Slashdot Mirror

Because no piece of software has ever had a bug.

ISO 26262. *

Trying to argue why "software may theoretically have bugs" is a bad argument will take too much time. It is a lot easier for both of us if you just read the standard. (Or IEC 61508 if you want to, the safety related parts should be fairly equivalent.)

Just to get an idea of the scope, a system developed according to the standard will be able to manage a situation where a transistor in the CPU stops working, for example if the ALU no longer can set the zero-flag and conditional branches no longer is possible. Yep, you so called "safe" high level languages means jack shit when it comes to designing safe systems. Your built in super-automatic buffer overrun check isn't guaranteed to work.

The software should be bug-free, but even if it isn't then it shouldn't cause a safety issue.

Completely agree

However, my snark was more to do with the way certain internet commenters have this incredibly high standard placed upon Tesla, yet if an existing car manufacturer for example has a tech flaw, there isn't nearly the same level of outrage/concern/whatever

Could it be that "electric cars" and "autonomous driving" are a threat to people who's ePeen is attached to their ability to own and operate a big V8?

Note: I'm not saying that Tesla should get a pass for whatever may be wrong in their cars. I'm saying that the level of wrath directed towards Tesla seems to be people getting defensive over their toys being slowly taken away. I suspect that most of these people have never even heard of Lidar until it became a talking point for Tesla

* I do not assume that Tesla actually follows the standard even if they are legally required to.

I just hope that they're doing a better job of it than Toyota

and I say all of this while I tend to avoid American cars due to hardware reliability concerns (hoping Tesla will be the exception here)

For once, the answer to the headline is "yes."

Yes, Kaspersky should show its source code to the US Government. They should show their source code to all of their users. All software should come with its source code. If you weren't convinced of that before, you should have been by the audit of Toyota's source code.

http://www.safetyresearch.net/...

and no proper post-mortem was divulged, just denial and smoke screens.

That's not true at all.

...and Toyota settled with utmost haste after they were found guilty. http://www.safetyresearch.net/... Software like this CANNOT be connected to larger networks safely.

Not only that, but in the article he completely dismisses/ignores/pretends-it-doesn't-exist the Toyota unintended acceleration analysis that happened after the NASA folks got their chance. Turns out the NASA folks didn't get everything there was to analyze, and low and behold once all of the info was available: Toyota's engineers did a crap job of safety in their software.

Full details can be read here.

I can't speak to him being a shill, but he's definitely either misinformed or disingenuous.

> And that real cause was? Verified by empirical data?

Um, ok. It's not hard to find.

I may have missed the whooooosh sound accompanying your sarcasm or you missed this report. Which one is it?

One problem caused by this fault is that if the throttle gets stuck in the open position (the exact amount is redacted from the public record, but it looks to be >30%), then the vacuum assist to the brakes is greatly reduced (after all, normally the throttle closes when you move your foot to the brake pedal, so you get full vacuum assist). The upshot is that the driver would need to apply far more pedal pressure than they're used to to get full braking - combined with the fact that the engine is pulling hard it will feel like the brakes have simultaneously failed. Turning off the ignition might help with the acceleration, but not with replenishing the vacuum assistance.

There is a lot more to this than simple driver error. Read the court testimony, it's a real eye-opener and in fact a really great read: http://www.safetyresearch.net/2013/11/07/toyota-unintended-acceleration-and-the-big-bowl-of-spaghetti-code/

Anyone who knows anything about coding, or just has an interest in this case can read a great summary here: http://www.safetyresearch.net/2013/11/07/toyota-unintended-acceleration-and-the-big-bowl-of-spaghetti-code/ which also has links to the testimony of the expert witnesses to the court.

The testimony makes fascinating reading, and is based on analysis of the actual source code in clean-room conditions. If after reading it you still think this isn't a software problem, maybe you need to turn in your geek badge right now.

They didn't speculate. They analysed the source code, which they had clean-room access to, as well as the actual compiler and test harness used by Toyota. Toyota testified that the stack utilisation was 41%, whereas the analysis showed that it was actually 97% *before* the recursion was taken into account. It looks pretty certain that stack overflow could occur. Following the stack are key system structures used to control the scheduling of threads on the CPU, and damage to these structures could cause one or more of the threads to never get any scheduled time. One of the threaded tasks not only controls the throttle, but also the failsafes in case of some scenarios,and also the code that writes fault codes to the battery-backed RAM. Basically, if that task dies, then the throttle is left uncontrolled, the failsafes don't kick in, and no fault codes are written so that the problem is revealed after the fact. It's a terrible design; a disaster waiting to happen.

Uses can protect themselves against this sort of thing by not buying a Toyota until they are compliant with the relevant standards. Only hurting them in the marketplace will get them to fix this problem.

The testimony from both expert witnesses Barr and Koopman are now a matter of the public record and actually make fascinating reading - they'll be especially interesting to computer guys because it goes into a lot of detail about the code design, though frequently translated for the benefit of the court into layman's language. It's going to go down in history I reckon as a classic case of how not to design a safety-critical system.

A great summary and links to the public court documents can be found here: http://www.safetyresearch.net/2013/11/07/toyota-unintended-acceleration-and-the-big-bowl-of-spaghetti-code/

By the way, the deposition isn't where it used to be. Here is one that still exists (PDF warning).

Trivia: the copper man used to test and advertise heated electric blankets. The same ones whose failures cause an estimated 5000 fires each year in the U.K. The ones that were sold for more than a decade in the U.S. without adequate safety circuits.