10 years of Dieselgate

10 Years of Dieselgate: The Enduring Challenge of Automotive Emission Cheating

Speakers: Felix Domke, Karsten Burger

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=py37TT6PxW4

Overview

A decade after the initial "Dieselgate" scandal rocked the automotive industry, security researchers Felix Domke and Karsten Burger revisit the pervasive issue of defeat devices in vehicle emission control systems. Their talk, "10 years of Dieselgate," delivered at 39C3, delves into the intricate technical mechanisms manufacturers employ to circumvent emissions regulations, revealing that Volkswagen's actions were not an isolated incident but rather indicative of a systemic problem across the industry. This presentation offers a deep technical dive into various Engine Control Unit (ECU) firmware implementations, showcasing how vehicles are programmed to exhibit vastly different emission behaviors during laboratory testing compared to real-world driving.

The speakers, both experts in reverse engineering and automotive forensics, illustrate the evolution of these sophisticated cheating mechanisms. What began as simple "acoustic functions" evolved into complex, multi-parameter detection systems designed to precisely identify regulatory test cycles and manipulate engine and after-treatment operations. The talk highlights the enduring challenge of ensuring automotive transparency and accountability, particularly as vehicle software grows in complexity and impact. It serves as a critical reminder that despite significant public and regulatory attention, the underlying issues that enabled Dieselgate remain largely unaddressed, necessitating urgent calls for greater transparency and independent review of control software.

Background

▶ Watch: Introduction to Dieselgate and initial reverse engineering (0:00)

The genesis of the Dieselgate scandal lies in the inherent conflict faced by diesel engine manufacturers: the "triangle conflict" of performance, cleanliness, and economy. Diesel engines, known for their high compression and fuel efficiency, inherently produce higher levels of certain pollutants compared to petrol engines. While solutions for carbon monoxide, hydrocarbons, and particulate matter (soot) have been largely implemented through technologies like catalyzers and diesel particulate filters (DPF) (especially with Euro 5 standards), the persistent challenge has been nitrogen oxides (NOx). NOx emissions are particularly problematic as they are harmful to human health, contributing to respiratory issues.

NOx forms at high combustion temperatures and with excess oxygen, conditions that optimize engine efficiency. Reducing NOx typically requires compromising on fuel efficiency or drivability. Early attempts included Exhaust Gas Recirculation (EGR), which feeds exhaust gas back into the engine to lower combustion temperatures. More advanced post-engine treatment systems include NOx storage catalysts and, most effectively, Selective Catalytic Reduction (SCR) systems, which use an AdBlue (urea-based) fluid sprayed into the exhaust to convert NOx into harmless nitrogen and water. However, these systems add significant cost, complexity, and require user maintenance (refilling AdBlue).

The legislative landscape, particularly in Europe with its rapidly evolving Euro standards (Euro 1 through Euro 6), continuously pushed for lower NOx limits. While lab tests indicated compliance, real-world measurements, especially for Euro 5 and early Euro 6 standards, consistently showed actual NOx emissions several times higher than legal limits. This discrepancy fueled suspicion and eventually led to the discovery of defeat devices. The talk emphasizes that this problem was not exclusive to Volkswagen; data presented by Karsten Burger shows that many manufacturers struggled with real-world NOx emissions, with some performing significantly worse than others even post-scandal. The core problem, as the speakers explain, is that NOx reduction directly conflicts with the desire for low fuel consumption, smooth engine operation, and silent performance, forcing engineers into a corner where they often chose to optimize for test conditions rather than real-world driving.

Key Findings

▶ Watch: Understanding NOx: The central problem of Dieselgate (4:00)

The talk presents several critical findings that underscore the systemic nature and evolving sophistication of emission defeat devices:

1. Widespread Industry Practice: Contrary to the public perception that Dieselgate was solely a Volkswagen issue, the speakers demonstrate that similar defeat devices, employing diverse technical strategies, have been identified across numerous other automotive manufacturers. This indicates a broader industry-wide tendency to optimize for regulatory test cycles rather than consistent real-world emission control.
2. Evolution of Defeat Device Complexity: From their origins as simple "acoustic functions" in 2002 that subtly influenced pilot injections for sound quality, these devices rapidly evolved. They incorporated increasingly sophisticated detection mechanisms, such as driving curves matching specific test cycle profiles, and later, checks for specific driving parameters like steering wheel angle to differentiate lab conditions from real driving.
3. Multi-faceted Manipulation of Emission Systems: Defeat devices manipulate various aspects of engine operation and exhaust after-treatment. This includes altering EGR rates, disabling or enabling catalyst heating modes, and intentionally limiting AdBlue dosing in SCR systems to reduce operational costs or extend service intervals, all at the expense of real-world emission reduction.
4. Strategic Exploitation of Regulatory Loopholes: The presentation highlights how manufacturers exploit ambiguities or specific conditions in regulations. The "two-stage type approval" for motorhomes, for instance, allows base vehicles to be certified under light, "naked" conditions, while the much heavier, fully equipped versions are approved without re-testing, leading to drastically higher real-world emissions.
5. Lack of Transparency as a Core Enabler: A central theme is the opacity of automotive software. Without access to source code, detailed binary structures, or comprehensive function documentation, independent experts face immense challenges in reverse engineering and proving the existence of defeat devices. This lack of transparency allows manufacturers to implement complex, hidden logic without effective external scrutiny.

