14 ms·

A year of digging through code yields “smoking gun” on VW, Fiat diesel cheats

180 points by AndrewDucker 9y ago

Sniffnoy 9y ago
> The researchers also say that it’s high-time regulators dispense with the kind of lab tests that US and EU governments have required for years. Instead, some kind of active scan for illegal code needs to be developed. Alternatively, combine the lab tests with imprecise real-world tests as a sanity check, or keep the exact nature of the lab tests a secret and vary them over time. Really, the first of these seems like a good idea regardless of what else you do.
- tyingq 9y ago
  The real world sanity checks for cheating make sense. But the nature of the regular tests can't be secret. Carmakers need to know the bar they are supposed to hit. Building something on the speculation that it might pass, maybe, is a whole different business model.
  - Sniffnoy 9y ago
    OK, but there are test details that are known to the manufacturers but seem irrelevant to the thing being tested. Like the bit about the angle of the steering wheel. Surely there are multiple ways one can test for the same standard?
    - tyingq 9y ago
      The cheats are based around detecting when a car is strapped down to a dynamometer, indoors. That why the cheaters are looking at ambient temp, steering wheel angle, etc.
  - adrianN 9y ago
    "Build a car that doesn't emit more than X of exhaust Y when a typical driver drives it a) ten kilometers in the city, b) a hundred kilometers on the highway." That seems like a good enough requirement to me. Define "a typical driver" as "out of a hundred random test drivers, no more than 20 exceed the thresholds, no more than 5 exceed the thresholds by more than a factor two." That forces the car manufacturers to have a sufficient safety margin in their emissions. I don't know how difficult the actual measurement is, but maybe you could pay a couple thousand people a reasonable amount of money to have some devices attached to their cars for a month or two and collect data. Or make the car makers pay for the procedure.
    - tyingq 9y ago
      Driving style has a profound effect on emissions. As does ambient temperature, uphill vs downhill, time at stoplight. Short trip vs longer (catalytic converters don't work till they are hot). I'm sure they can find some way to address the cheating, but it's likely not the case that they are just missing some obvious simple solution.
      - wereHamster 9y ago
        Modern cars have enough sensors that they could store all necessary information about trips, have the service center read it out each time the car is serviced, anonymise, and send back to the manufacturer. That way the manufacturer would have accurate, real-world data about their 'average driver'. Could even make it country-specific.
        tyingq 9y ago
        These tests, though, are the ones you have to pass before you can sell that model of car, administered by government agencies. The agencies dictate the tests and measures.
        mcguire 9y ago
        Why anonymize it? Could be a new profit center.
    - joncrocks 9y ago
      So this is going to happen once they've built the car + engine, and started selling it? Is 'car tester' going to become a side-hustle? I agree that a degree of randomness is likely a good idea to avoid defeat devices, but one also has to consider that it could have two unintended consequences: 1) more expensive cars, due to more stringent QA procedures 2) relaxing of standards to ensure that companies can still practically make cars that conform to 'standards.' As ever, it's important to consider that a layman's "seems reasonable to me" is another experts "that's not how things work."
      - 9y ago
  - stordoff 9y ago
    Would it be feasible to have two tests? One public, and one where the details are hidden. The hidden test has a significantly lower pass bar, so that the only way you would fail it whilst passing the public test is if you are manipulating the outcome of the public test.
- pedrocr 9y ago
  Doing a sanity check helps but the best thing that can be done to avoid a repeat of this is to make sure there are sufficiently heavy fines and hopefully also jail time from this case. If the penalty is heavy enough the detection probability doesn't need to be as high.
DonHopkins 9y ago
It smells more like a "smoking tailpipe".
avar 9y ago
I may be missing something here, but if you take a step back this just seems like a tragedy of misaligned economic incentives. Both the US & EU would have wanted this information from day one, and this whole fiasco cost VW billions in fines. There would have been any number of engineers at VW and Bosch that knew exactly how this worked, but there was nothing in it for them to come clear about it. They were never going to get charged for writing that code, and they would have likely been out of a job or destroyed their career at those companies if they volunteered to authorities how this worked. So why don't investigators just offer a huge cash prices to engineers at those companies who can provide details about exactly how this worked, along with immunity as long as they're forthcoming with information about who instructed them to implement this? You'd have an army of engineers overnight willing to spill the beans, and you'd save millions in investigative costs, and quickly get to the real root cause of the corruption. Instead some independent team of investigators is left digging through old firmware images posted on forums to reverse engineer how the defeat device worked.
- obstinate 9y ago
  I don't know for certain whether the concept of a bounty was considered, and if so why it was rejected. But I can think of a few possibly good reasons to not do this. For one thing, it could be thought of as rewarding the engineers who wrote the evil code, maybe even creating an incentive for engineers to add such code in the future. There are precedents for enforcement actions having the unintended consequence of causing more incidents. Another thing is that you may actually wish to prosecute the people who wrote the code, to serve as a disincentive to future engineers considering following management orders on a similar defeat device.
