4 ms·

"For the bulk of this research, EDN consulted Michael Barr, CTO and co-founder of Barr Group, an embedded systems consulting firm, last week. As a primary exper

"For the bulk of this research, EDN consulted Michael Barr, CTO and co-founder of Barr Group, an embedded systems consulting firm, last week. As a primary expert witness for the plaintiffs, the in-depth analysis conducted by Barr and his colleagues illuminates a shameful example of software design and development" Well, okay, so the article kindly submitted here takes the position of personal injury attorneys who just won a trial before an Oklahoma jury. And perhaps that is the correct factual position about what Toyota did and what Toyota should have done instead. (Disclosure: I am a lawyer, so I had law school courses that trained me to think on both sides of issues that go to litigation.) When "unintended acceleration" cases were first mentioned in the news media, including one case that occurred here in Minnesota, I was very wary of buying Toyota cars, and bought other brands instead. But as our previous cars wore out, we bought Toyotas, and Toyota vehicles are what we drive for all our driving now. I notice that both cars we bought have very clear warnings near the floor mats about attaching those securely and not using any floor mat that isn't attached securely. Toyota, from this point of view, seems to be acknowledging that floor mats used to get jammed up against accelerator pedals in a way that made cars hard to control. We have not had any problems with our vehicles. The news stories about unintended acceleration in Toyota cars seem to have diminished. Perhaps whatever was bad about the former designs has been fixed.

pnathan 13y ago
What EDN reports aren't really - by and large - design issues. They are more process issues: lack of certification (a big deal for embedded systems); lack of substantial code review (MISRA violations); lack of HW design testing (tin whiskers); inadequate analysis of memory usage. Process issues can be solved, given motivated management and diligent engineers. Whether the effort to solve them was done and how that effort goes becomes a cultural thing, and I can't speak to the Toyota SW engineering culture(s?).
InclinedPlane 13y ago
That's a dangerous line of reasoning in this case. I could be convinced that this court ruling is erroneous, and that the unintended acceleration issues can be entirely accounted for by floor mats and driver error. But in this case I think we should be thankful for bad floor mats and driver error, as they've brought to light very fundamental flaws in Toyota's firmware engineering processes. If there had never been a single unintended acceleration in a toyota vehicle it would not have been through robust engineering but instead through luck. And we need our vehicles to be safe by design, not through happenstance.
- tokenadult 13y ago
  If there had never been a single unintended acceleration in a toyota vehicle it would not have been through robust engineering but instead through luck. And we need our vehicles to be safe by design, not through happenstance. I especially appreciate your comment because my childhood best friend (an electrical engineer who designs safety-critical systems) thinks this way. He started out in avionics, and was the lead designer for the avionics system for a commercial airliner that so far has a very good safety record indeed, and then he moved over to the medical device industry. In his work, "zero defects" is the only standard, and fundamental understanding of how a system works, from the level of subatomic physics on up, is his approach to design with no hidden flaws. That approach is not easy, but he thinks that is the appropriate approach when human lives are at stake.
  - InclinedPlane 13y ago
    This problem in general is yet another symptom of the immaturity of the software industry as a whole. Most standards are community standards rather than well accepted and extremely well known official standards. And a lot of best practices still come down to judgment. Moreover, best practices and standards vary greatly depending on the nature of the product. Even within a small sub-field like embedded systems the requirements are very different for a car, airliner, or 3D printer. It's telling that even at a big company like Toyota which is fairly risk averse and is well known for its commitment to quality and safety they are still capable of churning out pretty crappy software that is hugely important. Software dev is still a pretty hard problem overall, we live in an era where there have been lots of successes, but failure is still common and the consequences of failure can sometimes be severe.
- revelation 13y ago
  If you can solve the halting problem, we can make software that doesn't misbehave. I'm not saying Toyota should be allowed to provide this shoddy piece of software in a critical subsystem, but I very much think a) other vendors software will be just as crappy and b) this feels like the court longing for reasons to fault Toyota on something that was still very likely user error, not software misbehaving.

pnathan 13y ago

What EDN reports aren't really - by and large - design issues. They are more process issues: lack of certification (a big deal for embedded systems); lack of substantial code review (MISRA violations); lack of HW design testing (tin whiskers); inadequate analysis of memory usage. Process issues can be solved, given motivated management and diligent engineers. Whether the effort to solve them was done and how that effort goes becomes a cultural thing, and I can't speak to the Toyota SW engineering culture(s?).

InclinedPlane 13y ago

That's a dangerous line of reasoning in this case. I could be convinced that this court ruling is erroneous, and that the unintended acceleration issues can be entirely accounted for by floor mats and driver error. But in this case I think we should be thankful for bad floor mats and driver error, as they've brought to light very fundamental flaws in Toyota's firmware engineering processes. If there had never been a single unintended acceleration in a toyota vehicle it would not have been through robust engineering but instead through luck. And we need our vehicles to be safe by design, not through happenstance.

tokenadult 13y ago
If there had never been a single unintended acceleration in a toyota vehicle it would not have been through robust engineering but instead through luck. And we need our vehicles to be safe by design, not through happenstance. I especially appreciate your comment because my childhood best friend (an electrical engineer who designs safety-critical systems) thinks this way. He started out in avionics, and was the lead designer for the avionics system for a commercial airliner that so far has a very good safety record indeed, and then he moved over to the medical device industry. In his work, "zero defects" is the only standard, and fundamental understanding of how a system works, from the level of subatomic physics on up, is his approach to design with no hidden flaws. That approach is not easy, but he thinks that is the appropriate approach when human lives are at stake.
- InclinedPlane 13y ago
  This problem in general is yet another symptom of the immaturity of the software industry as a whole. Most standards are community standards rather than well accepted and extremely well known official standards. And a lot of best practices still come down to judgment. Moreover, best practices and standards vary greatly depending on the nature of the product. Even within a small sub-field like embedded systems the requirements are very different for a car, airliner, or 3D printer. It's telling that even at a big company like Toyota which is fairly risk averse and is well known for its commitment to quality and safety they are still capable of churning out pretty crappy software that is hugely important. Software dev is still a pretty hard problem overall, we live in an era where there have been lots of successes, but failure is still common and the consequences of failure can sometimes be severe.
revelation 13y ago
If you can solve the halting problem, we can make software that doesn't misbehave. I'm not saying Toyota should be allowed to provide this shoddy piece of software in a critical subsystem, but I very much think a) other vendors software will be just as crappy and b) this feels like the court longing for reasons to fault Toyota on something that was still very likely user error, not software misbehaving.