[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:00.00,0:00:13.07,Default,,0000,0000,0000,,{\i1}33c3 intro music{\i0}
Dialogue: 0,0:00:13.07,0:00:15.79,Default,,0000,0000,0000,,Herald: Let me present Felix Domke with
Dialogue: 0,0:00:15.79,0:00:19.63,Default,,0000,0000,0000,,the Software Defined Emissions: A Hacker's\NReview of Dieselgate.
Dialogue: 0,0:00:19.63,0:00:26.00,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:00:26.00,0:00:29.44,Default,,0000,0000,0000,,Felix Domke: Yeah, hey everyone. Thank you
Dialogue: 0,0:00:29.44,0:00:34.09,Default,,0000,0000,0000,,for coming here. I saw there are a lot of\Ninteresting talks at the same time in the
Dialogue: 0,0:00:34.09,0:00:39.27,Default,,0000,0000,0000,,other rooms, so thank you for coming here\Nand listening to me about software-defined
Dialogue: 0,0:00:39.27,0:00:46.45,Default,,0000,0000,0000,,emissions. "A Hacker's Review of\NDieselgate" is the subtitle. I'm Felix
Dialogue: 0,0:00:46.45,0:00:52.62,Default,,0000,0000,0000,,Domke. I usually do embedded software,\Nmainly security. I'm definitely not on
Dialogue: 0,0:00:52.62,0:00:58.81,Default,,0000,0000,0000,,cars and definitely not on things that\Nhave combustion thingies, so I only got
Dialogue: 0,0:00:58.81,0:01:03.97,Default,,0000,0000,0000,,dragged into car software last year when\Nmy own Volkswagen car was accused of
Dialogue: 0,0:01:03.97,0:01:10.94,Default,,0000,0000,0000,,cheating and I wanted to know what exactly\Nwas going on. I held the talk last year
Dialogue: 0,0:01:10.94,0:01:15.90,Default,,0000,0000,0000,,about some of the details of the\NVolkswagen Sharan defeat device. For the
Dialogue: 0,0:01:15.90,0:01:20.75,Default,,0000,0000,0000,,details you can take a look at that talk.\NThis time I want to look more at the
Dialogue: 0,0:01:20.75,0:01:26.78,Default,,0000,0000,0000,,process of finding or analyzing car\Nsoftware. I want to look at whether this
Dialogue: 0,0:01:26.78,0:01:35.85,Default,,0000,0000,0000,,process scales to more cars. The first\Nstep when having a piece of software that
Dialogue: 0,0:01:35.85,0:01:40.66,Default,,0000,0000,0000,,does not always do what people think it\Ndoes is, well obtain a firmware image,
Dialogue: 0,0:01:40.66,0:01:46.20,Default,,0000,0000,0000,,obtain a binary image of the firmware, and\Nin the case of my car I knew it was a
Dialogue: 0,0:01:46.20,0:01:52.09,Default,,0000,0000,0000,,Bosch EDC17, which is a Bosch ECU that a\Nlot of cars use, including my Volkswagen
Dialogue: 0,0:01:52.09,0:01:57.61,Default,,0000,0000,0000,,car. So, I didn't know anything about\NECUs, dumping software and so on, so I
Dialogue: 0,0:01:57.61,0:02:02.19,Default,,0000,0000,0000,,asked Google "Hey, what do I need to do to\Ndump an EDC 17," and Google had a lot of
Dialogue: 0,0:02:02.19,0:02:07.52,Default,,0000,0000,0000,,answers for this, but usually those were\Npeople that wanted to sell me some device.
Dialogue: 0,0:02:07.52,0:02:13.48,Default,,0000,0000,0000,,Those were chip tuners that built their\Nown devices where you can plug in the ECU
Dialogue: 0,0:02:13.48,0:02:18.77,Default,,0000,0000,0000,,and then it extracts the image, usually by\Nexploiting some bugs in the software. But
Dialogue: 0,0:02:18.77,0:02:22.67,Default,,0000,0000,0000,,I didn't really want to buy something and\Nit takes like a lot of time until I get in
Dialogue: 0,0:02:22.67,0:02:28.32,Default,,0000,0000,0000,,my hands. I wanted to start. So I was\Nlooking to do this on my own. What these
Dialogue: 0,0:02:28.32,0:02:35.18,Default,,0000,0000,0000,,sites usually tell you without paying is\Nhow you wire up your given ECU for their
Dialogue: 0,0:02:35.18,0:02:41.70,Default,,0000,0000,0000,,device, so they tell you where to connect\N12 volt, where to connect the CAN bus,
Dialogue: 0,0:02:41.70,0:02:46.91,Default,,0000,0000,0000,,which is the serial communication bus that\Nthe ECU uses to communicate with the rest
Dialogue: 0,0:02:46.91,0:02:53.69,Default,,0000,0000,0000,,of the car\Ndevices. Usually it's pretty easy, so...
Dialogue: 0,0:02:53.69,0:02:57.81,Default,,0000,0000,0000,,when analyzing ECU it makes a lot of sense\Nto reproduce the scenario on your desk and
Dialogue: 0,0:02:57.81,0:03:04.70,Default,,0000,0000,0000,,not in your car, so in order to make an\NECU boot all you need is ground, 12 volts,
Dialogue: 0,0:03:04.70,0:03:09.63,Default,,0000,0000,0000,,there's usually an ignition pin that you\Nalso have to supply 12 volt to it, and
Dialogue: 0,0:03:09.63,0:03:16.09,Default,,0000,0000,0000,,then it boots. So on my desk it looked\Nsomething like this, and then once we have
Dialogue: 0,0:03:16.09,0:03:23.19,Default,,0000,0000,0000,,the setup we can boot the ECU, we can use\NPython to talk to the ECU, which is great,
Dialogue: 0,0:03:23.19,0:03:27.91,Default,,0000,0000,0000,,and then we can use socket CAN, which is\Nthe Linux CAN support that's really great,
Dialogue: 0,0:03:27.91,0:03:32.45,Default,,0000,0000,0000,,and we can even use MicroPython if we\Nwant to have a smaller device that we can
Dialogue: 0,0:03:32.45,0:03:38.54,Default,,0000,0000,0000,,put in a car. So we can talk with the ECU.\NTalking with the ECU in modern cars,
Dialogue: 0,0:03:38.54,0:03:45.29,Default,,0000,0000,0000,,there's a protocol called UDS. Basically,\NI simplified this slightly, you can ask
Dialogue: 0,0:03:45.29,0:03:50.40,Default,,0000,0000,0000,,the ECU "Hey, I want to read memory by\Naddress," you give it an address and you
Dialogue: 0,0:03:50.40,0:03:54.63,Default,,0000,0000,0000,,ask it to read four bytes in this case of\Nthat address, and then it returns it to
Dialogue: 0,0:03:54.63,0:04:00.54,Default,,0000,0000,0000,,you. So I thought "Hey, maybe I can use\Nthis to dump the software." In my case the
Dialogue: 0,0:04:00.54,0:04:05.46,Default,,0000,0000,0000,,device responds with a Security Access\NDenied, so I looked into what I need to
Dialogue: 0,0:04:05.46,0:04:10.31,Default,,0000,0000,0000,,do. You actually have to do a Security\NAccess command. You send a command that's
Dialogue: 0,0:04:10.31,0:04:15.84,Default,,0000,0000,0000,,called Request Seed. You get back\Nbasically a 32 bit random number and then
Dialogue: 0,0:04:15.84,0:04:20.10,Default,,0000,0000,0000,,what you have to do is to, have to\Nprocess this seed through a super-secret
Dialogue: 0,0:04:20.10,0:04:25.45,Default,,0000,0000,0000,,function and then return it in a response\Ncall. The question is how do we know this
Dialogue: 0,0:04:25.45,0:04:29.86,Default,,0000,0000,0000,,super secret function. There are multiple\Nmethods. We can look at the ECU software
Dialogue: 0,0:04:29.86,0:04:34.09,Default,,0000,0000,0000,,itself, if the algorithms in there, to\Nverify it. We can reverse diagnostic
Dialogue: 0,0:04:34.09,0:04:39.57,Default,,0000,0000,0000,,software that uses this mechanism. So for\Nexample the Volkswagen software they use
Dialogue: 0,0:04:39.57,0:04:43.23,Default,,0000,0000,0000,,for car shops, or maybe someone else\Nalready reversed this and put it in their
Dialogue: 0,0:04:43.23,0:04:48.60,Default,,0000,0000,0000,,own tools which may be easier to get it\Nfrom in terms of third-party diagnostic
Dialogue: 0,0:04:48.60,0:04:55.21,Default,,0000,0000,0000,,software. And in the case of my Bosch ECU,\Nthe super secret function was this. I
Dialogue: 0,0:04:55.21,0:04:59.53,Default,,0000,0000,0000,,basically had to add this number to it.\NThe mechanism is called pin code.
Dialogue: 0,0:04:59.53,0:05:06.28,Default,,0000,0000,0000,,It's in... I mean it's not super\Nsecret. Anyway, once I know this...
Dialogue: 0,0:05:06.28,0:05:13.76,Default,,0000,0000,0000,,{\i1}applause{\i0}\NYeah, thank you. I mean, it... once you
Dialogue: 0,0:05:13.76,0:05:19.48,Default,,0000,0000,0000,,do this, you send back the result and hey,\Nthen you can read... you can send the read
Dialogue: 0,0:05:19.48,0:05:24.28,Default,,0000,0000,0000,,command again and, hey you're getting back\Ndata, so this is great, right? We can read
Dialogue: 0,0:05:24.28,0:05:29.25,Default,,0000,0000,0000,,memory at runtime of the ECU, and we can\Neven do this while the car is operating.
Dialogue: 0,0:05:29.25,0:05:34.14,Default,,0000,0000,0000,,However it turns out that for the Bosch\NECU you can only dump specific regions. You
Dialogue: 0,0:05:34.14,0:05:39.43,Default,,0000,0000,0000,,can dump most of memory, some memory areas\Nare excluded, but most of the interesting
Dialogue: 0,0:05:39.43,0:05:44.22,Default,,0000,0000,0000,,stuff you can read. But you can't read any\Ncode. You cannot read anything in flash.
Dialogue: 0,0:05:44.22,0:05:50.20,Default,,0000,0000,0000,,But we are hackers, of course, so we find\Na way. The CPU used in these ECUs is a
Dialogue: 0,0:05:50.20,0:05:57.44,Default,,0000,0000,0000,,Infineon TriCore CPU, and it's used, at\Nleast this particular one, was used in the
Dialogue: 0,0:05:57.44,0:06:03.87,Default,,0000,0000,0000,,ECU I cared about, and the security model\Nfor this chip is that you can always enter
Dialogue: 0,0:06:03.87,0:06:07.76,Default,,0000,0000,0000,,a specific bootloader mode and execute\Nyour own code, so you can strap a few
Dialogue: 0,0:06:07.76,0:06:11.39,Default,,0000,0000,0000,,lines they... the chip tuners tell you\Nthat, right, they tell you what's high and
Dialogue: 0,0:06:11.39,0:06:16.87,Default,,0000,0000,0000,,low, which pins you have to connect your\Nground and 3.3 volt, and then it enters
Dialogue: 0,0:06:16.87,0:06:21.20,Default,,0000,0000,0000,,this bootloader mode, you can upload some\Npiece of code. However, you can't read the
Dialogue: 0,0:06:21.20,0:06:25.69,Default,,0000,0000,0000,,flash, because the flash is locked. When\Nyou start in bootloader mode, the flash is
Dialogue: 0,0:06:25.69,0:06:32.61,Default,,0000,0000,0000,,not readable until you write a specific\Npassword to a register. That was not so
Dialogue: 0,0:06:32.61,0:06:37.46,Default,,0000,0000,0000,,great, so I looked into what else I could\Ndo. The datasheet is very specific on how
Dialogue: 0,0:06:37.46,0:06:43.21,Default,,0000,0000,0000,,to operate this chip. For example there's\Nthis one flash supply pin. So, even though
Dialogue: 0,0:06:43.21,0:06:47.26,Default,,0000,0000,0000,,the flash is in the same package as the\Nrest of the CPU, it has a dedicated supply
Dialogue: 0,0:06:47.26,0:06:52.72,Default,,0000,0000,0000,,pin and it tells you which parameters not\Nto exceed to ensure correct operation, but
Dialogue: 0,0:06:52.72,0:06:57.25,Default,,0000,0000,0000,,I really don't want the correct operation\Nwhich is in this case preventing me from
Dialogue: 0,0:06:57.25,0:07:02.53,Default,,0000,0000,0000,,dumping the flash. So, what can we do? We\Ncan violate the requirements. The
Dialogue: 0,0:07:02.53,0:07:06.43,Default,,0000,0000,0000,,requirements for 3.3 volts. Let's see what\Nhappens outside of that range. And turns
Dialogue: 0,0:07:06.43,0:07:11.70,Default,,0000,0000,0000,,out, down to a certain voltage level,\Nroughly 1.6 volt, everything just works as
Dialogue: 0,0:07:11.70,0:07:17.51,Default,,0000,0000,0000,,normal. That doesn't help us.\NAnd below that voltage the device hangs in
Dialogue: 0,0:07:17.51,0:07:21.40,Default,,0000,0000,0000,,the bootloader, so that doesn't help us\Neither. The interesting parts happened
Dialogue: 0,0:07:21.40,0:07:26.15,Default,,0000,0000,0000,,when you are at the very specific voltage\Nlevel, and this is a little bit
Dialogue: 0,0:07:26.15,0:07:31.48,Default,,0000,0000,0000,,unscientific, because it's really just the\Nvoltage level I tried, and then most of
Dialogue: 0,0:07:31.48,0:07:35.34,Default,,0000,0000,0000,,the time the device comes up and flash is\Nprotected, and then the remaining times
Dialogue: 0,0:07:35.34,0:07:39.43,Default,,0000,0000,0000,,the device comes up and hangs in the\Nbootloader. But one in 10 times something
Dialogue: 0,0:07:39.43,0:07:45.49,Default,,0000,0000,0000,,interesting happened. The device came up\Nand the flash was not protected, so I
Dialogue: 0,0:07:45.49,0:07:54.20,Default,,0000,0000,0000,,could dump it out.\N{\i1}applause{\i0}
Dialogue: 0,0:07:54.20,0:07:58.31,Default,,0000,0000,0000,,So having the image now in my hands, I\Ncould start in actually reversing the
Dialogue: 0,0:07:58.31,0:08:03.04,Default,,0000,0000,0000,,defeat device and what I found was - I\Ndon't want to duplicate a lot of what I
Dialogue: 0,0:08:03.04,0:08:07.31,Default,,0000,0000,0000,,talked about in the last talk - I found a\Nfunction called "acoustic function," or
Dialogue: 0,0:08:07.31,0:08:12.52,Default,,0000,0000,0000,,"Akustikfunktion" in German. It's a\Nfunction that senses vehicle speed, the
Dialogue: 0,0:08:12.52,0:08:17.14,Default,,0000,0000,0000,,duration of the engine operation, and some\Nother things, and then controls emission
Dialogue: 0,0:08:17.14,0:08:21.06,Default,,0000,0000,0000,,related functionality, or in short you can\Nsay that this is the test cycle detection
Dialogue: 0,0:08:21.06,0:08:26.31,Default,,0000,0000,0000,,that enables the defeat device. And I\Nverified it to exist on my Sharan device
Dialogue: 0,0:08:26.31,0:08:31.87,Default,,0000,0000,0000,,by driving through the test cycle and\Nlogging data. And during the last year I
Dialogue: 0,0:08:31.87,0:08:36.89,Default,,0000,0000,0000,,verified that it's actually the same\Ndefeat device, more or less, that exists
Dialogue: 0,0:08:36.89,0:08:41.14,Default,,0000,0000,0000,,on a lot of other Volkswagen cars. All\Nthese Volkswagen defeat devices that we
Dialogue: 0,0:08:41.14,0:08:46.42,Default,,0000,0000,0000,,talked about for the Euro 5 cars, they use\Nmore or less the same acoustic function.
