EMFI-Triggered Software Faults

Can They Drive a Car Crazy?

- By Colin O'Flynn

This article follows up on some previous work presented about using electromagnetic fault injection (EMFI) for triggering bugs in an automotive ECU which appeared to make it open up the throttle without the user pushing the pedal. While the previous research was done on a workbench, now Colin takes his tests to a running car and reports on his findings.

Back in my January 2021 article “Finding a $Billion Dollar Fault Mode” (Circuit Cellar 366), I described some work I did to try and track down what I believed to be an elusive ECU “bug” [1]. The term bug is used loosely, as really it was some form of corrupted data triggering unintended throttle control problems, and I was using an electromagnetic fault injection (EMFI) tool to trigger these modes.

In this article, I'm going to wrap up that work by discussing some additional tests I conducted over the past few years. But as some readers may not have been with me for the initial article (or your memory of an article you read four years ago isn't perfect), I'll quickly summarize what led me down this path, and what we can learn about safety-critical design.

UNINTENDED BEGINNINGS

The core of my bug hunting was to try and see if I could validate the claim that cars with electronic throttles can unintentionally accelerate without the user depressing the throttle. Such events are high-stress and rare, which make them difficult to prove, and if the car works perfectly afterwards, was someone just pushing the wrong pedal? Cases of “pedal misapplication” are known, but is every event driver error, or is there a reasonable chance some could be software or hardware failures?

The technical reason we might suspect it could be a software bug is because of the control loop shown in Figure 1. You can see there is no physical connection between the accelerator pedal and the throttle; this is all managed in software running on the controller.