[HN Gopher] A case study of Toyota unintended acceleration and s...
___________________________________________________________________
A case study of Toyota unintended acceleration and software safety
(2014) [pdf]
Author : georgecmu
Score : 64 points
Date : 2022-05-02 15:22 UTC (7 hours ago)
(HTM) web link (course.ece.cmu.edu)
(TXT) w3m dump (course.ece.cmu.edu)
| darknavi wrote:
| This is from 2014 by the way.
| RcouF1uZ4gsC wrote:
| > I testified as a Plaintiff expert witness
|
| This slide is written by someone that has a bias.
|
| I have not seen any independent confirmation that the Toyota
| problem was caused by a software issue (and indeed the slides
| mention that NASA looked at it and did not find such an issue).
| buescher wrote:
| Toyota lost the lawsuit on their development processes and
| firmware design. As far as I know, no specific bug that would
| cause unintended acceleration was ever found.
| elfchief wrote:
| IIRC, they did identify a bit that if it were flipped in a
| certain way at a certain time, would lead to the struck
| throttle condition, and were able to successfully replicate
| the stuck throttle condition by 'manually' flipping that bit.
| So they never reproduced the problem in the field, but they
| could force a condition that would cause it -- and for a one-
| in-a-million thing like a cosmic ray bit flip, that seems
| like a reasonable methodology.
|
| (and was only a problem because they didn't handle critical
| variables correctly, by having mirrors of the values that
| could be compared to protect against various types of
| corruption)
| buescher wrote:
| Koopman is the real deal. Big fan of the RTX-2000 here, and
| his embedded software book is excellent. But my
| recollection is that he and Barr found no such particular
| bit - the argument was, if one task failed, which could be
| due to any number of potential bugs, perhaps just one bit
| getting flipped, the unintended acceleration could happen.
|
| The material from Barr is worth reading too (google it),
| and if you want some amusement:
|
| https://www.embedded.com/why-every-embedded-software-
| develop...
|
| https://www.embedded.com/a-rebuttal-to-why-every-embedded-
| so...
| bsder wrote:
| > Toyota lost the lawsuit on their development processes and
| firmware design. As far as I know, no specific bug that would
| cause unintended acceleration was ever found.
|
| I truly believe that it was human factors and not a computer
| failure.
|
| I've been in similar situations and had a acquaintance drive
| through a wall because of human factors. In our case, the
| parking lot was relatively flat but had a drainage channel at
| the front. So, you could put your car into reverse, release
| the brake, and your car would _roll forward_. Quite unnerving
| if you are driving a stick, but your brain processes it
| because you are used to rolling in the wrong direction. If
| you are driving an automatic, you smack the accelerator, jump
| across way too small gap between you and a building, and bury
| your car trunk in an office wall.
|
| Nevertheless, I'm also quite happy that Toyota got smacked as
| their development process was _TERRIBLE_. They 100% deserved
| what they got even if it wasn 't a computer bug.
| matthewdgreen wrote:
| NASA looked at it well before the analysis mentioned in the
| slide deck, and it was a much shorter analysis and simply did
| not find this flaw. Toyota had their own technical experts and
| plenty of opportunity to publish technical reports rebutting
| it. I am not aware of any place where they did so, and they
| certainly had the opportunity (nobody is muzzling them.) I
| believe that maybe Toyota did argue that there was no evidence
| _that this flaw caused the actual events in the field_ , which
| is true but also not a rebuttal exactly.
| photochemsyn wrote:
| The list of issues seems pretty independent of any bias of the
| presenter:
|
| > Copyright 2014, Philip Koopman. CC Attribution 4.0
| International license.
|
| * Poor isolation of task functions
|
| * "Kitchen Sink" "Task X" both computes throttle angle AND is
| responsible for many of the failsafes (same CPU, same task).
| Brake Override function in 2010 MY Camry is in this same task.
| [Bookout 2013-10-14 AM 80:5-82:16]
|
| * OSEK RTOS not certified; 80% CPU load (> 70% RMA limit)
| [Bookout 2013-10-14PM 42:6-25] [NASA App. A p. 119]
|
| * Many large functions - 200 functions exceeded 75 lines of
| non-comment code [NASA App. A p. 23]
|
| * Reviews informal and only on some modules [Bookout 2013-10-11
| PM 29:24-30:5; 2013-10-14 49:17-21]
|
| * No formal specifications [Bookout 2013-10-11 PM 29:24-30:5]
|
| * No bug tracking system [Bookout 2013-10-14 PM 49:3-50:23]
|
| * No configuration management [Bookout 2013-10-11 PM 30:7-10]
|
| That doesn't look good. No bug tracking system? Large functions
| with no comments? Certainly not best practices as I've ever
| seen them described.
| elfchief wrote:
| They also followed almost none of the guidelines in the MISRA
| C standard, which is a standard developed by the automotive
| industry specifically for helping to ensure that code running
| on car computers is up to at least _some_ standard.
| Stratoscope wrote:
| > > _* Many large functions - 200 functions exceeded 75 lines
| of non-comment code [NASA App. A p. 23]_
|
| > _Large functions with no comments?_
|
| I don't think that's what the citation says. It says the
| functions had more than 75 lines of code _not counting any
| comments_. It doesn 't say there were no comments in these
| functions.
|
| Nitpick aside, I'm sure we can all agree that a large number
| of such lengthy functions is not good practice.
| tempnow987 wrote:
| I'm always curious in these cases.