Dialogue: 0,0:08:46.42,0:08:51.12,Default,,0000,0000,0000,,Basically, to remind you, there are a few\Ncurves stored in the software that look
Dialogue: 0,0:08:51.12,0:08:59.76,Default,,0000,0000,0000,,like this. This is the NEDC. This is the\Ntest cycle you have to drive a car
Dialogue: 0,0:08:59.76,0:09:05.36,Default,,0000,0000,0000,,through. They exactly define how fast you\Nhave to drive for a given time in seconds,
Dialogue: 0,0:09:05.36,0:09:10.26,Default,,0000,0000,0000,,so it's speed over time. If we draw this\Nas distance over time it looks like this.
Dialogue: 0,0:09:10.26,0:09:16.56,Default,,0000,0000,0000,,So this is the distance you got. You're\Nnot really moving the car, because you're
Dialogue: 0,0:09:16.56,0:09:22.49,Default,,0000,0000,0000,,doing this in a lab on a dynamometer, but\Nwhat the car thinks it has moved to, and
Dialogue: 0,0:09:22.49,0:09:25.74,Default,,0000,0000,0000,,if we overlay this with the curves we\Nfound in a software there's a perfect
Dialogue: 0,0:09:25.74,0:09:31.29,Default,,0000,0000,0000,,match. So this is the way how they\Ndescribe the test cycle. So this was for
Dialogue: 0,0:09:31.29,0:09:36.79,Default,,0000,0000,0000,,my Sharan. So I looked into, what do the\Nother cars do, especially what do the
Dialogue: 0,0:09:36.79,0:09:41.94,Default,,0000,0000,0000,,cars in North America do, because they're\Nnot using the NEDC. And I found something
Dialogue: 0,0:09:41.94,0:09:48.48,Default,,0000,0000,0000,,interesting, or some someone sent an\Ninteresting document to me, that was this.
Dialogue: 0,0:09:48.48,0:09:54.19,Default,,0000,0000,0000,,It was an emission service action. It\Nbasically describes how there was a recall
Dialogue: 0,0:09:54.19,0:09:57.75,Default,,0000,0000,0000,,for some vehicles, that required a\Nsoftware update in the shop.
Dialogue: 0,0:09:57.75,0:10:03.04,Default,,0000,0000,0000,,So this is basically the document that\Ninforms the car shop what they have to do,
Dialogue: 0,0:10:03.04,0:10:08.94,Default,,0000,0000,0000,,and it had something very interesting in\Nit. By the way, this was in December 2014,
Dialogue: 0,0:10:08.94,0:10:13.45,Default,,0000,0000,0000,,so this was way before the whole\NDieselgate was public, but this was
Dialogue: 0,0:10:13.45,0:10:17.38,Default,,0000,0000,0000,,already while the EPA was already talking\Nwith Volkswagen, already demanding
Dialogue: 0,0:10:17.38,0:10:22.37,Default,,0000,0000,0000,,explanations. All that investigation was\Nalready proceeding. Volkswagen knew about
Dialogue: 0,0:10:22.37,0:10:26.95,Default,,0000,0000,0000,,this, that people figured out about the\Ndefeat device, and it had something very
Dialogue: 0,0:10:26.95,0:10:30.99,Default,,0000,0000,0000,,interesting in it, that said "in addition,\Nthe vehicle's engine management software
Dialogue: 0,0:10:30.99,0:10:34.83,Default,,0000,0000,0000,,had been improved to ensure the vehicle's\Ntailpipe emissions are optimized and
Dialogue: 0,0:10:34.83,0:10:40.89,Default,,0000,0000,0000,,operating efficiently." That sounds really\Nfishy to me, so I was curious, what
Dialogue: 0,0:10:40.89,0:10:46.13,Default,,0000,0000,0000,,exactly did they change in the software\Nupdate? And luckily they tell you the old
Dialogue: 0,0:10:46.13,0:10:53.12,Default,,0000,0000,0000,,and the new software versions, and you can\Nthen go and look them up on a firmware
Dialogue: 0,0:10:53.12,0:10:58.21,Default,,0000,0000,0000,,DVD, that you can download on the\NVolkswagen website, and it turned out that
Dialogue: 0,0:10:58.21,0:11:03.21,Default,,0000,0000,0000,,it's an ECU software similar to the the\NBosch ECU software I looked at before. So
Dialogue: 0,0:11:03.21,0:11:07.62,Default,,0000,0000,0000,,there's an acoustic function again there,\Nand the curve stored there, they match the
Dialogue: 0,0:11:07.62,0:11:14.82,Default,,0000,0000,0000,,US test cycles. This is one of them. There\Nare many more test cycles in the US, so
Dialogue: 0,0:11:14.82,0:11:18.41,Default,,0000,0000,0000,,there's another curve that matches this,\Nand this is the curve stored in the
Dialogue: 0,0:11:18.41,0:11:27.26,Default,,0000,0000,0000,,software and this is the corresponding\Ntest cycle. And there are a lot of them.
Dialogue: 0,0:11:27.26,0:11:32.82,Default,,0000,0000,0000,,But I noticed something really\Ninteresting, and some of the curves...
Dialogue: 0,0:11:32.82,0:11:41.58,Default,,0000,0000,0000,,they were much wider open than the other\Nones. So for example this one... there's
Dialogue: 0,0:11:41.58,0:11:46.24,Default,,0000,0000,0000,,really a nonzero probability that if you\Njust have your morning commute, through, I
Dialogue: 0,0:11:46.24,0:11:50.20,Default,,0000,0000,0000,,don't know, some streets or something,\Nthat you accidentally match this driving
Dialogue: 0,0:11:50.20,0:11:55.49,Default,,0000,0000,0000,,cycle every time you start driving in the\Nmorning, so the car would, every time you
Dialogue: 0,0:11:55.49,0:11:59.75,Default,,0000,0000,0000,,drive this, think it is in test cycle\Nmode, and would operate with the
Dialogue: 0,0:11:59.75,0:12:06.40,Default,,0000,0000,0000,,optimized... in the optimized emission\Nmode and apparently this caused problems
Dialogue: 0,0:12:06.40,0:12:12.48,Default,,0000,0000,0000,,and what I saw, what Volkswagen added in\Nthe software that was part of this recall,
Dialogue: 0,0:12:12.48,0:12:16.31,Default,,0000,0000,0000,,was this function. So, this is from it\Nfrom a disassembly. In pseudocode, this is
Dialogue: 0,0:12:16.31,0:12:22.09,Default,,0000,0000,0000,,this. So they started looking at the\Nsteering wheel angle, and if they figured
Dialogue: 0,0:12:22.09,0:12:28.04,Default,,0000,0000,0000,,out that you move the steering wheel\Nangle, then they ignored the curves, the
Dialogue: 0,0:12:28.04,0:12:31.90,Default,,0000,0000,0000,,more open curves. So the idea is "Yeah, if\Nyou move the steering wheel, you're
Dialogue: 0,0:12:31.90,0:12:38.93,Default,,0000,0000,0000,,definitely not in a test cycle, so at that\Npoint we do not try to operate in this
Dialogue: 0,0:12:38.93,0:12:43.45,Default,,0000,0000,0000,,emission optimized mode. And it's a\Nlittle bit of speculation, but it matches
Dialogue: 0,0:12:43.45,0:12:47.65,Default,,0000,0000,0000,,up pretty well with with all the facts\Nthat I read, is that because those cars
Dialogue: 0,0:12:47.65,0:12:52.86,Default,,0000,0000,0000,,operated in the test cycle mode too often,\Nthat eventually caused the the particulate
Dialogue: 0,0:12:52.86,0:12:59.50,Default,,0000,0000,0000,,filters to clog, and their solution for\NVolkswagen, and again, this was while they
Dialogue: 0,0:12:59.50,0:13:04.71,Default,,0000,0000,0000,,were already investigated by the EPA, was\Nto add the steering wheel angle detection.
Dialogue: 0,0:13:04.71,0:13:08.53,Default,,0000,0000,0000,,For more details, I worked with this with\Nthe NDR, and they produced a feature on
Dialogue: 0,0:13:08.53,0:13:13.75,Default,,0000,0000,0000,,that, so there are some more details.\NSo this is Volkswagen, but there are more
Dialogue: 0,0:13:13.75,0:13:20.78,Default,,0000,0000,0000,,cars, and if we look at this... this is a\Nmeta-study based on something that the the
Dialogue: 0,0:13:20.78,0:13:25.81,Default,,0000,0000,0000,,Ministry of Transport... they tested a lot\Nof diesel cars and what they found was
Dialogue: 0,0:13:25.81,0:13:31.90,Default,,0000,0000,0000,,this. This is actually a representation by\Nthe ICCT. So the orange line is the
Dialogue: 0,0:13:31.90,0:13:38.77,Default,,0000,0000,0000,,emission limit, and the bars have an upper\Nand lower end, and the lower end is how
Dialogue: 0,0:13:38.77,0:13:44.42,Default,,0000,0000,0000,,much emissions the cars have. This is just\Nfor nitrogen oxides, for NOx emissions,
Dialogue: 0,0:13:44.42,0:13:48.64,Default,,0000,0000,0000,,what they had in the lab, when you're\Ndriving the test cycle. So and you can see
Dialogue: 0,0:13:48.64,0:13:53.10,Default,,0000,0000,0000,,all of these cars managed to stay under\Nthe orange line, so they get their
Dialogue: 0,0:13:53.10,0:13:57.58,Default,,0000,0000,0000,,certification, but when driving them on a\Nreal street, they produce the emissions
Dialogue: 0,0:13:57.58,0:14:01.71,Default,,0000,0000,0000,,corresponding to the upper end of that\Nbar, which is for some cars significantly
Dialogue: 0,0:14:01.71,0:14:09.07,Default,,0000,0000,0000,,higher. It's off by a factor of 10 and\Nmore. When you're driving the car on a
Dialogue: 0,0:14:09.07,0:14:13.47,Default,,0000,0000,0000,,street. And this is interesting, because\Nthe cars, they can meet the emission
Dialogue: 0,0:14:13.47,0:14:16.58,Default,,0000,0000,0000,,goals. The question is why don't they\Nalways meet the emission goals?
Dialogue: 0,0:14:16.58,0:14:23.36,Default,,0000,0000,0000,,Why do they operate so differently in the\Ntest cycle than on the street? And I try
Dialogue: 0,0:14:23.36,0:14:29.30,Default,,0000,0000,0000,,to give you a partial answer. And let's\Nlook at how a car can optimize emissions.
