13 ms·

Toyotas Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

152 points by UberMouse 11y ago

plumeria 11y ago
Here are the slides Barr used in his presentation: http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUB...
btilly 11y ago
Please add (2013) to the title. People may have forgotten this because it was in the news a few years back. But Toyotas randomly experienced "unintended acceleration" due to software bugs. Many reported incidents were undoubtably due to the problem that people in a panic can step on the wrong pedal and will misremember what they did. Others were due to a floor mat that could jam the pedal. But some were Toyota's fault.
- nikanj 11y ago
  Was that ever proven? Did Toyota ever come out with a software patch that had to be installed in all cars made by them? I remember them replacing carpets that might get stuck, and this http://www.thetruthaboutcars.com/2010/03/the-best-of-ttac-the-audi-5000-intended-unintended-acceleration-debacle/ http://www.thetruthaboutcars.com/2010/03/the-best-of-ttac-th...
  - tomcorrigan 11y ago
    It was never proven because it never happened. The wikipedia article has much more detail.: http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_... It is not merely coincidental that all unintended acceleration events occurred in automatic cars. Also, a widespread unintended acceleration problem has not been observed in Toyota cars outside the USA. It's a shame that so many on HN are so swift to condemn Toyota
    - lloeki 11y ago
      > It is not merely coincidental that all unintended acceleration events occurred in automatic cars. Also, a widespread unintended acceleration problem has not been observed in Toyota cars outside the USA. If my car went nuts on acceleration the first thing I'd do would be to jump on the clutch pedal and apply brakes (and possibly set the stick to neutral) but that's because most cars here are manual thus that's what we learn to operate†. Pursuing on that line: once at a stop, cut the ignition and disaster is averted. Start again and you're probably fine due to the reboot. Then drive to nearest Toyota to complain, but since "nothing" (i.e no damage, no injury) really happened, you'll get a shrug and a reflash. † In a country where people learn only on automatic cars, setting back to neutral is most probably not reflex (if mechanically possible at all)
  - mannykannot 11y ago
    I, too, am left wondering over the paradox of the brake supposedly being powerful enough to hold back any amount of torque the engine and transmission can apply - unless, in the name of anti-skid braking or traction control, the system has the ability to override the driver and release or limit the braking torque. Furthermore, those explanations of the floor-mat recall that I have checked all say that the mats were suspected of having interfered with the accelerator, not the brake. Toyota subsequently performed a second recall, to correct problems with the accelerator pedal. These both imply that unintended acceleration was at least a significant causative factor in the accidents - unless Toyota and the NHTSA were simply acting in order to be seen doing something. With regard to proof, the article covers the issue in some detail: after a far-from-exhastive series of investigations, there have already been found so many ways for the software to get into unintended states that only a vanishingly small number of the vast range of possible causes have been considered. Asking for proof of an error is the wrong question to ask: the burden of proof clearly rests with the manufacturer to show that their systems are safe - and Toyota cannot do that with this software. That Toyota replaced floor-mats is certainly not evidence for the correctness of their software, and nor is the non-appearance of a software patch. The article quotes a concerned Toyota engineer whose statements indicate a culture of denial within the company.
- UberMouse 11y ago
  Doh, all the reddit links were from today didn't realize it was from 2013. Updated the title.
swang 11y ago
So many questions remain... How do I tell which Toyotas are affected? Do they all have these problems? What, if anything, did Toyota do to fix their software engineering processes? I ask because my parents have a 2005 or 2006 Toyota Sienna, and I don't feel very comfortable with them driving it now.
- MichaelGG 11y ago
  If you're concerned about safety, look into the stats. With the number of accidents happening overall, I wouldn't be surprised if even a known flaw doesn't increase risk a whole lot. There's probably dominating factors, such as location (weather, etc.) and distance driven at which times, or which model of vehicle. Maybe I'm wrong and this is a significant risk, but the approach should be the same. Even if they found and fixed one problem, the stats would still tell you which cars are safest. It could very well be that other vendors are worse, just haven't been investigated.
  - peterfirefly 11y ago
    Toyota cars are some of the safest on the road in the US according to the safety statistics -- even if (big if) some of them had problems with "unintended acceleration". This tells us that even if (big if) the issue was real, it was actually never important. Also funny that it never was an issue outside of the US.
    - thescrewdriver 11y ago
      Which safety statistics? IIHS crash test reports or actual road statistics?
      - peterfirefly 11y ago
        The latter.
        thescrewdriver 11y ago
userbinator 11y ago
Things were so much simpler when the only problems that could cause unintended acceleration were mechanical in nature. A broken return spring, seized linkage, etc. My daily driver has a mechanical throttle (although it is electronically fuel-injected), and honestly I can't see much point in "drive-by-wire" for cars. But, on the other hand, even despite so many possible bugs, AFAIK no one has been able to demonstrate one instance of unintended acceleration even with extensive testing.