|
| Was the key not usable? Ie, turn off vehicle?
|
| Was neutral not available?
|
| To get my car to go I need key in the on position AND the gear in
| drive. I can go to neutral and turn off key anytime.
|
| These stories of barreling down the highway with key locked,
| throttle locked, gear selector locked seem bogus.
| weaksauce wrote:
| you going 100mph and turning off your car is not a great idea
| since that locks up the steering wheel all but guaranteeing a
| crash. I am pretty sure most cars should be able to switch into
| neutral though which would be advisable. who knows though how
| someone operates under pressure like that. they did call 911
| and you can hear the final moments iirc.
| XnoiVeX wrote:
| All motorcycles come with a standard electronic kill switch.
| Should cars be mandated to have them too?
| throwaway-jim wrote:
| I don't understand where there is a kill switch when you can
| just turn off your vehicle using the key? Besides killing the
| engine will mean no power to the brakes and steering as well.
| michaelt wrote:
| Motorcycle kill switches are always on the handlebars, so you
| can reach it without letting go of the handlebars. Also makes
| it easier to find - some bikes have the keyswitch on the
| side, but the kill switch is always on the handlebars.
| pjdesno wrote:
| When this first came out, I recall reading that the reason the
| watchdog timer was reset from the timer interrupt was because as
| they added more software and overloaded the CPU, things got
| slower and the timer started triggering during normal operation.
| This caused the engine to hiccup if the vehicle was moving, or
| stall if you were at a stop. (IIRC reboot takes ~125ms, so no
| spark during this time)
|
| The watchdog is the last-ditch failsafe, in a safety-critical
| system, and they basically disabled it because it was
| inconvenient. In some businesses (aviation?) you could probably
| be convicted of something for doing that, whether or not it ever
| hurt anyone.
| civilized wrote:
| What's infuriating is, think about how much of that software
| was probably worthless bloat for features no one needs. As many
| as 89 people may have died so Toyota could claim Bluetooth and
| MP3s in their latest models.
| oofbey wrote:
| I wonder how much the software engineers at Tesla & similar
| think about this stuff. I bet not much.
| 2143 wrote:
| > What's infuriating is... As many as 89 people may have died
| so Toyota could claim Bluetooth and MP3s in their latest
| models.
|
| You don't have to stay infuriated anymore.
|
| The computers for in-car-entertainment is different and
| decoupled from the one for engine and throttle management.
|
| As for the bloat, my observation (which could be wrong) is
| that Toyota seems to have comparatively less bloat.
| WalterBright wrote:
| > The computers for in-car-entertainment is different and
| decoupled from the one for engine and throttle management.
|
| Learning the lessons from the aviation industry all over
| again.
| RC_ITR wrote:
| >The computers for in-car-entertainment is different and
| decoupled from the one for engine and throttle management.
|
| Somewhat unrelated to this particular case, but
| terrifyingly, the network isn't and CAN is one of the least
| secure BUS's imaginable.
| vodou wrote:
| >... CAN is one of the least secure BUS's imaginable.
|
| Can you elaborate on this?
| kayodelycaon wrote:
| No security or authentication. IIRC, any attached device
| has full control over the physical layer by design. I
| don't really see why this is a problem in a car with
| isolated buses for safety-critical components.
| fmntf wrote:
| Even cheap cars have a dedicated powertrain/brake/ABS CAN
| bus. Separate buses are then interconnected via a
| gateway.
| firephonestival wrote:
| New cars do, but that has not always been the case. The
| rapid shift to hard bus separation happened after this
| incident:
|
| https://www.eetimes.com/hacked-jeep-whom-to-blame/
| PaulHoule wrote:
| I'd assume the entertainment is decoupled from any engine
| control, drivetrain control or drive-by-wire features.
| malfist wrote:
| Yeah, GP is wrong in assuming bluetooth or MP3 processing
| had anything to do with this.
|
| The CAN bus is what rules in cars, and infotainment systems
| are generally isolated and off of it. In some cases
| infotainment can read the CAN bus for things like pulling
| speed to display on GPS, but generally cannot place items
| on the bus
| chomp wrote:
| You're correct, this is the ETCS, which is a piece of the
| electronics in a Toyota. It's responsible for feeding
| speed, sensor, and drive control inputs in, and figuring
| out EFI, throttle, timing and stuff like that.
| elfchief wrote:
| One thing that I found amusing/interesting/horrifying back when
| I read about this originally is that you can measure the
| computer reboot time in _feet_. IIRC, in the problem vehicles,
| the reboot time was something like 150 feet @ 60mph.
| [deleted]
| nvusuvu wrote:
| My father was gifted a 1972 Buick Regal. I was asked to drive it
| on I-85 (interstate) During acceleration on the onramp, the cable
| controlling the throttle got stuck and the gas was flowing into
| the carb and UA continued to occur. I was reaching speeds in
| excess of 100 MPH (160 Kmph). The brakes did nothing to slow me
| me down. My wife, driving adjacent to me in another vehicle,
| thought I was showboating or just being wreckless. I had to kill
| the engine with the key, slow down, and then crank the car, begin
| accelerating, then kill the engine to 'manage' the vehicle until
| I could get off the interstate. Terrifying ordeal.
| kemiller2002 wrote:
| "Funny" enough, my family had a similar experience. My parents
| owned a 1984 Ford conversion van. On a family road trip, a
| squirrel got up into the engine and built a nest or something
| around the component which was used to control the amount of
| gas going into the engine (I don't remember the exact
| specifics), my dad had to shift it between drive and neutral
| until we could make it off the highway as well.
