember the CCC talks correctly, it was quite the nontrivial/involved
feat for VW to configure the software in such a way that the cycle detection
signal influences ad blue injection rates, although the EDC architecture is
quite data-driven.

~~~
rurban
Agree with the plausible deniability. They obviously came up with some
innocent names and only told co-conspirators the real meaning behind.

Interesting:
[https://www.etas.com/en/products/ascet_developer.php](https://www.etas.com/en/products/ascet_developer.php)
Generates C via models. I prefer SimuLink RealTime-Workshop (now Simulink
Coder) though. You only need very few C there.

------
retSava
Why is this even necessary? If they were found in court to be guilty of having
this cheat mode, why weren't they also compelled to produce said code that
enables it (and the cheat mode code respectively)? IIUC, the 5th is not
applicable to legal entities, hence VW could not claim it so they should be
able to be forced to produced it, under penalty of law otherwise.

~~~
retSava
(I do think that we should not trust whatever they would've produced as the
full story though. As I learned in the military, the colloqial saying "Trust
is good, control is better (as in checking the result)".)

------
romanovcode
So where is the code?

