5 ms·

Also, it implies a couple of engineers could slip through arbitrary code to be executed under selective conditions. That's terrifying.

Laaw 11y ago
But also probably true, regardless of this specific situation.
- twblalock 11y ago
  From what I know of the car industry, coding standards are very low. I don't think any car companies would look good if their code was audited by professional software engineers in other fields.
  - dogma1138 11y ago
    Then you don't know the motor industry very much as it has very strict coding standards like ISO 26262, the code has to be audited internally and by certified 3rd parties with every release to meet the development cycle requirements of the standards. http://www.ldra.com/en/software-quality-test-tools/group/by-industry-standard/automotive-iso-26262-misra http://www.ldra.com/en/software-quality-test-tools/group/by-... The industry also has specific coding standard for every language that is used in embedded systems like MISRA-C https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C Today every thing you do with your car from using breaks to deploying air-bags is done through the computer, there's no way in hell that the motor industry would be releasing poor code "intentionally" because it would cost them billions in liabilities.
    - joezydeco 11y ago
      And you're not familiar with what happened when a 3rd party (Michael Barr) was allowed to FINALLY look inside Toyota's engine code and determine the cause of the "Unintended Acceleration" problem: "Barr checked the [Toyota] source code against MISRA’s 2004 edition and found 81,514 violations." http://www.safetyresearch.net/blog/articles/toyota-unintended-acceleration-and-big-bowl-%E2%80%9Cspaghetti%E2%80%9D-code http://www.safetyresearch.net/blog/articles/toyota-unintende...
      - OopsCriticality 11y ago
        The model year 2005 Camry in question from the trial would have been made available in 2004, and the electronic throttle control system was designed prior to 2004 (IIRC, the ETC design was carried forward from the previous model). How does it makes sense to apply MISRA-C:2004 in this case, especially when the Toyota ETC in question was admittedly not designed under MISRA-C:2004 nor prior MISRA-C revisions? It is inaccurate to claim Michael Barr determined the cause of Toyota's unintended acceleration: he proposed a possible failure mode that was persuasive to a lay jury. His proposed failure mode didn't leave a DTC, so there's no way to actually know if his proposed failure mode actually happened in this case (or in any other).
        deleted 11y ago
        [deleted]
        danielweber 11y ago
        Barr always struck me as something of a charlatan trying to bamboozle a jury.
        dogma1138 11y ago
        I remember when this was posted on HN before, what I always wondered about is the discrepancy between the violations that NASA found and Barr. NASA found 7000 and change Barr found over 81,000, I'm not sure whats the size of the code that was reviewed but that's allot, even if you count the fact that half of them might be silly like naming convention violations that still leaves quite an odd number for actual violations especially when considering that the code for an embedded system can't be that huge. And the 10,000 global variables thing, well 10,000 sounds like a huge number but there wasn't any mention if they were a) necessary, b) implemented correctly, and c) out of how many variables in total? if the code they've tested has say 1 million variables then well.... And how they described global variables is also weird, they claimed that every software within the system can access them to me this sounds that your stereo or the rain sensor for the wipers can override data for the breaks, but that might be true only if everything is running within a single application. If the breaks run as an independent application well then only every function within the break software (depending on the language and how global variables are implemented) could potentially access those variables. To me pretty much that entire explanation seem to be constructed to sound worse than what it is, which is why I think that expert witnesses should only be allowed to be appointed and called by the court it self (as in by the judge so they and the jury could understand the technical details better) and not by either the defense or the prosecution.
    - Dav3xor 11y ago
      I've worked at a couple different companies that made safety critical software, and I have to agree with joezedeco. Dav3xor's Law -- Code Quality is Inversely Proportional to Risk.
      - dogma1138 11y ago
        And 2 of my friends worked for BetterPlace (RIP) and it took years for Nissan to accept the code which had to be rewritten to comply and certified by an external 3rd party. And that code wasn't even "mission critical" in terms of road safety. Anecdotal evidence is anecdotal.
      - cpeterso 11y ago
        Any theories why? Maybe because these big systems are outsourced to multiple low-ball vendors and their stitched together?
    - selimthegrim 11y ago
      And this would be why Toyota engineers _forgot which direction their stack was growing in_ and shit all over MISRA-C (see https://news.ycombinator.com/item?id=10355200 https://news.ycombinator.com/item?id=10355200)?
  - RealityVoid 11y ago
    I have seen both very good code and very bad code. Standards are in place for making it good but it really depends the most on who's implementing it and the SW team culture.
theli0nheart 11y ago
And, supposing this is true, would you actually be surprised by this? This is a car company, not a CI and code-review obsessed software company in Silicon Valley.
- scott_karana 11y ago
  > This is a car company, not a CI and code-review obsessed software company in Silicon Valley. I read that as: > This is a company whose products are high-velocity 1500kg chunks of steel zooming around in public, not a company that sells an intangible virtual good/service --- Yes, I know software is historically poor with car companies, but we should still expect better. Let's not just lower our standards because of cynicism :-)
- mrighele 11y ago
  I found products made by car companies to be in general more reliable than those made by software companies (either in Silicon Valley or not). I trust my life to my car (software included) every day. I wouldn't do that with any software of my smartphone, not even the OS.
  - Laaw 11y ago
    Doesn't it blow your mind that there are no "standards of engineering" or whatever for software? There's no licensure body for software engineers who build software running your car, and therefore no accountability on a personal level. When an engineer builds a bridge, she has to personally sign off on the bridge, saying it's safe, and is risking not only her professional career, but I think she can also be jailed and held criminally liable if the bridge kills people due to negligence. It blows my mind, at least, that no such thing exists for software.
    - jes 11y ago
      If you could have perfectly safe software, without requiring individual engineers to be licensed, would that be acceptable to you? I'm not asking if you think such a thing would be possible or not - I'm asking if you would accept an alternate means of getting what I think we both want.
JustSomeNobody 11y ago
I wonder what the NTSB thinks about this. This is a clear safety issue.
- sgustard 11y ago
  US vehicle safety is governed by NHTSA, and they are already using this to push for further regulatory power. http://www.detroitnews.com/story/business/autos/foreign/2015/09/22/nhtsa-head-vw-diesel-deception-another-reason-question-assumptions/72614662/ http://www.detroitnews.com/story/business/autos/foreign/2015...
asn0 11y ago
If that's the case, the execs are even more at fault for not having proper controls in place to prevent rogue employees from jeopardizing the entire company.
- johansch 11y ago
  Welcome to real life.
cmiles74 11y ago
The code might even have been outsourced. I'm not trying to disparage outsourced developers, I know what I might do if the user story was something like "Needs to pass emissions when attached to test system."
- hydrogen18 11y ago
  In that case it would probably be "The system shall pass all emissions tests"
  - tonyarkles 11y ago
    Under all conditions? Under normal conditions? Low-temperature? High-temperature? At 10,000 feet? Only when attached to the test harness?
  - paulajohnson 11y ago
    Actually the usual form for this kind of requirement would be "The system shall comply with <emission regulation>".
- jsprogrammer 11y ago
  It shouldn't matter. Another test process should have caught incorrect code. The car should be tested to the specs and the specs should reflect the regulations.
- asolove 11y ago
  "As an emissions test, I want to pass the car."
s73v3r 11y ago
Remember the Toyota code, or at least the review, that was leaked a while back? I don't find it surprising at all that it would be possible to sneak through some stuff that no one knows what it does. And in that kind of environment, people generally don't mess with stuff they don't know what it does, cause they don't know what it'll break.