  - avar 9y ago
    You may wish to prosecute them either way, and you might offer them immunity either way. Doing this would just guarantee that if they were eligible for lenient handling or immunity that they'd get a handsome cash payout by ratting on their management or giving investigators details relevant to the case, but which they didn't think to look for.
  - 9y ago
mabbo 9y ago
While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. They still did it, and then didn't tell anyone. And that doesn't sit well with me. In my opinion (and I welcome disagreement and debate) engineers have an obligation to say 'no' to wiring unethical code.
- obstinate 9y ago
  You are correct. "Just following orders," is sometimes an understandable action (in the sense that I understand why someone might not want to refuse an order and risk their job), but that doesn't make it an excusable one.
- ebbv 9y ago
  It depends how drastic. You are talking about people risking their careers. We all have our own moral standards to live by. Maybe they justified it by saying all the other car companies are doing the same thing (and by the way there are some indicators they did.)
- adrianN 9y ago
  It's imho not so clear cut whether this code is unethical or not. There is a legitimate argument that increasing NOx to reduce CO2 is better in the long term. Remember that the two are inversely related: the hotter and leaner your engine runs, the more NOx you produce, but your fuel efficiency also goes up.
  - lazyasciiart 9y ago
    In the long term, making their cars cause accidents that killed many people would reduce the environmental impact of humanity, so would also be arguably ethical by that logic.
- bosie 9y ago
parennoob 9y ago
> In 2015, regulators realized that diesel Volkswagens and Audis were emitting several times the legal limit of nitrogen oxides (NOx) during real-world driving tests. This means that they can detect emissions levels during real world driving tests. What's wrong with just making those tests the actual regulatory ones? So whatever ingenuity automakers can use will be put to minimizing emissions in the exact same scenarios that will be used in real life.
- DonHopkins 9y ago
  Are the tests that the hidden code is supposed to defeat performed only a few times on specific cars by regulators, or are they the regular smog checks that everyone has to pass each time they renew their registration [1]? If the latter, then all those smog check shops will have to get new mobile equipment (how much more does that cost?) and drive each car around town for a long time. [2] This article [3] has a mention and photo of "A portable emissions measurement system at the Engine and Emissions Research Laboratory at West Virginia University." "Mr. Carder and his team drew on their experience testing trucks when they got the contract to test cars in 2013. One challenge was to fit what amounts to a mobile laboratory in the car. At the time, the equipment available for such emissions testing had enough battery power only for short trips. To make long hauls possible, the West Virginia University researchers bought portable gasoline generators at regular hardware stores and bolted them to the rear ends of the test cars. The generators made a terrible racket and frequently broke down because they were not designed to be bumped around." [1] http://www.dmv.org/ca-california/smog-check.php http://www.dmv.org/ca-california/smog-check.php [2] https://www.youtube.com/watch?v=YZmCp7NocMA https://www.youtube.com/watch?v=YZmCp7NocMA [2] Researchers Who Exposed VW Gain Little Reward From Success: https://www.nytimes.com/2016/07/25/business/vw-wvu-diesel-volkswagen-west-virginia.html https://www.nytimes.com/2016/07/25/business/vw-wvu-diesel-vo...
- nisa 9y ago
  > What's wrong with just making those tests the actual regulatory ones? Nothing. But Germany has a strong position in the EU and to a large degree does what VW/BMW/Mercedes want and they wanted to avoid stronger or better tests. This topic is quite often in the news here and it's clear that there is no political will to establish real word tests. There are also a lot of other cheats in this firmware: - Below 14°C? Just blast the emissions out. It's not like these cars are driven in the winter. - Autobahn? Go blast out the emissions! - and so on... This should be a far bigger scandal than it is now.
jancsika 9y ago
> Firmware images were gleaned from car-tuning forums and from an online portal maintained by Volkswagen for car repair shops. Documentation, in the form of so-called “function sheets,” was harder to come by. The function sheets were necessary to give the binary context, but the sheets are copyrighted by Bosch and generally not shared with the public. The research team ended up turning to the auto-performance tuning community again. These hard-core hobbyists and professionals share leaked function sheets so they can make aftermarket modifications to their cars. This is crazy. And, as we move toward self-driving cars, dangerous. Can someone point me to a well-regarded source in the industry that makes a cogent and convincing argument for why all the software running in a car (save maybe for the entertainment panel) should not be required to be open source? To be clear: I'm not asking for speculation, or even an explanation from an expert based on years of experience. I'm asking for a publicly accessible reference based on research data that explains the security benefits of not releasing the source code for life-critical software in the car. Edit: clarification
- obstinate 9y ago
  I would be very surprised if such a thing exists. Are there any industries, safety critical or otherwise, where the default is open source? If not, why would anyone think to justify the decision to not open source code, and especially why would anyone think to make such a memo or piece of research public?
  - ryukafalz 9y ago
