6 ms·

Jaguar recalls 18,000 cars over major software fault

51 points by Netadmin 15y ago

laluser 15y ago
Interesting, I guess that's one aspect of software systems that doesn't come to my mind right away. With the increase in the amount of microprocessors in each car and as the code behind all that processing becomes more intelligent, I wonder if these complexities will make cases like this more prevalent.
- 0x12 15y ago
  Of course it will. The worst bit is that it won't be just your audio system not working either, but some critical part. Cruise control malfunctions can be relatively benign or they can be the equivalent of someone stomping on the accelerator.
  - laluser 15y ago
    Car mechanics: the next generation of programmers?
    - shabble 15y ago
      No more so than an "IT Support Technician" who comes to reflash your BIOS and maybe install a few Windows patches. The real hackers are screwing around with (hopefully their own) ECUs: http://ecuhacking.activeboard.com/ http://ecuhacking.activeboard.com/
- shabble 15y ago
  I'm not sure it's so much the quantity of controllers/code, but the quantity and quality of the interfaces between them. If I were writing something like this, there'd be a very clear demarcation of "safety critical throttle/brakes/steering stuff" | "blinky lights and radio" I suspect that it starts out that way when the engineers are arguing about the liability issues of going full-throttle at random, but then it becomes standard, everyone gets a bit blasé, and before you know it the assistant vice-chairhorse of marketing is talking about how cool it'd be if your radio gets louder as you speed up. Even then, I'd be arguing in favour of something like a data diode[1]. I can't think of any non-critical system that should have input to the cruise control[2] [1] https://secure.wikimedia.org/wikipedia/en/wiki/Unidirectional_network https://secure.wikimedia.org/wikipedia/en/wiki/Unidirectiona... [2] Of course, if it did, I'd claim it was by definition now a critical system. :)
  - regularfry 15y ago
    > If I were writing something like this, there'd be a very clear demarcation of "safety critical throttle/brakes/steering stuff" | "blinky lights and radio" As an ex-blinky-lights-and-radio tech, I can assure you that they are clearly separated. Admittedly, my experience is limited to BMWs, but there's enough shared knowledge across the industry about the Right Way to do this stuff that I'd be surprised if Jaguar had made that mistake.
    - topbanana 15y ago
      I have heard that there are separate buses for these things, but how does information propagate between them? For example, if my ABS fails, how does it pop up into the service menu on iDrive?
      - regularfry 15y ago
        The instrument pack in the dashboard is connected to both buses. It needs real-time data from the drive systems to display speed and so on, so it's used as a hub.
est 15y ago
In next five years could we see cars updating their system software over WiFI?
- deleted 15y ago
  [deleted]
- zalew 15y ago
  ford syncs it's gadgets on assembly lines http://news.cnet.com/8301-1035_3-20014787-94.html http://news.cnet.com/8301-1035_3-20014787-94.html and no doubt that somewhere in the future that will be the way to upgrade ECU firmware. taking the design-production cycle into account, such systems should already be in advanced stages of progress to go into production in 5 years, so I doubt that.
- roel_v 15y ago
  BMW already does this (others too I guess, I don't know), although not over WiFi, but over a GPRS connection. You pay a yearly fee for data costs, it also transmits data on car health back to your dealer so that they know when to call you to make an appointment for maintenance.
  - topbanana 15y ago
    I recently had a problem with the turbocharger unit in my car. The local techs couldn't figure it out so they just patched in a remote engineer in Germany. I was impressed.
seclorum 15y ago
My car wouldn't drive without software telling it what to do. I find it very disturbing that I can't it. I think life-critical software should be open source by law ..
- yuvadam 15y ago
  Though nothing would delight me more than to be able to hack my cars open-source firmware, I can't see that happening by a long shot. Security-by-obscurity is still a - supposedly - valid claim nowadays.
  - pantaloons 15y ago
    There's nothing that would delight me less than driving on the road with someone who has hacked their cars firmware. In any case this seems more like competitive advantage through obscurity than security through obscurity, for the same reason that manufacturers don't include blueprints and engine schematics.
    - MoreMoschops 15y ago
      "There's nothing that would delight me less than driving on the road with someone who has hacked their cars firmware." Engine tuners already do this.
