Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mitsubishi Recalls 68,000 SUVs Over Bad Software (consumerreports.org)

Posted by msmash on from the software-glitches dept.

Mitsubishi is recalling 68,000 SUVs because of bad software in two different engine-control units (ECUs), according to the National Highway Traffic Safety Administration. Consumer Reports adds: In one of the two actions, the automaker is recalling 58,916 of its 2018 Eclipse Cross, 2017 to 2018 Outlander, and 2018 Outlander Sport SUVs because of faulty software in the hydraulic unit ECU -- the computer control system for the brake system. According to NHTSA, the software problem could cause some features -- such as adaptive cruise control (ACC); forward-collision mitigation (FCM), which is a combination of forward-collision warning and automatic emergency braking; and antilock brakes (ABS) -- to not work as expected. In the second action, Mitsubishi is recalling 9,166 of its 2018 Eclipse Cross, 2017 to 2018 Outlander, and 2018 Outlander Sport SUVs because of bad software in the computer control for the FCM system. According to NHTSA, if the FCM system detects a pedestrian in front of the vehicle who could be hit, that ECU may activate the brake for longer than necessary, even when the obstacle is no longer detected. There's concern that when this happens, the driver may provide additional braking, making the SUV slow rapidly and increasing the risk of a rear-end collision, NHTSA says. Consumer Reports has also detailed the models that are affected and how customers could contact the manufacturer.

49 of 82 comments (clear)

  1. Re:FYI If you read the article by oldgraybeard · · Score: 1

    Me bad I think I was reading 2 different things and posted on the wrong article.

  2. Re:FYI If you read the article by Anonymous Coward · · Score: 1

    You mean for Subaru SUVs, not Mitsubishi.

  3. Re:FYI If you read the article by oldgraybeard · · Score: 1

    recalling the new 2019 Subaru Ascent for missing spot welds

  4. Re:FYI If you read the article by oldgraybeard · · Score: 2

    Yes I screwed up!

  5. Their Integration testing sucks... by bobbied · · Score: 1

    Where were the system integration tests that where supposed to catch such things?

    Seems to me that this kind of system interaction would be the subject of a series of integration tests which would be fully validated BEFORE they where allowed to sell these vehicles. Guess I was wrong.. Silly me.

    Makes you wonder how much other garbage is slipping by. I guess they will discover that finding system bugs is cheaper the sooner in the development cycle you catch them. Enjoy paying the dealers to do this work and don't forget to consider the bad PR costs this will have.

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    1. Re:Their Integration testing sucks... by Agripa · · Score: 1

      Where were the system integration tests that where supposed to catch such things?

      Hey, the regression tests on last year's models did not find any problems. Why are we spending money on them?

  6. Re:FYI If you read the article by bobbied · · Score: 2

    Yes I screwed up!

    Not as badly as Mitsubishi did...

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
  7. NHTSA quote doesn't make any sense by jgrimard · · Score: 2

    "According to NHTSA, if the FCM system detects a pedestrian in front of the vehicle who could be hit, that ECU may activate the brake for longer than necessary, even when the obstacle is no longer detected. There's concern that when this happens, the driver may provide additional braking, making the SUV slow rapidly and increasing the risk of a rear-end collision, NHTSA says."

    The second sentence doesn't make any sense to me. Am I the only one? Why would the drive provide additional breaking if the obstacle is no longer detected?

    1. Re:NHTSA quote doesn't make any sense by bws111 · · Score: 1

      My guess would be that the driver thinks the car 'sees' something he doesn't, and he reacts to that by braking harder.

    2. Re: NHTSA quote doesn't make any sense by bws111 · · Score: 1

      There is only ONE reason for any of these 'driver assist' features (BLIS, ACC, lane departure, auto-braking, etc) to exist at all - to alert you to things you didn't see. If you are not going to trust alerts BECAUSE you didn't see it, then there is no reason for the systems in the first place. So, either the systems must be removed altogether (best idea), or they must work correctly. There is no middle ground.