Dialogue: 0,0:14:29.30,0:14:33.25,Default,,0000,0000,0000,,The first thing they do... so this is a\Nvery simplified diesel engine. So fresh
Dialogue: 0,0:14:33.25,0:14:38.85,Default,,0000,0000,0000,,air goes in, fuel goes out, and there's an\Nexhaust pipe, right? And a lot of nitrogen
Dialogue: 0,0:14:38.85,0:14:44.75,Default,,0000,0000,0000,,oxide, a lot of NOx, goes out as well, and\Nwe don't want that. So we added an EGR
Dialogue: 0,0:14:44.75,0:14:49.44,Default,,0000,0000,0000,,valve, which is basically a valve that\Ncauses a part... a fraction of the
Dialogue: 0,0:14:49.44,0:14:54.23,Default,,0000,0000,0000,,outgoing air to recirculate again through\Nthe engine and burn again. And what this
Dialogue: 0,0:14:54.23,0:14:59.10,Default,,0000,0000,0000,,causes is that the flame temperature goes\Ndown, and if we look at the relationship,
Dialogue: 0,0:14:59.10,0:15:04.72,Default,,0000,0000,0000,,it's very simplified here, but with a\Nlower flame temperature you get fewer NOx
Dialogue: 0,0:15:04.72,0:15:11.23,Default,,0000,0000,0000,,concentrations, so you improve emissions\Nby lowering the flame temperature, however
Dialogue: 0,0:15:11.23,0:15:18.01,Default,,0000,0000,0000,,at the same time you're increasing the\Nsoot level, or the particulate matter, and
Dialogue: 0,0:15:18.01,0:15:22.84,Default,,0000,0000,0000,,there is this trade-off - if you do too\Nmuch of EGR, too much of the exhaust gas
Dialogue: 0,0:15:22.84,0:15:27.90,Default,,0000,0000,0000,,recirculation, you're getting too much\Nsoot, and the other hand if you do it too
Dialogue: 0,0:15:27.90,0:15:32.40,Default,,0000,0000,0000,,few, you get too much NOx, so you can\Nargue that the green area isn't really
Dialogue: 0,0:15:32.40,0:15:37.33,Default,,0000,0000,0000,,great, because there's no point where both\Nof them are great. And here we see the
Dialogue: 0,0:15:37.33,0:15:45.93,Default,,0000,0000,0000,,result of a clogged EGR valve. If there's\Ntoo much soot it will clog. EGR, as the
Dialogue: 0,0:15:45.93,0:15:54.02,Default,,0000,0000,0000,,conclusion, is the least cost solution. It\Ndoesn't really work at higher loads. It
Dialogue: 0,0:15:54.02,0:15:57.85,Default,,0000,0000,0000,,works at low loads, and it does not\Nrequire exhaust... high exhaust
Dialogue: 0,0:15:57.85,0:16:03.48,Default,,0000,0000,0000,,temperatures, which is great, but\Nexcessive use of that clogs particulate
Dialogue: 0,0:16:03.48,0:16:07.22,Default,,0000,0000,0000,,filters, affects the combustion, the\Ndrivability goes down, and there are
Dialogue: 0,0:16:07.22,0:16:11.33,Default,,0000,0000,0000,,trade-offs with this. It's also not very\Nuseful for higher engine loads, for
Dialogue: 0,0:16:11.33,0:16:16.56,Default,,0000,0000,0000,,example when you're accelerating you have\Nto disable EGR at high speeds. So a better
Dialogue: 0,0:16:16.56,0:16:22.17,Default,,0000,0000,0000,,method, that was added on top of this, is\Ncalled "selective catalytic reduction". I
Dialogue: 0,0:16:22.17,0:16:27.45,Default,,0000,0000,0000,,am... so, basically the idea is you have\Nan SCR catalyst in your exhaust pipe...
Dialogue: 0,0:16:27.45,0:16:33.99,Default,,0000,0000,0000,,there are more catalysts there, but let's\Ntalk about NOx, and in there, this
Dialogue: 0,0:16:33.99,0:16:39.64,Default,,0000,0000,0000,,happens. We can simplify this, somehow,\Nand say if you put ammonia into this
Dialogue: 0,0:16:39.64,0:16:43.76,Default,,0000,0000,0000,,catalyst, the NOx is converted to nitrogen\Nand water.
Dialogue: 0,0:16:43.76,0:16:48.48,Default,,0000,0000,0000,,And Nitrogen and water is great, it's\Nharmless. It's already part of the air.
Dialogue: 0,0:16:48.48,0:16:53.11,Default,,0000,0000,0000,,The only issue is ammonia is this and this\Nis not something you want the driver to
Dialogue: 0,0:16:53.11,0:16:58.55,Default,,0000,0000,0000,,refill in your car. So instead this\Nsolution is we can create ammonia in the
Dialogue: 0,0:16:58.55,0:17:03.45,Default,,0000,0000,0000,,car from using from something that's less\Ndangerous, and we have the reaction there.
Dialogue: 0,0:17:03.45,0:17:09.50,Default,,0000,0000,0000,,We can simplify this again and say we take\Nurea - Harnstoff auf Deutsch - and heat,
Dialogue: 0,0:17:09.50,0:17:15.87,Default,,0000,0000,0000,,and we create ammonia. Urea or urea\Nsolution is this. It's called AdBlue or
Dialogue: 0,0:17:15.87,0:17:21.21,Default,,0000,0000,0000,,DEF - diesel exhaust fluid - it's not\Ndangerous. You can buy it, you can
Dialogue: 0,0:17:21.21,0:17:26.44,Default,,0000,0000,0000,,transport it... it's relatively cheap. The\Nidea is, we have this reaction, it
Dialogue: 0,0:17:26.44,0:17:32.52,Default,,0000,0000,0000,,requires ammonia in the catalyst, and we\Nput AdBlue into it, or urea, and using the
Dialogue: 0,0:17:32.52,0:17:36.35,Default,,0000,0000,0000,,heat that we have from the exhaust pipe,\Nwe create the ammonia that we need to
Dialogue: 0,0:17:36.35,0:17:44.42,Default,,0000,0000,0000,,reduce the nitrogen oxides back to\Nnitrogen and water. There's a great
Dialogue: 0,0:17:44.42,0:17:48.39,Default,,0000,0000,0000,,property of this, that some of the ammonia\Nthat's produced in the catalyst stays
Dialogue: 0,0:17:48.39,0:17:53.47,Default,,0000,0000,0000,,there until it's used up, so\Nthere's some storage there. So the the
Dialogue: 0,0:17:53.47,0:17:56.99,Default,,0000,0000,0000,,requirement for creating ammonia is heat,\Nand if you don't have heat, but for
Dialogue: 0,0:17:56.99,0:18:00.94,Default,,0000,0000,0000,,example because you just started up your\Nengine... if there is still ammonia from
Dialogue: 0,0:18:00.94,0:18:05.76,Default,,0000,0000,0000,,the last usage in your catalyst you can\Nstill use that, and use that up, and by
Dialogue: 0,0:18:05.76,0:18:09.86,Default,,0000,0000,0000,,the time you have used it up, maybe the\Nheat is enough to supply more AdBlue and
Dialogue: 0,0:18:09.86,0:18:17.77,Default,,0000,0000,0000,,then fill up that storage. The downside is\Nyou need a pump to dose the AdBlue, and
Dialogue: 0,0:18:17.77,0:18:21.60,Default,,0000,0000,0000,,you need lots of software to control this\Nprocess. And you need a heater because the
Dialogue: 0,0:18:21.60,0:18:26.02,Default,,0000,0000,0000,,AdBlue freezes at some point, and it's an\Nexpensive solution, it adds roughly $500
Dialogue: 0,0:18:26.02,0:18:32.08,Default,,0000,0000,0000,,to a car, which can be significant amount\Nof money for a small car, and it requires
Dialogue: 0,0:18:32.08,0:18:37.70,Default,,0000,0000,0000,,a large AdBlue tank for long service\Nintervals, so you don't have to refill it
Dialogue: 0,0:18:37.70,0:18:42.41,Default,,0000,0000,0000,,every few thousand kilometers or\Nsomething. The great thing about SCR is
Dialogue: 0,0:18:42.41,0:18:48.00,Default,,0000,0000,0000,,that it's efficient at higher loads.\NThere's a third method called LNT, Lean
Dialogue: 0,0:18:48.00,0:18:52.13,Default,,0000,0000,0000,,NOx Trap, it's cheaper than SCR for\Nsmaller engine, it doesn't require
Dialogue: 0,0:18:52.13,0:18:54.32,Default,,0000,0000,0000,,anything,\Nhowever the bad thing is it requires
Dialogue: 0,0:18:54.32,0:18:59.32,Default,,0000,0000,0000,,frequent re-generation, which decreases\Nfuel efficiency, so it's kind of a stop-
Dialogue: 0,0:18:59.32,0:19:03.30,Default,,0000,0000,0000,,gap solution. And it's not efficient for\Ncontinuous high engine load, for example
Dialogue: 0,0:19:03.30,0:19:06.95,Default,,0000,0000,0000,,if you're driving on the German Autobahn\Nat full speed, then LNT is not going to
Dialogue: 0,0:19:06.95,0:19:13.11,Default,,0000,0000,0000,,help you much. For the sake of this talk,\Nlet's keep in mind that EGR is exhaust gas
Dialogue: 0,0:19:13.11,0:19:16.50,Default,,0000,0000,0000,,recirculation, that's the thing that\Noperates within the engine and then we
Dialogue: 0,0:19:16.50,0:19:20.97,Default,,0000,0000,0000,,have the SCR, the selective catalytic\Nreduction, that uses AdBlue and is after
Dialogue: 0,0:19:20.97,0:19:27.47,Default,,0000,0000,0000,,the engine. We also saw that all these\Ntechnologies have significant trade-offs
Dialogue: 0,0:19:27.47,0:19:32.17,Default,,0000,0000,0000,,for NOx compliance, so we can kind of see\Nthe motivation for a defeat device here,
Dialogue: 0,0:19:32.17,0:19:36.56,Default,,0000,0000,0000,,because it would be the solution to all of\Nthese trade-offs. You get no downsides
Dialogue: 0,0:19:36.56,0:19:42.70,Default,,0000,0000,0000,,during regular driving, because nobody can\Nmeasure your emissions and while
Dialogue: 0,0:19:42.70,0:19:46.96,Default,,0000,0000,0000,,maintaining conformance because during a\Ntest cycle you have perfect emissions.
Dialogue: 0,0:19:46.96,0:19:53.88,Default,,0000,0000,0000,,That kind of explains why there are defeat\Ndevices. OK, let's get back to the bigger
Dialogue: 0,0:19:53.88,0:20:01.92,Default,,0000,0000,0000,,picture and see what other cars do. So\Nthis is an Opel car, it's a Zafira car,
Dialogue: 0,0:20:01.92,0:20:07.40,Default,,0000,0000,0000,,it's a Euro 6 car, it's a pretty modern\Ncar, it has an SCR catalyst. In theory it
Dialogue: 0,0:20:07.40,0:20:13.77,Default,,0000,0000,0000,,should have really great, low emissions,\Nespecially at higher speeds because that's
Dialogue: 0,0:20:13.77,0:20:18.45,Default,,0000,0000,0000,,where SCR is good at. But quite\Nsurprisingly it doesn't. If we look again
Dialogue: 0,0:20:18.45,0:20:24.50,Default,,0000,0000,0000,,at this report, we can see that this\NZafira exceeds the limit by up to 12x
Dialogue: 0,0:20:24.50,0:20:28.86,Default,,0000,0000,0000,,compared to the Euro 6 limit. This is\Nespecially interesting because there's
Dialogue: 0,0:20:28.86,0:20:34.62,Default,,0000,0000,0000,,this Opel advertisement where they\Nadvertise their diesel technology applying
Dialogue: 0,0:20:34.62,0:20:39.71,Default,,0000,0000,0000,,to the Insignia and the Zafira and they\Nsay a lot of diesel fun without regrets,
Dialogue: 0,0:20:39.71,0:20:44.90,Default,,0000,0000,0000,,the new diesel generation of Opel achieves\Nbest emission values and gasoline levels.
Dialogue: 0,0:20:44.90,0:20:48.95,Default,,0000,0000,0000,,Yeah, after they got sued for this they\Nhad to change it slightly and they had to
Dialogue: 0,0:20:48.95,0:20:53.50,Default,,0000,0000,0000,,add this to the sentence.\N{\i1}scattered laughter{\i0}
Dialogue: 0,0:20:55.68,0:20:59.07,Default,,0000,0000,0000,,So, during this testing, they had\Nthis 12x emission
Dialogue: 0,0:20:59.07,0:21:03.39,Default,,0000,0000,0000,,limits. For example, one particular test\Nwas to drive the test cycle in the same
Dialogue: 0,0:21:03.39,0:21:05.87,Default,,0000,0000,0000,,way, but at a different temperature,\Nat 10°C,
Dialogue: 0,0:21:05.87,0:21:10.20,Default,,0000,0000,0000,,and the car exceeded the\Nvalues by a factor of 6 even though the
Dialogue: 0,0:21:10.20,0:21:15.33,Default,,0000,0000,0000,,car would be operated in the very same\Nway. It was just that the ambient air
Dialogue: 0,0:21:15.33,0:21:21.84,Default,,0000,0000,0000,,temperature was 10°C instead\Nof 25. So they asked Opel why this was the
Dialogue: 0,0:21:21.84,0:21:26.66,Default,,0000,0000,0000,,case during their investigation, and Opel\Nresponded, saying that the EGR and the SCR
Dialogue: 0,0:21:26.66,0:21:32.65,Default,,0000,0000,0000,,injection, they work to the full extent in\Nthe temperature range of 20 to 30°C.
