Having recently presented short seminars about electric vehicle technology at Top Tech Live, and at some other trade events, it has become clear that technicians are only slowly beginning to delve into the
world of electric and hybrid vehicle technologies.   

This month I have chosen a subject from a recent visit to NTN SNR at their Annecy plants in the Rhone alps region of France.
Last week found me at Lyon airport, thankfully not with Ryanair. There are seven plants, if my memory serves me correctly. It is a proud French company with global facilities in the far east, central Europe and the Americas. Their adopted company language is English- so much for Brexit and ill feelings. Take it from me it does not exist, except in the minds of the idiots we call politicians.
The company produces a huge range of bearings for a cross section of transport segments such as light vehicle and public transport. This includes the incredible demands of the TGV, commercial vehicles, and earth moving plant and aerospace such as Airbus and others.

This subject I hope, brings some reality into what is often expressed as an emotive opinion without substance or fact-based evidence.

We need to talk about security. Why? Because deliberately or not, its effects are mutating our opportunities within the automotive aftermarket. We need to understand more about it and, at some point, to try to anticipate the eventual set of circumstances to which it might lead. As they say, forewarned is forearmed.

We’ll begin by looking at an example of a recent security system and checking out its inner workings. We’ll review its potential vulnerabilities and assess the need for, and impacts of, increased security. First though, we’ll cover some general concepts, to keep in our minds the bigger picture regarding possible motivations for increased security.


Security
Security is the protection of things having value, where they might be at risk from theft or attack; i.e. when they have, or are perceived to have a vulnerability. Security aims to prevent an agent of ill-intent (e.g. criminals, intruders, missiles, or computer-viruses etc.) from gaining access. The consequence of this is the introduction of barriers to those requiring legitimate access, such as owners, occupiers, citizens or data-holders. This dichotomy is at the heart of all security implementation issues. This always begs the question; what level of security balances an intended degree of protection from risk, with the subsequent barriers to legitimate access or freedoms?

As the assessment of risk primarily determines the necessary level of security, it is not hard to imagine that superficially legitimate security concerns can be used to justify limiting access to a favoured group. It’s a simple trick, just inflate the perceived risks and exaggerate the vulnerabilities where necessary. A similar mechanism can be used in a health and safety environment, where legitimate but undesirable behaviours in the eyes of the decision makers can be quashed by deliberate overstatement of the perceived risks. When loaded with the weight of moral absolutes (“lives are at stake”), the arguments seem powerful but are they really intended to shut-down reasoned debate regarding the actual risks? Anyway, the point is, we cannot have a reasonable discussion regarding proportionate levels of security without being able to properly assess potential vulnerabilities and associated risks.


Immobilisation
Vehicle immobiliser systems have been developed to protect vehicles from theft. There is a clear need for the security as the risks are very real. Car thefts were far more common prior to their development. Such systems work by only allowing vehicle mobilisation when a key, placed in the ignition switch, is from the unique set authorised to start the vehicle. The following describes a representative immobiliser system and its behaviour during ignition-on and engine-start conditions, just after the car has been unlocked. As we will be discussing potential vulnerabilities, the make and model is not given.

Component-wise, such systems usually consist of a transponder in the key head, a transponder coil around the ignition switch and an immobilisation control system within either a dedicated immobiliser control module, or another control unit, such as the central electronics module (CEM). The CEM might be hard-wired to an immobiliser indicator in the dashboard or instrument cluster (IC), to indicate the system’s status to the user. The CEM will communicate with the engine control module (ECM) using a CAN bus. Note that, if the CEM is on the medium-speed CAN bus and the ECM on the high-speed CAN bus, then a control module that is connected to both buses, such as the IC, will need to act as a gateway to communications between the two.

There are usually two stages to the authorisation/start process; the first, a key checking phase, is initiated when the key is placed in the ignition barrel and the second is a start-authorisation phase, instigated when the operator turns on the ignition.
A typical key checking phase might progress as follows (see Figure 1 for the representative signals): initially the system will be in an immobilised state, indicated by periodic flashing (e.g. once every two seconds) of the immobiliser indicator. When the key is placed in the ignition switch, the CEM energises the transponder coil (e.g. at 125 kHz), which excites the transponder. The transponder responds by transmitting identification and rolling code data to the CEM via an inductive voltage within the transponder coil circuit. The CEM will check the returned data against the stored data to confirm its identity. The CEM might double-check the key identity using the same mechanism.

The start-authorisation phase proceeds as follows: When the ignition key is turned to position II (ignition on), the ECM detects the ignition supply voltage and sends a start request CAN message to the CEM. If the key is valid, the CEM responds positively, with a code derived from the message contents sent by the ECM. In return, the ECM replies to confirm that the vehicle is in a mobilised state and that it can crank and run the engine. Upon receipt of this confirmation message, the CEM can illuminate the immobiliser indicator (e.g. with a one second confirmation flash) and then turn it off. If the key is invalid, the CEM will respond negatively to the ECM’s start request message, such that the ECM will not crank or start the engine, and the alarm indicator will continue to indicate an immobilised state.


