Have I Stumbled on an Emissions Test Defeat Device in MEMS3?

[revilla]

As you may know, I've been working on reverse-engineering the MEMS3 (Caterham K Series EU3) ECU for some time now. I've now got to the point where I have enough of the code properly identified, annotated and understood that I can start to work on particular routines and features in detail. Because of something else I was needing to look into for somebody, I recently set about reverse-engineering the air fuel ratio calculations.

There's rather a lot of it! This is just the base AFR calculation, not taking into account enrichments for low temperature, after start etc. These are all applied as adjustments to the calculated injector pulse width rather than a change to the target AFR. There's a full article on the calculation on my website here which lists all of the gory details: https://andrewrevill.co.uk/MEMS3AirFuelRatioCalculation.htm.

However, there was one piece of code which caught my attention. Initially I could not understand what it was doing.

It's kind of a bolt-on at the end of the AFR calculation, and because of this code, under some circumstances the ECU will perform the full AFR calculation and then just discard the results and run exactly stoichiometric, Lambda 1. It's coded as a state machine with 5 states, here's the diagram that describes it:

It's a bit twisted to get your head around, but here is what it actually does:

• When the ECU first boots, the ECU initially runs normally.
• It starts a countdown timer.
• The countdown timer only counts down while the RPM is between two limits. In the diagram above they're 1200rpm and 6000rpm which are the values in my VVC ECU.
• The contdown timer only counts down while the ECU is requesting enrichment below Lamba 1.
• While the timer is running, at any point in the specified RPM range, the ECU is locked to Lambda 1.
• If at any point you rev it beyond the upper limit of the range, the timer is cancelled and the ECU goes back to normal behaviour.
• Once the timer expires or is cancelled, the ECU runs normally forever - until it is next rebooted, e.g. by an extended power-off.

I was mystified as to what this was for, but in my VVC ECU the timer is set to 0 seconds, which basically means the feature isn't used (the timer will expire as soon as it is started) and this means the other numbers might not be typical of what was intended. So I set about looking in all the maps in my library to see if this feature was actually used anywhere, and this is what I found:

• In all MG Rover cars other than those below, and all of the specific Caterham maps, it was disabled with the timer set to 0 (like on my own ECU).
• In Rover 75 / MG ZT maps, it was set to operate between 2350rpm and 4000rpm, with the timer set to 30.
• In Freelander maps, it was set to operate between 2600rpm and 4200rpm, with the timer set to 1600.

So taking the case of the Rover 75 / MG ZT, this seems like a reasonable feature. I'm not sure exactly what the designers had in mind, maybe it was to prevent and basic AFR enrichments compounding with after-start enrichment leading to rich cuts. But after 30 seconds of normal driving in the midrange RPMs it was cancelled, so was only a startup transient effect.

But ...

Think what it means in the Freelander case.

• For the first TWENTY SIX MINUTES of driving time:
  •  In the range 2600rpm to 4200rpm (idle time isn't counted).
  • During which the ECU is requesting enrichment.
• The ECU is locked to Lambda 1 and is prevented from applying any of the normal enrichment.
• Unless you rev it out beyong 4200rpm, at which point the whole thing is immediately cancelled.

26 minutes is in no way a transient after-start effect.

The fact that it cancelled completely the first time you exceed 4200rpm, and isn't reinstanted when the revs drop back down, suggests its not important for normal driving. The first time you open the engine up, it reverts to apply all of the normal enrichments from that point onwards.

Initially I thought I must have got this wrong, so I took an original, unmodified, Freelander ECU and map and ran it up on my engine simulator to see how it actually behaved in real life. It did exactly what I had worked out from the program code, it really did lock the target Lambda at 1 for a full 26 minutes! Then it just cancelled the effect and left the ECU running normally. If I revved it up, it cancelled immediately, even if the engine was stone cold. And it would have been doing exactly the same on a real engine, on a car, on the road.

And the homologation emissions tests applied at the time all involved fixed drive cycles, which were in the range of 1400 to 1800 seconds duration, and probably included up to around 1600 seconds of regular midrange driving ...