    >Are there any industries, safety critical or otherwise, where the default is open source? Cryptography.[0] When trustworthiness is paramount, as in crypto (and IMO in safety-critical applications like this), being able to inspect the code helps a lot. [0] https://www.schneier.com/crypto-gram/archives/1999/0915.html#OpenSourceandSecurity https://www.schneier.com/crypto-gram/archives/1999/0915.html...
- Tempest1981 9y ago
  More common is submitting their code to a regulatory agency, as in the medical and gaming (slot machine) industries. They can also confirm that the code submitted is what is actually running on the device.
obstinate 9y ago
What puzzles me about all this is why the investigators did not compel the companies to produce the exact mechanisms by which they cheated emissions as part of the settlements. I guess it doesn't really matter, since what you're chiefly interested in is the manufacturer ceasing the behavior and not repeating the offense, so that might be why they didn't.
dkarapetyan 9y ago
Weird conclusion. This kind of activity should just be deemed illegal instead of treating it as an arms race between the manufacturers and regulators. Have 3rd party code auditors look through the code and flag any shenanigans. Instead of treating the code as an unregulated black box.
garaetjjte 9y ago
Why they were analyzing time/distance curves, steering wheel angles, temperature, etc. instead of just using accelerometer to check if car is really moving?
- tyingq 9y ago
  I don't think there's any accessible to the software. They are used for airbags, but I think that's not on the CAN bus. If one were, it might be too dead a giveaway to poll it, since you already have speed via rotational sensors.
bambax 9y ago
> In 2015, regulators realized that diesel Volkswagens and Audis were emitting several times the legal limit of nitrogen oxides (NOx) during real-world driving tests. But one problem regulators confronted was that they couldn’t point to specific code that allowed the cars to do this. They could prove the symptom (high emissions on the road), but they didn’t have concrete evidence of the cause (code that circumvented US and EU standards). I don't understand this from a regulator's point of view: as a regulator, all you have to do is test for symptoms. You don't have to explain root causes. You drive the vehicle in conditions as close as possible to real ones, measure emissions, and decide whether or not they're above the norms. Why would regulators do this in a lab? It's like health inspections that would ask restaurants to send food to be tested, instead of showing up anytime, unannounced. Regulators should pick up real cars from real owners and test them on the road, at regular intervals. Or, modern technology should allow to test a car all the time and report emissions and fuel efficiency, etc. during its lifetime. People cheat, and if cheating is easy they cheat more. The one thing a regulator cannot do is trust the industry.
- LoSboccacc 9y ago
  the problem is the wording on the emission regulation, you need to respect the limits during the testing cycle and you can't have defetaing measures to cheat - if something it's not intentional, it's a gray area. a piece of code which purpose is specifically defeating the testing cycle instead, run directly afoul of the regulations, no arguing against multibillionaire company needed.
- majewsky 9y ago
  > Why would regulators do this in a lab? It's like health inspections that would ask restaurants to send food to be tested, instead of showing up anytime, unannounced. Because the law on how regulators work was written by the auto lobby. (At least, that's how it is in the EU. Don't know about the US.)
  - kadavero 9y ago
    Funny you should mention the lobby. The US auto lobby was the reason the US NOx diesel emission requirements are more stringent than EU in the first place, specifically disadvantaging European diesel cars (which are much cleaner overall).
edejong 9y ago
An interesting twist to this would be to change liability. Make the driver liable (not the manufacturer) for driving a car breaking the emission standards. This will set in motion the following steps: - Car users will be offered insurance against breaking emission standards - Insurance companies will hire specialists to lower insurance rates of above insurance - Consumers are disincentivized to modify their ECU in a non-compliant way - Consumers are incentivized to buy cars offering more transparency in firmware (and car manufacturers will offer more transparency) I'm a firm believer in: you buy it, then you're responsible for ascertaining its safety. If you can't do this, hire someone to do it for you.
- unityByFreedom 9y ago
  > I'm a firm believer in: you buy it, then you're responsible for ascertaining its safety. If you can't do this, hire someone to do it for you People elect government to take care of this for them. We can't all be experts in everything. I firmly believe that when we work together on solving problems, we are better off. Putting the onus on the individual is exactly what big businesses would like. It gives them even more of a free pass towards short term profits. Get caught doing something wrong? Close up shop and reopen another, earning profit while fooling the public again under another name. No thank you!!!
- crowbahr 9y ago
  Problem is that the US Government guarantees that vehicles sold here have met minimum safety requirements. The public relies on the government to have done that legwork. Beyond that you would immediately get into jargon and confusing packaging for insurance and vehicle emissions. I was just buying dental insurance and the 4 different plans provided by a single provider had 30+ different fields each of which was subtly different. How am I, as a standard consumer, supposed to make sense of all of that... Much less compare it with the 3 other networks. Then add onto that another factor (the type of car I drive) into the same bag and it becomes just absurd. I don't have a solution to the cheating but I feel like mandating open source software is a good step.
  - edejong 9y ago
dreamthtwasrome 9y ago
Courts gotta subpoena Bosch and VW codebases with commit logs, ticket systems and related engineering docs.

