“To the best of my knowledge today, this was not a corporate decision,” he said. “This was a couple of software engineers who put this in for whatever reasons and I would also like to find out.”

The he is the new CEO of Volkswagen testifying before the US Congress on how the decision to add the software and hardware system to create an emissions inspection workaround to the Volkswagen diesels. The CEO is saying that rogue engineers made this decision on their own.

As I work in regulated industries (aviation and medical devices) this was pretty shocking to hear. I couldn’t help but wonder, how could a system be added to a vehicle without anyone knowing? Where was this system documented? Manufactured? How was this included on the Bill of Materials? How were the requirements for the cars verified and validated? How were quality checks done on a system that is not standard? Did the addition of the system impact system safety? I can only assume there was no review of the risk assessment to determine the impact of adding the hardware and software.
From an enterprise perspective what kind of process controls existed/didn’t exist to allow this to happen?

And could just a few engineers really make such a change and not have it caught by manufacturing, testing or quality? We know the issue was not meeting performance requirements, but do any of us believe that several engineers made the decision to provide a workaround without assistance from other departments? I expect we’ll find others identified as collaborators in this activity.

There are a lot more questions than answers and I’m sure it will be sometime before we have all the answers. But for anyone involved in developing products, especially in regulated markets, we all want to know if this could happen (is happening?) with our current products.

Is this a new category for risk assessments, the addition of unplanned/unknown SW/HW to a system? How would we even go about identifying/assessing such a risk? Do we now ask is anyone adding something not specified to the product? I think we know what the answer would be. Though it could make for some interesting risk meetings.
This will be a subject requiring much discussion and identification of processes and procedures to prevent this from happening again in the future. More to come for sure as this investigation moves forward.

For now we all need to be taking a closer look at how we get products out the door.

Bio:
Paul Kostek is a Principal of Air Direct Solutions LLC a Seattle based systems engineering and project management firm.