| tempnow987 wrote:
| I was boating and same issue - broke to full throttle on a gas
| engine. So I just came flying in and killed engine. I could
| have restarted probably if needed. These things are almost
| always stoppable.
|
| Another boat had a diesel. This boat had serious flooding and I
| went over to help ($1M+ boat, owner had backed it hard into
| concrete pier and not noticed a transom crack that opened).
| Engine would not shut off (electrical all shorted out). That
| diesel engine was running full tilt almost totally submerged -
| was pretty impressive. Eventually someone got a mask and
| snorkel and dove to fuel cutoff before it ingested a bunch of
| water through air intake (which I'm sure would have stopped
| it). With diesels I always liked knowing where manual fuel
| cutoff was after that.
| moron4hire wrote:
| A place I worked years ago was a manufacturer of industrial
| lifting cranes. They had a problem one particularly hot
| summer of the diesels in the cranes starting up in their own.
|
| These were massive engines. The block was bigger than my
| whole car. Terrifying watching one of them run away. They
| tended towards "violent, unscheduled disassembly" if they
| couldn't be shut down.
| vikingerik wrote:
| In such cases, if you can't brake or release the throttle, one
| other out is to gear-shift into neutral. The result of slamming
| that power into neutral won't be great for the engine or
| transmission, but at least you'll be able to stop accelerating
| and coast to a stop.
| twofornone wrote:
| Shifting to neutral under load is probably not harmful. It's
| the opposite that is harsh on the drivetrain.
|
| However if the throttle is stuck and you are in neutral
| you'll end up revving at redline until you turn off the
| engine. Not the end of the world momentarily but you don't
| want to leave the engine revving that high for a prolonged
| period of time.
| macintux wrote:
| I recall riding with a friend who had an automatic, and his
| engine was racing at every stoplight (I don't recall the name
| of the hardware that's supposed to disengage the engine when
| the brake is fully applied, but clearly it was broken).
|
| So, he sat at every light with the brake pushed hard to the
| floor, trying to keep it from plunging into the intersection.
| As a long-time stick shift driver, I asked him why he didn't
| just shift it into neutral.
| 2143 wrote:
| > I asked him why he didn't just shift it into neutral.
|
| What if the engine free-revs and redlines on neutral?
|
| Maybe turning it off might be a safer alternative.
| sidewndr46 wrote:
| Even very old cars have a rev limiter based off the RPM
| that momentarily disables the ignition.
| Kon-Peki wrote:
| A "modern" car is unaffected by free-revving to the
| redline. The computer shuts off fuel intermittently to
| prevent damage.
| Syonyk wrote:
| And most older engine will float the valves and, assuming
| nothing collides or comes apart (floating valves isn't
| good for the rest of the valvetrain), self limit that
| way.
|
| But almost any engine with electronic ignition (so early
| 80s or later for a standard car or motorcycle, with
| plenty earlier having that feature) will cut spark to
| control RPM as needed. Unless you just start getting
| ignition breakup at RPM (not enough dwell time for the
| coil).
| op00to wrote:
| I would take a blown engine over flying into an
| intersection any day of the week.
| toast0 wrote:
| If it's only an issue at stop lights, it might just be a
| very high idle for whatever reason, and putting it in
| neutral wouldn't necessarily redline.
|
| For throttle stuck fully open, going very fast on the
| highway, yeah you're gonna redline, but it's probably
| better to redline in neutral while you pull over than to
| turn the key off while you're still driving.
| Enginerrrd wrote:
| Not sure, but you might still have power steering if you
| leave it on but in neutral. If you turn it off, you'll
| definitely lose hydraulic steering assistance.
| amluto wrote:
| At any respectable speed in a well constructed car with a
| mechanical steering linkage, power steering is basically
| unnecessary. My old car used to have glitchy power
| steering-- at 35mph, I could generally tell when it
| wasn't working, but it wasn't very obvious. At 5 mph it
| was quite obvious when it wasn't working.
| abawany wrote:
| Yep, plus brakes - one typically gets two or so powered
| hits before the brake pedal also becomes unmanageable
| after the engine is off.
| slingnow wrote:
| Safer for the engine? Absolutely. Safer for you?
| Definitely not.
|
| Which one are you optimizing for?
| WalterBright wrote:
| Happened to me once. I stuck my foot under the gas pedal and
| forced it back up.
|
| The throttle return spring is rather weak, and it doesn't take
| much to gum it up. A little force the other way will usually
| unstick it.
| PaulHoule wrote:
| I'm no fan of the mitigation of killing the throttle if somebody
| stomps on the brake.
|
| If you're trying to go around corners as fast as possible in a
| front-wheel drive car you're going to drive with one foot on the
| brake and one foot on the gas and will apply the brakes and the
| gas at the same time.
|
| The article also says that global variables will kill you,
| putting variables on the stack will kill you but doesn't say
| where it is safe to put variables. I can't imagine the heap is
| any better, that a garbage collector isn't going to pause and
| kill you, etc.
|
| As an Arduino enthusiast I see statically allocated (global?)
| variables are frequently the way to go for an embedded system,
| the frontier is to be able to prove the correctness of what
| you're doing.