Technical Deep Dive

▶ Watch: Discrepancy: NOx legislation vs. real-world emissions (7:45)

The technical deep dive into ECU firmware and defeat device mechanisms forms the core of the presentation, showcasing the intricate ways manufacturers have gamed emissions tests. Felix Domke's expertise in reverse engineering is evident as he dissects several examples.

Volkswagen's "Acoustic Function" (EDC16):

The talk begins by tracing the infamous "acoustic function" within Volkswagen's EDC16 (Electronic Diesel Control) software.

• Early Stages (2002): Initially, this function was genuinely acoustic, dealing with a flap to prevent "undesirable acoustic change." It had no emission impact.
• Emission Impact (2003): A significant change occurred in 2003 with the addition of an "acoustic package" influencing injection characteristics shortly after start. This involved pilot injections – small fuel injections before the main injection that improve engine sound (reducing "diesel knock") but lower fuel efficiency. The acoustic function learned to disable these pre-injections under specific conditions, leading to higher fuel efficiency (and lower CO2) but a less pleasant engine sound.
• Test Cycle Detection (2007): The system evolved with the introduction of driving curves. These are pre-programmed upper and lower bounds for expected driven distance over engine runtime, designed to match regulatory test cycles. If the vehicle's driving behavior falls within these curves, it's likely on a test stand. Later, the system expanded to 7 and then 10 curves to support various test cycles, including North American standards.
• Real-world Differentiation: To counter false positives (where normal driving might briefly match a test curve), Volkswagen added a check for steering wheel angle. If the steering wheel moved, the car was deemed to be in real-world operation, not a lab.
• Expanded Control: Crucially, this "acoustic function" was later extended to control Exhaust Gas Recirculation (EGR). In test mode, it would increase EGR to reduce NOx emissions, sacrificing drivability and fuel efficiency. In regular operation, it would reduce EGR, prioritizing efficiency and performance, but leading to higher NOx. This allowed VW to avoid more expensive SCR catalyst systems.

Defeat Device in Another Manufacturer (EGR & SCR):

Domke presented an example from a different manufacturer involving a PowerPC CPU. This device enabled a more fuel-efficient engine mode (producing higher NOx) without ensuring the SCR catalyst was ready to remove the excess NOx. The SCR catalyst requires a certain temperature and sufficient AdBlue fluid to be effective. The software would switch to this efficient mode regardless of catalyst readiness, leading to high tailpipe emissions when the catalyst was cold or AdBlue was low. The detection mechanism here involved environmental parameters (temperature, atmospheric pressure) and specific engine operating points (RPM, torque) rather than full driving cycle matching.

Gearbox ECU Manipulation:

A more unusual example involved a gearbox ECU from an automated gearbox, running on an SH2 CPU. Reverse engineering this firmware was complex due to its unstructured nature. Researchers observed the gearbox switching from a "warm-up" mode to a "DS" (drive sport) mode under specific driving activities, such as exceeding lateral acceleration (driving a curve), a "kickdown" event (sudden acceleration from standstill), or using reverse gear. Notably, this switch was not temperature-related, despite the "warm-up" name, and the gearbox could not return to warm-up mode once in DS. In DS mode, the gearbox used a different gear profile, typically running at higher RPMs in lower gears for better drivability, but resulting in different, often higher, emissions compared to the lower-RPM, higher-gear profile used in the "warm-up" (test) mode. Initial tests showed small changes, but later tests revealed significant emission increases when the car was "kicked out" of warm-up mode, exceeding regulatory limits.