- SoftwareMaven 11y ago
  A 150 foot long skid mark seems like pretty compelling evidence of unintended acceleration.
- spydum 11y ago
  Have you never encountered such a bug? It isn't difficult to understand how hard a bug might be to track down when it only affects such a small subset of your users and only under specific circumstances. It is the dreaded Heisenbug
- bri3d 11y ago
  Drive-by-wire is good for a lot of efficiency technologies because it enables the elimination of the throttle plate, and therefore of many kinds of throttling losses (see MultiAir, ValveTronic, ValveMatic, etc.). It also enables simpler cruise control and traction/stability control systems. The addition of computers to cars is mostly a plus (IMO) but the hidden complexity is frightening to say the least.
- thrownaway2424 11y ago
  There are no mechanical throttles for electric cars.
hliyan 11y ago
This is appalling: Toyota had more than 10,000 global variables. “And in practice, five, ten, okay, fine. 10,000, no, we're done. It is not safe, and I don't need to see all 10,000 global variables to know that that is a problem,” Koopman testified. and: Toyota’s failure to check the source code of its second CPU, supplied by Denso —even as executives assured Congress and NHTSA that the cause of UA couldn’t be in the engine software and: He was critical of Toyota watchdog supervisor – software to detect the death of a task -- design. He testified that Toyota’s watchdog supervisor “is incapable of ever detecting the death of a major task. That's its whole job. It doesn't do it. Instead, Toyota designed it to monitor CPU overload, and, Barr testified: “it doesn't even do that right. and: Barr also testified that Toyota’s software threw away error codes from the operating system, ignoring codes identifying a problem with a task. When the news first broke a few years ago, given Toyota's reputation for quality and process, I thought this was an American industry lead witch-hunt of a Japanese competitor. But if this testimony is correct, what Toyota engineers have done is unforgivable.
- elmin 11y ago
  I wouldn't be so quick to blame the engineers. They might be working within a managerial structure which doesn't give them the latitude they need to do their jobs. Yes engineers have a duty, but in software it's often hard to know exactly what the impact of cruft will be, and often all you can do is quit.
  - icelancer 11y ago
    Blow the whistle? Contact regulatory agencies?
  - hliyan 11y ago
    I agree, but I also believe that as an engineer I have an duty to refuse to build something under conditions that, once built, would cause harm to others. Or at least to relay my concerns to management in writing before proceeding. And sometimes, quitting is the ethical thing to do.
thaumaturgy 11y ago
There are a bunch of neat comments from past threads about this if you search HN for "Michael Barr": "On a cyclomatic-complexity scale, a rating of 10 is considered workable code, with 15 being the upper limit for some exceptional cases. Toyota’s code had dozens upon dozens of functions that rated higher than 50. Tellingly, the throttle-angle sensor function scored more than 100, making it completely and utterly untestable." https://news.ycombinator.com/item?id=7711771 https://news.ycombinator.com/item?id=7711771 "For example, http://www.edn.com/design/automotive/4423428/Toyota-s-killer-firmware--Bad-design-and-its-consequences http://www.edn.com/design/automotive/4423428/Toyota-s-killer... quotes Barr's claims: 'Toyota’s electronic throttle control system (ETCS) source code is of unreasonable quality.' 'Toyota’s source code is defective and contains bugs, including bugs that can cause unintended acceleration (UA).'" https://news.ycombinator.com/item?id=8906513 https://news.ycombinator.com/item?id=8906513 (and the linked article has a link to slides which are enlightening) A number of comments at https://news.ycombinator.com/item?id=6636811 https://news.ycombinator.com/item?id=6636811, "Toyota's firmware: Bad design and its consequences"
PhantomGremlin 11y ago
There is, to me, a more interesting question: If not Toyota, then who? Which auto manufacturers do it right? And is there any public evidence to support that? If not, then I'm probably just as "safe" or "unsafe" in any other brand of car as in a Toyota.
- alexvoda 11y ago
  This is mere speculation but the software in Tesla cars is probably at least decent since they dared reuse some of the technology on the Spacex Dragon V2 capsule. I think this is one field in desperate need of open sourcing. Anyone who has the capability and the desire should be able to audit the software. Modifications should be prevented by signing, unless the user signs that he assumes full legal responsibility for the effects of the modifications and has the vehicle recertified as roadworthy.
  - Cthulhu_ 11y ago
    Open sourcing it is nice and all from an idealist standpoint, but given the complexity of the software (millions of LOC), the fact that all the software would be used in commercial companies, and simply the area itself (cars), do you really think the community would pick up on it? I doubt it. Plus, the researcher did audit it - 18-20 months' work, and that was just analyzing it, not actually improving or fixing it. Plus there is no car manufacturer ever that would allow anyone to change the firmware on their own.
bliti 11y ago
These are safety-critical systems. It still is mind numbing that the quality of the code is so bad. After this came out, I've assumed all modern fuel-injected Toyota's suffer from the same lack of safety. I don't think other automakers may be better. I own a Toyota, but it has a mechanical throttle body. :)
_ati 11y ago