Dialogue: 0,0:21:32.65,0:21:42.19,Default,,0000,0000,0000,,It's what they call "normal use".\NSo our question was, is it really just the
Dialogue: 0,0:21:42.19,0:21:49.55,Default,,0000,0000,0000,,temperature window? So we got a car and\Ninvestigated. The ECU in that car is a
Dialogue: 0,0:21:49.55,0:21:56.35,Default,,0000,0000,0000,,General Motors ECU. It's developed in-\Nhouse, Opel is a GM daughter. It uses an
Dialogue: 0,0:21:56.35,0:22:06.35,Default,,0000,0000,0000,,automotive PowerPC, yay PowerPC! It uses\Nsomewhat obscure variable length
Dialogue: 0,0:22:06.35,0:22:12.63,Default,,0000,0000,0000,,instruction extension to PowerPC. So how\Ndo we start? Again, we need a firmware
Dialogue: 0,0:22:12.63,0:22:19.11,Default,,0000,0000,0000,,image. So let's ask the Internet, "How do\NI dump this ECU?" Luckily, someone in some
Dialogue: 0,0:22:19.11,0:22:23.71,Default,,0000,0000,0000,,chip tuning forum already uploaded their\Nstock ECU, which means they're what they
Dialogue: 0,0:22:23.71,0:22:30.02,Default,,0000,0000,0000,,dumped from their ECU using some chip\Ntuning tool. It's not the same ECU, but
Dialogue: 0,0:22:30.02,0:22:34.02,Default,,0000,0000,0000,,it's very similar and I hope they shared\Nsome code so I can analyze the software,
Dialogue: 0,0:22:34.02,0:22:40.80,Default,,0000,0000,0000,,maybe find a way to dump it. So the dump\Nwas made with this tool and the tool did
Dialogue: 0,0:22:40.80,0:22:45.79,Default,,0000,0000,0000,,not let me export the binary. And the tool\Nis free, however to use any of the
Dialogue: 0,0:22:45.79,0:22:50.72,Default,,0000,0000,0000,,features in that software, you have to buy\Ntheir expensive hardware, that then
Dialogue: 0,0:22:50.72,0:22:55.59,Default,,0000,0000,0000,,connects to the car, which I didn't want.\NThis is how their software looks like. I
Dialogue: 0,0:22:55.59,0:22:59.43,Default,,0000,0000,0000,,loaded the image I found on the internet,\Nand I couldn't save it or anything without
Dialogue: 0,0:22:59.43,0:23:05.42,Default,,0000,0000,0000,,having the device attached. However, I can\Njust use a memory debugger and just dump
Dialogue: 0,0:23:05.42,0:23:10.25,Default,,0000,0000,0000,,it from the address space, and that gave\Nme a first firmware image to start with. I
Dialogue: 0,0:23:10.25,0:23:14.22,Default,,0000,0000,0000,,threw it in a disassembler and I found the\NUDS function and, yeah, it implements read
Dialogue: 0,0:23:14.22,0:23:19.37,Default,,0000,0000,0000,,memory by address, so that's good. Most of\Nthe RAM was readable without a security
Dialogue: 0,0:23:19.37,0:23:24.57,Default,,0000,0000,0000,,challenge. That is good, so I didn't even\Nneed a security challenge to read RAM.
Dialogue: 0,0:23:24.57,0:23:30.49,Default,,0000,0000,0000,,However, the flash, it is readable, but\Nonly with the security challenge. So let's
Dialogue: 0,0:23:30.49,0:23:36.67,Default,,0000,0000,0000,,take a look at the security challenge.\NMaybe it's as simple as the Bosch one. So
Dialogue: 0,0:23:36.67,0:23:40.88,Default,,0000,0000,0000,,their way of doing this is, they store\N16-bit input and output value in the
Dialogue: 0,0:23:40.88,0:23:45.34,Default,,0000,0000,0000,,firmware, and it's different for every\Ndevice, and they don't store the algorithm
Dialogue: 0,0:23:45.34,0:23:50.62,Default,,0000,0000,0000,,to compute the output from the input,\Ninstead they just store the pair, and,
Dialogue: 0,0:23:50.62,0:23:55.79,Default,,0000,0000,0000,,well, it's just 16 bit, right, so let's\Nbrute force it. The issue is, you can only
Dialogue: 0,0:23:55.79,0:24:03.14,Default,,0000,0000,0000,,try every 15 seconds, so it's kind of\Nlame. The question is, how do the GM
Dialogue: 0,0:24:03.14,0:24:08.07,Default,,0000,0000,0000,,tools, the original factory tools, get\Naccess to that? Luckily, chip tuners had
Dialogue: 0,0:24:08.07,0:24:12.85,Default,,0000,0000,0000,,reversed that and then obfuscated it into\Ntheir own tools. But that can be de-
Dialogue: 0,0:24:12.85,0:24:18.58,Default,,0000,0000,0000,,obfuscated and eventually it's just a\Nlittle bit amount of bit shifting and so
Dialogue: 0,0:24:18.58,0:24:26.34,Default,,0000,0000,0000,,that was easy to fix. And also the the GM\Nrepair manuals tell you how to wire up the
Dialogue: 0,0:24:26.34,0:24:30.62,Default,,0000,0000,0000,,ECU. They tell you where to put 12 volts,\Nthe CAN bus again, and ground, and the
Dialogue: 0,0:24:30.62,0:24:35.57,Default,,0000,0000,0000,,ignition pin, and with all of that in\Nplace, I can do the security challenge. I
Dialogue: 0,0:24:35.57,0:24:41.87,Default,,0000,0000,0000,,can now read all of flash memory and read\Nthe four megabytes of PowerPC code, which
Dialogue: 0,0:24:41.87,0:24:46.60,Default,,0000,0000,0000,,mostly consists of mathematical functions.\NThere are no strings or anything, it's
Dialogue: 0,0:24:46.60,0:24:52.04,Default,,0000,0000,0000,,really hard to find what a function does,\Nwhat... There are thousands of variables.
Dialogue: 0,0:24:52.04,0:24:55.74,Default,,0000,0000,0000,,It's really hard to find what they mean,\Nright, so I need to know some entry
Dialogue: 0,0:24:55.74,0:25:01.37,Default,,0000,0000,0000,,points, some known data values, and then I\Ncould refer to... one thing I could find
Dialogue: 0,0:25:01.37,0:25:06.02,Default,,0000,0000,0000,,are real-world constants, for example\Nthere's the density of diesel fuel stored,
Dialogue: 0,0:25:06.02,0:25:10.55,Default,,0000,0000,0000,,which allows me to understand that this is\Nsomething related to fuel, an amount of
Dialogue: 0,0:25:10.55,0:25:17.05,Default,,0000,0000,0000,,fuel. Or more useful are the OBD2 calls.\NSo there are some standardized things you
Dialogue: 0,0:25:17.05,0:25:22.42,Default,,0000,0000,0000,,can ask an ECU, that's engine rpm, vehicle\Nspeed, and things like that, and I would
Dialogue: 0,0:25:22.42,0:25:27.96,Default,,0000,0000,0000,,find that table in the firmware and then I\Nhad a first start of things like RPM,
Dialogue: 0,0:25:27.96,0:25:33.22,Default,,0000,0000,0000,,speed, and so on. That was a good start.\NIt's not much more than what you can see
Dialogue: 0,0:25:33.22,0:25:37.35,Default,,0000,0000,0000,,here. So there's a lot of stuff not\Nincluded in these.
Dialogue: 0,0:25:37.35,0:25:39.82,Default,,0000,0000,0000,,The next thing I did was, I drove the car
Dialogue: 0,0:25:39.82,0:25:44.14,Default,,0000,0000,0000,,for a few weeks and I let a device\Nattached that would constantly log all
Dialogue: 0,0:25:44.14,0:25:50.01,Default,,0000,0000,0000,,memory using the rebuy address thing, and\Nevery few minutes I would get one memory
Dialogue: 0,0:25:50.01,0:25:55.18,Default,,0000,0000,0000,,dump, basically. It's a few hundred\Nkilobytes of RAM, and then I put this into
Dialogue: 0,0:25:55.18,0:26:01.39,Default,,0000,0000,0000,,my disassembly, and that allowed me to\Nunderstand more of what individual
Dialogue: 0,0:26:01.39,0:26:07.08,Default,,0000,0000,0000,,variables do there. And I found some\Ninteresting things. So the first thing,
Dialogue: 0,0:26:07.08,0:26:10.80,Default,,0000,0000,0000,,one of the first things I found, was\Nbasically something that resembles this.
Dialogue: 0,0:26:10.80,0:26:16.31,Default,,0000,0000,0000,,So there was something that look at the\Nambient temperature, and this basically
Dialogue: 0,0:26:16.31,0:26:23.39,Default,,0000,0000,0000,,checks for range, right, and it did...\Nthis was for controlling the SCR systems,
Dialogue: 0,0:26:23.39,0:26:27.59,Default,,0000,0000,0000,,and it's interesting to know that the NEDC\Nrequires the temperature between 20
Dialogue: 0,0:26:27.59,0:26:31.80,Default,,0000,0000,0000,,and 30°C, and this is right\Ncentered around this, when they check from
Dialogue: 0,0:26:31.80,0:26:38.94,Default,,0000,0000,0000,,17.5 to 33°C. But this was of\Ncourse nothing new. I found something
Dialogue: 0,0:26:38.94,0:26:44.04,Default,,0000,0000,0000,,similar, however, another temperature\Ncheck. And as you can see it's written in
Dialogue: 0,0:26:44.04,0:26:47.99,Default,,0000,0000,0000,,a different way. It effectively achieves\Nthe same thing, but it's a separate piece
Dialogue: 0,0:26:47.99,0:26:52.56,Default,,0000,0000,0000,,of code, and this time it was for the EGR\Nsystem. So we have these two exhaust
Dialogue: 0,0:26:52.56,0:26:58.27,Default,,0000,0000,0000,,treatment or optimization mechanisms\Nthere, EGR and SCR, and they don't share
Dialogue: 0,0:26:58.27,0:27:01.90,Default,,0000,0000,0000,,code. They have their own temperature\Nwindow. So we found the temperature
Dialogue: 0,0:27:01.90,0:27:06.22,Default,,0000,0000,0000,,window, which was known to exist. The\Nquestion was, is there more? And one thing
Dialogue: 0,0:27:06.22,0:27:11.53,Default,,0000,0000,0000,,we found was this: It's basically reading\Nthe vehicle speed and comparing to a fixed
Dialogue: 0,0:27:11.53,0:27:17.65,Default,,0000,0000,0000,,number, and it turned out it's something\Nlike this. So it would check the
Dialogue: 0,0:27:17.65,0:27:23.86,Default,,0000,0000,0000,,vehicle speed and if it's above 145 km/h\Nit would set a flag and then under 140 it
Dialogue: 0,0:27:23.86,0:27:27.01,Default,,0000,0000,0000,,would clear. Keep in mind that the NEDC\Nmaximum speed
Dialogue: 0,0:27:27.01,0:27:34.18,Default,,0000,0000,0000,,120 km/h, so during a test cycle that\Nwould never happen. So let's see if this,
Dialogue: 0,0:27:34.18,0:27:38.85,Default,,0000,0000,0000,,what we found in software, if this really\Ntranslate something the car does in the
Dialogue: 0,0:27:38.85,0:27:44.61,Default,,0000,0000,0000,,real world, and it's getting slightly\Ntechnical here, I apologize, but we need
Dialogue: 0,0:27:44.61,0:27:52.32,Default,,0000,0000,0000,,to log some variables and a useful value\Nto to know is, how much NOx is there after
Dialogue: 0,0:27:52.32,0:27:56.77,Default,,0000,0000,0000,,the engine, and after the SCR catalyst,\Nand luckily there are 2 NOx sensors in the
Dialogue: 0,0:27:56.77,0:28:00.88,Default,,0000,0000,0000,,car. One before and one after the\Ncatalyst, and they give you basically the
Dialogue: 0,0:28:00.88,0:28:05.44,Default,,0000,0000,0000,,NOx concentration in ppm. So we log that,\Nand we also log the signal of how much
Dialogue: 0,0:28:05.44,0:28:09.79,Default,,0000,0000,0000,,AdBlue is dosed into the system, and we\Nlog the catalyst temperature. And one
Dialogue: 0,0:28:09.79,0:28:14.12,Default,,0000,0000,0000,,thing to keep in mind is that there's also\Nthis amount of ammonia that's stored in
Dialogue: 0,0:28:14.12,0:28:18.62,Default,,0000,0000,0000,,the catalyst. We don't have this as a\Nvalue, but just keep this in mind. And
Dialogue: 0,0:28:18.62,0:28:26.52,Default,,0000,0000,0000,,this is how we've driven the car. The\Nblue line is the vehicle speed. You can
Dialogue: 0,0:28:26.52,0:28:33.74,Default,,0000,0000,0000,,see that it goes from 0 to 150 km/h, and\Nthe critical point here is the 145 km/h
Dialogue: 0,0:28:33.74,0:28:39.38,Default,,0000,0000,0000,,that we found in the firmware. The green\None is the catalyst temperature, which we
Dialogue: 0,0:28:39.38,0:28:45.52,Default,,0000,0000,0000,,see between ambient level, and then up to\N380 degrees. The critical point here is
Dialogue: 0,0:28:45.52,0:28:53.40,Default,,0000,0000,0000,,200 degrees Celsius, where this urea to\Nammonia process starts to work. We logged
Dialogue: 0,0:28:53.40,0:28:58.40,Default,,0000,0000,0000,,something that is the SCR strategy. So it\Nturns out there are multiple ways how the
Dialogue: 0,0:28:58.40,0:29:04.96,Default,,0000,0000,0000,,ECU computes how much AdBlue to dose and I\Ncall them strategy. So 0 means off, no
Dialogue: 0,0:29:04.96,0:29:09.30,Default,,0000,0000,0000,,AdBlue is dosed. 1 means the regular way\Nthat keeps into account the storage
Dialogue: 0,0:29:09.30,0:29:15.37,Default,,0000,0000,0000,,mechanism, and then 2 is a special reduced\Nway. And then also we log the actual
Dialogue: 0,0:29:15.37,0:29:24.20,Default,,0000,0000,0000,,dosing value. And then we also had the\Nsensor data from between the engine and
Dialogue: 0,0:29:24.20,0:29:32.16,Default,,0000,0000,0000,,the catalyst, and between the catalyst\Nand the exhaust. The first thing that
Dialogue: 0,0:29:32.16,0:29:37.95,Default,,0000,0000,0000,,happens... or, actually nothing happens\Nuntil the point where we reach 200°C
Dialogue: 0,0:29:37.95,0:29:46.78,Default,,0000,0000,0000,,at the catalyst. You can...\Nuntil that point, as I said the required
Dialogue: 0,0:29:46.78,0:29:51.43,Default,,0000,0000,0000,,temperature is not... does not allow\NAdBlue dosing, and then it starts dosing
Dialogue: 0,0:29:51.43,0:29:59.23,Default,,0000,0000,0000,,quite a few amount of AdBlue. But then,\Nwhen we cross the 145 km/h, the SCR
Dialogue: 0,0:29:59.23,0:30:07.05,Default,,0000,0000,0000,,strategy changes, and no further AdBlue is\Ndosed until basically this point, and this
Dialogue: 0,0:30:07.05,0:30:15.44,Default,,0000,0000,0000,,point is exactly 120 seconds after we go\Nlower than 140 km/h. So this matches what
Dialogue: 0,0:30:15.44,0:30:17.02,Default,,0000,0000,0000,,we found\Nin the software, right, this was what we
Dialogue: 0,0:30:17.02,0:30:19.55,Default,,0000,0000,0000,,found in the\Nsoftware. So we can see that this was
Dialogue: 0,0:30:19.55,0:30:27.75,Default,,0000,0000,0000,,actually true. This is real behavior of\Nthe ECU. And to look at the effect of
Dialogue: 0,0:30:27.75,0:30:35.11,Default,,0000,0000,0000,,this, you have to check the difference\Nbetween the blue and the green line in the
Dialogue: 0,0:30:35.11,0:30:40.93,Default,,0000,0000,0000,,lower diagram, between basically the\Namount of NOx that is removed by the SCR
Dialogue: 0,0:30:40.93,0:30:46.09,Default,,0000,0000,0000,,catalyst. And you can see during the\Nregular operation quite a lot of NOx is
Dialogue: 0,0:30:46.09,0:30:49.76,Default,,0000,0000,0000,,removed. The blue line goes up because\Nwe're driving faster and faster, and the
Dialogue: 0,0:30:49.76,0:30:56.61,Default,,0000,0000,0000,,green line goes down almost to zero, and\Nthis this works for quite a while, and it
Dialogue: 0,0:30:56.61,0:31:03.31,Default,,0000,0000,0000,,even keeps working a while until the\Ncatalyst runs out of ammonia, and then it
Dialogue: 0,0:31:03.31,0:31:07.43,Default,,0000,0000,0000,,would need more AdBlue to operate, but\Nbecause we're in the reduced mode it does
Dialogue: 0,0:31:07.43,0:31:13.56,Default,,0000,0000,0000,,not put any more AdBlue into the system.\NSo the SCR basically stops working, and
Dialogue: 0,0:31:13.56,0:31:19.28,Default,,0000,0000,0000,,the emission levels reach the engine\Nemissions, so no further... The SCR system
Dialogue: 0,0:31:19.28,0:31:24.79,Default,,0000,0000,0000,,does not work in this red area. And here\Nwe see this again, so here are the
Dialogue: 0,0:31:24.79,0:31:28.10,Default,,0000,0000,0000,,sequences of active dosing. Here we see\Nwhere the catalyst temperature is too low
Dialogue: 0,0:31:28.10,0:31:33.64,Default,,0000,0000,0000,,for dosing. We see the regular operation.\NWe see where it's still working,
Dialogue: 0,0:31:33.64,0:31:38.05,Default,,0000,0000,0000,,because there's still ammonia stored and\Nthen until we run out of ammonia and no
Dialogue: 0,0:31:38.05,0:31:45.94,Default,,0000,0000,0000,,refill happens, until exactly 120 seconds\Nafter going below 140 kilometers an hour.
