Investigating Software

Investigating Software

Friday, 27 November 2015

VW behaving badly.

The EPA (The US government's Environmental Protection Agency) recently issued Notice of Violations regarding the emissions from Volkswagen cars. Volkswagen is actually a group of brands, therefore the Notice affects other cars such as Audi, Porsche and Skoda.

A lot of the focus has been on what was going on in Volkswagen, for example who knew what was being done? Did the VW testers know? Did they pass the details on etc.

What interests me is the wider issue of how this could have been possible for so long?  (Since 2009)  If so many cars were affected and for so long, why didn’t we hear about this sooner? Why isn’t there a team of people assigned to finding this stuff out... Oh wait, there is...

In the UK these emissions tests are governed by the Vehicle Certification Agency, answering to the Department of Transport.

One might expect the manufacturer to be less inclined to investigate the cars emissions, after-all testing costs money (less profit). I might also expect them to exploit the test rules and tolerances as best they could. This behaviour, while not ethical, is explainable given their motivations and incentives.

I'm even understanding of the mistaken belief that they can 'prove' their cars are compliant. This is highlighted in this quote from Vauxhall/Opel/GM when the BBC asked about possible irregularities in their vehicle NOx emissions:

"We have in-house testing that proves that the Zafira 1.6 meets all the legal emission limits."

A curious statement, Given that the systems concerned are software controlled, and as Dijkstra put it: "Testing shows the presence, not the absence of bugs".

An independent tax-funded regulatory body is in theory acting in our interests, the vehicle buyers and breathers of the emissions. So why did they not discover the issue? A closer look at the 'tests' themselves gives some clues. Here are a few points worth noting:

1) The test is carried out in a controlled temperature of 20-30 degrees centigrade. At first this might seem OK to non testers. But if you look-up the average temperatures, in the hottest month, of a few European locations:

 Bonn       August  18°C (64°F)
 London     July    19°C (66°F)
 Lisbon     July    24°C (74°F)
 Paris      July    20°C (68°F)
 Brussels   July    18°C (64°F)
 Rome       July    26°C (78°F)
 Vienna     July    19°C (66°F)
 Stockholm  July    18°C (64°F)

You begin to see that this rule is suspect. E.g.: In Paris, in the hottest month, approximately half the time will you meet this criteria in real life.

2) The relevant UK/EU test dates back to 1996. Some parts of the test date back 40 years.  Odd, given that the Engine Control Units, usually responsible for managing emissions behaviour, were introduced in the 1980s & 90s (<40years ago).

3) The procedure is highly predictable and repeatable - it always took 20mins 20secs to complete.

4) The rules require the 'driver' to stay within 2km/h (1.2mph) of an 'ideal' speed throughout the test.

In summary, old, highly scripted and rigidly enforced checks were performed in an unrealistic environment. The emissions-test isn't really testing at all. The procedure is a successful attempt to provide a repeatable scripted acceptance-test of a systems behaviour.

A systems behaviour was developed so when the car was driven in a defined manner, all the checks passed. The car can pass the test, but this provides no indication as to whether this is normal behaviour, or what might occur in any number of other realistic situations.

On a BBC Panorama programme, A former Automotive Type Approval Engineer talking about how cars have been only passing the emissions tests in the most unrealistic of conditions, is quoted as saying:
"...Testing the wrong things, in the wrong way, for quite a while"

This wasn’t testing, But it was done in the name of testing. Sound familiar?

Monday, 23 November 2015

'No More ASCII' Firefox Add-on

Many of my clients have a multi-national (and multi-lingual) user base, and their software receives input from a range of devices, not just those configured to UK or US locales. The sites may also need to process and publish content that is 'non-ASCII'.

So when I'm quickly testing a website or web application, I need to investigate how they handle inputs from a multitude of locales, quickly.

That's why I created the No More ASCII, a Firefox Add-on, it has a set of stock text strings from a range of languages and scripts. These have been chosen for their widespread use around the world, as well as their ability to highlight deficiencies in many web-sites. For example these features of the scripts can cause problems for ASCII/poor-Unicode implementations:
  • Right To Left text  - Hebrew
  • Diacritics - Swedish
  • Non-Roman - Mandarin, Hindi etc.
The text strings may not make 'sense' as some are partial sentences or Monty Python quotes. They are aimed to have a selection of characters that may not be well encoded by your software.

Here is an example of a web site ( The Telegraph ) that doesn’t handle a Hebrew query of their articles very well:

Or take a look at the Firefox website. Queries for Mandarin Chinese characters return 'No results found.' But a search for Hindi script, returns 'Search is temporarily unavailable'. That looks like an issue i might want to investigate...

The free add-on is available to download now, and I hope to expand the list of languages/scripts available. Requests are welcome. Credit goes to Wikipedia and Omniglot for the text used.

Thursday, 19 November 2015

Counting Strings Firefox Addon

A while back I created a simple web based tool that helped you create text strings of a specified length. The text strings are created to make it easy to tell their length even if they are truncated.

The tool was based on a similar tool by James Bach, called perlclip.

I've now updated my Counting Strings script to be a free Firefox add-on. So you can now have it with you where ever you test online. You don't even need to restart your browser.

Counting Strings opens right in your browser, without affecting your website.