      - d99kris 15y ago
        Yes. And also developers/testers of other electronic control units in the vehicle. The early phase development is always in simulators and on test tracks, but typically car manufacturers have deals with the governments which allow them to drive on regular roads with systems under development. Of course, should something happen, there's a number to call to get towed away quickly.
      - roel_v 15y ago
        Only a very small part of the firmware, or more specifically, not really the firmware but just some chips that control the ignition timing and gas mixture. None of which puts other drivers at risk; at worst they blow up the engine of their own car (I don't know if that's possible with chip tuning, just saying). Many 'types' of car tuning that cause danger are already prohibited on most places. But if somebody could rewrite the firmware so that the car stereo controls all of a sudden are the only way to actuate the brakes, that could create very dangerous situations. Which I why I hope that there will remain strong regulations on what firmware people can load onto their cars, at least in as far as they use that car on public roads.
vegai 15y ago
It's frightening how cars' software is bloating up. I would've thought that a product that very easily kills people if things go wrong would have been under more scrutiny.
- Nexialist 15y ago
  This is nothing. I work for an aircraft maintenance software company. Last week I fixed a bug where the system would silently delete a maintenance task if you clicked the X button on a confirmation dialog instead of "no". This had not been fixed for three years.
  - d99kris 15y ago
    The difference is that a pilot knows far more about an aircraft than the average driver knows about their vehicle.
    - Nexialist 15y ago
      That's probably true, but the potential for a severe, un-recoverable issue is about as high. An aircraft is composed of hundreds of individually tracked components with associated information about how old the component is, how much it has flown, etc. Most of these parts have a mandatory expiration date at which point it is swapped out or sent for repair. A failure in the system which tracks all this data (which is what I work on) isn't quite as directly dangerous as, say, a bug in the on-board navigational software. But you can still end up flying around with an engine way past its intended expiration date far too easily.
      - d99kris 15y ago
        Point taken.
      - sokoloff 15y ago
        Agreed. I know a fair bit about what keeps my single-engine piston aircraft in the sky, and many of the possible faults are routinely checked/confirmed OK during pre-flight inspection and/or run-up. Still, I don't want to inadvertantly miss a 500-hr magneto IRAN, a wing spar or bolt NDT inspection interval, run my dry vacuum pump twice as long as I planned, or several other possible faults that aren't easily testable by other than maintenance technicians.
eftpotrm 15y ago
Stupid question time. Why couldn't the driver put the car into neutral and coast to a safe halt to restart the system? (Obviously though it's an issue that needs fixing!)
- efishkin 15y ago
  Strangely enough, it's impossible to go from either of the drive modes (D & S(Jaguar's "Sport" mode)) to neutral, and vice versa, without almost fully engaging the brakes. Just tapping the brakes is insufficient. A friend and I attempted to do a "neutral bomb" in my XF but as it's impossible to transition without hitting the brakes, the attempt was a total failure.
- roel_v 15y ago
  Much of the shifting is done in software also; for example on my car I can't go from 'drive' to 'reverse' if I'm driving too fast, and I'm not sure if moving the shift stick into neutral has any mechanical effects or if that too is just a signal to the controller who then (electronically) drives the gear box. Which makes sense I guess from the point of preventing damage, but it does cause the software to become a single point of failure.
- sp332 15y ago
  The brakes should be strong enough to stop the car even if you can't get the car out of gear. It takes longer to stop of course, and you might need to replace your brakes afterwards but it should stop.
mynegation 15y ago
Automotive producers in general have pretty high standard of the source code creation and maintenance. However - the set of guidelines that govern the code - MISRA (Motor Industry Software Reliability Association), while better than nothing, are pretty poor. Most of MISRA rules look like they were designed to be easily checked by automated tools - not to check for real defects. That situation may have been acceptable 15 years ago, but modern static and dynamic analysis tools are capable of much more than that.