Dialogue: 0,0:31:45.94,0:31:52.67,Default,,0000,0000,0000,,So our conclusion after this is that the\NSCR is programmed to stop working at 145
Dialogue: 0,0:31:52.67,0:31:58.09,Default,,0000,0000,0000,,km/h. The efficiency goes to 0. Opel\Noffered a hand-waving explanation, one of
Dialogue: 0,0:31:58.09,0:32:01.100,Default,,0000,0000,0000,,the press releases why this is necessary.\NThey argued with some physical details,
Dialogue: 0,0:32:01.100,0:32:07.55,Default,,0000,0000,0000,,and we presented these physical details to\Nsome experts, professors that work with
Dialogue: 0,0:32:07.55,0:32:14.22,Default,,0000,0000,0000,,combustion engines for a long time. Most\Nof them disagree with these explanations,
Dialogue: 0,0:32:14.22,0:32:20.25,Default,,0000,0000,0000,,I mean, yeah. But more importantly, other\Ncars including my Volkswagen Sharan
Dialogue: 0,0:32:20.25,0:32:26.76,Default,,0000,0000,0000,,device, which is Euro 5 car, so one\Ngeneration older, and it's known to have a
Dialogue: 0,0:32:26.76,0:32:34.32,Default,,0000,0000,0000,,defeat device, and it performs\Nsignificantly better than this car. OK, we
Dialogue: 0,0:32:34.32,0:32:39.58,Default,,0000,0000,0000,,continue to look. We found something here\Nthat is a... that looks like this. It
Dialogue: 0,0:32:39.58,0:32:44.75,Default,,0000,0000,0000,,takes a... there's a\Nbarometric pressure sensor that sends us
Dialogue: 0,0:32:44.75,0:32:49.24,Default,,0000,0000,0000,,the pressure of the air and compares it\Nwith a value and if we look at how
Dialogue: 0,0:32:49.24,0:32:55.47,Default,,0000,0000,0000,,pressure is related to height we see that\Nwhat they check with is 91.5 kilopascal
Dialogue: 0,0:32:55.47,0:33:00.08,Default,,0000,0000,0000,,and which corresponds to 850 meter. And\Napparently Europe's highest test center's
Dialogue: 0,0:33:00.08,0:33:05.60,Default,,0000,0000,0000,,at 800 meter, which may be a coincidence\Nor not. But above that point they reduce
Dialogue: 0,0:33:05.60,0:33:10.99,Default,,0000,0000,0000,,their CR system as well. Now, the\Ninteresting thing is... yeah barometric
Dialogue: 0,0:33:10.99,0:33:14.69,Default,,0000,0000,0000,,pressure is something very important to\Nknow for an ECU. There's a good reason to
Dialogue: 0,0:33:14.69,0:33:18.66,Default,,0000,0000,0000,,have the sensor for all of the combustion\Nprocess. You need to know how much air
Dialogue: 0,0:33:18.66,0:33:24.44,Default,,0000,0000,0000,,there is. So for EGR it makes a lot of\Nsense to have this, but for SCR, which is
Dialogue: 0,0:33:24.44,0:33:29.81,Default,,0000,0000,0000,,the system after the engine, no combustion\Nis happening. We are not aware of any
Dialogue: 0,0:33:29.81,0:33:35.89,Default,,0000,0000,0000,,effect that the outside air pressure has\Non the SCR system, and also other SC
Dialogue: 0,0:33:35.89,0:33:41.21,Default,,0000,0000,0000,,equipped cars don't have this mechanism,\Nso... for us it does not make
Dialogue: 0,0:33:41.21,0:33:47.00,Default,,0000,0000,0000,,physically... it doesn't seem to be\Nphysically required. So far we looked at
Dialogue: 0,0:33:47.00,0:33:54.13,Default,,0000,0000,0000,,SCR. Let's look at EGR. What we saw was,\Nwhen we drove the car during the test
Dialogue: 0,0:33:54.13,0:33:56.36,Default,,0000,0000,0000,,cycle, so we put it in the lab and drive\Nthe
Dialogue: 0,0:33:56.36,0:34:01.79,Default,,0000,0000,0000,,test cycle, we consistently saw much\Nhigher EGR values, much higher than
Dialogue: 0,0:34:01.79,0:34:05.35,Default,,0000,0000,0000,,compared to driving on the street,\Ncompared to all kind of scenarios that we
Dialogue: 0,0:34:05.35,0:34:09.40,Default,,0000,0000,0000,,drove on the street. So higher EGR value\Nhere means, that the EGR valve, that I
Dialogue: 0,0:34:09.40,0:34:13.92,Default,,0000,0000,0000,,showed you earlier, is more open, more\Nexhaust gas recirculates to the engine. It
Dialogue: 0,0:34:13.92,0:34:20.73,Default,,0000,0000,0000,,causes lower NOx emissions before the SCR\Ncatalyst, and we really... we're curious
Dialogue: 0,0:34:20.73,0:34:26.26,Default,,0000,0000,0000,,why did the car behave so differently when\Nrunning on a street than running in a test
Dialogue: 0,0:34:26.26,0:34:29.07,Default,,0000,0000,0000,,cycle. And we already took into account\Ntemperature, so the temperature was not
Dialogue: 0,0:34:29.07,0:34:34.74,Default,,0000,0000,0000,,the issue anymore. And thankfully the car,\Nwhen it computes the reason for reducing
Dialogue: 0,0:34:34.74,0:34:41.87,Default,,0000,0000,0000,,EGR, it stores a reason in some variable\Nthat we can log, and it looks like this.
Dialogue: 0,0:34:41.87,0:34:46.74,Default,,0000,0000,0000,,There is a number of things that can\Nhappen, that causes the ECU to switch to
Dialogue: 0,0:34:46.74,0:34:51.91,Default,,0000,0000,0000,,some low EGR mode, and a few of them\Nmake sense, for example if something is
Dialogue: 0,0:34:51.91,0:34:56.23,Default,,0000,0000,0000,,broken, fault flags are set, or if the, I\Ndon't know, the coolant temperature is out
Dialogue: 0,0:34:56.23,0:35:02.93,Default,,0000,0000,0000,,of range, it makes sense to just keep the\Ndevice running at all cost. But when none
Dialogue: 0,0:35:02.93,0:35:08.43,Default,,0000,0000,0000,,of these reasons apply, the value stored\Nis 2, and 2 basically means, that the full
Dialogue: 0,0:35:08.43,0:35:16.84,Default,,0000,0000,0000,,EGR operation is used, so it's basically\Nthe NOx-optimized mode with the fewest
Dialogue: 0,0:35:16.84,0:35:21.73,Default,,0000,0000,0000,,emissions. And then we looked at some\Nreal-world driving, you can see this in
Dialogue: 0,0:35:21.73,0:35:26.01,Default,,0000,0000,0000,,the background - the vehicle speed is in\Nthe background - and we saw that... the
Dialogue: 0,0:35:26.01,0:35:31.07,Default,,0000,0000,0000,,red graph shows you the reason to go to\Nthis limited EGR mode and what we saw is
Dialogue: 0,0:35:31.07,0:35:37.71,Default,,0000,0000,0000,,that most of the time the reason is 13 and\Nonly a few times it's 2, which means that
Dialogue: 0,0:35:37.71,0:35:43.08,Default,,0000,0000,0000,,it's not limited. And looking into this\Nmore details, we see it sometimes drops
Dialogue: 0,0:35:43.08,0:35:49.09,Default,,0000,0000,0000,,back to 2, to the unlimited mode, to the\Noptimized... emission optimized mode, but
Dialogue: 0,0:35:49.09,0:35:53.51,Default,,0000,0000,0000,,any acceleration, or almost any\Nacceleration switches it back to 13, and
Dialogue: 0,0:35:53.51,0:35:59.65,Default,,0000,0000,0000,,then it stays there for a long time. And\N13, if we look it up, is what I call load
Dialogue: 0,0:35:59.65,0:36:06.84,Default,,0000,0000,0000,,limit. And then, interestingly, if we run\Nit through the NEDC, we never saw a 13. So
Dialogue: 0,0:36:06.84,0:36:11.47,Default,,0000,0000,0000,,the engine stays in mode 2 all the time,\Nand 16 just means that the engine is off.
