Inside the cheater VW ECU used on AdBlue equipped models.

"Saracen" (manualdoucheelitist) 01/04/2016 at 15:05 • Filed to: dieselgate

11

13

A pair of German hackers gave a talk at 32C3 last week, regarding the Bosch ECU’s used in VW’s TDI models equipped with AdBlue. Being a software engineer by trade, I was interested in their findings and how they did it, so I sat down last night and watched the 65 minute presentation.

The first half of the talk is a bit dry, as it is a crash course in cost-benefit analysis in the automotive market, but it still provides some useful information behind why this ever happened at VW. The real action is the second half of the lecture.

The second presenter, Felix, bought a spare Bosch ECU [intended to be used for an EA189 motor] from eBay, and used a firmware bug to dump the raw binary, which he then parsed through with a disassembler. He found documentation online that figure out how the ECU’s variables correlated with memory addresses reverse engineered from the binary. Once he had an idea as to how the cheat was working, he was able to verify it with real-world tests on his own cheater-TDI equipped VW.

The interesting parts of the talk is a description of how the Bosch ECU works:

The ECU contains a simulated model of the engine.

It is almost completely data driven, with very little logic flow. Change a variable (one of 20,000 that can be changed), and the ECU calculates the altered output immediately.

In regards to emissions, the ECU controls AdBlue dosage used during Selective Catalytic Reduction. It turns out that AdBlue dosage requires precise calculation: too little and you don’t burn off much NOx, too much and your exhaust is mostly ammonia. The trick is to maximize NOx burn-off while minimizing Ammonia leakage.

In order to calculate AdBlue dosage, the ECU has two dosage models calculated side by side at all times: A main model which is to be used most of the time, and an alternate model for the edge conditions that the main model cannot account for. At any given point, the ECU will choose which model to use based on various inputs.

So what are those various inputs? Felix tracked it down to a table that represented distance traveled over a given period of time...there are three tables, each with an upper and lower bounds. When compared with EU emissions test procedures ( Travel at x km/h per hour for y minutes, etc...) Felix found that when the curves for the test procedure are integrated over time (giving him a graph of distance travelled), the resulting curve fits exactly between the upper and lower bounds for inputs required to trigger the regular dosage model.

This alternate dosage model uses almost no AdBlue at all, and was being triggered most of the time, except for when the calculated distance over time input fell within the narrowly defined upper and lower bounds.

Felix verified this in the real world....when he stuck to the bounds of the emissions test the AdBlue injection signal behaved as it should, but when he went out of bounds, AdBlue injection dropped to zero and stayed there.

So this means that it was very easy for VW to circumvent any emissions test it was subjected to. Just change a few variables to account for the distance traveled during a very strictly defined testing procedure, and its cars will look squeaky clean.

Since this is only related to AdBlue equipped cars (like my 2015 GSW TDI), the cheat found in the 2009-2014 likely uses an entirely different cheat, but likely still based on tweaking the model of the engine located in the ECU.

!!! UNKNOWN CONTENT TYPE !!!

crowmolly > Saracen 01/04/2016 at 15:13

0

Thanks for sharing. This is probably the way things are in my ‘13 Passat.

tromoly > Saracen 01/04/2016 at 15:16

0

Saw this on Hackaday the other day, some of the things are pretty interesting and aren’t reported in the general media reports.

Santiago of Escuderia Boricua > Saracen 01/04/2016 at 15:18

0

So the adblue is processed as a giant equation? Very interesting...

jariten1781 > Saracen 01/04/2016 at 15:23

1

I’ll watch later when I have a chance...but quick question. Did they mention what other parameters were being modified in the AdBlue models?...because surely they weren’t cheating emissions just to extend the fill interval for the supplemental fluid. That’d be crazy, the bits and pieces we've got on the non-SCR cars have at least been rational if illegal.

Saracen > jariten1781 01/04/2016 at 15:28

1

That appeared to be the only thing modified.

They are not cheating just to reduce AdBlue usage. That doesn’t make sense. It must be adversely affecting either performance or longevity of emissions components.

Saracen > tromoly 01/04/2016 at 15:47

0

Yeah, I figured everything that the press was reporting was a very dumbed down version of what was going on. I’m glad these guys investigated!

Saracen > crowmolly 01/04/2016 at 15:48

1

Yep, your car has the EA189 engine. Mine is the newer EA288, but I’m sure the same scheme is being used.

450X_FTW > Saracen 01/04/2016 at 15:49

0

So with the decrease in AdBlue usage, there was no red flags set by customers as to why their vehicles used far less AdBlue then they should have been using?

Saracen > 450X_FTW 01/04/2016 at 15:54

0

I guess not. Most customers were probably just thrilled that they don’t have to refill it. And most AdBlue equipped models are 2015 and up and likely still only having their AdBlue tanks refilled by the dealer.

My VW dealer topped off my AdBlue tank when I took it in for the 10k service a couple of weeks ago, but didn’t specify how much was needed.

AMGtech - now with more recalls! > Saracen 01/04/2016 at 17:15

0

Interesting. I expected it to be... more direct.

I find it strange that they did it because of adblue. It really shouldn’t affect performance since it is only exhaust after treatment. For example, W164 ML320 CDI makes less power than a slightly newer W164 ML350 Bluetec. Same engine, just a few extra sensors and a different exhaust (basically). To top that off, we don’t have an unusual rate of exhaust component failure, unless you count NOx sensors themselves.

There has to be more to it. Maybe their SCR catalysts and DPF’s don’t have the capacity to handle all the extra conversion required with adblue. Maybe by not running adblue they can increase power by increasing fuel. But I have absolutely ZERO familiarity with VW diesels, so I really have no idea.

Saracen > AMGtech - now with more recalls! 01/04/2016 at 17:17

0

I don’t think they did it because of AdBlue. But clearly performance or emission components were adversely affeced in the process.

AMGtech - now with more recalls! > Saracen 01/04/2016 at 19:11

0

Right. It would be interesting to get the whole story from those directly involved with the “decision” to do it this way.

Tapas > Saracen 01/04/2016 at 21:35

0

Thank you for the detailed write-up :)