2 ms·
Presumably it pulls over and stops if the backend connection drops, no? This is a kind of goalpost motion: you're countering an argument about an incorrectly-i
by ajross 2y ago
Presumably it pulls over and stops if the backend connection drops, no? This is a kind of goalpost motion: you're countering an argument about an incorrectly-identified failure mode by positing that the condition would still obtain if there was a dual mode failure instead (i.e. that the car would get stuck in a navigation loop and have a bug in its recovery from connectivity issues).
That's bad engineering, because you can always get to some kind of catastrophe if you keep piling on layers. Might as well just skip to "What if the motor circuit fails open and it accelerates forever?!" in that case.
- kragen 2y agoAn E-stop button would also solve the problem of the motor circuit failing closed, causing the kind of uncontrolled acceleration you're talking about.
- ajross 2y agoUh, that was sarcasm. Unintended acceleration failures are huge deals in the industry and absolutely already designed in with multiple (probably dozens) of layers of safety/redundancy at all levels up to and including human control. The point was that you can still imagine a N-mode failure that defeats all of that and use it to justifify whatever whizgig you're demanding in your local internet discussion. And that this was ridiculous, because that's not how you do engineering. And... you did.
- kragen 2y agoYes, you can always imagine failures that disable your failsafes. But you seem to be using that as an excuse for advocating omitting even basic failsafes. That's also not how you do engineering.