51 points by Netadmin 15y ago

Interesting, I guess that's one aspect of software systems that doesn't come to my mind right away. With the increase in the amount of microprocessors in each car and as the code behind all that processing becomes more intelligent, I wonder if these complexities will make cases like this more prevalent.

0x12 15y ago
Of course it will. The worst bit is that it won't be just your audio system not working either, but some critical part. Cruise control malfunctions can be relatively benign or they can be the equivalent of someone stomping on the accelerator.
- laluser 15y ago
  Car mechanics: the next generation of programmers?
  - shabble 15y ago
    No more so than an "IT Support Technician" who comes to reflash your BIOS and maybe install a few Windows patches. The real hackers are screwing around with (hopefully their own) ECUs: http://ecuhacking.activeboard.com/ http://ecuhacking.activeboard.com/
shabble 15y ago
I'm not sure it's so much the quantity of controllers/code, but the quantity and quality of the interfaces between them. If I were writing something like this, there'd be a very clear demarcation of "safety critical throttle/brakes/steering stuff" | "blinky lights and radio" I suspect that it starts out that way when the engineers are arguing about the liability issues of going full-throttle at random, but then it becomes standard, everyone gets a bit blasé, and before you know it the assistant vice-chairhorse of marketing is talking about how cool it'd be if your radio gets louder as you speed up. Even then, I'd be arguing in favour of something like a data diode[1]. I can't think of any non-critical system that should have input to the cruise control[2] [1] https://secure.wikimedia.org/wikipedia/en/wiki/Unidirectional_network https://secure.wikimedia.org/wikipedia/en/wiki/Unidirectiona... [2] Of course, if it did, I'd claim it was by definition now a critical system. :)
- regularfry 15y ago
  > If I were writing something like this, there'd be a very clear demarcation of "safety critical throttle/brakes/steering stuff" | "blinky lights and radio" As an ex-blinky-lights-and-radio tech, I can assure you that they are clearly separated. Admittedly, my experience is limited to BMWs, but there's enough shared knowledge across the industry about the Right Way to do this stuff that I'd be surprised if Jaguar had made that mistake.
  - topbanana 15y ago
    I have heard that there are separate buses for these things, but how does information propagate between them? For example, if my ABS fails, how does it pop up into the service menu on iDrive?
    - regularfry 15y ago
      The instrument pack in the dashboard is connected to both buses. It needs real-time data from the drive systems to display speed and so on, so it's used as a hub.

est 15y ago

In next five years could we see cars updating their system software over WiFI?

deleted 15y ago
[deleted]
zalew 15y ago
ford syncs it's gadgets on assembly lines http://news.cnet.com/8301-1035_3-20014787-94.html http://news.cnet.com/8301-1035_3-20014787-94.html and no doubt that somewhere in the future that will be the way to upgrade ECU firmware. taking the design-production cycle into account, such systems should already be in advanced stages of progress to go into production in 5 years, so I doubt that.
roel_v 15y ago
BMW already does this (others too I guess, I don't know), although not over WiFi, but over a GPRS connection. You pay a yearly fee for data costs, it also transmits data on car health back to your dealer so that they know when to call you to make an appointment for maintenance.
- topbanana 15y ago
  I recently had a problem with the turbocharger unit in my car. The local techs couldn't figure it out so they just patched in a remote engineer in Germany. I was impressed.

seclorum 15y ago

My car wouldn't drive without software telling it what to do. I find it very disturbing that I can't it. I think life-critical software should be open source by law ..