Insecurity
The immobiliser’s subsystems could be vulnerable to several types of attack: Key recognition; The key recognition subsystem, consisting of the CEM, transponder coil or and transponder, could be prone to attack if the correct rolling codes could be transmitted in the right way and at the right time. Note that to move the vehicle, the correct mechanical key would need to be in place to remove steering locks etc. Key-less start systems present other sequencing issues (related to direct CAN messaging, described below), which would need to be co-ordinated with the press of the engine start button etc. The biggest vulnerability and simplest way to attack the system is to clone an authorised key.

Direct access to the CAN bus; If the start-request from the ECM and subsequent immobiliser related messages can be intercepted and the appropriate (algorithmically generated) response codes returned, then the CAN communication system could be used to carry out unauthorised mobilisation of a vehicle. The method would rely on a controllable communication device having a physical connection with the CAN bus. Timing is important (the messages are often expected to be received within a certain time frame) and the genuine responses that would be sent out by the immobiliser controller would need to be mitigated against (e.g. the filtering out of its likely negative response to a start request, that might cause the ECM to immobilise itself).

Aside from the practical connectivity and the sequencing issues, there is the issue of knowing how to generate the correct response codes to a start request. Although, the codes are observable in an unencrypted network, the relationship between the in and out codes can be extremely difficult to calculate using analytic methods alone and are more likely to be determined from reverse engineering of the control unit’s program files. Aside from the legal implications, the challenge is still great, which is very likely why it has not appeared to have happened.

Indirect access to the CAN bus; Given the potential difficulties of physically placing a communication device on the CAN bus, an alternative approach is to hijack a device that is already connected. Any internal (software or hardware) system within a connected control module that has access to the controller’s CAN interface might provide a channel through which unauthorised access could be attempted (especially if a vehicle manufacturer has already built-in a remote starting capability).

It is this type of attack that has been highlighted as a particular concern with the advent of connected vehicles, purportedly presenting hackers with opportunity to remotely control some or all of a vehicle’s functionality. There have been notably few examples of vehicles being hacked in this way and it will be very interesting to see if that changes over the coming years.
All in all, the challenges needing to be overcome to take advantage of any the three perceived vulnerabilities and to steal a car are great. Quite simply the easiest form of attack is to clone a key. The question is then, what are the motivations for ill-intentioned agents to attack our automobiles and are they likely to want to try to steal a car through attacking the immobiliser system? I’m not sure I’m qualified to answer that.


Information
There is a further, related, development that has already dawned within our automotive landscape. Our modern motor vehicles are capable of generating significant volumes of personal data regarding much of our travel and lifestyle habits. This information is hugely valuable. Google’s company worth is colossal and their value is driven purely by their knowledge of our online browsing habits (through the use of their web applications). For the most part, we are not always online. Imagine though, if they could collect a raw feed of data regarding our offline habits, such as those we might create when we travel within our vehicles. How much would the company that had access to that data be worth? With that thought, it is clear why tech firms are falling over themselves to tap into our automotive existences.

Given that all this valuable data is flying around unencrypted vehicle communication networks (much of it is required by engine, navigation, entertainment and ADAS systems etc.), why in their right minds, would the vehicle manufacturers not want to encrypt that data and keep it to themselves? By doing so they would be able to prevent any third parties, including (coincidentally) aftermarket diagnostic tool manufacturers, from having any access to a vehicle’s CAN bus data, without the vehicle manufacturer’s prior consent.

Now, in that context, wouldn’t it be convenient if the vehicle manufacturers jumped upon the reports of the hackers’ abilities to put lives at risk, so as to justify the encryption of vehicle networks? Conspiracy theory? Maybe. I am susceptible. I once imagined that the large discrepancy between real-world and quoted fuel efficiency figures could have been indicative of an OE-level distortion of engine test results…


Further tech info
http://automotiveanalytics.net/agile-diagnostics

The exhaust is a lot more than just an exit route for waste gases for some time now. Tim Howes, deputy general manager – supply chain and technical service, NGK Spark Plugs (UK) Ltd, provides some context: “In 2009, The Euro V emissions standard for passenger cars demanded a significant reduction in NOx, HC and particulate matter and in 2014 the Euro VI standard brought a further tightening of these emissions, primarily for diesel engines.”


Complexity
For diesel powered vehicles this has meant a significant increase in the complexity of exhaust gas recirculation (EGR) and after treatment resulting in the fitment of various combinations of diesel oxidising catalyst (DOC), selective catalytic reduction (SCR), lean NOx trap (LNT),  diesel particulate filter (DPF) and other associated devices and control systems.
All these additional components have led to an increased need for sensors in the system.