Dialogue: 0,0:36:11.47,0:36:16.95,Default,,0000,0000,0000,,But we never see 13. So this explains why\Nthe EGR values were so different in a test
Dialogue: 0,0:36:16.95,0:36:23.33,Default,,0000,0000,0000,,cycle. So, let's look into this load limit\Nfunction that we found. It's basically
Dialogue: 0,0:36:23.33,0:36:30.16,Default,,0000,0000,0000,,defined by curves, by five curves. For\Nevery gear there's a curve, or for a
Dialogue: 0,0:36:30.16,0:36:36.23,Default,,0000,0000,0000,,bucket of gears. It's basically that they\Nlook up RPM, they get a value for that
Dialogue: 0,0:36:36.23,0:36:45.38,Default,,0000,0000,0000,,curve, and if you exceed that value, they\Nswitch to the reduced EGR mode. What they
Dialogue: 0,0:36:45.38,0:36:49.78,Default,,0000,0000,0000,,compare this threshold with is the amount\Nof fuel injected per cylinder per
Dialogue: 0,0:36:49.78,0:36:53.30,Default,,0000,0000,0000,,revolution, but you can also say this is\Ntorque, just with a
Dialogue: 0,0:36:53.30,0:36:59.03,Default,,0000,0000,0000,,constant factor. And then once you are\Noutside of one of these curves, it
Dialogue: 0,0:36:59.03,0:37:05.09,Default,,0000,0000,0000,,switches to the non-optimized mode where\Nit emits a lot more emissions, and then
Dialogue: 0,0:37:05.09,0:37:10.35,Default,,0000,0000,0000,,you have to go back into the green area to\Nswitch back to the optimized mode. So
Dialogue: 0,0:37:10.35,0:37:12.22,Default,,0000,0000,0000,,let's see what this means in practice. So\Nhere we
Dialogue: 0,0:37:12.22,0:37:18.91,Default,,0000,0000,0000,,have a car, and the traffic light is red,\Nso the car stops, and then the traffic
Dialogue: 0,0:37:18.91,0:37:26.35,Default,,0000,0000,0000,,light goes green and the car accelerates,\Nand accelerates, and accelerates, gets
Dialogue: 0,0:37:26.35,0:37:33.87,Default,,0000,0000,0000,,faster and faster, and then it's at the\Nhighest speed here, and drives for a
Dialogue: 0,0:37:33.87,0:37:39.14,Default,,0000,0000,0000,,while. And this is a typical city cycle,\Nthis is there to... how you drive in a
Dialogue: 0,0:37:39.14,0:37:45.22,Default,,0000,0000,0000,,city, and then the next traffic light\Nturns red and the car brakes and stops in
Dialogue: 0,0:37:45.22,0:37:52.90,Default,,0000,0000,0000,,front of the traffic light. Let's take a\Nlook at this again with one more variable,
Dialogue: 0,0:37:52.90,0:38:01.92,Default,,0000,0000,0000,,the RPM. We can see that when the car\Nstarts moving, the RPM goes up. And then
Dialogue: 0,0:38:01.92,0:38:05.50,Default,,0000,0000,0000,,at some point there is a drop in RPM, and\Nthis is because it's a manual transmission
Dialogue: 0,0:38:05.50,0:38:10.28,Default,,0000,0000,0000,,and the driver switched to the next gear.\NNow it's switched to again the next gear,
Dialogue: 0,0:38:10.28,0:38:15.50,Default,,0000,0000,0000,,and this causes the RPM to drop, but the\Nspeed to remain almost
Dialogue: 0,0:38:15.50,0:38:19.92,Default,,0000,0000,0000,,constant, and it drives for a long time in\Nthe same gear, and then the traffic light
Dialogue: 0,0:38:19.92,0:38:24.53,Default,,0000,0000,0000,,goes red, the driver presses the clutch,\Nthe engine goes back to idle state, there
Dialogue: 0,0:38:24.53,0:38:28.60,Default,,0000,0000,0000,,is no connection anymore to the wheels,\Nbetween the engines and the wheels, and
Dialogue: 0,0:38:28.60,0:38:37.12,Default,,0000,0000,0000,,the car gets slower. OK, one more\Nvariable. It's the last one, I promise. It
Dialogue: 0,0:38:37.12,0:38:44.29,Default,,0000,0000,0000,,is torque. The engine power in kilowatt or\Nsomething is not just a function of RPM,
Dialogue: 0,0:38:44.29,0:38:48.46,Default,,0000,0000,0000,,it's a function of RPM and torque. so RPM\Nand torque together are very useful to
Dialogue: 0,0:38:48.46,0:38:53.83,Default,,0000,0000,0000,,characterize engine behavior. And a very\Ngood way to do this is to have a graph
Dialogue: 0,0:38:53.83,0:39:00.23,Default,,0000,0000,0000,,where we put RPM on the one axis and\Ntorque we put on the other axis, and then
Dialogue: 0,0:39:00.23,0:39:05.89,Default,,0000,0000,0000,,we draw this in two dimensions, and so we\Nget this, basically. This is the operating
Dialogue: 0,0:39:05.89,0:39:14.05,Default,,0000,0000,0000,,points we go through when driving the\Ncycle we saw. So the green dot here
Dialogue: 0,0:39:14.05,0:39:21.66,Default,,0000,0000,0000,,indicates where we are. And so we restart\Nthe car, the car accelerates, sorry, the
Dialogue: 0,0:39:21.66,0:39:27.59,Default,,0000,0000,0000,,car idles for a while, so the green dot\Nstays there. It idles at around 800 RPM,
Dialogue: 0,0:39:27.59,0:39:32.57,Default,,0000,0000,0000,,almost no torque, because there's nothing\Nto move, and then the driver accelerates
Dialogue: 0,0:39:32.57,0:39:38.85,Default,,0000,0000,0000,,and the torque goes up, the RPM goes up\Nmore slowly, and then at some point, the
Dialogue: 0,0:39:38.85,0:39:43.76,Default,,0000,0000,0000,,driver presses the clutch, which\Ndisconnects the engine, the
Dialogue: 0,0:39:43.76,0:39:48.96,Default,,0000,0000,0000,,torque goes down, the RPM adjusts to the\Nspeed of the next gear, and then the
Dialogue: 0,0:39:48.96,0:39:53.94,Default,,0000,0000,0000,,driver releases the clutch and now the\Nengine again has to move the car, so the
Dialogue: 0,0:39:53.94,0:39:59.33,Default,,0000,0000,0000,,torque goes up until reaching the the\Nhighest RPM value and then that the driver
Dialogue: 0,0:39:59.33,0:40:03.76,Default,,0000,0000,0000,,again switches to the next gear, so the\Nwhole thing repeats, and then while the
Dialogue: 0,0:40:03.76,0:40:09.11,Default,,0000,0000,0000,,car is driving, the majority of this the\Ncycle, the engine spends in this one
Dialogue: 0,0:40:09.11,0:40:14.95,Default,,0000,0000,0000,,operating point. We're currently at 1800\NRPM or something, and 80 Newton meter or
Dialogue: 0,0:40:14.95,0:40:19.97,Default,,0000,0000,0000,,so torque. And then at some point the\Ndriver presses the clutch, the engine goes
Dialogue: 0,0:40:19.97,0:40:26.78,Default,,0000,0000,0000,,back to idle and stays there, basically.\NSo this is how you read this diagram. And
Dialogue: 0,0:40:26.78,0:40:34.48,Default,,0000,0000,0000,,now what we found in the firmware was that\Noverlaid basically on this representation
Dialogue: 0,0:40:34.48,0:40:42.49,Default,,0000,0000,0000,,we see a mask, or a limit. If we go over\Nthis curve, those are the same curves that
Dialogue: 0,0:40:42.49,0:40:50.50,Default,,0000,0000,0000,,I showed you earlier, just laid on top of\Nthis. If we go over this curve,
Dialogue: 0,0:40:50.50,0:40:59.23,Default,,0000,0000,0000,,then we switch to the worse emission mode,\Nwe switch to the mode where the EGR value
Dialogue: 0,0:40:59.23,0:41:06.60,Default,,0000,0000,0000,,is limited. So we can see in our driving\Nthat this happens basically at this point,
Dialogue: 0,0:41:06.60,0:41:10.24,Default,,0000,0000,0000,,the point where the driver\Naccelerates above a certain point, that
Dialogue: 0,0:41:10.24,0:41:18.27,Default,,0000,0000,0000,,causes it to go over the load limit and\Nthe engine basically switches or
Dialogue: 0,0:41:18.27,0:41:22.51,Default,,0000,0000,0000,,significantly reduces EGR. And that's fine\Nbecause EGR doesn't work when you need a
Dialogue: 0,0:41:22.51,0:41:27.59,Default,,0000,0000,0000,,lot of engine power, so it make sense that\Nthat's at that point, and what we would
Dialogue: 0,0:41:27.59,0:41:32.74,Default,,0000,0000,0000,,think is that it switches back once we\Nleave this load envelope, once we go below
Dialogue: 0,0:41:32.74,0:41:36.84,Default,,0000,0000,0000,,the limit again, once we are inside the\Nlimit, we would expect the ECU to switch
Dialogue: 0,0:41:36.84,0:41:42.67,Default,,0000,0000,0000,,back to the full EGR operation. But what\Nwe see instead is that this does not
Dialogue: 0,0:41:42.67,0:41:50.12,Default,,0000,0000,0000,,happen, and the reason is that you don't\Nhave to go under the maximum, the load
Dialogue: 0,0:41:50.12,0:41:54.77,Default,,0000,0000,0000,,limit, you have to go into this green\Narea. You have to go back to idling at a
Dialogue: 0,0:41:54.77,0:42:00.45,Default,,0000,0000,0000,,very low RPM to switch back to the full\NEGR mode and this only happens at the very
Dialogue: 0,0:42:00.45,0:42:04.81,Default,,0000,0000,0000,,end. When the driving cycle is almost\Ndone, when the driver presses the clutch
Dialogue: 0,0:42:04.81,0:42:12.08,Default,,0000,0000,0000,,and lets the engine idle. So especially\Nthis long sequence where the driver... the
Dialogue: 0,0:42:12.08,0:42:18.15,Default,,0000,0000,0000,,car was driving at the same speed, we were\Ntechnically in ... within the load limit,
Dialogue: 0,0:42:18.15,0:42:21.97,Default,,0000,0000,0000,,where we're not exceeding the load limit,\Nbut because we previously exceeded the
Dialogue: 0,0:42:21.97,0:42:26.96,Default,,0000,0000,0000,,load limit and it doesn't matter for how\Nlong you exceeded it, and we did not go to
Dialogue: 0,0:42:26.96,0:42:33.30,Default,,0000,0000,0000,,the green area before, we were still in\Nthis low EGR, high emission mode, even
Dialogue: 0,0:42:33.30,0:42:41.01,Default,,0000,0000,0000,,though we're still within the load limit\Nimposed by the software. So let's take a
Dialogue: 0,0:42:41.01,0:42:47.80,Default,,0000,0000,0000,,look at how often this actually happens in\Nreal-world data. So here's us driving
Dialogue: 0,0:42:47.80,0:42:53.32,Default,,0000,0000,0000,,through a city, and we can see we\Nconstantly exceed these load limits. And
Dialogue: 0,0:42:53.32,0:43:00.84,Default,,0000,0000,0000,,this is driving on the Autobahn, and yeah\Nwe constantly exceed those. But they look
Dialogue: 0,0:43:00.84,0:43:05.94,Default,,0000,0000,0000,,interesting. They look as if they had been\Ndesigned according to something, right,
Dialogue: 0,0:43:05.94,0:43:12.67,Default,,0000,0000,0000,,they have the specific form and it's not\Njust... yeah, I... I don't know... and it
Dialogue: 0,0:43:12.67,0:43:16.48,Default,,0000,0000,0000,,turns out if you do something really\Nstrange, you can stay within these limits,
Dialogue: 0,0:43:16.48,0:43:20.76,Default,,0000,0000,0000,,so we tried that and we managed to stay\Nwithin the limit by doing something, and
Dialogue: 0,0:43:20.76,0:43:24.90,Default,,0000,0000,0000,,we... it was reproducible, we could do\Nthis a lot of time it would always stay in
Dialogue: 0,0:43:24.90,0:43:31.69,Default,,0000,0000,0000,,this limit and the answer is: If you drive\Nthe test cycle you're staying in this
Dialogue: 0,0:43:31.69,0:43:41.43,Default,,0000,0000,0000,,limit.\N{\i1}applause{\i0}
Dialogue: 0,0:43:41.43,0:43:48.26,Default,,0000,0000,0000,,So yeah, these curves basically defined...\Nthey closely correlate to the limits that
Dialogue: 0,0:43:48.26,0:43:55.65,Default,,0000,0000,0000,,you need to pass the NEDC. Okay, to be\Nclear it is fully acceptable that the EGR
Dialogue: 0,0:43:55.65,0:44:00.52,Default,,0000,0000,0000,,rate is reduced when... for higher engine\Nloads. It's natural, you have to do this.
Dialogue: 0,0:44:00.52,0:44:06.93,Default,,0000,0000,0000,,For example, when you accelerate the EGR\Nrate will decrease up to zero probably,
Dialogue: 0,0:44:06.93,0:44:10.77,Default,,0000,0000,0000,,when you do it ... when you're running at\Nhigh speeds, all of that is great. So this
Dialogue: 0,0:44:10.77,0:44:14.57,Default,,0000,0000,0000,,method of having a load limit ... well,\Nyou can argue if really having the load
Dialogue: 0,0:44:14.57,0:44:18.83,Default,,0000,0000,0000,,limit exactly where the NEDC is makes\Nsense, but having a load limit is okay,
Dialogue: 0,0:44:18.83,0:44:22.61,Default,,0000,0000,0000,,right? However, what we think is not okay\Nis that, if you only exceeded the limit
Dialogue: 0,0:44:22.61,0:44:28.93,Default,,0000,0000,0000,,once ... um... you would stay in this high\Nemissions mode for potentially a long time
Dialogue: 0,0:44:28.93,0:44:35.27,Default,,0000,0000,0000,,until you get back to low speed idle the\Nnext time. And we think that is the
Dialogue: 0,0:44:35.27,0:44:40.17,Default,,0000,0000,0000,,problem. We ... so far this was all based\Non what we saw in the software, so let's
Dialogue: 0,0:44:40.17,0:44:46.61,Default,,0000,0000,0000,,see if this translates to something that\Nhappens in reality. So to repro this we...