| bonestamp2 wrote:
| > If you're trying to go around corners as fast as possible
|
| Why do you need the brakes? The nearest freeway on ramp to my
| home is unusually short, and it's a 270 degree turn. I've had
| to get very good at getting my vehicle to accelerate as quickly
| as possible around that curve so that I can merge safely when
| the on ramp ends.
|
| I don't need the brakes to do that, in fact the front brakes in
| most vehicles are usually much stronger and the braking bias is
| usually weighted greatly in favor of the front brakes. So
| again, I really don't know why you need the brake, especially
| in a front wheel drive car... you're just fighting the engine
| and the brakes can usually win that fight (except for in high
| powered rear wheel drive cars where the rear brakes are weak
| and the engine can overpower them).
| closewith wrote:
| You use the brakes to control loading on the front wheels to
| maximise grip. You need to control brakes and throttle to
| corner quickly.
| tcoff91 wrote:
| Yeah the trail braking part makes sense to me, but I can't
| think of why you'd be continuing to press the throttle when
| you're in the braking zone. Is this some kind of trick to
| prevent an automatic transmission from downshifting out of
| the power band while you're in the braking zone?
| [deleted]
| tcoff91 wrote:
| Using the brakes all the way into the apex of the corner
| helps to increase cornering speed by transferring more weight
| to the front wheels to increase grip. It's called trail
| braking.
|
| This isn't relevant for your example as in your example, you
| are entering the freeway on-ramp at a low speed and
| accelerating throughout the entire corner. Navigating a
| corner at highest possible speed means you're arriving at the
| corner at a high speed and must decelerate in order to make
| the corner.
|
| It's not immediately clear to me why you would use gas and
| brake at the same time in an automatic transmission vehicle.
| The only reason I can think of would be to keep the revs of
| the engine in the powerband and prevent the car from
| downshifting so that you can immediately have full power when
| you accelerate out of the apex. In a manual transmission
| vehicle, there's a technique called heel-and-toe where you
| blip the gas pedal with your heel to rev-match the engine on
| your downshift while braking with your toe and depressing the
| clutch with your left foot, but you're never introducing
| force to the front wheels that would counter the force of the
| brakes.
| moron4hire wrote:
| Yes, that's exactly right, it's to keep the engine in the
| powerband. Automatic transmissions take both engine speed
| and throttle position into account when selecting a gear.
| More throttle while braking pushes the transmission to
| downshift more aggressively.
| LeifCarrotson wrote:
| > The article also says that global variables will kill you,
| putting variables on the stack will kill you but doesn't say
| where it is safe to put variables. I can't imagine the heap is
| any better, that a garbage collector isn't going to pause and
| kill you, etc.
|
| Function-scope static or file-scope static variables are the
| best place for variables in an embedded system written in C.
| They don't pollute the shared namespace, nor do they require
| allocation and de-allocation.
|
| In an Arduino program, for example, you might have something
| like this, with a sketch.ino file: #include
| <stdint.h> #include "MyFile.h"
| uint32_t Bad_Global_Variable; // This doesn't
| conflict with same name in MyFile.cpp static uint8_t
| state = 1; void setup() {
| setup_myFile(); state = 0; }
| void loop() { loop_myFile(); }
|
| a MyFile.h header: #ifndef _MY_FILE_H_
| #define _MY_FILE_H_ #include <stdint.h>
| void setup_myFile(void); void loop_myFile(void);
| #endif // End include guard
|
| and a MyFile.cpp library: #include "MyFile.h"
| static uint32_t MyFileScopeVariable = 0; //
| This doesn't conflict with same name in sketch.ino
| static uint8_t state = 0; void
| setup_myFile(void) { MyFileScopeVariable = 1;
| // Can't access or have conflicts with myFunctionScopeVariable
| here state = 1; } void
| loop_myFile(void) { static uint32_t
| myFunctionScopeVariable = 0; MyFileScopeVariable++;
| myFunctionScopeVariable++; }
|
| Statically allocated variables are definitely the only the way
| to go.
|
| Statically allocated global variables are easy and available,
| suitable for small embedded systems written by one person or a
| small group of collaborators who can be expected to know about
| every variable in the program or at least to be able to
| refactor their code if it collides with an existing name.
| Adding a prefix to your statically allocated global variables
| (eg. 'mf_state' for a global variable in the MyFile library
| above) is another way to reduce collisions, but isn't compiler-
| enforced.
|
| Statically allocated file-scope or function-scope variables are
| a best practice in an automotive ECU scale projects, and can
| reduce issues if you've got lots of vendors each contributing
| code and not a lot of visibility between projects.
| quickthrowman wrote:
| > If you're trying to go around corners as fast as possible in
| a front-wheel drive car you're going to drive with one foot on
| the brake and one foot on the gas and will apply the brakes and
| the gas at the same time.
|
| If you're going around corners as fast as possible in a front
| wheel drive car, sell it and buy an AWD or RWD car that doesn't
| understeer.
| gedy wrote:
| > you're going to drive with one foot on the brake and one foot
| on the gas and will apply the brakes and the gas at the same
| time.
|
| There are vastly more people who are just bad drivers who use
| both feet like this out of poor skills or bad habit. Afaik this
| was the main cause of "unintended acceleration" with panicked
| drivers.
| DakotaR wrote:
| Besides driving manual on hills, I've had to use both feet to
| creep up oil change ramps.
| cameronh90 wrote:
| That's what the handbrake is for.
| throwaway0a5e wrote:
| Or the "drive one way, hold brake, put it in the other
| gear, add some gas, release brake" trick for getting mildly
| stuck vehicles unstuck.
