Hacker News Reader

Comment by m_mueller | Hacker News Reader

Don't you need at least three actors, such that in a single failure condition you can use an election algorithm? I guess two are enough if you do regular snapshotting and the worst case time to restore from a snapshot is lower than the real time bounds you need to comply with.

View on HN

It depends if, when two processors disagree, you can perform a simple 'stop' action.

For example, if something goes wrong with the processor on your industrial robot arm, you just stop all the motors and activate all the brakes. No need to figure out which of the processors is right, have an engineer come out and fix the bug that caused the disagreement.

On the other hand, if something goes wrong with the processor during your space shuttle launch, it would not help to turn off all the rockets - better to have an election algorithm so things can keep working.

Is a self-driving car more like the first case or the second? Depends if the driver is ready to take the wheel :)

I'd argue the second case, generally.

There are far too many situations where a switchover time of [user initial reaction time + initial response time] is high enough to be rather dangerous.

Generally the system will fall back to a 'limp home mode' running on a simpler algorithm on a watchdog microcontroller. See for example, Freescale's reference design for an airbag controller.

http://www.freescale.com/webapp/sps/site/application.jsp?cod...

Reply on news.ycombinator.com