Similar to the aerospace and medical may be there should be strict regulations in terms of processes to be followed for development in the automobile industry also. Usually in medical, failing the audit would restrict the producer to sell the product in market for 1 year. May be something similar could be enforced in automobile industry also. Ofcourse it might increase the cost of cars but atleast they will be lot more safer.
meesterdude 11y ago
So, take this into account, and add in self driving cars. The complexity involved in these, and the coordination required, is nontrivial and its clear from the article they do NOT have a good handle on things. I mean, most cars do seem to get around OK, so I'm partly amazed that under the hood, things could really be so scary. But we can't be lazy about adding complexity and systems, especially as more faith is placed on them. That this is not NASA grade code (or anything close) does not give me any warm fuzzies. It reeks of unprofessionalism, greed, and laziness. There needs to be a sane-software assesment. People rely on products with an ever increasing amount of source code - it would be interesting if a third party could come along and certify that a given codebase is not a big scary unmaintainable mess; not to say there won't be bugs or issues, but that these guys are at least trying to make a well designed system, and aren't doing a bunch of crazy stupid things.
- deleted 11y ago
  [deleted]
  - meesterdude 11y ago
    Shouldn't toyota be closer to NASA than google? I mean, we're talking about systems that peoples lives depend on. I would be OK if my website was built by some IT department, if it meant that some level of NASA engineering is going into the control systems i rely on in my day to day life. That this is not the case is a little surprising to me, to be honest.
- thaumaturgy 11y ago
  The companies currently most actively involved in automated automobiles (hah) are pretty good at what they do. Volvo has been producing big trucks for several years now that have remarkable safety features, like automatically detecting stopped traffic ahead and bringing the fully loaded truck to a complete stop in what seems like an impossibly short distance (https://www.youtube.com/watch?v=HoCknasKdRU https://www.youtube.com/watch?v=HoCknasKdRU). There are plenty of things I dislike about Google but I can't say they're bad at software. If anybody can build a safe automated vehicle, they can. Tesla, too, who have a lot riding on their hard-earned reputation for building next-generation vehicles. I'm an old-school car guy, I haven't been a big fan of the complexity added to cars ever since the really bad emissions control systems in 80s cars, but even I have to admit that all that complexity has probably saved a lot more lives than it has cost -- antilock brakes, airbags, better pollution control, better fuel economy, way better structural safety features.
michaelfeathers 11y ago
> Toyota had more than 10,000 global variables. “And in practice, five, ten, okay, fine. 10,000, no, we're done. It is not safe, and I don't need to see all 10,000 global variables to know that that is a problem,” Koopman testified. I wonder why people want to believe 5 or 10 are okay.
- jfoutz 11y ago
  Check engine light? Passenger without a seatbelt? I mean, it's an embedded system, resources are scarce. There are more elegant solutions, yes. But a pattern of setting an error condition from a bunch of different sensors, that's checked from a bunch of locations seems reasonable. At least, not insane.
- ericye16 11y ago
  For simple configurations that have global affects, global variables might be easier than some other methods of keeping track of settings. It's a bit more frequent in embedded software than other software though.
- icelancer 11y ago
  He's not sanctioning 5-10 globals, only saying he could deal with that number of them without freaking out. Which is certainly true.
thrownaway2424 11y ago
Counting global variables is just silly. I think any number of global variables is perfectly fine.
- thrownaway2424 11y ago
  Lots of downvotes, no rebuttals.
  - Crito 11y ago
    You might as well claim that you think that dogshit makes for a fine breakfast. It doesn't warrant a rebuttal.
  - chopin 11y ago
    Maybe you should cite something to back your claim made upthread.
  - mercurial 11y ago
    That's a consequence of the use global variables having been recognized as an anti-pattern for a very long time now, and people downvoting the obvious instead of writing a rebuttal.
- xutopia 11y ago
  You're using a throwaway in what seems to be an apparent troll. For newbie programmers out there the reason we don't use global variables willy nilly is because it is very easy to lose track of all the places where one can be accessed. The result is that your code becomes very fragile.
bootload 11y ago
"Defects in the car’s electronic throttle control system (ETCS) were directly responsible for the Camry’s sudden acceleration and resulting crash." [0] I couldn't find an exact description of how the driver crashed. Was it using the on-board cruise control or normal throttle use? Never use the cruise control. Must ask when I get my car serviced if it has electronic or mechanical throttle body cf @bliti [0] http://www.usatoday.com/story/money/cars/2013/10/25/toyota-sudden-acceleration-lawsuit/3187369/ http://www.usatoday.com/story/money/cars/2013/10/25/toyota-s...
- catshirt 11y ago
  it was a symptom of neither cruise control or normal throttle use. the way the issue manifested is actually pretty terrifying: "Koua insists that his 1996 Toyota Camry sped up to between 70 and 90 mph despite heavy braking." http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_... out of context, but "we're in trouble, there's no break" https://www.youtube.com/watch?v=03m7fmnhO0I https://www.youtube.com/watch?v=03m7fmnhO0I
  - bootload 11y ago
