
Reverse engineering the VW electronic control unit - oska
http://lwn.net/SubscriberLink/670488/4350e3873e2fa15c/
======
jzwinck
The "data driven" nature of the ECU is not surprising. Ever since the first
ECUs were made they have used lookup tables (LUTs) as opposed to mathematical
models. I don't know exactly how ubiquitous LUTs are today but certainly they
are traditionally used in this application. Computer enthusiasts may enjoy
knowing that the controller in many LCD monitors is similarly LUT based rather
than containing curves as formulas.

As an aside, I imagine "A2L" is short for addr2line.

~~~
_pmf_
> As an aside, I imagine "A2L" is short for addr2line.

A2L is for "ASAM MCD-2 MC Language" [0] (but it does contain addresses for
internal variables and associated information related to the interpretation of
the variable's meta data, so your guess makes sense).

Mostly, A2L files are generated by using the concrete addresses from an ELF
file to fill a template A2L file. This file can be used with something called
"application tool", which is mostly either Vector CANape or ETAS Inca, to
either manipulate or read out the variable values from the live ECU via the
XCP/CCP protocol. XCP also contains mechanisms for so called bypass operation,
where stimuli that are generally received via sensors are fed from the host PC
(used mainly in stand-alone test scenarios for the ECU).

[0]
[https://wiki.asam.net/display/STANDARDS/ASAM+MCD-2+MC](https://wiki.asam.net/display/STANDARDS/ASAM+MCD-2+MC)

~~~
kaftoy
Yeah, so much for the "reverse engineering" operation. The guy didn't even
take the time to research what the A2L is, but he was quick to throw
accusations around [1]. There's nothing like some quick internet exposure.

[1] "Domke said that it is clear that lots of different kinds of cheating is
going on in the ECU" ... because "12KB block of code that is used to ensure
the tachometer always shows 780 RPM when the car is idling. Even though the
engine is not that steady [...]". What does he expect? The RPM niddle to have
1-2-10 rpm resolution on the analog board? Or for the value to switch super
fast on the digital screen to annoy the driver? All this stuff is filtered to
have a smooth display info on the dashboard, same way input values from sensor
in all sensor based applications are filtered at some point, for example.

[edit]

And btw, the SW is not set to display anything. The engine ECU does not
display shit. It send data to the BCM or some other module over the CAN
(usually) network. The value of 780 rpm in this case is a setpoint value. The
ECU is programmed to KEEP a minimum idle engine speed value when not torque is
requested. Else the engine would stall. This is done in a closed loop, one of
the inputs being the engine speed which is calculated in different ways, from
system to system (usually crank wheel sensor counting the teeth). This balance
you may imagine will not be able to keep perfectly fixed 780 rpm idle speed,
while the BCM will filter the dashboard value for driver's comfort.

~~~
ygra
> he was quick to throw accusations around

To be fair:

a) English isn't his native language and both "schummeln" and "betrügen" would
be "cheating" in English, though one with much less negative connotation

b) in the talk it sounded more like he was saying that the ECU (or other
embedded computers) do _a lot_ of filtering and processing already, even in
places where you'd expect to have a straight path from the sensor to the
reading (e.g. the idle rpm). When listening to the talk it didn't sound to me
as he was implying that all of that processing was on the same level as the
emissions stuff; just that there's a lot going on that most people don't even
realise.

~~~
jzwinck
Betrügwagen.

------
snyderize
This seems to be about engines that use diesel exhaust fluid (lots of
references to AdBlue), not the 2.0 L TDIs that are part of the emissions
scandal

~~~
ygra
The ECU he looked at was from his own car, which does use DEF, but also was
affected by the recall that reprogrammed it, so it had the affected engine.
While many of the affected cars didn't use DEF, some did. And since he could
tinker and test with his own car, that's what he looked at.

~~~
snyderize
OK, I thought his was something new. Seems like the fix for these is easy --
just use the normal dosing regime for the AdBlue and everything should be
fine. I'm more interested in what happens with the cars like mine that don't
use the fluid, and what the performance and mileage trade offs were to get
under emissions targets.

------
rurban
It was a Bosch ECU, not a VW ECU. VW (via Audi) just provides the a2l
parametrization for the ECU.