| kayodelycaon wrote:
| > If you're trying to go around corners as fast as possible in
| a front-wheel drive car you're going to drive with one foot on
| the brake and one foot on the gas and will apply the brakes and
| the gas at the same time.
|
| This does not seem like a valid use case for driving on public
| roads.
| Swizec wrote:
| > This does not seem like a valid use case for driving on
| public roads.
|
| Driving in the snow often requires this because the brake
| acts as a poor man's diff lock which gives you more traction.
| You can see the effect at speeds as low as 30kph in snow - a
| nice slow speed even in the city.
| jeffbee wrote:
| Literally every car sold today does this for you.
| salawat wrote:
| And automated things never fail? Then what are we
| reading? The user should be trained to be 10% smarter
| than the piece of equipment.
| jeffbee wrote:
| There is no way that 99% of drivers under 99% of
| realistic conditions will be anywhere near as effective
| as automatic traction control, much less more effective.
| It is absolutely a fair tradeoff to have a drive-by-wire
| that's better than virtually everyone and almost as good
| as that one guy under perfect controlled conditions.
| failedengineer wrote:
| I've never heard of this, and I learned how to drive in
| places with very rough winters.
|
| You just hold the brake (lightly) with one foot, and gas
| with the other? This doesn't sound as useful as putting the
| car in 2nd, or rocking back and forth?
| Zak wrote:
| > _This doesn 't sound as useful as putting the car in
| 2nd, or rocking back and forth?_
|
| Neither of those cause the wheel with more traction to
| get any torque. Applying the brakes lightly will. Rocking
| and manually preventing wheelspin with the brake can be
| combined.
|
| In theory, traction control will as well, but traction
| control may also intervene and decrease power right when
| you need it as you're getting unstuck, so there's
| potential merit in turning it off and preventing excess
| wheelspin with the brake yourself.
|
| Source: I learned to drive in Alaska, and I have used
| this technique.
| failedengineer wrote:
| yeah, Alaska and Sibera are pretty much the only places
| with worse winters than where I learned. I'll keep this
| in my pocket for times when I'm spinning a wheel and am
| out of other options. We only get a few inches a year
| here, but my traction control might be out someday.
|
| Thanks!
| kayodelycaon wrote:
| You're using the brake to prevent a slipping tire from
| taking all of the power. This is a non-issue for any car
| made in the last decade since traction control is
| mandatory.
| olyjohn wrote:
| That assumes that all traction control systems are equal.
| A lot of them are hot garbage and won't get a car moving
| when only a single tire is off the ground.
| guicho271828 wrote:
| Cars are not built only for public roads.
| [deleted]
| brimble wrote:
| I don't think anyone is considering doing this to race
| cars.
| vesrah wrote:
| Which is fine, as long as there is some kind of sane
| defeat for originally street cars that might see the
| track.
| robonerd wrote:
| Frankly it's also fine if there isn't. Taking street cars
| to the track is a tiny niche and Toyota needn't cater to
| it. Aftermarket modding is an option anyway.
| BoorishBears wrote:
| If you're serious about racing you'll have an aftermarket
| ECU
| olyjohn wrote:
| That would depend on what kind of racing you do. I'm
| pretty sure Spec Miata requires you to run a stock ECU.
| And it's literally the most popular racing series on the
| planet.
| salawat wrote:
| No, it isn't fine, what you're seeing here is the push to
| use manufacturing infra to impose one group's will on
| another. Tools should be neutral.
|
| We should empower people, not manipulate them through
| engineering usecases to/to not accommodate.
| brimble wrote:
| I feel empowered when I don't have to worry as much about
| how to safely operate my car, and it's just automatically
| safer. And when I don't have to worry as much about other
| drivers on public roads because _their_ cars are
| automatically safer. The amount I 'd be happy to pay to
| make that functionality configurable in order to
| accommodate people with different preferences, is $0.00.
| robonerd wrote:
| > _If you 're trying to go around corners as fast as possible
| in a front-wheel drive car you're going to drive with one foot
| on the brake and one foot on the gas and will apply the brakes
| and the gas at the same time._
|
| If you want a race car, buy a race car.
| adolph wrote:
| > If you're trying to go around corners as fast as possible in
| a front-wheel drive car you're going to drive with one foot on
| the brake and one foot on the gas and will apply the brakes and
| the gas at the same time.
|
| Mario, when you do this move, is your third foot on the clutch?
|
| _Heel-and-toe shifting is used before entry into a turn while
| a vehicle is under braking, preparing the transmission to be in
| the optimal range of rpm to accelerate out of the turn._
|
| https://en.wikipedia.org/wiki/Heel-and-toe_shifting
| jacquesm wrote:
| > If you're trying to go around corners as fast as possible in
| a front-wheel drive car you're going to drive with one foot on
| the brake and one foot on the gas and will apply the brakes and
| the gas at the same time.
|
| Sure, but that's not normal driving and even though it should
| be possible this situation should simply never occur outside of
| a racetrack, a regular driver will move their one foot from the
| gas and move it to the brake.
| salawat wrote:
| You're assuming levels of clean abstraction that not only are
| not guaranteed to rxist, but foolhardy to assume.
|
| It is better to leave options open rather than to lock things
| behing explicit configuration in the abscence of readily
| available documentation.
|
| Which I assure you, Service/Operators manuals are not.