180 points by AndrewDucker 9y ago

> The researchers also say that it’s high-time regulators dispense with the kind of lab tests that US and EU governments have required for years. Instead, some kind of active scan for illegal code needs to be developed. Alternatively, combine the lab tests with imprecise real-world tests as a sanity check, or keep the exact nature of the lab tests a secret and vary them over time. Really, the first of these seems like a good idea regardless of what else you do.

tyingq 9y ago
The real world sanity checks for cheating make sense. But the nature of the regular tests can't be secret. Carmakers need to know the bar they are supposed to hit. Building something on the speculation that it might pass, maybe, is a whole different business model.
- Sniffnoy 9y ago
  OK, but there are test details that are known to the manufacturers but seem irrelevant to the thing being tested. Like the bit about the angle of the steering wheel. Surely there are multiple ways one can test for the same standard?
  - tyingq 9y ago
    The cheats are based around detecting when a car is strapped down to a dynamometer, indoors. That why the cheaters are looking at ambient temp, steering wheel angle, etc.
- adrianN 9y ago
  "Build a car that doesn't emit more than X of exhaust Y when a typical driver drives it a) ten kilometers in the city, b) a hundred kilometers on the highway." That seems like a good enough requirement to me. Define "a typical driver" as "out of a hundred random test drivers, no more than 20 exceed the thresholds, no more than 5 exceed the thresholds by more than a factor two." That forces the car manufacturers to have a sufficient safety margin in their emissions. I don't know how difficult the actual measurement is, but maybe you could pay a couple thousand people a reasonable amount of money to have some devices attached to their cars for a month or two and collect data. Or make the car makers pay for the procedure.
  - tyingq 9y ago
    Driving style has a profound effect on emissions. As does ambient temperature, uphill vs downhill, time at stoplight. Short trip vs longer (catalytic converters don't work till they are hot). I'm sure they can find some way to address the cheating, but it's likely not the case that they are just missing some obvious simple solution.
    - wereHamster 9y ago
      Modern cars have enough sensors that they could store all necessary information about trips, have the service center read it out each time the car is serviced, anonymise, and send back to the manufacturer. That way the manufacturer would have accurate, real-world data about their 'average driver'. Could even make it country-specific.
      - tyingq 9y ago
        These tests, though, are the ones you have to pass before you can sell that model of car, administered by government agencies. The agencies dictate the tests and measures.
      - mcguire 9y ago
        Why anonymize it? Could be a new profit center.
  - joncrocks 9y ago
    So this is going to happen once they've built the car + engine, and started selling it? Is 'car tester' going to become a side-hustle? I agree that a degree of randomness is likely a good idea to avoid defeat devices, but one also has to consider that it could have two unintended consequences: 1) more expensive cars, due to more stringent QA procedures 2) relaxing of standards to ensure that companies can still practically make cars that conform to 'standards.' As ever, it's important to consider that a layman's "seems reasonable to me" is another experts "that's not how things work."
    - 9y ago
- stordoff 9y ago
  Would it be feasible to have two tests? One public, and one where the details are hidden. The hidden test has a significantly lower pass bar, so that the only way you would fail it whilst passing the public test is if you are manipulating the outcome of the public test.
pedrocr 9y ago
Doing a sanity check helps but the best thing that can be done to avoid a repeat of this is to make sure there are sufficiently heavy fines and hopefully also jail time from this case. If the penalty is heavy enough the detection probability doesn't need to be as high.