Laaw 11y ago

But also probably true, regardless of this specific situation.

twblalock 11y ago
From what I know of the car industry, coding standards are very low. I don't think any car companies would look good if their code was audited by professional software engineers in other fields.
- dogma1138 11y ago
  Then you don't know the motor industry very much as it has very strict coding standards like ISO 26262, the code has to be audited internally and by certified 3rd parties with every release to meet the development cycle requirements of the standards. http://www.ldra.com/en/software-quality-test-tools/group/by-industry-standard/automotive-iso-26262-misra http://www.ldra.com/en/software-quality-test-tools/group/by-... The industry also has specific coding standard for every language that is used in embedded systems like MISRA-C https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C Today every thing you do with your car from using breaks to deploying air-bags is done through the computer, there's no way in hell that the motor industry would be releasing poor code "intentionally" because it would cost them billions in liabilities.
  - joezydeco 11y ago
    And you're not familiar with what happened when a 3rd party (Michael Barr) was allowed to FINALLY look inside Toyota's engine code and determine the cause of the "Unintended Acceleration" problem: "Barr checked the [Toyota] source code against MISRA’s 2004 edition and found 81,514 violations." http://www.safetyresearch.net/blog/articles/toyota-unintended-acceleration-and-big-bowl-%E2%80%9Cspaghetti%E2%80%9D-code http://www.safetyresearch.net/blog/articles/toyota-unintende...
    - OopsCriticality 11y ago
      The model year 2005 Camry in question from the trial would have been made available in 2004, and the electronic throttle control system was designed prior to 2004 (IIRC, the ETC design was carried forward from the previous model). How does it makes sense to apply MISRA-C:2004 in this case, especially when the Toyota ETC in question was admittedly not designed under MISRA-C:2004 nor prior MISRA-C revisions? It is inaccurate to claim Michael Barr determined the cause of Toyota's unintended acceleration: he proposed a possible failure mode that was persuasive to a lay jury. His proposed failure mode didn't leave a DTC, so there's no way to actually know if his proposed failure mode actually happened in this case (or in any other).
      - deleted 11y ago
        [deleted]
      - danielweber 11y ago
        Barr always struck me as something of a charlatan trying to bamboozle a jury.
        dogma1138 11y ago
        I remember when this was posted on HN before, what I always wondered about is the discrepancy between the violations that NASA found and Barr. NASA found 7000 and change Barr found over 81,000, I'm not sure whats the size of the code that was reviewed but that's allot, even if you count the fact that half of them might be silly like naming convention violations that still leaves quite an odd number for actual violations especially when considering that the code for an embedded system can't be that huge. And the 10,000 global variables thing, well 10,000 sounds like a huge number but there wasn't any mention if they were a) necessary, b) implemented correctly, and c) out of how many variables in total? if the code they've tested has say 1 million variables then well.... And how they described global variables is also weird, they claimed that every software within the system can access them to me this sounds that your stereo or the rain sensor for the wipers can override data for the breaks, but that might be true only if everything is running within a single application. If the breaks run as an independent application well then only every function within the break software (depending on the language and how global variables are implemented) could potentially access those variables. To me pretty much that entire explanation seem to be constructed to sound worse than what it is, which is why I think that expert witnesses should only be allowed to be appointed and called by the court it self (as in by the judge so they and the jury could understand the technical details better) and not by either the defense or the prosecution.
  - Dav3xor 11y ago
    I've worked at a couple different companies that made safety critical software, and I have to agree with joezedeco. Dav3xor's Law -- Code Quality is Inversely Proportional to Risk.
    - dogma1138 11y ago
      And 2 of my friends worked for BetterPlace (RIP) and it took years for Nissan to accept the code which had to be rewritten to comply and certified by an external 3rd party. And that code wasn't even "mission critical" in terms of road safety. Anecdotal evidence is anecdotal.
    - cpeterso 11y ago
      Any theories why? Maybe because these big systems are outsourced to multiple low-ball vendors and their stitched together?
  - selimthegrim 11y ago
    And this would be why Toyota engineers _forgot which direction their stack was growing in_ and shit all over MISRA-C (see https://news.ycombinator.com/item?id=10355200 https://news.ycombinator.com/item?id=10355200)?
- RealityVoid 11y ago
  I have seen both very good code and very bad code. Standards are in place for making it good but it really depends the most on who's implementing it and the SW team culture.