| Gordonjcp wrote:
| > If you're trying to go around corners as fast as possible in
| a front-wheel drive car you're going to drive with one foot on
| the brake and one foot on the gas and will apply the brakes and
| the gas at the same time.
|
| No you won't.
|
| > As an Arduino enthusiast I see statically allocated (global?)
| variables are frequently the way to go for an embedded system,
| the frontier is to be able to prove the correctness of what
| you're doing.
|
| When you have 2kB of RAM to play with you haven't got a lot of
| stack or heap to sling function parameters around on, so it's
| Through The Looking Glass and you do it all backwards -
| everything goes in a global unless you have a really really
| good reason for having local scope (loop counters would be a
| good example).
| Jtsummers wrote:
| > As an Arduino enthusiast I see statically allocated (global?)
| variables are frequently the way to go for an embedded system,
| the frontier is to be able to prove the correctness of what
| you're doing.
|
| As a professional in the embedded and safety critical systems
| space: No, they aren't "the way to go". You often end up with a
| small number (think "singletons" for OO people) but the rest
| can be done properly with local variables or more limited scope
| variables instead of garbage global variables to manage complex
| system state.
| virtue3 wrote:
| 256.6K Non-Comment Lines C Source + 39.5K NCSL headers (Main
| CPU)
|
| Global variables in that kind of codebase might be -really-
| hard to keep track of how you are accessing and writing them
| :/.
|
| This gets really fucking nasty when you're doing things like
| setting it to volatile and potentially accessing it across
| threads and you end up with a partial write and then doing a
| read, etc.
|
| I'm sure the axiom of "it's never tested as much as we want"
| still probably applies here and that's slightly terrifying.
|
| also FTA: 2272 - global variable declared with different types
|
| "Spaghetti code": Incomprehensible code due to unnecessary
| coupling, jumps, gotos, or high complexity
|
| Yeah that sounds fun. really fun. This is why I purposefully
| never work on any system that could kill someone. I just can't
| imagine being in charge of something like that and not wanting
| to go insane with knowing my code wasn't checked enough. or I
| wasn't careful enough.
| monocasa wrote:
| The rumor I heard at the time was that large portions of the
| code were autogenned out of a Matlab model of the engine, and
| that was where the globals and awful code complexity metrics
| came from.
| sidewndr46 wrote:
| If you're declaring a variable as volatile and accessing it
| from separate threads, it is going to be "fucking nasty" in
| so many ways.
| jacquesm wrote:
| Indeed, spaghetti code is bad, but _spaghetti data
| manipulated by spaghetti code_ is orders of magnitude worse.
|
| The thing that I never got is why there are plenty of high
| level languages that have 'global' more or less as the
| default. This is asking for trouble. Side effects should be
| very carefully introduced and reasoned about and kept to an
| absolute minimum, not be the default sauce to sprinkle across
| your codebase, the possible number of states increases very
| rapidly if you do that.
| 2143 wrote:
| > If you're trying to go around corners as fast as possible
| in a front-wheel drive car
|
| 1. Please don't do circus on public roads.
|
| 2. If you're on private roads, well, you know, front-wheel-
| drive cars tend to handle poorly in fast corners. Do yourself
| a favour and get a RWD or AWD or something.
| DSMan195276 wrote:
| > As an Arduino enthusiast I see statically allocated (global?)
| variables are frequently the way to go for an embedded system,
| the frontier is to be able to prove the correctness of what
| you're doing.
|
| Worth noting that 'statically allocated' and 'global' aren't
| the same thing. Whether they're making that distinction in the
| powerpoint I'm not really sure because it's more of a language
| specific thing and the document isn't quite that technical.
|
| As for how you do that, in C/C++ you can add `static` to a
| global variable declaration to make it "local" to the
| file/compilation-unit it is declared in. The variable itself
| still works the same from within the file, but a static
| variable cannot be "seen" outside the file even with an
| `extern`, so it can only be (easily) modified from functions
| inside the file. Doing it this way allows you the big
| advantages of static allocation (in many cases the only real
| option) while still allowing you to encapsulate the variables
| within a sane API that the rest of the code uses.
|
| Edit: Actually page 39 references this, saying that 89% of the
| variables are not locally scoped. There are still ways to
| achieve some level of encapsulation even without using `static`
| but it's effectiveness drops a lot since anyone can just write
| an `extern` line and ruin your day...
| jonsen wrote:
| I haven't heard of any incidents since that time. Did they fix
| all the cars, or what?
| foxyv wrote:
| I used to have a Honda Civic with a sticky throttle. Luckily it
| was a manual transmission so it wasn't a big deal. Just push in
| the clutch and pull the pedal up with my toe then replace/repair
| the throttle whenever is convenient. No unintended acceleration
| and no fiery wrecks.
|
| I kind of wonder if we're heading the wrong direction with drive
| by wire cars. In aerospace it makes a lot of sense, especially
| when you are super dedicated to safe coding. But in a consumer
| vehicle? Not so great. Then again, Boeing hasn't been doing great
| with it either.
| cowmix wrote:
| I had an early 80s Accord with a sticky throttle. I almost
| wrecked my car many times because of it and I'm shocked I'm
| even here to type this.
| failedengineer wrote:
| There are loads of people on here who have never driven
| cable-controlled throttles, rack-and-pinion assisted
| steering... I'd even guess there are a few that haven't used
| manual windows or hand-adjusted rear view mirrors (the kind
| you have to lean waaaay over to fix), and probably lots that
| haven't driven brakes without ABS, especially in the winter.