    thx @catshirt, I note this about my Camry: "Toyota Australia announced that its accelerator pedals are made by a different supplier and that there is no need for a recall of Australian made vehicles". Reading through the notes I see trying to turn the engine off while going effects various electrical sub-systems. Me, I'd try putting the car in neutral (auto). A couple of years ago the alternator blew in my car. The battery had enough charge to let me drive +30km home after a re-start by a local RAC. When I drove the car the three kilometres to the shop, the charge started to drop and battery failure light (alternator failure) clicked on. First the car started loosing systems: seat-belts, overdrive, ABS... etc. This continued, till I bunny hopped the car into the garage where everything stopped working. No doubt a sticky accelerator is scarier than the lurching I had in busy traffic, kept going till the end. Power steering was the last to go, then the engine itself.
hackuser 11y ago
In the 1990s an engineer for one the U.S. automakers told me that the code in their cars was a black box. Nobody knew how it functioned; all they could do was watch the input and output, and add patches as needed to modify the output. Maybe the engineer was talking about code for a specific component, but perhaps Toyota's software isn't unique.
- r00fus 11y ago
  Exactly my thoughts. I bet any company when put under the spotlight would show some really bad practices/anti-patterns. Is that however, a problem with the industry? I can't help think of Fight Club's "recall" equation here...
tulb 11y ago
hi
yaakov34 11y ago
This issue returns to Hacker News and to public consciousness every few months, and each time there is something missing: namely, some kind of direct proof that an actual failure of this software resulted in unintended acceleration, anywhere, ever. Let alone a case of runaway acceleration which the driver is unable to stop with the brakes (requiring a simultaneous brake failure). Since the accelerator pedals in these Toyota vehicles have been pressed no fewer than tens of trillions of times in recent years, that's not an appalling safety record at all. In fact, stuck pedals (whether due to bad lubricants or rolled-up floor mats) are many orders of magnitude more likely to cause stuck throttle than software failures, while runaway vehicles (ones with brakes not working either) are generally caused by "pedal misapplication", i.e. stomping on the gas instead of the brakes. The fact that software has an execution pathway leading to something bad does not mean that this pathway can ever be entered, since in a closed realtime system like this, it is not possible to receive every combination of inputs, unlike in a system loading user data from a file. This is not to say that Toyota shouldn't clean up and verify its code, but the moral panics over what this code says about programmers, the human condition, Japan, etc. etc. are unwarranted. Quote from http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_...: On February 8, 2011, NASA and the NHTSA announced the findings of a ten-month study concerning the causes of the Toyota malfunctions of 2009. According to their findings, there were no electronic faults in the cars that could have caused the sudden-acceleration problems.
- tunesmith 11y ago
  Every time this article comes up on hacker news there are a few comments that show up talking about how no one was able to prove that the bugs definitely caused the crashes, and thus the criticisms of Toyota are overblown. I'm left wondering how on earth to reconcile those viewpoints with general software engineering (which is a huge part of what this community is about), where we regularly see articles about new concurrency frameworks, fault-tolerant programming, formal methods to prove correctness of code, etc. If it's important enough for Amazon to use TLA+ to prove correctness of DyanmoDB then shouldn't it be considered outrageous that Toyota doesn't do the same thing for something that is potentially an accelerating death machine?
kensai 11y ago
"In 1998 that standard had a Rule No. 70 called -- I don't remember the exact language. But function should call themselves. And the rules basically are the same in but they changed the numbering system, so in the standard this rule, same rule is No. 16.2. So this violation of the MISRA C rule." "What was NASA's view about this recursion? A So NASA's view, NASA was concerned about stack -- possible stack overflow. They had a couple of pages devoted to it, about five pages. I pulled some quotes here. Recursion could exhaust the stack space leading to memory corruption and run time failures that may be Yes. In what way? The stack can overflow due to this recursion in the Camry. And create memory corruption? And that would create memory corruption, that's difficult to test -- detect in testing." Man, some elementary stuff here. They changed the specs numbering and did not update their manuals as well as forgetting that recursion in very costly in memory and could overwrite the stack... Jee, these are things a C programmer learns from day one, even in CS50...
JabavuAdams 11y ago
Please edit the title to read "Toyota's", not "Toyotas".
ilitirit 11y ago
Software that can modify any aspects of a vehicle's handling should be subjected to a higher level of testing and scrutiny than things like airbags and safety belts. A faulty cruise-control component is demonstrably more dangerous than a faulty safety belt.
e40 11y ago
Any ideas if other Japanese car makers have the same problem with their software?
thrillgore 11y ago
10,000 god damn global variables. It would be very difficult to expect some kind of unit testing with that many straggling race conditions bouncing around. Wow.
cpeterso 11y ago
Does Google (or Tesla or Uber) use Ada for their self-driving car projects? I am afraid that answer is likely C++. I noticed that this article mentions MISRA-C but not Ada. I thought I had read the Toyata used SPARK Ada. Michael Barr's slides have more technical details about Toyota's C code: http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUB...
deleted 11y ago
[deleted]