Catalyst Heating Mode (Highly Specific Checks):

This example revealed another defeat device accidentally triggered during the gearbox testing. The engine firmware contained highly specific checks to enable a catalyst heating mode. These checks included a long list of parameters: "20 to 40 meters after starting off driving," ambient temperature between 25-30°C, RPM between 920-2000, and specific turbocharger temperatures, among others. This mode actively heats the SCR catalyst by injecting more fuel, which increases fuel usage but ensures the catalyst reaches its operating temperature quickly. In regular driving, if any of these highly specific conditions were not met (e.g., moving the car a few meters outside the 20-40m window), the catalyst heating mode would not enable, leading to high emissions from a cold catalyst. This demonstrates an optimization for a very narrow, lab-specific driving scenario, rather than for real-world necessity.

AdBlue Dosing Manipulation (Persistent Switch):

Another manufacturer's system detected the end of the Extra Urban Driving Cycle (EUDC), the high-speed part of the test cycle, using a finite state machine and hard-coded tables matching average speed over time. Upon detection, it would set a persistent internal flag for 60 kilometers. This flag influenced AdBlue dosing in the SCR system. In test mode, it would dose the correct, higher amount of AdBlue, resulting in low NOx emissions. However, in regular driving (with the test mode off), the software would intentionally limit AdBlue consumption to a fixed target of 550 ml per 1000 kilometers. This figure was derived from calculating the amount needed to last 20,000 km (a typical maintenance interval) from a 17-liter AdBlue tank, minus some for diagnostics. This 0.55 L/1000km is significantly below the physically necessary 1.5-2.5 L/1000km, leading to drastically higher NOx emissions in real-world driving.

Exhaust Mass Flow Limits:

One manufacturer's SCR system showed very poor real-world efficiency (often below 50%). Investigation revealed that if the exhaust mass stream (kilograms per hour of emissions) exceeded a certain limit, the software would simply "give up," assuming the catalyst couldn't handle the load, and would cease or reduce AdBlue dosing. A later software update, forced upon the manufacturer, significantly improved SCR efficiency to 80-90% with the same hardware, simply by increasing AdBlue consumption to roughly twice the original amount. This suggests intentional downrating based on an arbitrary usage limit rather than actual hardware capability.

General Test Cycle Detection & Simple Cheats:

Other examples include systems that reduce EGR if the air conditioning (AC) is turned on (AC is typically off during emissions tests) or if the car is not driven within a specific speed range. A luxury car, noted for having "horrible emissions" (double-digit multiples of the regulatory limit), was found to have a down-tuned SCR catalyst due to cost-cutting, demonstrating that even without complex detection, intentional under-engineering can constitute a defeat device.

Forensic Methodology:

Karsten Burger detailed the rigorous methodology required for legal proceedings. This involves combining software analysis (using disassemblers to reconstruct functions and data from binary firmware, identifying 20,000 data constants and 10,000 variables) with blackbox testing (real-world and test bench measurements). The goal is to establish causal factors – direct links between software logic and emission changes – rather than mere correlations, which are insufficient for legal proof. This interdisciplinary effort requires expertise in physics, chemistry, car electronics, control systems, combustion engines, and emission regulations. Burger emphasized the immense effort involved, often working with 20,000-page function documentations and the complete lack of cooperation from car manufacturers in Germany.

Demo / Proof of Concept

▶ Watch: Overview of different vehicle emissions measurement methods (8:30)

While the talk did not feature a live, interactive demonstration of a tool, the speakers presented extensive evidence and results from their own proof-of-concept (PoC) reverse engineering and testing work. This effectively served as a demonstration of their findings and methodologies.

Key elements of the "demo" included:

• Firmware Analysis Visualizations: Screenshots and diagrams derived from disassembler output, illustrating the internal logic of the ECU software. For instance, the talk showed how the "acoustic function" in the Volkswagen EDC16 firmware evolved, with specific code snippets or logic paths highlighted.
• Driving Curve Overlays: Visual overlays of the actual regulatory driving cycles (e.g., NEDC) against the "driving curves" found within the vehicle firmware. These graphs clearly demonstrated how the internal software bounds perfectly matched the prescribed test cycles, providing direct evidence of test cycle detection logic.
• Logged Driving Data & Emission Measurements: Graphs and data logs from real-world driving and controlled lab tests. These illustrated:
• The different gear profiles used by the gearbox ECU in "warm-up" versus "DS" modes, and the resulting changes in engine speed and emissions.
• The effect of "kicking" a car out of its "warm-up" mode, showing how a small change in driving style led to significant emission increases.
• AdBlue dosing rates in normal driving versus test mode, graphically depicting the intentional limitation of AdBlue consumption (e.g., the 0.55 L/1000km target) and the subsequent rise in tailpipe NOx emissions when the test mode was deactivated.
• Comparisons of SCR efficiency before and after a forced software update, showing how a simple change in software (increasing AdBlue dosing) could dramatically improve real-world emission reduction with the same hardware.
• Specific Parameter Checks: The speakers presented the detailed, highly specific conditions (e.g., "20 to 40 meters after starting," precise temperature and RPM ranges) found in firmware that enabled or disabled features like catalyst heating mode only under lab-like conditions.