    3. Re:NHTSA quote doesn't make any sense by drinkypoo · · Score: 1

      Driver goes to hit brake, car applies brakes too, driver's weight transfers forwards and they apply lots of brake pressure accidentally. Car doesn't let off braking even though obstacle has cleared path, neither does driver due to weight transfer.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    4. Re:NHTSA quote doesn't make any sense by NaCh0 · · Score: 1

      The NHTSA statement makes perfect sense. Natural instinct when your car spectacularly malfunctions is to perform an emergency stop of the vehicle and assess the situation.

      Stop the car means driver press the brake. The problem is that the computer is mistakenly applying the brakes. This is how you get the double force braking phenomenon.

      It's easy to think this wouldn't happen to you but this is not some kind of long thought out process. This is a high stress unexpected we're going to die moment when your foot automatically hops on the brake. Only later do you learn that it was a false alarm.

  8. Re:FYI If you read the article by sinij · · Score: 2

    Yes I screwed up!

    Not as badly as Mitsubishi did...

    Both had malfunctioning brakes.

  9. The Microsoftification of all machines by Tablizer · · Score: 1

    Our "machines" are becoming more software and less hardware over time because making complex or dynamic behavior in software is usually easier than via hardware. This also implies that more "hardware" problems will actually be software problems. They are essentially becoming robots controlled by microprocessors (which may or may not be controlled in part by a human user).

    Getting things fixed is also becoming more like dealing with the likes of Microsoft than a local craft-person. Smaller shops and 3rd parties often have a difficult time getting the specifications and/or diagnostic software needed to troubleshoot and fix machines, as the manufacturers fight for control over and revenues from repairs.

    One repair guy told me, "Frankly, we just can't afford the vendor's software to diagnose that gizmo. We don't get enough repair requests for it to justify the monthly licensing fee." (paraphrased) Translation: I have to go directly to the vendor and pay their fat fee to get it fixed.

    --
    Table-ized A.I.
    1. Re:The Microsoftification of all machines by sinij · · Score: 1

      Cars haven't been mostly analog at least since late 80s. So that ship has long since left the port.

      We are now fighting next battle - lets not connect all that garbage to the Internet. Your car doesn't belong on IoT junk pile.

    2. Re:The Microsoftification of all machines by Jeremi · · Score: 1

      We are now fighting next battle - lets not connect all that garbage to the Internet. Your car doesn't belong on IoT junk pile.

      I don't know, if these 68,000 SUVs could have their firmware updated over the Internet, it would save 68,000 people trips their local Mitsubishi dealership.

      The trick, as always, is to enable that functionality without simultaneously enabling the vehicles to be hacked by bad actors.

      --


      I don't care if it's 90,000 hectares. That lake was not my doing.
    3. Re:The Microsoftification of all machines by Tablizer · · Score: 1

      "Plastics!"
      -The Graduate

      --
      Table-ized A.I.
    4. Re:The Microsoftification of all machines by anegg · · Score: 1

      The trick, as always, is to enable that functionality without simultaneously enabling the vehicles to be hacked by bad actors.

      I don't think I want "update over the Internet" functionality for my car regardless of whether it is protected from Internet hackers. I think it is possible that the evolution of rapid and easy update of software over the Internet has lowered the initial quality of software and software fixes. When software updates are expensive, more time/effort can be justified on the front-end of the software change, making sure that the change has the desired effects and only the desired effects. When software updates are less expensive, it is easy to foresee a trend towards less up-front testing because "it can always be fixed later with another update." I would hope that the safety-critical world of vehicle software would not fall prey to the economics of the situation, but...

    5. Re:The Microsoftification of all machines by bobbied · · Score: 1

      No dealership visit, no IoT.

      Unless you brick your car by flashing bad firmware which doesn't support updates but seems to boot properly. Then it's a tow to the dealer to dig out the JTAG connections to fix it..

