Can a variable be locked at hardware level?

Question

I changed out of curiosity the max speed variable of my car ECU from 250Km/h to 60Km/h to see if the car reach that speed and hold there or I can go beyond and get a warning but it turns out that I cannot exceed that limit.

Now, I'm unable to get the speed to its original value nor increase it, I found out later that this particular variable can only be decreased... My local car dealer (VW) doesn't know how to fix it, so I had to rely on third party mechanics specialized in ECUs but unfortunately so far no one have figured out the solution, even after re-flashing the entire ECU.

I got the reference of my ECU chip which is UN92CB but I couldn't find any datasheet, so I was wondering if it is possible to hardware lock a variable from increasing, so I can just buy a new ECU instead of losing my time figuring out the problem.

Edit: Unfortunately I don't know where or in which chip it's stored and I don't have the necessary tools to dig in the binary program, the ECU specialist have very expensive equipment but a small brain, I already asked him to backup the program inside my ECU, reduce the speed limit to 59Km/h for example, and re-flash it again with the backup file, if the speed limit stays at 59Km/h then it would be pointless to continue with this method and we should look elsewhere.

Anyway, my local VW dealer doesn't know anything, there are no ways to directly contact VW Germany, and the ECU architecture is most likely a manufacturer secret.

There is still hope someone managed to overcome the issue by flashing it again in this thread, btw I removed the car speed sensor so I can accelerate as much as I want :)

Answer 1

Well, there is burnable fuse read-only memory.

The burned and unburned fuses represent different states of ZERO and ONE. You cannot unburn fuses; You can only burn them.

So if the speed is stored as a binary number and you keep writing different numbers, all the burned fuses (ZEROES) remain unaffected, while any unburned fuses (ONES) will be burned into ZEROES if your new number happens to contain a ONE that lands on that digit. This happens both when trying to rewrite it to a large or smaller number since what you're you're doing is hitting ZEROES by chance and turning them to ONES.

As a result it won't let you write any number smaller than the current number since any smaller number (or any number for that matter) that has a ONE in the digit will not stick if that digit has previously been written to a zero. What happens if whenever you write a new number it will either stay the same or erratically get smaller. So not quite the scenario you describe if you can write any slower speed than the current one.

If you are able to write any smaller number then there are software controls in place. They may not even be locks in the sense that it's a software flag you can just unlock or a physical switch you can flip. It could be that the writing algorithm unconditionally checks that the new value being written is smaller before writing it. In that case, there is no lock as much as the software has been lobotomized of the capability of a writing a larger number.

And in that case, if the speed value is stored in memory different than the ECU that you re-flashed then reflashing it wouldn't change anything.

Answer 2

A chip is always a design before being a product,

During the design phase you can define which memory elements you are going to use, how you are going to read them and to write them, your only limitation is the technology process that you have chosen, but again there are quite a lot of technology processes that are available today so there is a fair level of freedom.

This means that the chip can read, write, and retain data as the designer has defined it.

Automotive industry rarely use generic components. They have a lot constraints: Pressure‐Temperature‐Time, power supply, and safety. A lot of automotive chips are therefore equipped not with chip for general purposes but specifically designed for their application.

My assumption would be that your chip was indeed designed so it cannot increase. That would remove any possibility of a software failure that could increase it.

If re-flashing the entire ECU, does not work: it is either that the chip has been designed so it indeed does not work, or that your chip is now defective, in both cases you will have to change it.

Answer 3

This is easy to do in firmware, as long as you have nonvolatile memory on board. Example: Imagine you can set a bit to be 1 or 0 in a specific register. Then you assert the rule that IF the content of that register is 0, THEN ignore the BOOTUP command. The bootup routine now cannot be run and by extension the content of that register cannot be changed. The device is now completely dead until you kill the nonvolatile memory, which causes the content of that register to be lost.

If your firmware engineer is a dope it is possible for such a "dope instruction" (ordinary engineers would call this a "fatal bug") to persist after release. It is then inevitable that a customer will stumble across it by accident and inadvertently kill his product. This serves as your signal to kill your firmware guy.

It is also possible that stray static electrical charges can booger up the microprocessor and cause it to enter a state called lockup, in which it ignores both the RESET command and the BOOTUP routine. In this case, resetting the machine requires you to remove the power supply and physically short the power terminals together (the most popular tool for this being a straightened-out paper clip, which is called a LOCKUP FIX).