|
| I can't believe I didn't think of it, but... I didn't realize
| that older throttles could get stuck.
|
| I do know that power steering is literally the difference
| between smaller women being able to drive and not. I had an
| old Ford Aspire that a couple of my friends just couldn't
| drive because they couldn't turn it if it wasn't moving at
| road speeds.
| throwaway0a5e wrote:
| >I do know that power steering is literally the difference
| between smaller women being able to drive and not
|
| Only because once it's a standard feature other engineering
| departments start doing things that requires the system to
| be there in order to get good results.
|
| The steering geometry that keeps modern (like mid 00s on
| up, the "wide tread, narrow sidewall" era) cars from
| wandering on crowned roads substantially increases steering
| force required.
|
| It's not like small women didn't drive 60s barges just fine
| without power steering.
| AlexandrB wrote:
| The other change is both steering wheels and steering
| ratios[1] have gotten smaller.
|
| [1] https://en.m.wikipedia.org/wiki/Steering_ratio
| olyjohn wrote:
| My mom used to drive an old Volvo wagon. It weighed a ton
| and didn't even come with power steering. Just a huge
| wheel to make the leverage a bit easier. She knew the
| real trick though, turn the wheel while the car was even
| just slightly moving. Even less than 1mph was enough
| movement to lighten the steering feel.
| jonny_eh wrote:
| > hand-adjusted rear view mirrors
|
| Do you mean side mirrors? I recall when you needed to lean
| over to the passenger side to adjust it.
| failedengineer wrote:
| yeah, the side mirrors
| jcstauffer wrote:
| I recall when they didn't put them on the passenger side.
| subinsebastien wrote:
| (1) Automotive (2) Medical Devices (3) Aerospace
|
| In my mind, all three are done with more or less similar rigour
| conforming to strict standards. Yet, exceptions are seen in all
| of them.
| kirykl wrote:
| Keep in mind the US Gov also owned a large amount of General
| Motors debt at the time
| GiorgioG wrote:
| What does this have to do with Toyota?
| adolph wrote:
| Since Toyota was a competitor to GM it implies a conflict of
| interest on the government's part.
| 29athrowaway wrote:
| If you write dirty code knowing it is going to be used in a car,
| you should be charged with manslaughter, children endangerment
| and any form of legal punishment arising from creating long
| functions with high cyclomatic complexity being called in
| spaghetti in the context of controlling a vehicle that can cause
| people to die.
|
| Seriously, when will the excuses for dirty code end? Whatever you
| think the business is, clearly killing 89 people is not it. Use a
| linter and remember your contribution to the business as a
| programmer is programming properly.
|
| If programming is below you go do something else. If you have
| management aspirations go interview for a management job. If you
| don't like coding properly go code something else or consider
| another career.
|
| Write proper code and stop talking about how dirty code is good
| for the business. Not only it is not true, nobody wants to hear
| about it, and nobody should have to deal with your 4d jenga tower
| in a professional setting, goddamn it.
| a-dub wrote:
| throttle angle function - 1300 lines
| subinsebastien wrote:
| Here is the YouTube video. https://youtu.be/NCTf7wT5WR0
| Overtonwindow wrote:
| When the driver pressed the brake pedal, why doesn't the vehicle
| disengage the throttle? I remember when this happened and many
| demonstrations were done that even if you were pressing the pedal
| to the floor, the brake disengages the throttle and brings the
| car to a stop.
| HPsquared wrote:
| Ironically on a car with vacuum assisted brakes and no
| mechanical vacuum pump, it's the other way round: when full
| throttle, there is no vacuum available and (after a few uses)
| the brakes become substantially weaker. That's on naturally-
| aspirated engines without a software override, anyway.
| 0xfeba wrote:
| But they'll typically have a check valve good for one assist.
| Assuming you press once and only once and *hard*, they will
| win.
|
| But that's a big assumption to make for people panicking.
| throwaway0a5e wrote:
| >But they'll typically have a check valve good for one
| assist
|
| 2-3 in practice.
| jandrese wrote:
| Also, the general guidance for someone who thinks their
| brakes are failing is to pump them to try to build
| pressure. In this case that guidance is the exact opposite
| of what you should do. The guidance is for a different but
| more common failure mode: brake line rupture.
|
| The correct solution to a runaway engine is to slap the car
| into neutral and then apply brakes and pull over if
| necessary. But that's not something most driving schools
| teach nor is it something your average person will
| practice.
| justoreply wrote:
| According to this podcast, in order to stop the car you just
| need to brake, as brakes are always more powerful than the
| engine
|
| https://www.pushkin.fm/episode/blame-game/
| jandrese wrote:
| I think the issue is that a runaway engine will lose vacuum
| which makes the brake boosters ineffective.
| InitialLastName wrote:
| Malcolm Gladwell has a long history of taking every
| opportunity available to use misleading interpretations of
| evidence to justify his fables [0 for a notable example]. I
| would take anything he puts an "always" behind with a very
| large (boulder-sized) grain of salt.
|
| [0] http://askakorean.blogspot.com/2013/07/culturalism-
| gladwell-...
| camhenlin wrote:
| > brakes are always more powerful than the engine
|
| That's really not true at all. Generally, as braking systems
| pick up heat, they become continually less and less efficient
| at slowing the car down and will eventually stop working
| entirely. This will be especially true when fighting against
| an engine running at wide open throttle. It's called brake
| fade.