      Don't laugh... I *could* happen, given the quality of software/firmware deliveries these days.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    6. Re:The Microsoftification of all machines by Joe_Dragon · · Score: 1

      why when the dealer can sell you an 512GB HDD for $250+install.

    7. Re:The Microsoftification of all machines by vtcodger · · Score: 1

      "No dealership visit, no IoT"

      If the vehicle has to come in to the dealer for the update they will, to a near certainty, find $200-500 worth of essential -- non-warranty -- maintenance that really should be done right now, today, "Man, you should NOT be driving a car with brake rotors that look like that ..."

      No dealership visit, no profits. Not likely to be a big seller in the boardroom.

      --
      You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
    8. Re:The Microsoftification of all machines by sinij · · Score: 1

      We are now fighting next battle - lets not connect all that garbage to the Internet.

      I don't know, if these 68,000 SUVs could have their firmware updated over the Internet.

      The trick, as always, is to enable that functionality without simultaneously enabling the vehicles to be hacked by bad actors.

      This can't be done. When you connect something to the Internet, the Internet gets to access it. Even if something is designed and coded perfectly, and it won't be, new types of attacks will come out that would still make attacking it possible.

      Cars last decades, software security last months. You are just signing yourself up to get hacked and/or EOL.

    9. Re:The Microsoftification of all machines by Jeremi · · Score: 1

      This can't be done. When you connect something to the Internet, the Internet gets to access it.

      You can make the connection unidirectional (see below).

      Even if something is designed and coded perfectly, and it won't be, new types of attacks will come out that would still make attacking it possible.

      I think it can be done; if you want to be super-secure, use full encryption on everything (of course), and on top of that, design the car so that the only time it ever powers on its WiFi hardware is for a few minutes after you've typed in (on the car's touchscreen) a single-use/unique-per-vehicle activation code that you received in the mail from the manufacturer as part of a recall/update procedure. At that point it connects to the manufacturer's server via SSH, downloads and authenticates the new firmware image that corresponds to that activation code, and installs it (with an option to downgrade if anything goes wrong).

      Could that still be theoretically hacked? Of course. Would it be? Probably not, because without a passcode to activate the hardware with, there would be no easy way for miscreants to develop or test any hacking technique. The amount of effort it would take them to develop an exploit would be greater than the amount of effort its would take them to "hack" the manual update procedure (e.g. by getting a job at a dealer and hacking customers' cars via the JTAG programmer when they come in for repairs), so they wouldn't bother.

      --


      I don't care if it's 90,000 hectares. That lake was not my doing.
    10. Re:The Microsoftification of all machines by sinij · · Score: 1

      You just re-invented air gap. If owner has to perform action to manually activate WiFi, then it is effectively disconnected the rest of the time.

      Another aspect you fail to consider - authentication. You have to spend a lot of effort on making sure you car connects to the right server, and not one in CIA headquarters.

    11. Re:The Microsoftification of all machines by Agripa · · Score: 1

      The trick, as always, is to enable that functionality without simultaneously enabling the vehicles to be hacked by bad actors.

      The people responsible for updating the firmware remotely are also bad actors or soon will be. How do they protect the functionality from themselves?

  10. So many acronyms! by Calydor · · Score: 1

    SUV, ECU, NHTSA, ACC, FCM, ABS, most of them repeated several times. The summary would be twice as long if you'd typed them all out.

    --
    -=This sig has nothing to do with my comment. Move along now=-
    1. Re:So many acronyms! by sconeu · · Score: 1

      Really??? In the context of cars, SUV and ABS are in common use among laypersons.
      ECU and NHTSA are pretty common as well.

      ACC and FCM were about the only ones I could think of that needed explanation.

      Also, ECU *was* defined.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    2. Re:So many acronyms! by sconeu · · Score: 1

      Actually, except for SUV and NHTSA, they were all defined. I expect that the author rightly assumed that everyone knows what an SUV (in the automotive context is), and NHTSA is a well-known US.gov agency.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  11. What? No OTA updates? by 140Mandak262Jamuna · · Score: 2
    When consumer reports uses a very severe process to test the brakes. Five consecutive full slam 60 mph to 0 mph, with one mile of driving to "let the brakes cool" between the slams. Tesla Model 3 stopped at 130 feet in the first slam and took 160 feet in the last slam. It was declared a failure.

