5 ms·

> can all of a sudden decide to go pedal to the metal Perhaps we should focus on this root cause? Why is the car even capable of this in the first place? Mayb

> can all of a sudden decide to go pedal to the metal Perhaps we should focus on this root cause? Why is the car even capable of this in the first place? Maybe we should consider removing software from certain areas of automobiles. More is definitely not making things any safer. Hydraulics and cable linkages are extremely robust. Even if the throttle on your 90s car gets stuck wide open, it would be trivial to pop the vehicle into neutral. A modern vehicle with the digital gear selector will give you a much more likely issue for such a bold action, especially if the computer is already misbehaving per acceleration. The steering wheels aren't even real anymore. What would stop a gamma ray from glitching my steering program full left turn while driving at 80mph on the freeway? How much of our safety do we really need to make the computer responsible for?

addaon 4y ago
> What would stop a gamma ray from glitching my steering program full left turn while driving at 80mph on the freeway? The processor running this (ASIL D) software almost certainly has hardware mitigations for SEUs. The most common such mitigation is lockstep cores (see e.g. TI Hercules, Infineon Aurix) where the same computation is run through two copies of the core (usually physically displaced and rotated to reduce common cause errors), and the output cross-checked between the two. Handling a mismatch has various approaches, ranging from pure hardware (three lockstep cores with voting) to pure software (on detected SEU issue a reset and try again) to pure analysis (show that failing to issue a steering command in this time slice has no safety impact as long as a correct one is issued in the next time slice), with many middle grounds.
GoToRO 4y ago
Different techniques to deal with gamma rays and other scenarios: every variable is stored in two places, the second is the complement value; plausability tests, can the value jump from 10 to 1000 in 10ms? and so on. Source: me
- bob1029 4y ago
  And if something directly impacts the mosfet gate drivers, what then? Is there some sort of N+1 strategy all the way up to the mechanical steering linkage?
  - GoToRO 4y ago
    Yes. Every system is evaluated from a safety perspective and measures are taken. What's interesting is that N+1 redundancy is seldom used. Usualy there is a totaly different system that checks the main system. Like a software watchdog that checks a hardware one. This is also why they need 5 years to get out a model that is more or less the previous model. That and they really don't get software.

addaon 4y ago

> What would stop a gamma ray from glitching my steering program full left turn while driving at 80mph on the freeway? The processor running this (ASIL D) software almost certainly has hardware mitigations for SEUs. The most common such mitigation is lockstep cores (see e.g. TI Hercules, Infineon Aurix) where the same computation is run through two copies of the core (usually physically displaced and rotated to reduce common cause errors), and the output cross-checked between the two. Handling a mismatch has various approaches, ranging from pure hardware (three lockstep cores with voting) to pure software (on detected SEU issue a reset and try again) to pure analysis (show that failing to issue a steering command in this time slice has no safety impact as long as a correct one is issued in the next time slice), with many middle grounds.

GoToRO 4y ago

Different techniques to deal with gamma rays and other scenarios: every variable is stored in two places, the second is the complement value; plausability tests, can the value jump from 10 to 1000 in 10ms? and so on. Source: me

bob1029 4y ago
And if something directly impacts the mosfet gate drivers, what then? Is there some sort of N+1 strategy all the way up to the mechanical steering linkage?
- GoToRO 4y ago
  Yes. Every system is evaluated from a safety perspective and measures are taken. What's interesting is that N+1 redundancy is seldom used. Usualy there is a totaly different system that checks the main system. Like a software watchdog that checks a hardware one. This is also why they need 5 years to get out a model that is more or less the previous model. That and they really don't get software.