4 ms·

>They didn’t want both processors to share any code, and therefore potentially the same bug. They're not worried about bugs, they're worried about electromagne

>They didn’t want both processors to share any code, and therefore potentially the same bug. They're not worried about bugs, they're worried about electromagnetic radiation (which is way more present when you get outside the atmosphere) flipping bits.

fit2rule 6y ago
There have been cases of homogenous CPU architectures in safety-critical where all CPU's failed at once. Bitflippinrads are one of a multi-variate set of problems that these systems are designed to detect and avoid. Nodes can degrade otherwise: SRAM failure, battery/cap depletion, all sorts of things. The idea is to detect when a voting node has had a catastrophic system failure, and then remove offending nodes from the decision as rapidly as possible. A multi-architecture system assists with managing (and certifying) things such as compiler bugs and impact from system-level homogeneity, where critical components all exhibit the same bug/failure. An x86 hardware bug is fatal if all 5 of the nodes in a voting system are x86 and making a critical decision; it is less of an issue if the other 2 or 3 nodes are PPC, ARM, MIPS, etc., or a mixture there-of, and - as variant hardware architectures - are democratically still voting during the period .. the idea is to avoid homogeneity and pursue heterogeneity.
gumby 6y ago
> They're not worried about bugs, they're worried about electromagnetic radiation I'm aware of that; I commented because I'm surprised by it. I'm sure the issue was discussed so I'm not implying that they are idiots. But it does seem odd to me.
- kraemahz 6y ago
  They are worried about bugs, but they address those in other ways. This is some of the most extensively integration tested software there is (I was part of the team that built the integration testing). Every commit is ran through a custom CI system that successively tests pieces of the system working together up to and including automated hardware tests. The number of lines of code dedicated to testing the vehicle is definitely much greater than the lines of code on the vehicle.

fit2rule 6y ago

There have been cases of homogenous CPU architectures in safety-critical where all CPU's failed at once. Bitflippinrads are one of a multi-variate set of problems that these systems are designed to detect and avoid. Nodes can degrade otherwise: SRAM failure, battery/cap depletion, all sorts of things. The idea is to detect when a voting node has had a catastrophic system failure, and then remove offending nodes from the decision as rapidly as possible. A multi-architecture system assists with managing (and certifying) things such as compiler bugs and impact from system-level homogeneity, where critical components all exhibit the same bug/failure. An x86 hardware bug is fatal if all 5 of the nodes in a voting system are x86 and making a critical decision; it is less of an issue if the other 2 or 3 nodes are PPC, ARM, MIPS, etc., or a mixture there-of, and - as variant hardware architectures - are democratically still voting during the period .. the idea is to avoid homogeneity and pursue heterogeneity.

gumby 6y ago

> They're not worried about bugs, they're worried about electromagnetic radiation I'm aware of that; I commented because I'm surprised by it. I'm sure the issue was discussed so I'm not implying that they are idiots. But it does seem odd to me.

kraemahz 6y ago
They are worried about bugs, but they address those in other ways. This is some of the most extensively integration tested software there is (I was part of the team that built the integration testing). Every commit is ran through a custom CI system that successively tests pieces of the system working together up to and including automated hardware tests. The number of lines of code dedicated to testing the vehicle is definitely much greater than the lines of code on the vehicle.