| BoorishBears wrote:
| Brake fade is a thing, but firm deliberate use of the
| brakes would slow the car down enough for you to turn it
| off well before your brake fluid was cooked.
|
| The problem is having the presence of mind to do that when
| confronted with such an unusual situation
| BoorishBears wrote:
| Brake Override function was also running on that CPU
| salawat wrote:
| Which still requires the assumption of well behaving control
| flow.
|
| Most brakes don't actually lockout engine operation, because
| there are cases where you want the engine to rev while the
| brake is applied.
|
| Just because at first blush it seems the use case is
| pointless, doesn't mean it is.
| BoorishBears wrote:
| Not sure what you're trying to say, the Camry did have a
| Brake Override function and it was running on the same CPU,
| that's not sarcasm.
|
| You think the Camry was designed for track duty?
| 0xfeba wrote:
| Some do (at least now) but there's no standard/regulation for
| it.
| shadowgovt wrote:
| From a software design and engineering perspective, I agree with
| the NASA report's take on global variable use.
|
| ... but I've also done game development, where maximum
| performance in minimum time is absolutely essential, and I wonder
| if it was actually feasible to maintain the performance the
| control system needed without global state.
|
| There's also the possibility of a culture clash. I've noticed
| that in embedded systems architecture development, global
| variables aren't frowned upon nearly as hard as they are in
| enterprise software, mostly because of the industry history of
| doing more with less. So I imagine a software culture risk
| developing from getting a bunch of hardware guys on a project
| where they now have access to microcontrollers with more memory
| than ever, but their risk tradeoff mindset is still "take the
| risk to squeeze every byte because we might run out."
| shadowgovt wrote:
| This actually marks the second incident I had tucked away in my
| brain where the initial story was "Sometimes the world is just
| weird" and the actual issue was computer systems.
|
| The reason we all keep seatbelts bucked in flight even when the
| sign is off these days is Qantas Flight 72, which took two sharp
| nose-dives in flight, rebounding passengers and crew off the
| ceiling and causing severe injuries. At the time, initial
| reporting was that they'd caught two freak mid-Pacific
| downdrafts, which had me nervous about flying for awhile.
|
| Turns out, the root cause was bad angle-of-attack data coming in
| from a faulty inertial measurement unit, which should have been
| caught by a safety system but proved so aggressively faulty that
| the safety system was overruled. It resulted in the plane's
| avionics becoming convinced it was flying belly-on into the wind
| at cruising speed and about to stall, so it did the thing it's
| supposed to do: pitched down hard to stall-recover.
|
| Don't ask me why I'm more comfortable with the story being
| "Sometimes computer engineers screw up" than "Sometimes our
| understanding of the physics of aviation just breaks down," but I
| am. ;)
| bob1029 wrote:
| Option B: Remove the computer and use a cable between the
| throttle body and the accelerator pedal, as was traditional for
| about 3/4 of a century.
| MengerSponge wrote:
| Because physical throttle cables never got stuck for that 3/4
| of a century.
| bob1029 wrote:
| The failure mode of a physical throttle cable is almost
| always much more gradual than with a computer bug, which can
| effectively kill you instantly without warning.
| cameronh90 wrote:
| I had a car from the 90s that suddenly developed a sticky
| throttle.
|
| Of course you just put the clutch in and nothing to worry
| about.
| jandrese wrote:
| My grandfather had a truck on his farm with an occasionally
| sticky throttle. He failed to mention this when I had just
| gotten my learners permit and was trying to get some
| practice. So the family hopped in the back and he took
| shotgun so we could drive over to the cattle pasture and
| check on the herd. Halfway there I hit a bump in the dirt
| road and accidentally smacked the throttle with my foot,
| which causes it to stick on the floorboard just as we are
| approached the stream to crossing.
|
| Luckily for everyone involved my grandfather knew what to
| do and slapped the stick into neutral before we all went
| careening over the rocky crossing. I was a bit slower
| getting the clutch in and the brakes on being a new driver.
| It was pretty weird feeling stopped in the middle of a
| stream with brakes fully on and the engine roaring. He then
| reached over and turned off the key, making me feel like an
| even bigger idiot for not thinking of it.
|
| The point is if you're not mentally prepared for a runaway
| engine it's hard to figure it out on the fly in the mere
| moments you have before your doom.
|
| Follow on note: Grandpa gave that truck to my uncle a few
| years later and my uncle managed to blow up the engine
| almost immediately. Turns out some of the head bolts were
| not fully tightened down at the factory but my grandfather
| drove it so gently that it wasn't a problem except for a
| persistent but low grade oil consumption issue for its
| entire life.
| MengerSponge wrote:
| "almost" is doing a lot of work in that sentence
| MarcoZavala wrote:
| jacquesm wrote:
| They did, but at least you were aware of it, besides,
| throttle cables breaking was far more common than them
| getting stuck. And typically if a throttle cable got stuck it
| wasn't really the cable but the butterfly valve attached to
| it that got stuck, usually on gunk in the throttlebody
| itself.
| Toutouxc wrote:
| I have a feeling you DO understand that going back to driver-
| operated throttles would mean going back to 90s emissions
| standards, but you just don't care, am I right?
| salawat wrote:
| You know, there are those that see the slow delegation and
| abstraction away from operators the finer details of
| operating a machine and locking them behind unauditable,
| undocumented blackboxes to be a regression and power grab,
| right?
___________________________________________________________________
(page generated 2022-05-02 23:01 UTC)