3 ms·
Most of the Toyota acceleration accidents were almost certainly the result of operator error. The fact that the staistical probablity increased with age gives
by bsder 2y ago
Most of the Toyota acceleration accidents were almost certainly the result of operator error. The fact that the staistical probablity increased with age gives that away.
However, Toyota got convicted because their software development process was so terrible that they were effectively criminally negligent and deserved to get absolutely roasted for it.
- jahewson 2y ago> criminally negligent Well, civil reckless disregard, as it wasn’t a criminal case.
- UltraSane 2y agoDid they use tons of global variables?
- bluGill 2y agoGlobals are common and even right in this application. However they didn't take proper care in other ways (i'm not clear what I've just been in embedded long enough to know globals are often required despite how hard they are to get right)
- UltraSane 2y agotons of global variables on code that has lots of people working on it seems almost as hard as trying to write lock-free data structures.
- bluGill 2y agoIn general embedded controllers like this don't have a lot of people working on them. They also have rules (enforced by review which isn't great) about when they can be accessed. In an embedded context you are not allowed to allocate memory (except at startup), so a lot of these globals are just arrays/buffers only used by one function or pseudo class (a class by intent but not actually a class by the language if the language even has a concept of class)
- bsder 2y agoGlobal variables (nee static) are fairly normal in embedded. You want to preallocate all your memory since you generally don't have a heap. Mostly you have specific inputs from some other tasks and your outputs are consumed by different tasks. So, even though the variables are "global" they generally only have one writer with multiple readers in properly done embedded programming. What Toyota did was not even in the same universe as "properly done embedded".
- UltraSane 2y ago"specific inputs from some other tasks and your outputs are consumed by different tasks" sounds a lot like how PLCs work. Just running an infinite loop scanning inputs and triggering outputs in response to the state of the inputs.
- heavyset_go 2y agoIIRC, their code was evaluated against MISRA-C and was found to have tons of blatant and preventable violations of its principles.
- bee_rider 2y agoProbably didn’t use misra
- bsder 2y agoAnd didn't have watchdogs. Or redundancy. Or analysis of what failures would do. Or ... etc. It wasn't just one thing. It was a near complete and total disregard for the fact that they were writing code for machines that could kill people.
- 7thaccount 2y agoThe investigation literally called their code "spaghetti".