DonHopkins 9y ago

It smells more like a "smoking tailpipe".

avar 9y ago

I may be missing something here, but if you take a step back this just seems like a tragedy of misaligned economic incentives. Both the US & EU would have wanted this information from day one, and this whole fiasco cost VW billions in fines. There would have been any number of engineers at VW and Bosch that knew exactly how this worked, but there was nothing in it for them to come clear about it. They were never going to get charged for writing that code, and they would have likely been out of a job or destroyed their career at those companies if they volunteered to authorities how this worked. So why don't investigators just offer a huge cash prices to engineers at those companies who can provide details about exactly how this worked, along with immunity as long as they're forthcoming with information about who instructed them to implement this? You'd have an army of engineers overnight willing to spill the beans, and you'd save millions in investigative costs, and quickly get to the real root cause of the corruption. Instead some independent team of investigators is left digging through old firmware images posted on forums to reverse engineer how the defeat device worked.

obstinate 9y ago
I don't know for certain whether the concept of a bounty was considered, and if so why it was rejected. But I can think of a few possibly good reasons to not do this. For one thing, it could be thought of as rewarding the engineers who wrote the evil code, maybe even creating an incentive for engineers to add such code in the future. There are precedents for enforcement actions having the unintended consequence of causing more incidents. Another thing is that you may actually wish to prosecute the people who wrote the code, to serve as a disincentive to future engineers considering following management orders on a similar defeat device.
- avar 9y ago
  You may wish to prosecute them either way, and you might offer them immunity either way. Doing this would just guarantee that if they were eligible for lenient handling or immunity that they'd get a handsome cash payout by ratting on their management or giving investigators details relevant to the case, but which they didn't think to look for.
- 9y ago

mabbo 9y ago

While I certainly don't support the 'rogue engineer' excuse that VW originally gave everyone, the idea does bring up an interesting point. An engineer did write this code. Almost certainly, many of them, working together. Now, their managers told them it was okay to do this, maybe that legal had given the go-ahead or that they had to do it to keep their jobs... But it's still pretty clear that this was not right. They still did it, and then didn't tell anyone. And that doesn't sit well with me. In my opinion (and I welcome disagreement and debate) engineers have an obligation to say 'no' to wiring unethical code.

obstinate 9y ago
You are correct. "Just following orders," is sometimes an understandable action (in the sense that I understand why someone might not want to refuse an order and risk their job), but that doesn't make it an excusable one.
ebbv 9y ago
It depends how drastic. You are talking about people risking their careers. We all have our own moral standards to live by. Maybe they justified it by saying all the other car companies are doing the same thing (and by the way there are some indicators they did.)
adrianN 9y ago
It's imho not so clear cut whether this code is unethical or not. There is a legitimate argument that increasing NOx to reduce CO2 is better in the long term. Remember that the two are inversely related: the hotter and leaner your engine runs, the more NOx you produce, but your fuel efficiency also goes up.
- lazyasciiart 9y ago
  In the long term, making their cars cause accidents that killed many people would reduce the environmental impact of humanity, so would also be arguably ethical by that logic.
bosie 9y ago

parennoob 9y ago

> In 2015, regulators realized that diesel Volkswagens and Audis were emitting several times the legal limit of nitrogen oxides (NOx) during real-world driving tests. This means that they can detect emissions levels during real world driving tests. What's wrong with just making those tests the actual regulatory ones? So whatever ingenuity automakers can use will be put to minimizing emissions in the exact same scenarios that will be used in real life.

