12 ms·

This is just one of many kinds of redundancy. Please see [1] for several ways in which redundancy is manifested (e.g. triple modular redundancy). Specifically,

This is just one of many kinds of redundancy. Please see [1] for several ways in which redundancy is manifested (e.g. triple modular redundancy). Specifically, uncooperative systems running at the same time was exactly how fault tolerance was achieved on the space shuttle[2]: >For true redundancy to take place, all computers must listen to all traffic on all buses, even though they might be commanding just a few. That way they know about all the data generated in the current phase. They must also be processing that data at the same time the other computers do. If there is a failure [...], since the Shuttle's other three computers are sending apparently correct commands to their actuators, the failed computer's commands are physically out-voted That's just one example. There's no need for the definition of the word "redundancy" to be as narrow as you said. [1]https://en.wikipedia.org/wiki/Redundancy_(engineering) https://en.wikipedia.org/wiki/Redundancy_(engineering) [2]https://history.nasa.gov/computers/Ch4-4.html https://history.nasa.gov/computers/Ch4-4.html

TomMarius 9y ago
Redundancy definitely does not mean running two different conflicting systems. Three (identical) - that's a different story.
- simion314 9y ago
  Why not, I have 2 different systems that detect an imminent impact in a wall, then if the systems do not agree you stop, if your main system is experimental then having the backup system that is using different tech then it seems obvious that is safer to stop, then analyze the cause of the conflict.
  - slowmotiony 9y ago
    So if one of these fails, the car stops? That doesn't seem like redundancy.
    - tux1968 9y ago
      If you walk into a store and don't see that it is being robbed at gunpoint, it would be very nice to hear the assailant ordering the cashier to empty the til. You have two chances to steer clear. Either your eyes or ears may fail you now and again, but you're better off with both. No?
      - jakeogh 9y ago
        Nothing wrong with having a chance to steer clear, but it strikes me as an odd reaction unless you live in a society where only the criminals can defend themselves.
    - cdancette 9y ago
      The question is not about failing but detecting an obstacle and braking. If one system detects an obstacle, stop the car. Even if this system was failing and the other wasn't detecting anything. And if one system fail, yes the car should stop if it's not safe to drive with only one of them.
    - m_eiman 9y ago
      Seems like a way to fail safe, which is what you should want.
      - jakeogh 9y ago
        unless the obstacle appears half way through an intersection where only one direction stops?
    - jschwartzi 9y ago
      In engineering we don't rely on our feeling. We have to actually have reason and evidence. You're approaching it as if the car should be moving at all costs, but the responsible engineering task is to keep the car moving unless the automated systems indicate that it's hazardous to others.
    - tialaramex 9y ago
      Yes, it's redundantly _safe_, which is the thing we actually care about. Safety is job #1. Well, not at Uber apparently. There are trade-offs here, sometimes we might decide to take a very small risk, after weighing it up. A famous example is ETOPS. Unlike propeller engines, jet engines for airliners are ridiculously reliable once running. ETOPS (jokingly "Engines Turn Or Passengers Swim") is a scheme which over the past few decades has gradually allowed twin engine jets (which obviously just become over-engineered gliders if both their engines fail) to fly over oceans and other large distances with no airports, on the rationale that although total engine failure would probably be deadly without anywhere to put the plane down, two unrelated sequential engine failures are now so unlikely as to be overall negligible risk to the passengers. But that needs a risk we understand. If you have no idea what the risk is, you can't make that trade, so redundantly safe systems are the obvious choice.
- InternetOfStuff 9y ago
  But they aren't conflicting: they have the same goal (not running into stuff). In fact, there's yet another different, redundant, potentially conflicting safety system: the human safety driver. If only one were to trigger, it still wouldn't be a conflict. And yeah, redundancy through using non-identical systems is very much a thing, and considered much safer than having two identical things (which might make the same mistakes). Source: I've worked on ASIL D safety-critical automotive systems, where diverse redundant subsystems were actually a design criterion.

TomMarius 9y ago

Redundancy definitely does not mean running two different conflicting systems. Three (identical) - that's a different story.

simion314 9y ago
Why not, I have 2 different systems that detect an imminent impact in a wall, then if the systems do not agree you stop, if your main system is experimental then having the backup system that is using different tech then it seems obvious that is safer to stop, then analyze the cause of the conflict.
- slowmotiony 9y ago
  So if one of these fails, the car stops? That doesn't seem like redundancy.
  - tux1968 9y ago
    If you walk into a store and don't see that it is being robbed at gunpoint, it would be very nice to hear the assailant ordering the cashier to empty the til. You have two chances to steer clear. Either your eyes or ears may fail you now and again, but you're better off with both. No?
    - jakeogh 9y ago
      Nothing wrong with having a chance to steer clear, but it strikes me as an odd reaction unless you live in a society where only the criminals can defend themselves.
  - cdancette 9y ago
    The question is not about failing but detecting an obstacle and braking. If one system detects an obstacle, stop the car. Even if this system was failing and the other wasn't detecting anything. And if one system fail, yes the car should stop if it's not safe to drive with only one of them.
  - m_eiman 9y ago
    Seems like a way to fail safe, which is what you should want.
    - jakeogh 9y ago
      unless the obstacle appears half way through an intersection where only one direction stops?
  - jschwartzi 9y ago
    In engineering we don't rely on our feeling. We have to actually have reason and evidence. You're approaching it as if the car should be moving at all costs, but the responsible engineering task is to keep the car moving unless the automated systems indicate that it's hazardous to others.
  - tialaramex 9y ago
    Yes, it's redundantly _safe_, which is the thing we actually care about. Safety is job #1. Well, not at Uber apparently. There are trade-offs here, sometimes we might decide to take a very small risk, after weighing it up. A famous example is ETOPS. Unlike propeller engines, jet engines for airliners are ridiculously reliable once running. ETOPS (jokingly "Engines Turn Or Passengers Swim") is a scheme which over the past few decades has gradually allowed twin engine jets (which obviously just become over-engineered gliders if both their engines fail) to fly over oceans and other large distances with no airports, on the rationale that although total engine failure would probably be deadly without anywhere to put the plane down, two unrelated sequential engine failures are now so unlikely as to be overall negligible risk to the passengers. But that needs a risk we understand. If you have no idea what the risk is, you can't make that trade, so redundantly safe systems are the obvious choice.
InternetOfStuff 9y ago
But they aren't conflicting: they have the same goal (not running into stuff). In fact, there's yet another different, redundant, potentially conflicting safety system: the human safety driver. If only one were to trigger, it still wouldn't be a conflict. And yeah, redundancy through using non-identical systems is very much a thing, and considered much safer than having two identical things (which might make the same mistakes). Source: I've worked on ASIL D safety-critical automotive systems, where diverse redundant subsystems were actually a design criterion.