I may be wrong, I'm not saying for sure that this WAS an emissions cheat, but it does feel as though an existing Rover 75 / MG ZT feature was abused, and the effect would have been to turn off the regular on-road enrichment for just long enough to complete an emissions test on first boot (provided the engine was kept within the midrange RPMs that would probably have been used on the test anyway to avoid the expected higher emissions when revving it hard).

I can't think of any other sensible reason to turn off the ECUs sophisticated AFR calculations for 26 minutes. If anyone would like to enlighten me then please do!

 

Edited January 4 by revilla

[revilla]

Video of it running on the Engine Simulator - Freelander ECU: 

 

[Colin_T]

Be interesting to see if when the above is active it also does anything ignition related alongside it.
Like retarding ignition to increase egt, or to alter co or hc. 
 

Is the condition only exited on >4200 rpm or is there a “and/or” engine load exceeds set amount E.g >40% tps ? 

[revilla]

Only seems to be exited above 4200rpm, or below 2600rpm if the ECU requests enrichment, but the base map doesn't provide for anything below stoich below 2600rpm so that shouldn't happen. It doesn't reference TPS or MAP for load at all in this piece. So far I can't see anything related on the igition side. Certainly nothing is directly synchronised to this, as in none of the variables are shared or referenced anythwere else. Doesn't mean there's not a separate process running alongside it though, I'll see if I can see anything.

Edited January 4 by revilla

[aerobod - near CYYC]

Perhaps you have discovered the early career of an ECU programmer who worked for BMW, was seconded to Rover, then later went to work for VW, Andrew? 😀

[Jonathan Kay]

Fascinating.

Is 1600/ 26 minutes used elsewhere for anything?

Jonathan

PS: 

1 hour ago, revilla said:

Only seems to be exited above 4200rpm...

Add a c in the right place and you're describing the owners...

[revilla]

No, I've just done a quick search and as far as I can see, that's the only scalar set to 1600 in the whole of the Freelander map, and it isn't referenced by any other code.

[john milner]

Could it be to do with engine temperature? If I am reading this correctly the Freelander would run cleaner for 26 minutes as it would have less fuel than the others so could this raise or lower the engine temperature? If so perhaps this has something to do with differing body shapes and getting engines up to temperature.

Emissions test beater seems most likely though. Possibly for company car tax purposes or some foreign market where Freelanders were the only cars with a K Series engine.

[ACFowles]

I wonder if Land Rover sales people were told to make sure a Freelander was "warmed up" before a test drive? 

[revilla]

If it was temperature related, the ECU would use temperature to control it. It has reads of coolant temperature, oil temperature, inlet air temperature, ambient temperature to play with. Just about everything else is modelled properly, from first principles. It even calculates the fuelling from the ideal gas equations and physical constants. A random 26 minutes isn't a warm up. It's linked to something that takes 26 minutes! I suppose it could have been to improve fuel economy on shopping cars that never get pushed hard, but it all feels funny to me. Especially the way it's just bolted onto the end of the calculation, almost as an afterthought. It does all of the full calculation, then arbitrarily at the end just says "naaaah, 14:7"!

[john milner]

A Freelander is a relatively heavy brick shaped car out of the K series models which may have an impact on short journey shopping cars. I do think though a cheat of some sort is most likely.

[SLR No.77]

I think calling it a cheat might be a bit of a stretch! It’s well known that maps are written to provide reduced emissions at very particular points in the range, often resulting in annoying flat spots, this may or may not be an adaptation of that concept.

The “cheat” devices employed by VW et al were capable of knowing when the vehicle’s emissions were being monitored and could change the complete ecu state to give the desired outcomes to the tests being done. Now that’s a proper cheat.

[john milner]

Only does it for a 26 minute point on one model so is unlikely to be for fixing flat spots etc. unless there is something unusual about Freelander usage. Whatever the reason it is by design not accident.

[revilla]

I know there were a few games being played. The rev limiter is set to let you briefly exceed the limit, then wind down. The initial limit is higher than the limit it settles at. I heard from someone who was directly involved in development that this was to improve the 0-60 times in press magazine reviews.