I have been asked several times about ABS wheel sensors. Like many other components, the technology is changing. The changes reflect the expansion in integrated chassis dynamics.

Just imagine how many functions require wheel speed and rotational differential data.

ABS, dynamic stability, hill start, audio volume, navigation, self park, all wheel drive, active steering assist, electronic handbrake etc. Sharing this data on a high speed can network ensures very accurate vehicle motion dynamics.

Older variable reluctance sensors (VRS) rely on a coil generating an alternating voltage when rotation occurs. The problem is they are not directional sensitive and cannot report motion at very low speed. Air gaps were critical as they affect signal amplitude. They are often referred to as passive sensors. So, the introduction of digital or active sensors was inevitable.


Principles
How do we tell them apart? Active sensors require a voltage supply from the ABS PCM, with a ground or signal return. They operate with different principles of signal generation; hall, and magneto resistive. Pure hall effect sensors will switch between the supply potential voltage and ground. Magneto resistive sensors operate on the principle of current and voltage change in response to a change in magnetic induction. This change can be introduced in several ways reflected in wheel bearing and sensor design. Smaller sensors with integrated magnetic field rings are now the norm. Developed by NTN at their Annecy facility they are called encoded bearings. A small ring mounted at one end of the bearing carries a series of north south poles. These have now been replaced by dual encoding, two sets of magnetic rings with a unique offset. This enables the abs module to determine direction of rotation.


Subtle differences
There are two very subtle differences in the digital outputs. They can be called pull up or pull down. The sensor supply voltage will be slightly lower than battery voltage this is due to the different internal resistance values. However, it will be around 10.5/11.5v.

The ground or return signal value will vary between 0v or 1.4/1.8v. You could have a sensor or circuit fault; let me try and explain the subtle differences, and how to prove which is which. Remember the golden rule if in doubt compare a wheel circuit that works normally.

First unplug the sensor and measure both circuits in the loom. With no load applied the supply voltage should jump up to NBV

Next check the ground circuit if its true ground then it’s a pull-down type and the signal will be on the power line, and may only be around 200mv

If a small voltage exists then it’s a pull up type and the signal will be on this wire not the supply. The digital signal will be very small when the wheel rotates. It could be small around 200/400mv, or as high as 0.5/1.8v, depending on the manufacturer variant

Common sense would dictate the serial route is easiest, however how would you determine an intermittent fault? It could be a faulty sensor, faulty encoder, or a circuit error. The only way is using a scope. Should we measure voltage or current though? Both change in the circuit. Unless you have a very special current clamp, go for voltage and select a AC coupling.

The specific question I am often asked is current measurement, well I can tell you in a pull-down circuit its around 7-15 ma with a 400mv voltage change. The pull up type will produce around 6/13ma with 0.2/0.35mv.     However, these voltage values can vary due to the value of the two parallel internal sensor resistors these are normally 1.4k ohms, with a much higher resistor in the meg ohm range, within the ABS pcm.

I hope this helps. The pico image was taken from a VW Golf 1.4 TSI. The easy bit is replacing the wheel sensors. Ever since metal housings were replaced with plastic they never corrode in the housings
do they…?

The need to adapt to changing vehicle technology is one of the main challenges of our time in the sector. Increasing connectivity and a vastly more complicated conventional vehicle provide a whole raft of obstacles on their own, before you even get to the rise of electric vehicles and hybrids.

Add to that a more uncertain legislative environment resulting from rules not quite keeping up with the technology coming in, and you’ve got yourself a whole host of issues that the entire industry needs to stay on top of if it is going to continue to offer a sterling service to customers.

Let’s look at electric vehicles. For Tom Harrison Lord from Fox Agency, the b2b marketing company specialising in the automotive sector,  Automechanika Birmingham offered a troubling glimpse into the future:  “This summer’s Automechanika Birmingham was entertaining and enjoyable as ever, but it also exemplified a worrying trend in the motor industry today. With the advancement of electric vehicles, there are going to be some rapid and stark changes ahead. The automotive aftermarket, however, seems to be burying its head in the sand.”


Access
The key, as it has been in the past, is access. In this case, the right to be able to repair vehicles. Think that’s all sorted? Perhaps not:  “The rise of the electric cars and vehicles is something that could hit the automotive aftermarket hard – in particular, independent garages.

“Many, if not all, electric vehicles invalidate their manufacturer warranty if essential work is carried out on the electrical systems by someone other than the main dealer. What’s more, many cars with batteries, such as the Mitsubishi Outlander PHEV, have warranties on the electrical components lasting up to ten years.

“Having no choice but to use the main dealer for a full decade shows just why independent workshops will have fewer vehicles coming through the doors in the years ahead.”