Dialogue: 0,0:44:46.61,0:44:51.69,Default,,0000,0000,0000,,the car... drive at constantly... or we\Nlet it idle, then we accelerate it to
Dialogue: 0,0:44:51.69,0:44:56.26,Default,,0000,0000,0000,,2,000 RPM, we let it drive there for a\Nwhile and then we quickly exceeded the
Dialogue: 0,0:44:56.26,0:45:02.71,Default,,0000,0000,0000,,load limit by going to 3,000 and then\Ngoing back and then after doing that we
Dialogue: 0,0:45:02.71,0:45:07.49,Default,,0000,0000,0000,,would again stay at 2,000 RPM. So it looks\Nlike this and we would naturally expect
Dialogue: 0,0:45:07.49,0:45:12.75,Default,,0000,0000,0000,,the engine to operate in the same way on\Nthe left and on the right side because the
Dialogue: 0,0:45:12.75,0:45:16.92,Default,,0000,0000,0000,,engine is doing the same thing there, it's\Nthe same torque level, it's the same RPM,
Dialogue: 0,0:45:16.92,0:45:22.05,Default,,0000,0000,0000,,everything is the same. So we would expect\Nthe same emissions, right, um ... and it
Dialogue: 0,0:45:22.05,0:45:26.25,Default,,0000,0000,0000,,turns out it isn't. And ... this is a\Nslightly convoluted diagram. So if you
Dialogue: 0,0:45:26.25,0:45:32.11,Default,,0000,0000,0000,,look at the green and red bars in the\Nmiddle you can see what happens before and
Dialogue: 0,0:45:32.11,0:45:36.09,Default,,0000,0000,0000,,after exceeding the limit for just once.\NAnd in the middle you can see the EGR
Dialogue: 0,0:45:36.09,0:45:40.79,Default,,0000,0000,0000,,position, the EGR valve position, and you\Ncan see that we get pretty high values
Dialogue: 0,0:45:40.79,0:45:50.39,Default,,0000,0000,0000,,between... 6... maybe 65 percent or\Nsomething before exceeding the load limit
Dialogue: 0,0:45:50.39,0:45:52.92,Default,,0000,0000,0000,,once.\NAnd after we exceeded it once even though
Dialogue: 0,0:45:52.92,0:45:57.97,Default,,0000,0000,0000,,the engine again is operating in the same\Nexact operating point, we see much lower
Dialogue: 0,0:45:57.97,0:46:03.57,Default,,0000,0000,0000,,EGR valve positions, around 50% or\Nsomething. And if we look at the bottom we
Dialogue: 0,0:46:03.57,0:46:08.76,Default,,0000,0000,0000,,see what the engine NOx emissions and we\Nsee that they are significantly higher on
Dialogue: 0,0:46:08.76,0:46:13.32,Default,,0000,0000,0000,,the right side than they are on the left\Nside. So this... for me, this does not
Dialogue: 0,0:46:13.32,0:46:17.89,Default,,0000,0000,0000,,sound like this is truly optimized for\Nemissions because the engine is doing the
Dialogue: 0,0:46:17.89,0:46:25.55,Default,,0000,0000,0000,,same thing, in both cases the emissions\Nshould be low. So going back to this quote
Dialogue: 0,0:46:25.55,0:46:31.28,Default,,0000,0000,0000,,that it works, the EGR and SCR injection\Nwork to the full extent in a temperature
Dialogue: 0,0:46:31.28,0:46:36.98,Default,,0000,0000,0000,,range of 20 to 30°C. Okay,\Nbut what about the EGR load limit and what
Dialogue: 0,0:46:36.98,0:46:41.18,Default,,0000,0000,0000,,about the the barometric pressure limit\Nfor SCR and what about the SCR speed
Dialogue: 0,0:46:41.18,0:46:46.29,Default,,0000,0000,0000,,limit? That would not be "to the full\Nextent", right? And the Opel answer is
Dialogue: 0,0:46:46.29,0:46:50.05,Default,,0000,0000,0000,,really interesting. Of course, they denied\Ndoing a test cycle detection, they say
Dialogue: 0,0:46:50.05,0:46:57.45,Default,,0000,0000,0000,,they don't do that. And what they said is,\Nwhen asked whether they lied to the KBA
Dialogue: 0,0:46:57.45,0:47:00.83,Default,,0000,0000,0000,,when saying that it works to the full\Nextent they said "The statement 'fully'
Dialogue: 0,0:47:00.83,0:47:11.57,Default,,0000,0000,0000,,was really related to the NEDC test\Nschedule, right, which... it went on and
Dialogue: 0,0:47:11.57,0:47:17.19,Default,,0000,0000,0000,,further... the Opel CEO had to say this.\NHe said: "The recent
Dialogue: 0,0:47:17.19,0:47:21.46,Default,,0000,0000,0000,,accusations based on the findings of\Nhacker Mr. Felix Domke" - hey, that's me -
Dialogue: 0,0:47:21.46,0:47:26.03,Default,,0000,0000,0000,,"are misleading oversimplifications and\Nmisinterpretations of the complicated
Dialogue: 0,0:47:26.03,0:47:30.58,Default,,0000,0000,0000,,interrelationships of a modern emission\Ncontrol system of a diesel engine.
Dialogue: 0,0:47:30.58,0:47:34.88,Default,,0000,0000,0000,,Emission control devices are highly\Nsophisticated integrated systems which
Dialogue: 0,0:47:34.88,0:47:39.40,Default,,0000,0000,0000,,cannot be broken down into isolated\Nparameters." Especially not by a hacker,
Dialogue: 0,0:47:39.40,0:47:50.46,Default,,0000,0000,0000,,right?\N{\i1}applause{\i0}
Dialogue: 0,0:47:50.46,0:47:54.63,Default,,0000,0000,0000,,That was kind of funny. There was another\Nfunny thing. Sorry, I only have a German
Dialogue: 0,0:47:54.63,0:47:57.99,Default,,0000,0000,0000,,quote and I didn't want to translate it,\Nbut when Opel basically ... they
Dialogue: 0,0:47:57.99,0:48:02.27,Default,,0000,0000,0000,,repeatedly say they don't have a cycle\Ndetection, right, and they say it's not a
Dialogue: 0,0:48:02.27,0:48:08.66,Default,,0000,0000,0000,,cycle detection because, if you use the\Ncar on the street in the same way as you
Dialogue: 0,0:48:08.66,0:48:12.87,Default,,0000,0000,0000,,would do them during the test cycle, the\Ncar would behave in the same way, so it's
Dialogue: 0,0:48:12.87,0:48:23.93,Default,,0000,0000,0000,,not...,right? {\i1}applause{\i0} ... and ... okay.\NBut what is with Volkswagen, right, they
Dialogue: 0,0:48:23.93,0:48:28.33,Default,,0000,0000,0000,,have the same thing, if you drive the NEDC\Non the street the car will go to test mode
Dialogue: 0,0:48:28.33,0:48:36.41,Default,,0000,0000,0000,,they have the same thing. I don't see how\Nthis does not represent a cycle detection.
Dialogue: 0,0:48:36.41,0:48:42.37,Default,,0000,0000,0000,,That was a lot of things to say about\NOpel, but on the bright side, they also
Dialogue: 0,0:48:42.37,0:48:46.77,Default,,0000,0000,0000,,said that they will - even though all that\Nwas incorrect, what we found - they said
Dialogue: 0,0:48:46.77,0:48:50.78,Default,,0000,0000,0000,,"We will further improve the efficiency of\Nemissions after treatment of our SCR
Dialogue: 0,0:48:50.78,0:48:55.99,Default,,0000,0000,0000,,diesel engines and so on as far as the\Nlaws of physics allow. This includes a
Dialogue: 0,0:48:55.99,0:48:59.68,Default,,0000,0000,0000,,voluntary service action" - and this\Nbasically means a software update for your
Dialogue: 0,0:48:59.68,0:49:04.99,Default,,0000,0000,0000,,car - "for the cars that are already on\Nthe road starting in June." So that is
Dialogue: 0,0:49:04.99,0:49:08.78,Default,,0000,0000,0000,,great. They're actually improving\Nsomething. Question's in which year,
Dialogue: 0,0:49:08.78,0:49:17.00,Default,,0000,0000,0000,,because this statement is from May 2016\Nand it's not out yet, but... Opel actually
Dialogue: 0,0:49:17.00,0:49:21.23,Default,,0000,0000,0000,,provided a new software already in July\Nand I think they already worked on this
Dialogue: 0,0:49:21.23,0:49:27.01,Default,,0000,0000,0000,,for quite a while and in July 16 the German\NKBA, the Kraftfahrtbundesamt, the Federal
Dialogue: 0,0:49:27.01,0:49:31.73,Default,,0000,0000,0000,,Motor Transport Authority, they are pretty\Nnice actually, and they do know about what
Dialogue: 0,0:49:31.73,0:49:36.21,Default,,0000,0000,0000,,they do, they are bit limited by the\Nresources they have, and by the manpower
Dialogue: 0,0:49:36.21,0:49:41.63,Default,,0000,0000,0000,,they have, but they know about cars and\Nthey know how to do these investigations.
Dialogue: 0,0:49:41.63,0:49:44.76,Default,,0000,0000,0000,,I mean, they're a little bit bound, but\Nwhat they should do and what they should
Dialogue: 0,0:49:44.76,0:49:49.20,Default,,0000,0000,0000,,not do, but they asked me to review a new\NECU software that was given to them by
Dialogue: 0,0:49:49.20,0:49:57.36,Default,,0000,0000,0000,,Opel for the Zafira in question and\NInsignia, which had a similar ECU and I
Dialogue: 0,0:49:57.36,0:50:01.35,Default,,0000,0000,0000,,looked at that software and I dumped the\Nfirmware and I looked at basically all the
Dialogue: 0,0:50:01.35,0:50:05.46,Default,,0000,0000,0000,,code sequences that I looked at before and\NI was positively surprised because they
Dialogue: 0,0:50:05.46,0:50:10.95,Default,,0000,0000,0000,,removed... they addressed each of our\Nconcerns. All of them, within the physical
Dialogue: 0,0:50:10.95,0:50:14.53,Default,,0000,0000,0000,,limitations of course. So they improved\Nthe temperature window and everything, so
Dialogue: 0,0:50:14.53,0:50:19.09,Default,,0000,0000,0000,,there was a significant improvement. They\Nwere able to improve the software and they
Dialogue: 0,0:50:19.09,0:50:25.69,Default,,0000,0000,0000,,let the DUH, which is the German\NEnvironmental Aid, they used a PEMS system
Dialogue: 0,0:50:25.69,0:50:28.91,Default,,0000,0000,0000,,- PEMS is a portable\Nemissions measurement system. It's
Dialogue: 0,0:50:28.91,0:50:33.46,Default,,0000,0000,0000,,something you put on the exhaust pipe on\Nyour car and then you can measure the
Dialogue: 0,0:50:33.46,0:50:40.70,Default,,0000,0000,0000,,exhaust during real-world driving, and\NOpel gave them a car with the new ECU
Dialogue: 0,0:50:40.70,0:50:45.52,Default,,0000,0000,0000,,software. Otherwise the car was identical\Nto the old software, and the results are
Dialogue: 0,0:50:45.52,0:50:49.68,Default,,0000,0000,0000,,this, right, so on the left side you see\Nthe old software, that has all these
Dialogue: 0,0:50:49.68,0:50:55.04,Default,,0000,0000,0000,,things that we criticized, and on the\Nright side you see the same car with a new
Dialogue: 0,0:50:55.04,0:51:00.50,Default,,0000,0000,0000,,ECU software and it's significantly\Nbetter. It's only slightly above the
Dialogue: 0,0:51:00.50,0:51:05.77,Default,,0000,0000,0000,,limit, right, but it's much better than\Nbefore and to put this in relation,
Dialogue: 0,0:51:05.77,0:51:11.26,Default,,0000,0000,0000,,before they were on the list pretty bad -\Nso this is sorted by worst to best - so
Dialogue: 0,0:51:11.26,0:51:15.72,Default,,0000,0000,0000,,they are in the, well, upper half at\Nleast, and now they are almost one of the
Dialogue: 0,0:51:15.72,0:51:21.84,Default,,0000,0000,0000,,best cars, just by switching the ECU\Nsoftware. And I mean this is great news,
Dialogue: 0,0:51:21.84,0:51:27.69,Default,,0000,0000,0000,,right, they actually improved their cars.\NLet's just hope they get this out to the
Dialogue: 0,0:51:27.69,0:51:31.46,Default,,0000,0000,0000,,cars soon. Let's just hope it doesn't have\Nside effects and something, but I'm sure
Dialogue: 0,0:51:31.46,0:51:37.44,Default,,0000,0000,0000,,Opel knows how to test for this. Going\Nback to these, we worked on the Opel
Dialogue: 0,0:51:37.44,0:51:44.29,Default,,0000,0000,0000,,thing... I think the Opel case, it....\Nonce they actually upgrade the cars, and
Dialogue: 0,0:51:44.29,0:51:48.94,Default,,0000,0000,0000,,once the cars really show these great\Nvalues that the preliminary software
Dialogue: 0,0:51:48.94,0:51:53.24,Default,,0000,0000,0000,,showed, I think we can close the Opel\Ncase, but there's a lot of other cars
Dialogue: 0,0:51:53.24,0:51:59.94,Default,,0000,0000,0000,,still to look at, and really, I mean...\Nthe effort to do this does not scale to so
Dialogue: 0,0:51:59.94,0:52:05.96,Default,,0000,0000,0000,,many cars, so we need to do something more\Nfundamentally to improve the situation.
Dialogue: 0,0:52:05.96,0:52:12.24,Default,,0000,0000,0000,,What I found out is that digital control\Nsystems, they are black boxes. The
Dialogue: 0,0:52:12.24,0:52:17.59,Default,,0000,0000,0000,,manufacturers have designed them to be\Nblack boxes. They even boast to you that
Dialogue: 0,0:52:17.59,0:52:22.06,Default,,0000,0000,0000,,they are 7,000 parameter in there and no\Nhacker can understand this and it's a very
Dialogue: 0,0:52:22.06,0:52:26.91,Default,,0000,0000,0000,,sophisticated problem. They are designed\Nto be black box, and this is not just true
Dialogue: 0,0:52:26.91,0:52:31.65,Default,,0000,0000,0000,,for Opel, this is true for all car\Nmanufacturers. Nobody wants anyone to look
Dialogue: 0,0:52:31.65,0:52:37.93,Default,,0000,0000,0000,,into their ECUs, and people seem to be ok\Nwith that. Like they think "Oh this is so
Dialogue: 0,0:52:37.93,0:52:40.85,Default,,0000,0000,0000,,complicated, there are so many German\Nengineers working on
Dialogue: 0,0:52:40.85,0:52:46.04,Default,,0000,0000,0000,,this problem, they must have found a great\Nsolution." So we are trusting these black
Dialogue: 0,0:52:46.04,0:52:53.12,Default,,0000,0000,0000,,boxes and we are not able to review the\Nblack boxes that we put into our cars and
Dialogue: 0,0:52:53.12,0:52:59.13,Default,,0000,0000,0000,,we have to trust the manufacturer to do\Nthe right thing and currently, the
Dialogue: 0,0:52:59.13,0:53:03.85,Default,,0000,0000,0000,,investigation to do this without\Nassistance from the manufacturer, it does
Dialogue: 0,0:53:03.85,0:53:11.94,Default,,0000,0000,0000,,not scale. We can do it but... the\Nmanufacturers can put more security on
Dialogue: 0,0:53:11.94,0:53:18.37,Default,,0000,0000,0000,,their ECUs... it probably can be broken,\Nbut it takes a lot more time, so it simply
Dialogue: 0,0:53:18.37,0:53:23.58,Default,,0000,0000,0000,,does not scale sufficiently. The issue is\Nblack boxes are really powerful, right.