DonHopkins 9y ago
Are the tests that the hidden code is supposed to defeat performed only a few times on specific cars by regulators, or are they the regular smog checks that everyone has to pass each time they renew their registration [1]? If the latter, then all those smog check shops will have to get new mobile equipment (how much more does that cost?) and drive each car around town for a long time. [2] This article [3] has a mention and photo of "A portable emissions measurement system at the Engine and Emissions Research Laboratory at West Virginia University." "Mr. Carder and his team drew on their experience testing trucks when they got the contract to test cars in 2013. One challenge was to fit what amounts to a mobile laboratory in the car. At the time, the equipment available for such emissions testing had enough battery power only for short trips. To make long hauls possible, the West Virginia University researchers bought portable gasoline generators at regular hardware stores and bolted them to the rear ends of the test cars. The generators made a terrible racket and frequently broke down because they were not designed to be bumped around." [1] http://www.dmv.org/ca-california/smog-check.php http://www.dmv.org/ca-california/smog-check.php [2] https://www.youtube.com/watch?v=YZmCp7NocMA https://www.youtube.com/watch?v=YZmCp7NocMA [2] Researchers Who Exposed VW Gain Little Reward From Success: https://www.nytimes.com/2016/07/25/business/vw-wvu-diesel-volkswagen-west-virginia.html https://www.nytimes.com/2016/07/25/business/vw-wvu-diesel-vo...
nisa 9y ago
> What's wrong with just making those tests the actual regulatory ones? Nothing. But Germany has a strong position in the EU and to a large degree does what VW/BMW/Mercedes want and they wanted to avoid stronger or better tests. This topic is quite often in the news here and it's clear that there is no political will to establish real word tests. There are also a lot of other cheats in this firmware: - Below 14°C? Just blast the emissions out. It's not like these cars are driven in the winter. - Autobahn? Go blast out the emissions! - and so on... This should be a far bigger scandal than it is now.

jancsika 9y ago

> Firmware images were gleaned from car-tuning forums and from an online portal maintained by Volkswagen for car repair shops. Documentation, in the form of so-called “function sheets,” was harder to come by. The function sheets were necessary to give the binary context, but the sheets are copyrighted by Bosch and generally not shared with the public. The research team ended up turning to the auto-performance tuning community again. These hard-core hobbyists and professionals share leaked function sheets so they can make aftermarket modifications to their cars. This is crazy. And, as we move toward self-driving cars, dangerous. Can someone point me to a well-regarded source in the industry that makes a cogent and convincing argument for why all the software running in a car (save maybe for the entertainment panel) should not be required to be open source? To be clear: I'm not asking for speculation, or even an explanation from an expert based on years of experience. I'm asking for a publicly accessible reference based on research data that explains the security benefits of not releasing the source code for life-critical software in the car. Edit: clarification

obstinate 9y ago
I would be very surprised if such a thing exists. Are there any industries, safety critical or otherwise, where the default is open source? If not, why would anyone think to justify the decision to not open source code, and especially why would anyone think to make such a memo or piece of research public?
- ryukafalz 9y ago
  >Are there any industries, safety critical or otherwise, where the default is open source? Cryptography.[0] When trustworthiness is paramount, as in crypto (and IMO in safety-critical applications like this), being able to inspect the code helps a lot. [0] https://www.schneier.com/crypto-gram/archives/1999/0915.html#OpenSourceandSecurity https://www.schneier.com/crypto-gram/archives/1999/0915.html...
Tempest1981 9y ago
More common is submitting their code to a regulatory agency, as in the medical and gaming (slot machine) industries. They can also confirm that the code submitted is what is actually running on the device.

obstinate 9y ago

What puzzles me about all this is why the investigators did not compel the companies to produce the exact mechanisms by which they cheated emissions as part of the settlements. I guess it doesn't really matter, since what you're chiefly interested in is the manufacturer ceasing the behavior and not repeating the offense, so that might be why they didn't.

