Do they not have a source repository with commit history and code reviews with names attached? Is that something unreasonable to expect from a multi-billion dollar company?
Also, the story seems to have been that the "cheat" was a special mode explicitly programmed for test purposes and not something totally under the covers. The "crime" was in enabling that mode under field conditions. That change may not be covered by source code revision control, if it were made in a config file outside of SCC.
In a field more of us here understand, it would be similar to coding a feature in a server that dumps user passwords to the log file in plain text. Such a feature would be useful for certain debugging situations, but it would be disastrous to have it enabled on a production box. So you'd put a big all-caps warning in the source code, documentation, example config files saying whatever you do don't turn this on in production. Supposedly the engine management developers did something along those lines, but the folks who built the cars ignored the warning and enabled the mode anyway.
> In a field more of us here understand, it would be similar to coding a feature in a server that dumps user passwords to the log file in plain text.
No, it's like coding that feature but explicitly making it turn off whenever it detects a security review. How is that justifiable?
What remains is explaining how engineering managers higher up (all the way to the top) could remain willfully ignorant of the fact that VW's diesel engines "passed" emissions without resorting to exotic tech like Mercedes' bluetec exhaust fluids. They knew there was some sort of magic in their engines that set them apart, but they either understood it was cheating, or they never asked any questions.
> What remains is explaining how engineering managers higher up (all the way to the top) could remain willfully ignorant of the fact that VW's diesel engines "passed" emissions without resorting to exotic tech like Mercedes' bluetec exhaust fluids.
How often do high level managers at a big company have a good handle on technical implementation details of specific systems and what the implications of those details actually are?
It's possible that these people either had non-technical backgrounds, technical backgrounds in unrelated areas, or out of date technical backgrounds (like they last worked with this stuff back when cars still commonly had carburetors).
I wouldn't be surprised to see him go to jail.
I think it depends on how general the implementation was. I could imagine real world uses for a feature to generically detect certain conditions and change parameters in response (e.g. to support different settings for highway vs city driving). If you have something general enough, then the "defeat device" could have just been a ruleset that only matched a very narrow set of conditions that usually only occurs during the tests.
Incompetence happens, but requiring chained events of successive incompetence to explain an outcome to explain an event doesn't seem rational to me.
I'm still cynical.
I've seen that exact thing (and worse...) on a production server in some job recently. But that big all-caps warning wasn't there, the docs were absent and there was no config bit to switch on/off, I found the file more or less by accident (wondering what all the io was that ate up the machine).