    Tesla pushed an over the air update for its anti lock brake calibration and fixed the issue. All five slams were within 125 feet or so. Consumer Reports chief test engineer actually wrote that he has never seen such a critical component being fixed by OTA. In other vehicles it would resulted in recalls of hundreds of thousands of vehicles and still only those vehicles that were brought to the dealership would have been fixed.

    Now it looks like not having an OTA is a huge mistake by the legacy car makers. They should follow Tesla and enable OTA on all their cars. NTHSA should mandate all cars should have OTA, after some cut off year like 2022 or so.

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    1. Re:What? No OTA updates? by Anonymous Coward · · Score: 1

      Personally I'd rather not have OTA updates for critical systems in my car, thanks. Last thing I want is somebody to discover a 0-day and send an update that disables my brakes entirely while I'm driving.

    2. Re:What? No OTA updates? by drinkypoo · · Score: 1

      Now it looks like not having an OTA is a huge mistake by the legacy car makers.

      Have you done the math? It costs such and such to include OTA, it costs such and such to do a recall, recalls happen x% of the time and affect y% of the models, vs z# total of units sold?

      They should follow Tesla and enable OTA on all their cars.

      Maybe. Do the math, show your work.

      NTHSA should mandate all cars should have OTA, after some cut off year like 2022 or so.

      Bollocks. OTA has security implications and if other automakers can achieve their goals without it, best to leave it out.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    3. Re:What? No OTA updates? by vtcodger · · Score: 1

      "Personally I'd rather not have OTA updates for critical systems in my car"

      Nor would I. Different reason. I spent several decades working in software test of complex systems. Frankly, the state of the art in software system test isn't that great. My experience was that patches generally did what they were intended to do, but all too often caused unexpected problems is other parts of the system, and that exhaustively testing every patch against the full system was impractical

      My concern is that we have a Martingale sort of thing here. The overwhelming majority of patches will work fine and produce modest benefits or do no harm. But occasionally a patch does something really bad -- and in an automobile, there is a certain potential for doing something REALLY (as in lethally) bad.

      Cut to scene of all the Teslas on the road at 0000 GMT on some arbitrary date making an abrupt left turn without regard to speed of travel or what, if anything, is to their left.

      --
      You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
    4. Re:What? No OTA updates? by 140Mandak262Jamuna · · Score: 1
      All automakers will implement OTA. Without any push by NTHSA.

      Why?

      Automakers are jerks. If they realize if they can do OTA and cripple the cars after selling it and hold people or ransom they will do it. If they see OTA is a way to get steady revenue stream, they would jump all over it.

      They will pitch it as safety, but once in, they will have fees every time you sell the car, to "register" the new owner, etc etc.

      --
      sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
    5. Re:What? No OTA updates? by toddestan · · Score: 2

      Personally I consider OTA a bad idea, as it would the foster the "ship it now, fix it later" attitude towards cars that has completely taken over with just about anything else that can connect to the internet.

      I want my car's brakes to work properly coming right from the factory right from day one. If screwing this up means a costly and embarrassing recall, that means the manufacturer has a pretty big incentive to get it right the first time.

  12. Re:Remember when... by HornWumpus · · Score: 1

    No. But I've always considered stopping a priority.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  13. No degree, no problem! by PmanAce · · Score: 1

    Keep hiring code monkeys with no degrees, that's the solution. Addendum: just because you know someone that has a degree and can't code, it's either he's shit for real and does not represent non-code monkeys in general (my gosh, bad doctors also exist!!) or you actually are not qualified in discerning code quality.

