> The problem was essentially people pushing the gas when they thought they were on the brakes Oh dear no. Certainly not. Read https://users.ece.cmu.edu/~koop

> The problem was essentially people pushing the gas when they thought they were on the brakes Oh dear no. Certainly not. Read https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_slides.pdf https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_... My favourite part from is, "Watchdog kicked by a hardware timer service routine". A watchdog timer is a piece of hardware that decrements a counter every microsecond or similar. The control system's main loop, running on the CPU, "kicks" the watchdog by setting the counter to a value like 1000 each iteration. The result is that if the CPU fails to execute the main loop often enough, the watchdog will "fire". This a) tells you that you have a bug and b) typically reboots the system so it has a chance to recover. Toyota used a timer service routine to kick the watchdog. This defeats the purpose of the watchdog. The control software can happily get stuck or crash and the watchdog will not notice. The fact that an engineer added this "feature" tells you that the watchdog was firing in development. That should have been addressed by fixing the buggy software, not by disabling the test. The fact that the disabled watchdog made it into the production release is unforgivable.