Do our own workshop war stories point to a diagnostic way forward asks  James Dillon

Barnaby Donohew examines how the aftermarket can learn from the tech sector to improve diagnostic outcome

It’s only when you visit the past that you realise how far the journey to the present has taken us. Some time ago Martin, a very good friend of mine from Londonderry, sent over a set of very early EVL Bosch injectors.

This injector pattern started life around the late 1960s and ran through to the mid 1980s and was used by Ferrari, Volvo, Opel, and many others. The set supplied to me came out of a VW camper van, and like many from this era were badly rusting and contaminated from in-tank corrosion. At the time fuel lines and tanks were made from untreated mild steel, and filtration did not meet current standards of 5 microns, or 2 microns with the latest HDEV 6 injectors. The biggest single cause of wear and failure was water ingress in gasoline due to condensation and external ingress.

The injectors were in a bad condition, sticking, blocked, and dribbling. I started the cleaning process with an external pre-clean ultrasonic tank before risking contamination in our ASNU bench. Several cleaning sessions later, with a varying degree of improvement, we arrived at a fully serviceable set.

I posted them back assuming it would be the last of my involvement. I should have known better. Martin and Matthew at Conlon motors have been involved with our training programme over many years. I travel over there several times a year for onsite training, and you have guessed it, waiting for me on my last visit was the camper van.

It was running extremely rich, blowing blue smoke. You could taste the emissions. If you have ever followed a vintage car you will know what I mean. This is where a trip down memory lane started.  I have not worked on this system for many years.  In fact it was on systems like this that our current-day diagnostic processes were developed.

Our industry is in a constant state of flux; new technology and changing customer behaviour are impacting our organisations, and ultimately the financial success of your business.

Frank Massey looks at how you need to always keep an open mind on diagnostic methods

Even apparently simple problems require thorough investigation if you want to diagnose faults right the first time

Two months from now will bring my tenure in the motor industry to 49 years. I would like to think I have evolved, kept up with technology, enabling me to provide a professional service, enjoying customer respect and integrity. My focus has been the technical challenges, while my son David manages the commercial responsibilities.

"Electronic Lego" is a phrase that was introduced to me by an engineering manager when I worked for the diagnostic company Crypton around 25 years ago. In the late 1980s the Company had developed engine tuning machines which moved away from bespoke central processing units (the so called Big Box tuners) to a PC based system. The elements of the PC based system could not just be bought and fitted together (like lego) and be expected to work. The PC components and peripherals had to be carefully selected, including the compatibility of their drivers and software to ensure a robust PC based diagnostic machine could be created. Over the past 10 years or so motor vehicles have moved away from their previous Lego like construction, where replacement parts were free to be plugged in and replaced at will. The change was due partly to the modern vehicle being constructed as a rolling network of computers and partly to the advent of the factory fitted immobiliser, where transponder keys and the relationship between vehicle computers became prevalent.

I gave this topic some considerable thought before choosing to discuss not just a selection of tools we use, but also some tools we have designed and modified.

By James Dillon

By Frank Massey

By ACtronics

We began this journey last issue, so to recap: We need solid reasoning skills to carry out effective diagnostics; persistently good decision making doesn't happen by chance. Possibly out of convenience these skills are often underestimated and undervalued by people, both in and out of the trade. We must raise awareness of the discipline and precision of thought necessary for logical and critical thinking: so we can be better rewarded for our efforts; and to make sure they are consistently and properly applied.

Reasoning, arguments and hypotheses
We covered some fundamentals in my last article: we explain our reasoning using arguments, which contain statements supporting a conclusion; one type of argument, a deductive argument, should guarantee the truth of its conclusion (if it is sound); however, we need to use critical-thinking to check this, by making sure i) there are no other possible conclusions (which makes it a valid argument) and ii) the supporting statements are true.

Diagnostics is all about decisions. And what is a decision? It is a conclusion or resolution reached after consideration. Therefore, efficient and effective diagnostics is about drawing the right conclusions at the right time. How do we do that? Amongst other things, by making sure our logical and critical thinking skills are up to scratch. This series of articles aims to help us with that by looking at the principles of human reasoning.

A couple of interesting workshop repairs have taken my fancy in the recent months, the first involves a BMW 530 common rail diesel.

BTN Turbo

Alldata Repair gives independent workshops direct access to OE repair information via an online portal. The data is unedited - diagrams are not re-drawn and the info is uncut, what you see is the same information available to techs within dealer workshops.

If you've been reading this magazine for any amount of time, you'll be well aware of the obvious benefits of using an oscilloscope when diagnosing faults, but it is the less obvious benefits that with practice can lead to the correct diagnosis.

Q: Why did you feel there was a need to review your code of conduct?

Peeved with the Teves?