    --
    Tired of my customary (Score:1)
    1. Re:No degree, no problem! by Agripa · · Score: 1

      There aren't any degrees out there that goes through required safety standards for automotive programming.

      They used to be the same standards used for industrial embedded design and there are books on the subject of what *not* to do in mission critical systems.

  14. Very easy to fix! by LordHighExecutioner · · Score: 1

    Just close all the windows and reboot!

  15. No thanks. by pavon · · Score: 1

    Sure, if a device has to be connected to the internet to perform its job, then it must have OTA updates. But taking a critical safety device that has no reason to be connected to the internet whatsoever, and connecting just to receive OTA updates is asking for trouble. You are massively increasing your attack surface for a small convenience.

    1. Re: No thanks. by MachineShedFred · · Score: 1

      Several billion smartphones out there taking OTA updates all the time that hold valuable personal info and banking info, and not a single case of hijacking the OTA update process to compromise the device.

      It might be plausible that there are ways to implement this securely.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    2. Re: No thanks. by vyvepe · · Score: 1

      Several billion smartphones out there taking OTA updates all the time that hold valuable personal info and banking info, and not a single case of hijacking the OTA update process to compromise the device.

      Your banking info is not as valuable to you than your life. There is a big difference when random internet hacker gets access to hundreds of mobile phones and investigates user data on them. Compare that to getting access to hundreds of cars and crashing them.

    3. Re: No thanks. by MachineShedFred · · Score: 1

      Unless they are an assassin or a particularly psychotic anarchist, being able to crash random cars is of no value.

      Thousands, if not millions of bank accounts, is worth exactly the balance of the accounts to the hacker.

      Your argument makes no sense.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
  16. Re: Remember when... by MachineShedFred · · Score: 1

    That has never been the case with any automobile ever manufactured.

    See: brakes, transmission, driveline / axles, tires / wheels, steering, suspension, charging system, cooling system, headlights, etc.

    --
    Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
  17. The software's not bad by WillAffleckUW · · Score: 1

    The software isn't bad, it's just compiled that way.

    --
    -- Tigger warning: This post may contain tiggers! --
    1. Re:The software's not bad by Agripa · · Score: 1

      It is called software because they cannot keep it up.

  18. "We are compiling your braking system updates" by WillAffleckUW · · Score: 1

    "Attention, user!

    We are compiling your braking system updates.

    They should be operational in approximately 3 minutes.

    Please enjoy this music while the steering disables and we drive off a cliff."

    --
    -- Tigger warning: This post may contain tiggers! --
  19. Re:QA Costs Money, so why bother by antdude · · Score: 1

    Yep. Companies are neglecting QA testings like me. :(

    --
    Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  20. Shocking! by uvajed_ekil · · Score: 1

    BREAKING NEWS: Mitsubishi is not dead yet and sold a surprising 68,000 vehicles in 2017 and 2018.

    This "recall" is likely a hoax designed to make people think that other people actually still buy Mitsubishis. Too obvious though, since you surely don't know anyone who will actually admit to buying a Mitsubishi in the last five years, if not ten. How long now until they leave the US market completely?

    --
    This is a hacked account, for which the owner can not be held responsible.
  21. Hello by TrevinoMac · · Score: 1

    Need a hacker? A senior member.A professional in the areas mentioned below: 1.facebook,whatsapp,emails,twitter and instagram hack 2- Hacking computer system 3- Cloning of phones 4- Changing DMV records without leaving traces 5- Changing school grades without leaving traces 6- Retrieving hacked social media accounts 7- Credit card hack 8- Clearing criminal records 9- Clearing of bad driving records without leaving traces,Upgrade your license 10- Website hack 11- Retrieving hacked social media accounts 12- P.I - Private investigator like cheating husbands or wives and any other P.I activities and so many other services. 13- Catch hacker scammers 14- Wire transfer to any bank 15- Retrieval of hacked accounts (Facebook,twitter,instagram,zoosk,match etc..) 16- Bank logins Contact him via gmail wufbugspam1960@gmai.com......:..Good luck