152 points by UberMouse 11y ago

Here are the slides Barr used in his presentation: http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUB...

btilly 11y ago

Please add (2013) to the title. People may have forgotten this because it was in the news a few years back. But Toyotas randomly experienced "unintended acceleration" due to software bugs. Many reported incidents were undoubtably due to the problem that people in a panic can step on the wrong pedal and will misremember what they did. Others were due to a floor mat that could jam the pedal. But some were Toyota's fault.

nikanj 11y ago
Was that ever proven? Did Toyota ever come out with a software patch that had to be installed in all cars made by them? I remember them replacing carpets that might get stuck, and this http://www.thetruthaboutcars.com/2010/03/the-best-of-ttac-the-audi-5000-intended-unintended-acceleration-debacle/ http://www.thetruthaboutcars.com/2010/03/the-best-of-ttac-th...
- tomcorrigan 11y ago
  It was never proven because it never happened. The wikipedia article has much more detail.: http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_... It is not merely coincidental that all unintended acceleration events occurred in automatic cars. Also, a widespread unintended acceleration problem has not been observed in Toyota cars outside the USA. It's a shame that so many on HN are so swift to condemn Toyota
  - lloeki 11y ago
    > It is not merely coincidental that all unintended acceleration events occurred in automatic cars. Also, a widespread unintended acceleration problem has not been observed in Toyota cars outside the USA. If my car went nuts on acceleration the first thing I'd do would be to jump on the clutch pedal and apply brakes (and possibly set the stick to neutral) but that's because most cars here are manual thus that's what we learn to operate†. Pursuing on that line: once at a stop, cut the ignition and disaster is averted. Start again and you're probably fine due to the reboot. Then drive to nearest Toyota to complain, but since "nothing" (i.e no damage, no injury) really happened, you'll get a shrug and a reflash. † In a country where people learn only on automatic cars, setting back to neutral is most probably not reflex (if mechanically possible at all)
- mannykannot 11y ago
  I, too, am left wondering over the paradox of the brake supposedly being powerful enough to hold back any amount of torque the engine and transmission can apply - unless, in the name of anti-skid braking or traction control, the system has the ability to override the driver and release or limit the braking torque. Furthermore, those explanations of the floor-mat recall that I have checked all say that the mats were suspected of having interfered with the accelerator, not the brake. Toyota subsequently performed a second recall, to correct problems with the accelerator pedal. These both imply that unintended acceleration was at least a significant causative factor in the accidents - unless Toyota and the NHTSA were simply acting in order to be seen doing something. With regard to proof, the article covers the issue in some detail: after a far-from-exhastive series of investigations, there have already been found so many ways for the software to get into unintended states that only a vanishingly small number of the vast range of possible causes have been considered. Asking for proof of an error is the wrong question to ask: the burden of proof clearly rests with the manufacturer to show that their systems are safe - and Toyota cannot do that with this software. That Toyota replaced floor-mats is certainly not evidence for the correctness of their software, and nor is the non-appearance of a software patch. The article quotes a concerned Toyota engineer whose statements indicate a culture of denial within the company.
UberMouse 11y ago
Doh, all the reddit links were from today didn't realize it was from 2013. Updated the title.

swang 11y ago

So many questions remain... How do I tell which Toyotas are affected? Do they all have these problems? What, if anything, did Toyota do to fix their software engineering processes? I ask because my parents have a 2005 or 2006 Toyota Sienna, and I don't feel very comfortable with them driving it now.

MichaelGG 11y ago
If you're concerned about safety, look into the stats. With the number of accidents happening overall, I wouldn't be surprised if even a known flaw doesn't increase risk a whole lot. There's probably dominating factors, such as location (weather, etc.) and distance driven at which times, or which model of vehicle. Maybe I'm wrong and this is a significant risk, but the approach should be the same. Even if they found and fixed one problem, the stats would still tell you which cars are safest. It could very well be that other vendors are worse, just haven't been investigated.
- peterfirefly 11y ago
  Toyota cars are some of the safest on the road in the US according to the safety statistics -- even if (big if) some of them had problems with "unintended acceleration". This tells us that even if (big if) the issue was real, it was actually never important. Also funny that it never was an issue outside of the US.
  - thescrewdriver 11y ago
    Which safety statistics? IIHS crash test reports or actual road statistics?
    - peterfirefly 11y ago
      The latter.
      - thescrewdriver 11y ago

userbinator 11y ago

Things were so much simpler when the only problems that could cause unintended acceleration were mechanical in nature. A broken return spring, seized linkage, etc. My daily driver has a mechanical throttle (although it is electronically fuel-injected), and honestly I can't see much point in "drive-by-wire" for cars. But, on the other hand, even despite so many possible bugs, AFAIK no one has been able to demonstrate one instance of unintended acceleration even with extensive testing.

