quarantine 'em

The tester had to write a *lot* of tests before the developer gave up and implemented the implementation that was really being tested for

And in principle, there is *no* point at which the developer genuinely has to give up. They can fake a working implementation forever.

If the tester and the developer are not on the same side, it is VERY difficult for the tester to force out the implementation they want

This is at the unit test case level. At higher levels, fakery becomes harder, but is still possible if the developer is motivated

The crucial point is this: it needs to be impossible to computationally distinguish an emissions test from regular driving

If an engine passes your test, and later you wish it hadn't, harden your test. The engine manufacturer is not on your side

Here's the critical diagram. Coloured lines change VW engine behaviour if crossed. White line = emissions test http://lwn.net/Articles/670604/ …

The coloured lines are fixed features of the ECU program. An emissions test just happens to always pass down that narrow channel