theli0nheart 11y ago

And, supposing this is true, would you actually be surprised by this? This is a car company, not a CI and code-review obsessed software company in Silicon Valley.

scott_karana 11y ago
> This is a car company, not a CI and code-review obsessed software company in Silicon Valley. I read that as: > This is a company whose products are high-velocity 1500kg chunks of steel zooming around in public, not a company that sells an intangible virtual good/service --- Yes, I know software is historically poor with car companies, but we should still expect better. Let's not just lower our standards because of cynicism :-)
mrighele 11y ago
I found products made by car companies to be in general more reliable than those made by software companies (either in Silicon Valley or not). I trust my life to my car (software included) every day. I wouldn't do that with any software of my smartphone, not even the OS.
- Laaw 11y ago
  Doesn't it blow your mind that there are no "standards of engineering" or whatever for software? There's no licensure body for software engineers who build software running your car, and therefore no accountability on a personal level. When an engineer builds a bridge, she has to personally sign off on the bridge, saying it's safe, and is risking not only her professional career, but I think she can also be jailed and held criminally liable if the bridge kills people due to negligence. It blows my mind, at least, that no such thing exists for software.
  - jes 11y ago
    If you could have perfectly safe software, without requiring individual engineers to be licensed, would that be acceptable to you? I'm not asking if you think such a thing would be possible or not - I'm asking if you would accept an alternate means of getting what I think we both want.

JustSomeNobody 11y ago

I wonder what the NTSB thinks about this. This is a clear safety issue.

sgustard 11y ago
US vehicle safety is governed by NHTSA, and they are already using this to push for further regulatory power. http://www.detroitnews.com/story/business/autos/foreign/2015/09/22/nhtsa-head-vw-diesel-deception-another-reason-question-assumptions/72614662/ http://www.detroitnews.com/story/business/autos/foreign/2015...

asn0 11y ago

If that's the case, the execs are even more at fault for not having proper controls in place to prevent rogue employees from jeopardizing the entire company.

johansch 11y ago
Welcome to real life.

cmiles74 11y ago

The code might even have been outsourced. I'm not trying to disparage outsourced developers, I know what I might do if the user story was something like "Needs to pass emissions when attached to test system."

hydrogen18 11y ago
In that case it would probably be "The system shall pass all emissions tests"
- tonyarkles 11y ago
  Under all conditions? Under normal conditions? Low-temperature? High-temperature? At 10,000 feet? Only when attached to the test harness?
- paulajohnson 11y ago
  Actually the usual form for this kind of requirement would be "The system shall comply with <emission regulation>".
jsprogrammer 11y ago
It shouldn't matter. Another test process should have caught incorrect code. The car should be tested to the specs and the specs should reflect the regulations.
asolove 11y ago
"As an emissions test, I want to pass the car."

s73v3r 11y ago

Remember the Toyota code, or at least the review, that was leaked a while back? I don't find it surprising at all that it would be possible to sneak through some stuff that no one knows what it does. And in that kind of environment, people generally don't mess with stuff they don't know what it does, cause they don't know what it'll break.