Dialogue: 0,0:53:23.58,0:53:27.60,Default,,0000,0000,0000,,Black boxes can hurt people with, for\Nexample, excessive emissions. They can
Dialogue: 0,0:53:27.60,0:53:33.16,Default,,0000,0000,0000,,kill people if we think think about\Nautonomous cars that do mistakes. So what
Dialogue: 0,0:53:33.16,0:53:40.06,Default,,0000,0000,0000,,we do need, I think, is more transparency.\NA system that can kill people needs to be
Dialogue: 0,0:53:40.06,0:53:43.88,Default,,0000,0000,0000,,reviewable by the people. I think this is\Na very important thing.
Dialogue: 0,0:53:43.88,0:53:52.76,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:53:52.76,0:53:56.73,Default,,0000,0000,0000,,So, to have a system that can kill
Dialogue: 0,0:53:56.73,0:54:02.05,Default,,0000,0000,0000,,people... to have it reviewable by the\Npeople, we need to do things. For example,
Dialogue: 0,0:54:02.05,0:54:06.55,Default,,0000,0000,0000,,we need... we want access to source code\Nfor reviews. It doesn't necessarily mean
Dialogue: 0,0:54:06.55,0:54:11.21,Default,,0000,0000,0000,,we want open source, but we don't ask at\Nall the car manufacturers to open source
Dialogue: 0,0:54:11.21,0:54:15.14,Default,,0000,0000,0000,,all the software. That's not what I'm\Ntalking about. What we need is... think
Dialogue: 0,0:54:15.14,0:54:18.87,Default,,0000,0000,0000,,about how Microsoft is sharing source code\Nof Windows with universities or other
Dialogue: 0,0:54:18.87,0:54:25.53,Default,,0000,0000,0000,,countries. We need experts to look at the\Nsource code, and we want control software
Dialogue: 0,0:54:25.53,0:54:30.13,Default,,0000,0000,0000,,that is reviewable by design, that has a\Nlot of documentation, that has good
Dialogue: 0,0:54:30.13,0:54:34.24,Default,,0000,0000,0000,,comments, that is human readable code. I\Ndon't want to see a disassembly, I want to
Dialogue: 0,0:54:34.24,0:54:38.46,Default,,0000,0000,0000,,see the source, the MATLAB, or whatever\Nthey are using to define the functionality
Dialogue: 0,0:54:38.46,0:54:44.30,Default,,0000,0000,0000,,source, and read that. And I want to\Nunderstand why did they choose that
Dialogue: 0,0:54:44.30,0:54:49.15,Default,,0000,0000,0000,,curve of that map in this way? What was\Nthe design criteria? That needs to be
Dialogue: 0,0:54:49.15,0:54:55.04,Default,,0000,0000,0000,,reviewed. And we need transparency for\Ncontrol software decisions, which means
Dialogue: 0,0:54:55.04,0:55:02.71,Default,,0000,0000,0000,,that if a car operates in a certain way,\Nif I'm driving that car, I want to choose
Dialogue: 0,0:55:02.71,0:55:07.30,Default,,0000,0000,0000,,that I can log what the car is doing, for\Nexample by putting
Dialogue: 0,0:55:07.30,0:55:10.74,Default,,0000,0000,0000,,in, I don't know, a USB stick or something\Nif it's my car, and then the car will log
Dialogue: 0,0:55:10.74,0:55:17.07,Default,,0000,0000,0000,,all the data to that. That is... in the\Nend that allows me to reconstruct any
Dialogue: 0,0:55:17.07,0:55:21.78,Default,,0000,0000,0000,,decision that the software does. I think\Nthis is required to have the necessary
Dialogue: 0,0:55:21.78,0:55:31.07,Default,,0000,0000,0000,,transparency, that allows us to un-\Nblackbox these devices. All right.
Dialogue: 0,0:55:31.07,0:56:00.94,Default,,0000,0000,0000,,Thank you very much.\N{\i1}applause{\i0}
Dialogue: 0,0:56:00.94,0:56:04.18,Default,,0000,0000,0000,,Okay, I actually finished five minutes\Nearly. I didn't think this would happen,
Dialogue: 0,0:56:04.18,0:56:06.05,Default,,0000,0000,0000,,so...\NHerald: I'm so surprised.
Dialogue: 0,0:56:06.05,0:56:07.70,Default,,0000,0000,0000,,F: I am surprised too.\NHerald: You are on time. You have five
Dialogue: 0,0:56:07.70,0:56:09.60,Default,,0000,0000,0000,,minutes left\NF: Wow, what do I do with these five
Dialogue: 0,0:56:09.60,0:56:12.16,Default,,0000,0000,0000,,minutes\NHerald: We can walk around the stage or...
Dialogue: 0,0:56:12.16,0:56:15.39,Default,,0000,0000,0000,,Maybe people have some questions?\NF: I think so!
Dialogue: 0,0:56:15.39,0:56:24.02,Default,,0000,0000,0000,,Herald: Well, let's ask the Internet! Is\Nthe Internet ready?
Dialogue: 0,0:56:24.02,0:56:28.85,Default,,0000,0000,0000,,Signal Angel: Yes. Our first question:\NWhat dou you think is the responsibility
Dialogue: 0,0:56:28.85,0:56:32.93,Default,,0000,0000,0000,,of Bosch as a supplier for having their\Nsoftware and hardware used for this?
Dialogue: 0,0:56:32.93,0:56:37.35,Default,,0000,0000,0000,,F: So the question was: What's the\Nresponsibility for Bosch, who built the
Dialogue: 0,0:56:37.35,0:56:42.77,Default,,0000,0000,0000,,software for Volkswagen? It's a good\Nquestion and I have to be careful in what
Dialogue: 0,0:56:42.77,0:56:47.94,Default,,0000,0000,0000,,I answer. My personal opinion, and let's\Ntake this aside from Volkswagen and Bosch,
Dialogue: 0,0:56:47.94,0:56:52.28,Default,,0000,0000,0000,,is that if you build software that you\Nknow is used to be illegally it should...
Dialogue: 0,0:56:52.28,0:56:57.39,Default,,0000,0000,0000,,it must be your responsibility to not do\Nthat. And I'm not sure if this is
Dialogue: 0,0:56:57.39,0:57:03.88,Default,,0000,0000,0000,,something that is legally enforceable, but\Nit should be something that's enforceable
Dialogue: 0,0:57:03.88,0:57:10.54,Default,,0000,0000,0000,,ethically or for all of us programmers,\Nthat we don't build software that is
Dialogue: 0,0:57:10.54,0:57:17.34,Default,,0000,0000,0000,,designed to break the law.\N{\i1}applause{\i0}
Dialogue: 0,0:57:17.34,0:57:20.84,Default,,0000,0000,0000,,Herald: We quickly hop over to microphone\N1 please.
Dialogue: 0,0:57:20.84,0:57:25.44,Default,,0000,0000,0000,,Microphone: Thank you for a wonderful\Ntalk. I'm just wondering if you're aware
Dialogue: 0,0:57:25.44,0:57:30.72,Default,,0000,0000,0000,,of some cases of Volkswagen cars in\NAustralia, which was suffering from sudden
Dialogue: 0,0:57:30.72,0:57:35.74,Default,,0000,0000,0000,,and rapid power loss. This was happening\Nabout five years ago and there was a case
Dialogue: 0,0:57:35.74,0:57:41.51,Default,,0000,0000,0000,,where a Volkswagen suffered rapid power\Nloss on a motorway. The driver was Mrs.
Dialogue: 0,0:57:41.51,0:57:47.99,Default,,0000,0000,0000,,Melissa Ryan and she was rear-ended by a\Ntruck and killed. So when you say that
Dialogue: 0,0:57:47.99,0:57:52.98,Default,,0000,0000,0000,,these things can cause death, were you...\Nare you aware that any sort of Volkswagen
Dialogue: 0,0:57:52.98,0:57:58.15,Default,,0000,0000,0000,,software has been leading to power loss in\Nthe vehicles and affecting
Dialogue: 0,0:57:58.15,0:58:02.01,Default,,0000,0000,0000,,performance on the road, now I don't know\Nwhether Australian driving conditions are
Dialogue: 0,0:58:02.01,0:58:06.20,Default,,0000,0000,0000,,different to European driving conditions,\Nand how that might affect that. Have you
Dialogue: 0,0:58:06.20,0:58:10.69,Default,,0000,0000,0000,,done any tests that might indicate that\Ncould be happening in normal driving?
Dialogue: 0,0:58:10.69,0:58:14.90,Default,,0000,0000,0000,,F: Yeah, so... the question was whether\NI'm aware of, I think an Australian
Dialogue: 0,0:58:14.90,0:58:17.29,Default,,0000,0000,0000,,incident, right, where...\NM1: Can I...
Dialogue: 0,0:58:17.29,0:58:20.92,Default,,0000,0000,0000,,F: Yeah.\NM1: There were many reported cases. One of
Dialogue: 0,0:58:20.92,0:58:23.65,Default,,0000,0000,0000,,them was fatal, but there were many\Nreported cases of that happening.
Dialogue: 0,0:58:23.65,0:58:28.00,Default,,0000,0000,0000,,F: Of a sudden power loss, is that right?\NM1: Sudden and rapid power loss in the
Dialogue: 0,0:58:28.00,0:58:31.00,Default,,0000,0000,0000,,engine.\NF: Yeah, of the engine. I'm not aware of
Dialogue: 0,0:58:31.00,0:58:38.85,Default,,0000,0000,0000,,these incidents and I what I do know\Nand... is that the the personal safety is
Dialogue: 0,0:58:38.85,0:58:43.32,Default,,0000,0000,0000,,the number one design criteria for ECUs.\NThat does not mean that they are perfect,
Dialogue: 0,0:58:43.32,0:58:47.21,Default,,0000,0000,0000,,of course, that could mean that rare\Nbugs... that there could be malfunctions.
Dialogue: 0,0:58:47.21,0:58:53.01,Default,,0000,0000,0000,,I don't know about this, but at least it's\Nthe first design principle to provide the
Dialogue: 0,0:58:53.01,0:58:58.05,Default,,0000,0000,0000,,safety for the people driving the car,\Nwhich i think is a good thing, right. It's
Dialogue: 0,0:58:58.05,0:59:02.04,Default,,0000,0000,0000,,not the profit or anything, or at least we\Ncan hope so. I'm not aware of this
Dialogue: 0,0:59:02.04,0:59:07.51,Default,,0000,0000,0000,,particular incidence, and so I can't\Nreally say anything more about this. It
Dialogue: 0,0:59:07.51,0:59:11.69,Default,,0000,0000,0000,,would be great if... Are you aware of any\Nadditional details that were found in the
Dialogue: 0,0:59:11.69,0:59:16.29,Default,,0000,0000,0000,,investigation, please sent them to me.\NM1: Volkswagen was claiming that this was
Dialogue: 0,0:59:16.29,0:59:20.66,Default,,0000,0000,0000,,a gearbox problem on automatic cars, but\Nthen it started happening on manual cars
Dialogue: 0,0:59:20.66,0:59:24.59,Default,,0000,0000,0000,,as well, so that excuse went out of the\Nwindow.
Dialogue: 0,0:59:24.59,0:59:27.43,Default,,0000,0000,0000,,F: The issue with the problems is that\Nmost of them are very complex, so they
Dialogue: 0,0:59:27.43,0:59:32.58,Default,,0000,0000,0000,,probably involve more than just the engine\NECU, so they're very... but it's a
Dialogue: 0,0:59:32.58,0:59:37.45,Default,,0000,0000,0000,,good example of where we need to\Nunderstand exactly what is happening, and
Dialogue: 0,0:59:37.45,0:59:42.20,Default,,0000,0000,0000,,where we may not want to rely on\NVolkswagen or any other manufacturer alone
Dialogue: 0,0:59:42.20,0:59:48.79,Default,,0000,0000,0000,,to assist in figuring out what happens. We\Nneed more transparency there so that we
Dialogue: 0,0:59:48.79,0:59:54.04,Default,,0000,0000,0000,,can have definitely neutral accident\Ninvestigations.
Dialogue: 0,0:59:54.04,0:59:58.41,Default,,0000,0000,0000,,Herald: This was a long question and\Nreally detailed answer. Thank you very
Dialogue: 0,0:59:58.41,1:00:00.41,Default,,0000,0000,0000,,much.\NF: Sorry, I will be short
Dialogue: 0,1:00:00.41,1:00:06.60,Default,,0000,0000,0000,,Herald: Felix, that's your applause\N{\i1}applause{\i0}
Dialogue: 0,1:00:06.60,1:00:18.61,Default,,0000,0000,0000,,{\i1}music{\i0}
Dialogue: 0,1:00:18.61,1:00:31.00,Default,,0000,0000,0000,,subtitles created by c3subtitles.de\Nin the year 2018. Join, and help us!