dkarapetyan 9y ago

Weird conclusion. This kind of activity should just be deemed illegal instead of treating it as an arms race between the manufacturers and regulators. Have 3rd party code auditors look through the code and flag any shenanigans. Instead of treating the code as an unregulated black box.

garaetjjte 9y ago

Why they were analyzing time/distance curves, steering wheel angles, temperature, etc. instead of just using accelerometer to check if car is really moving?

tyingq 9y ago
I don't think there's any accessible to the software. They are used for airbags, but I think that's not on the CAN bus. If one were, it might be too dead a giveaway to poll it, since you already have speed via rotational sensors.

bambax 9y ago

> In 2015, regulators realized that diesel Volkswagens and Audis were emitting several times the legal limit of nitrogen oxides (NOx) during real-world driving tests. But one problem regulators confronted was that they couldn’t point to specific code that allowed the cars to do this. They could prove the symptom (high emissions on the road), but they didn’t have concrete evidence of the cause (code that circumvented US and EU standards). I don't understand this from a regulator's point of view: as a regulator, all you have to do is test for symptoms. You don't have to explain root causes. You drive the vehicle in conditions as close as possible to real ones, measure emissions, and decide whether or not they're above the norms. Why would regulators do this in a lab? It's like health inspections that would ask restaurants to send food to be tested, instead of showing up anytime, unannounced. Regulators should pick up real cars from real owners and test them on the road, at regular intervals. Or, modern technology should allow to test a car all the time and report emissions and fuel efficiency, etc. during its lifetime. People cheat, and if cheating is easy they cheat more. The one thing a regulator cannot do is trust the industry.

LoSboccacc 9y ago
the problem is the wording on the emission regulation, you need to respect the limits during the testing cycle and you can't have defetaing measures to cheat - if something it's not intentional, it's a gray area. a piece of code which purpose is specifically defeating the testing cycle instead, run directly afoul of the regulations, no arguing against multibillionaire company needed.
majewsky 9y ago
> Why would regulators do this in a lab? It's like health inspections that would ask restaurants to send food to be tested, instead of showing up anytime, unannounced. Because the law on how regulators work was written by the auto lobby. (At least, that's how it is in the EU. Don't know about the US.)
- kadavero 9y ago
  Funny you should mention the lobby. The US auto lobby was the reason the US NOx diesel emission requirements are more stringent than EU in the first place, specifically disadvantaging European diesel cars (which are much cleaner overall).

edejong 9y ago

An interesting twist to this would be to change liability. Make the driver liable (not the manufacturer) for driving a car breaking the emission standards. This will set in motion the following steps: - Car users will be offered insurance against breaking emission standards - Insurance companies will hire specialists to lower insurance rates of above insurance - Consumers are disincentivized to modify their ECU in a non-compliant way - Consumers are incentivized to buy cars offering more transparency in firmware (and car manufacturers will offer more transparency) I'm a firm believer in: you buy it, then you're responsible for ascertaining its safety. If you can't do this, hire someone to do it for you.

unityByFreedom 9y ago
> I'm a firm believer in: you buy it, then you're responsible for ascertaining its safety. If you can't do this, hire someone to do it for you People elect government to take care of this for them. We can't all be experts in everything. I firmly believe that when we work together on solving problems, we are better off. Putting the onus on the individual is exactly what big businesses would like. It gives them even more of a free pass towards short term profits. Get caught doing something wrong? Close up shop and reopen another, earning profit while fooling the public again under another name. No thank you!!!
crowbahr 9y ago
Problem is that the US Government guarantees that vehicles sold here have met minimum safety requirements. The public relies on the government to have done that legwork. Beyond that you would immediately get into jargon and confusing packaging for insurance and vehicle emissions. I was just buying dental insurance and the 4 different plans provided by a single provider had 30+ different fields each of which was subtly different. How am I, as a standard consumer, supposed to make sense of all of that... Much less compare it with the 3 other networks. Then add onto that another factor (the type of car I drive) into the same bag and it becomes just absurd. I don't have a solution to the cheating but I feel like mandating open source software is a good step.
- edejong 9y ago

dreamthtwasrome 9y ago

Courts gotta subpoena Bosch and VW codebases with commit logs, ticket systems and related engineering docs.