SoftwareMaven 11y ago
A 150 foot long skid mark seems like pretty compelling evidence of unintended acceleration.
spydum 11y ago
Have you never encountered such a bug? It isn't difficult to understand how hard a bug might be to track down when it only affects such a small subset of your users and only under specific circumstances. It is the dreaded Heisenbug
bri3d 11y ago
Drive-by-wire is good for a lot of efficiency technologies because it enables the elimination of the throttle plate, and therefore of many kinds of throttling losses (see MultiAir, ValveTronic, ValveMatic, etc.). It also enables simpler cruise control and traction/stability control systems. The addition of computers to cars is mostly a plus (IMO) but the hidden complexity is frightening to say the least.
thrownaway2424 11y ago
There are no mechanical throttles for electric cars.

hliyan 11y ago

This is appalling: Toyota had more than 10,000 global variables. “And in practice, five, ten, okay, fine. 10,000, no, we're done. It is not safe, and I don't need to see all 10,000 global variables to know that that is a problem,” Koopman testified. and: Toyota’s failure to check the source code of its second CPU, supplied by Denso —even as executives assured Congress and NHTSA that the cause of UA couldn’t be in the engine software and: He was critical of Toyota watchdog supervisor – software to detect the death of a task -- design. He testified that Toyota’s watchdog supervisor “is incapable of ever detecting the death of a major task. That's its whole job. It doesn't do it. Instead, Toyota designed it to monitor CPU overload, and, Barr testified: “it doesn't even do that right. and: Barr also testified that Toyota’s software threw away error codes from the operating system, ignoring codes identifying a problem with a task. When the news first broke a few years ago, given Toyota's reputation for quality and process, I thought this was an American industry lead witch-hunt of a Japanese competitor. But if this testimony is correct, what Toyota engineers have done is unforgivable.

elmin 11y ago
I wouldn't be so quick to blame the engineers. They might be working within a managerial structure which doesn't give them the latitude they need to do their jobs. Yes engineers have a duty, but in software it's often hard to know exactly what the impact of cruft will be, and often all you can do is quit.
- icelancer 11y ago
  Blow the whistle? Contact regulatory agencies?
- hliyan 11y ago
  I agree, but I also believe that as an engineer I have an duty to refuse to build something under conditions that, once built, would cause harm to others. Or at least to relay my concerns to management in writing before proceeding. And sometimes, quitting is the ethical thing to do.

thaumaturgy 11y ago

There are a bunch of neat comments from past threads about this if you search HN for "Michael Barr": "On a cyclomatic-complexity scale, a rating of 10 is considered workable code, with 15 being the upper limit for some exceptional cases. Toyota’s code had dozens upon dozens of functions that rated higher than 50. Tellingly, the throttle-angle sensor function scored more than 100, making it completely and utterly untestable." https://news.ycombinator.com/item?id=7711771 https://news.ycombinator.com/item?id=7711771 "For example, http://www.edn.com/design/automotive/4423428/Toyota-s-killer-firmware--Bad-design-and-its-consequences http://www.edn.com/design/automotive/4423428/Toyota-s-killer... quotes Barr's claims: 'Toyota’s electronic throttle control system (ETCS) source code is of unreasonable quality.' 'Toyota’s source code is defective and contains bugs, including bugs that can cause unintended acceleration (UA).'" https://news.ycombinator.com/item?id=8906513 https://news.ycombinator.com/item?id=8906513 (and the linked article has a link to slides which are enlightening) A number of comments at https://news.ycombinator.com/item?id=6636811 https://news.ycombinator.com/item?id=6636811, "Toyota's firmware: Bad design and its consequences"

PhantomGremlin 11y ago

There is, to me, a more interesting question: If not Toyota, then who? Which auto manufacturers do it right? And is there any public evidence to support that? If not, then I'm probably just as "safe" or "unsafe" in any other brand of car as in a Toyota.

alexvoda 11y ago
This is mere speculation but the software in Tesla cars is probably at least decent since they dared reuse some of the technology on the Spacex Dragon V2 capsule. I think this is one field in desperate need of open sourcing. Anyone who has the capability and the desire should be able to audit the software. Modifications should be prevented by signing, unless the user signs that he assumes full legal responsibility for the effects of the modifications and has the vehicle recertified as roadworthy.
- Cthulhu_ 11y ago
  Open sourcing it is nice and all from an idealist standpoint, but given the complexity of the software (millions of LOC), the fact that all the software would be used in commercial companies, and simply the area itself (cars), do you really think the community would pick up on it? I doubt it. Plus, the researcher did audit it - 18-20 months' work, and that was just analyzing it, not actually improving or fixing it. Plus there is no car manufacturer ever that would allow anyone to change the firmware on their own.

bliti 11y ago

These are safety-critical systems. It still is mind numbing that the quality of the code is so bad. After this came out, I've assumed all modern fuel-injected Toyota's suffer from the same lack of safety. I don't think other automakers may be better. I own a Toyota, but it has a mechanical throttle body. :)