These visual and data-driven proofs of concept, stemming from meticulous software analysis and controlled physical measurements, provided compelling evidence for the existence and operation of the described defeat devices across various manufacturers and systems.

Defensive Implications

▶ Watch: Technical explanation of NOx and particle formation (10:00)

The detailed exposure of these defeat devices carries profound implications for regulators, manufacturers, and consumers, highlighting critical areas for defensive action and systemic change.

1. Mandatory Software Transparency and Review: The most urgent call from the speakers is for greater transparency in automotive software. This doesn't necessarily mean open-sourcing proprietary code, but rather mandating that manufacturers deposit the complete binary structure and comprehensive function documentation (e.g., like the 20,000-page Bosch documentation mentioned) when seeking type approval. This would enable independent experts to review the code for defeat devices proactively. Furthermore, control software should be designed with reviewability in mind from the start, including human-readable code and mechanisms to log the reasons behind software decisions.
2. Strengthening Regulatory Frameworks: The "two-stage type approval" loophole, exemplified by motorhomes being approved based on a lighter, naked base vehicle, demonstrates weaknesses in current regulations. Laws need to be clearer, more robust, and less susceptible to exploitation. Regulations should mandate real-world emissions testing as the primary standard, not just laboratory compliance, and incorporate robust checks against software manipulation.
3. Independent Verification and Testing: Regulators must move beyond relying solely on manufacturer-provided data. Independent bodies need greater resources and mandates to conduct thorough software analysis alongside real-world emissions testing. The speakers advocate for the publication of all remote sensing measurements (e.g., laser measurements on roads), which would immediately expose polluting vehicles and incentivize compliance.
4. Interdisciplinary Expertise in Enforcement: Proving defeat devices in court requires a rare blend of expertise in software reverse engineering, automotive electronics, combustion physics, chemistry, control systems, and legal frameworks. There is a critical need to foster and support this interdisciplinary field, potentially through dedicated research programs or independent expert networks, to provide the robust causal evidence required for prosecution.
5. Prevention Over Prosecution: The speakers advocate for a shift from costly, reactive court proceedings to proactive prevention through better rules and transparency. If manufacturers know their software will be rigorously reviewed, the incentive to implement defeat devices diminishes significantly.
6. Consumer Awareness and Recourse: Consumers need to be aware that advertised fuel efficiency and emission figures may not reflect real-world performance. Legal frameworks should provide clearer recourse for consumers whose vehicles perform far below advertised environmental standards.
7. Ethical Software Engineering: The persistent nature of these defeat devices points to a cultural issue within some parts of the automotive engineering sector. Promoting ethical software development practices, where safety and environmental compliance are prioritized over cost-cutting and regulatory circumvention, is essential.

Key Takeaways

• The "Dieselgate" scandal was not an isolated incident; sophisticated defeat devices are a systemic problem across the automotive industry, evolving over the past decade.
• Manufacturers employ complex, multi-parameter detection systems (e.g., driving curves, steering wheel angle, specific environmental conditions) to identify and exploit regulatory test cycles.
• Emission control systems like EGR, pilot injections, SCR (AdBlue dosing), and catalyst heating strategies are deliberately manipulated to prioritize fuel efficiency, drivability, or cost over real-world NOx reduction.
• A critical lack of transparency in automotive ECU software and documentation, combined with regulatory loopholes (like "two-stage type approval"), enables these illicit practices to persist.
• Effective detection and legal prosecution of defeat devices demand deep reverse engineering expertise, meticulous software analysis, and rigorous real-world emission testing, requiring an interdisciplinary approach.
• Urgent reforms are needed, including mandatory deposition of binary software structures and function documentation, proactive independent software review, stronger real-world testing mandates, and greater transparency of emission data to prevent future cheating.

About the Speaker(s)

Felix Domke is a renowned security researcher and reverse engineer with a long history of investigating automotive software. He gained significant public attention for his work on the Dieselgate scandal, having previously delivered talks on the topic in 2015 and 2016. His expertise lies in dissecting complex embedded systems, particularly ECU firmware, to uncover hidden functionalities and vulnerabilities.

Karsten Burger is an expert advisor specializing in automotive forensics, often working with legal courts. His work involves in-depth software analysis of ECUs to provide causal evidence for legal proceedings. He emphasizes the critical need for an interdisciplinary approach, combining expertise in physics, chemistry, car electronics, control systems, and legal frameworks to effectively identify and prove the existence of defeat devices.