yuvadam 15y ago
Though nothing would delight me more than to be able to hack my cars open-source firmware, I can't see that happening by a long shot. Security-by-obscurity is still a - supposedly - valid claim nowadays.
- pantaloons 15y ago
  There's nothing that would delight me less than driving on the road with someone who has hacked their cars firmware. In any case this seems more like competitive advantage through obscurity than security through obscurity, for the same reason that manufacturers don't include blueprints and engine schematics.
  - MoreMoschops 15y ago
    "There's nothing that would delight me less than driving on the road with someone who has hacked their cars firmware." Engine tuners already do this.
    - d99kris 15y ago
      Yes. And also developers/testers of other electronic control units in the vehicle. The early phase development is always in simulators and on test tracks, but typically car manufacturers have deals with the governments which allow them to drive on regular roads with systems under development. Of course, should something happen, there's a number to call to get towed away quickly.
    - roel_v 15y ago
      Only a very small part of the firmware, or more specifically, not really the firmware but just some chips that control the ignition timing and gas mixture. None of which puts other drivers at risk; at worst they blow up the engine of their own car (I don't know if that's possible with chip tuning, just saying). Many 'types' of car tuning that cause danger are already prohibited on most places. But if somebody could rewrite the firmware so that the car stereo controls all of a sudden are the only way to actuate the brakes, that could create very dangerous situations. Which I why I hope that there will remain strong regulations on what firmware people can load onto their cars, at least in as far as they use that car on public roads.

vegai 15y ago

It's frightening how cars' software is bloating up. I would've thought that a product that very easily kills people if things go wrong would have been under more scrutiny.

Nexialist 15y ago
This is nothing. I work for an aircraft maintenance software company. Last week I fixed a bug where the system would silently delete a maintenance task if you clicked the X button on a confirmation dialog instead of "no". This had not been fixed for three years.
- d99kris 15y ago
  The difference is that a pilot knows far more about an aircraft than the average driver knows about their vehicle.
  - Nexialist 15y ago
    That's probably true, but the potential for a severe, un-recoverable issue is about as high. An aircraft is composed of hundreds of individually tracked components with associated information about how old the component is, how much it has flown, etc. Most of these parts have a mandatory expiration date at which point it is swapped out or sent for repair. A failure in the system which tracks all this data (which is what I work on) isn't quite as directly dangerous as, say, a bug in the on-board navigational software. But you can still end up flying around with an engine way past its intended expiration date far too easily.
    - d99kris 15y ago
      Point taken.
    - sokoloff 15y ago
      Agreed. I know a fair bit about what keeps my single-engine piston aircraft in the sky, and many of the possible faults are routinely checked/confirmed OK during pre-flight inspection and/or run-up. Still, I don't want to inadvertantly miss a 500-hr magneto IRAN, a wing spar or bolt NDT inspection interval, run my dry vacuum pump twice as long as I planned, or several other possible faults that aren't easily testable by other than maintenance technicians.

eftpotrm 15y ago

Stupid question time. Why couldn't the driver put the car into neutral and coast to a safe halt to restart the system? (Obviously though it's an issue that needs fixing!)

efishkin 15y ago
Strangely enough, it's impossible to go from either of the drive modes (D & S(Jaguar's "Sport" mode)) to neutral, and vice versa, without almost fully engaging the brakes. Just tapping the brakes is insufficient. A friend and I attempted to do a "neutral bomb" in my XF but as it's impossible to transition without hitting the brakes, the attempt was a total failure.
roel_v 15y ago
Much of the shifting is done in software also; for example on my car I can't go from 'drive' to 'reverse' if I'm driving too fast, and I'm not sure if moving the shift stick into neutral has any mechanical effects or if that too is just a signal to the controller who then (electronically) drives the gear box. Which makes sense I guess from the point of preventing damage, but it does cause the software to become a single point of failure.
sp332 15y ago
The brakes should be strong enough to stop the car even if you can't get the car out of gear. It takes longer to stop of course, and you might need to replace your brakes afterwards but it should stop.

mynegation 15y ago

Automotive producers in general have pretty high standard of the source code creation and maintenance. However - the set of guidelines that govern the code - MISRA (Motor Industry Software Reliability Association), while better than nothing, are pretty poor. Most of MISRA rules look like they were designed to be easily checked by automated tools - not to check for real defects. That situation may have been acceptable 15 years ago, but modern static and dynamic analysis tools are capable of much more than that.