Hacker News Reader

Comment by trhway | Hacker News Reader

i didn't get whether they were able to show an actual path of how UA could have occurred (like for example in case of Arian 5 or that Canadian radiation machine - that is what makes those cases useful and supports all the good recommendations produced as result), nevertheless the slant seems to be clear ... Google self-driving car has just become significantly more expensive and several years more further into the future. And Toyota i guess is going to have much more people hired into its engineering department who isn't going to do actual engineering (Senior rule 62 compliance engineer) and produce a lot more and better TPS reports NASA-style instead :)

View on HN

The problem with comparing it to the Arianne 5 or Therac-25 is that those were situations where there was a single bug that you could blame. Toyota's software had so many bugs that it was impossible /to/ tell what paths would lead to UA, just that there was no accountability and quality assurance.

Regarding your second point, similar complaints were made about other safety features, like mandatory turn signals or airbags. Yes, there will be additional time spent ensuring that they are compliant with safety standards. But in this case, a lot of that time should have already been taking place. Some code needs more review time, a second or third or even fourth set of eyes on it. When people can die because of a bug, then the bar for what is acceptable code can and should be higher.

>Toyota's software had so many bugs that it was impossible /to/ tell what paths would lead to UA,

your statement sounds kind of contradictory to me. If there many - just choose any path. It may be impossible to say which one actually happened, yet should be possible to show an actual path, at least one, that could plausibly lead to UA.

> i didn't get whether they were able to show an actual path of how UA could have occurred

I think the answer is no -- there was never a clear demonstration of an extant buggy execution trace. Just a preponderance of evidence that such a trace could exist.

The lack of ECC memory means that you don't even need that... the effects of a little solar flare, or even noise from a powerline nearby could have caused the issue.

no. there were multiple reports of UA. Solar flare, etc... can't cause such consistency.

Yes, I'm sure it was a bug in this case. However, this paper shows that RAM errors are so common you really don't want non-ECC in anything safety-critical.

http://www.cs.toronto.edu/~bianca/papers/sigmetrics09.pdf

   For example, we observe DRAM error rates that are orders of magnitude higher
   than previously reported, with 25,000 to 70,000 errors per billion
   device hours per Mbit and more than 8% of DIMMs affected
   by errors per year. We provide strong evidence that memory
   errors are dominated by hard errors, rather than soft errors, which
   previous work suspects to be the dominant error mode

Reply on news.ycombinator.com