_ati 11y ago

Similar to the aerospace and medical may be there should be strict regulations in terms of processes to be followed for development in the automobile industry also. Usually in medical, failing the audit would restrict the producer to sell the product in market for 1 year. May be something similar could be enforced in automobile industry also. Ofcourse it might increase the cost of cars but atleast they will be lot more safer.

meesterdude 11y ago

So, take this into account, and add in self driving cars. The complexity involved in these, and the coordination required, is nontrivial and its clear from the article they do NOT have a good handle on things. I mean, most cars do seem to get around OK, so I'm partly amazed that under the hood, things could really be so scary. But we can't be lazy about adding complexity and systems, especially as more faith is placed on them. That this is not NASA grade code (or anything close) does not give me any warm fuzzies. It reeks of unprofessionalism, greed, and laziness. There needs to be a sane-software assesment. People rely on products with an ever increasing amount of source code - it would be interesting if a third party could come along and certify that a given codebase is not a big scary unmaintainable mess; not to say there won't be bugs or issues, but that these guys are at least trying to make a well designed system, and aren't doing a bunch of crazy stupid things.

deleted 11y ago
[deleted]
- meesterdude 11y ago
  Shouldn't toyota be closer to NASA than google? I mean, we're talking about systems that peoples lives depend on. I would be OK if my website was built by some IT department, if it meant that some level of NASA engineering is going into the control systems i rely on in my day to day life. That this is not the case is a little surprising to me, to be honest.
thaumaturgy 11y ago
The companies currently most actively involved in automated automobiles (hah) are pretty good at what they do. Volvo has been producing big trucks for several years now that have remarkable safety features, like automatically detecting stopped traffic ahead and bringing the fully loaded truck to a complete stop in what seems like an impossibly short distance (https://www.youtube.com/watch?v=HoCknasKdRU https://www.youtube.com/watch?v=HoCknasKdRU). There are plenty of things I dislike about Google but I can't say they're bad at software. If anybody can build a safe automated vehicle, they can. Tesla, too, who have a lot riding on their hard-earned reputation for building next-generation vehicles. I'm an old-school car guy, I haven't been a big fan of the complexity added to cars ever since the really bad emissions control systems in 80s cars, but even I have to admit that all that complexity has probably saved a lot more lives than it has cost -- antilock brakes, airbags, better pollution control, better fuel economy, way better structural safety features.

michaelfeathers 11y ago

> Toyota had more than 10,000 global variables. “And in practice, five, ten, okay, fine. 10,000, no, we're done. It is not safe, and I don't need to see all 10,000 global variables to know that that is a problem,” Koopman testified. I wonder why people want to believe 5 or 10 are okay.

jfoutz 11y ago
Check engine light? Passenger without a seatbelt? I mean, it's an embedded system, resources are scarce. There are more elegant solutions, yes. But a pattern of setting an error condition from a bunch of different sensors, that's checked from a bunch of locations seems reasonable. At least, not insane.
ericye16 11y ago
For simple configurations that have global affects, global variables might be easier than some other methods of keeping track of settings. It's a bit more frequent in embedded software than other software though.
icelancer 11y ago
He's not sanctioning 5-10 globals, only saying he could deal with that number of them without freaking out. Which is certainly true.

thrownaway2424 11y ago

Counting global variables is just silly. I think any number of global variables is perfectly fine.

thrownaway2424 11y ago
Lots of downvotes, no rebuttals.
- Crito 11y ago
  You might as well claim that you think that dogshit makes for a fine breakfast. It doesn't warrant a rebuttal.
- chopin 11y ago
  Maybe you should cite something to back your claim made upthread.
- mercurial 11y ago
  That's a consequence of the use global variables having been recognized as an anti-pattern for a very long time now, and people downvoting the obvious instead of writing a rebuttal.
xutopia 11y ago
You're using a throwaway in what seems to be an apparent troll. For newbie programmers out there the reason we don't use global variables willy nilly is because it is very easy to lose track of all the places where one can be accessed. The result is that your code becomes very fragile.

bootload 11y ago

"Defects in the car’s electronic throttle control system (ETCS) were directly responsible for the Camry’s sudden acceleration and resulting crash." [0] I couldn't find an exact description of how the driver crashed. Was it using the on-board cruise control or normal throttle use? Never use the cruise control. Must ask when I get my car serviced if it has electronic or mechanical throttle body cf @bliti [0] http://www.usatoday.com/story/money/cars/2013/10/25/toyota-sudden-acceleration-lawsuit/3187369/ http://www.usatoday.com/story/money/cars/2013/10/25/toyota-s...

