Ok, I'm going to go over this again, I theorized this when they first proposed the single ECU:
Let me start by saying, unless you are yourself a software programming genius -
there is no way you can say for certain a mutable-software based system isn't hackable.
A system may seem to you to be "perfect" or "impenetrable", BUT unless you are a programming genius, you absolutely can't ascertain that for sure. You do not see every possibility as an elite programmer does, you can't fathom the possibilties.
So right out of the gate, you have to presume there *could* be shennanigans going on with the ECU.
Then, you have the analog side of the KERS system, which involves capacitance, resistance, and inductance. The ECU software has to go by measurements of these things, BUT they can all be *transitory* - what the ECU is reading does not mean that is what is happen *at that exact moment*.
Analog circuits can be devised so that voltage and current can be delayed, or swapped in value; the ECU does not automatically know the nature of the circuit it is attached to.
Between those two concepts there is plenty of leeway to devise a "legal" TC system.
One way would be to create a window whereby the KERS motor has a load across it under "special circumstances". You wouldn't see it charging, you wouldn't see a voltage spike.
Or you could rig a capacitance system so that the way it discharges is proportionate to the curve of the impedance of the KERS motor, so that it "wants" to discharge more when the resistance of the motor is higher, or vice versa - you could make it so that if the resistance goes up, there is a lag time before it discharges.
Or, if you know there is a particular corner where you can gain a lot of time with TC, you do laps in FP and figure out the timing of the oscillation of the tire slipping, and inversely oscillate the discharge.
Or you could make a "battery overheating" event, whereby the resistance on the circuit looks like it's one thing, but actually the charge coming off the KERS motor is being buffered via the rise time of a capacitor or a battery.
.. or more possibliities. All of which could be disguised by deft programming. Charlie Whiting would not have the knowledge base to detect such a thing, Microsoft engineers wouldn't "see" it happening, unless they did a full audit of the code and analyzed how RBR has tweaked things relative to prior knowledge of RBR's analog circuitry.
Which, unless you're paying a dedicated hacker, for each team full time, to figure out "is the system being hacked?" you would never know.
But, it would be a good distraction to place the ability to out accellerate everyone on the genius of Newey, instead of the genius of an unseen programmer.