catshirt 11y ago
it was a symptom of neither cruise control or normal throttle use. the way the issue manifested is actually pretty terrifying: "Koua insists that his 1996 Toyota Camry sped up to between 70 and 90 mph despite heavy braking." http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_... out of context, but "we're in trouble, there's no break" https://www.youtube.com/watch?v=03m7fmnhO0I https://www.youtube.com/watch?v=03m7fmnhO0I
- bootload 11y ago
  thx @catshirt, I note this about my Camry: "Toyota Australia announced that its accelerator pedals are made by a different supplier and that there is no need for a recall of Australian made vehicles". Reading through the notes I see trying to turn the engine off while going effects various electrical sub-systems. Me, I'd try putting the car in neutral (auto). A couple of years ago the alternator blew in my car. The battery had enough charge to let me drive +30km home after a re-start by a local RAC. When I drove the car the three kilometres to the shop, the charge started to drop and battery failure light (alternator failure) clicked on. First the car started loosing systems: seat-belts, overdrive, ABS... etc. This continued, till I bunny hopped the car into the garage where everything stopped working. No doubt a sticky accelerator is scarier than the lurching I had in busy traffic, kept going till the end. Power steering was the last to go, then the engine itself.

hackuser 11y ago

In the 1990s an engineer for one the U.S. automakers told me that the code in their cars was a black box. Nobody knew how it functioned; all they could do was watch the input and output, and add patches as needed to modify the output. Maybe the engineer was talking about code for a specific component, but perhaps Toyota's software isn't unique.

r00fus 11y ago
Exactly my thoughts. I bet any company when put under the spotlight would show some really bad practices/anti-patterns. Is that however, a problem with the industry? I can't help think of Fight Club's "recall" equation here...

tulb 11y ago

yaakov34 11y ago

This issue returns to Hacker News and to public consciousness every few months, and each time there is something missing: namely, some kind of direct proof that an actual failure of this software resulted in unintended acceleration, anywhere, ever. Let alone a case of runaway acceleration which the driver is unable to stop with the brakes (requiring a simultaneous brake failure). Since the accelerator pedals in these Toyota vehicles have been pressed no fewer than tens of trillions of times in recent years, that's not an appalling safety record at all. In fact, stuck pedals (whether due to bad lubricants or rolled-up floor mats) are many orders of magnitude more likely to cause stuck throttle than software failures, while runaway vehicles (ones with brakes not working either) are generally caused by "pedal misapplication", i.e. stomping on the gas instead of the brakes. The fact that software has an execution pathway leading to something bad does not mean that this pathway can ever be entered, since in a closed realtime system like this, it is not possible to receive every combination of inputs, unlike in a system loading user data from a file. This is not to say that Toyota shouldn't clean up and verify its code, but the moral panics over what this code says about programmers, the human condition, Japan, etc. etc. are unwarranted. Quote from http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls http://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_...: On February 8, 2011, NASA and the NHTSA announced the findings of a ten-month study concerning the causes of the Toyota malfunctions of 2009. According to their findings, there were no electronic faults in the cars that could have caused the sudden-acceleration problems.

tunesmith 11y ago
Every time this article comes up on hacker news there are a few comments that show up talking about how no one was able to prove that the bugs definitely caused the crashes, and thus the criticisms of Toyota are overblown. I'm left wondering how on earth to reconcile those viewpoints with general software engineering (which is a huge part of what this community is about), where we regularly see articles about new concurrency frameworks, fault-tolerant programming, formal methods to prove correctness of code, etc. If it's important enough for Amazon to use TLA+ to prove correctness of DyanmoDB then shouldn't it be considered outrageous that Toyota doesn't do the same thing for something that is potentially an accelerating death machine?

kensai 11y ago

"In 1998 that standard had a Rule No. 70 called -- I don't remember the exact language. But function should call themselves. And the rules basically are the same in but they changed the numbering system, so in the standard this rule, same rule is No. 16.2. So this violation of the MISRA C rule." "What was NASA's view about this recursion? A So NASA's view, NASA was concerned about stack -- possible stack overflow. They had a couple of pages devoted to it, about five pages. I pulled some quotes here. Recursion could exhaust the stack space leading to memory corruption and run time failures that may be Yes. In what way? The stack can overflow due to this recursion in the Camry. And create memory corruption? And that would create memory corruption, that's difficult to test -- detect in testing." Man, some elementary stuff here. They changed the specs numbering and did not update their manuals as well as forgetting that recursion in very costly in memory and could overwrite the stack... Jee, these are things a C programmer learns from day one, even in CS50...

JabavuAdams 11y ago

Please edit the title to read "Toyota's", not "Toyotas".

ilitirit 11y ago

Software that can modify any aspects of a vehicle's handling should be subjected to a higher level of testing and scrutiny than things like airbags and safety belts. A faulty cruise-control component is demonstrably more dangerous than a faulty safety belt.

e40 11y ago

Any ideas if other Japanese car makers have the same problem with their software?

thrillgore 11y ago

10,000 god damn global variables. It would be very difficult to expect some kind of unit testing with that many straggling race conditions bouncing around. Wow.

cpeterso 11y ago

Does Google (or Tesla or Uber) use Ada for their self-driving car projects? I am afraid that answer is likely C++. I noticed that this article mentions MISRA-C but not Ada. I thought I had read the Toyata used SPARK Ada. Michael Barr's slides have more technical details about Toyota's C code: http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUBBED.pdf http://www.safetyresearch.net/Library/BarrSlides_FINAL_SCRUB...

deleted 11y ago

[deleted]