Earlier quoted context omitted.
A friend of mine works for VW's engine computer division. Yes, those engine computers. After all I've heard of their development methods (or lack thereof), I'm surprised the engines even start more often than one time out of ten.
Care to elaborate? Kernel developers are not practising SCRUM or TDD yet are shipping a fairly stable product.
Post-Mortem for Google Compute Engine’s Global Outage on April 11
331–340 of 368 posts
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#332Earlier quoted context omitted.
> Most people have a greater fear of flying than driving by car although statistically you're far more at risk in a car. One cause of that fear of flying is loss of control; you have to accept placing your life in someone else's hands. Really? That sounds counter intuitive. You'd think the reason people are afraid of flying is, because, you know, it's flying. Thirty thousand feet between you and the cold, hard ground…
Can't find it with a quick google now, but there was a study on this. Giving people fake controls, even when they knew they were fake, reduced anxiety. Give ambulatory meat some onboard decision-making ability, and it will want to use it.
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#333Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#334This is a very good Post-Mortem. As I assumed it was kind of a corner case bug meet corner case bug met corner case bug. This is also why I am of afraid of a self driving cars and other such life critical software. There are going to be weird edge cases, what prevents you from reaching them? Making software is hard....
Having said that I am still scared, I'm not sure how well Tesla auto pilot will handle a tire blowout at 70mph. Perhaps better than I would, but I would much rather I was in control.
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#335Earlier quoted context omitted.
In 2007 the FAA revealed the Boeing 787 had passenger Internet traffic and flight control traffic on the same network separated via software firewall. This gives us the classic reassuring response from Boeing spokeswoman Lori Gunter : "There are places where the networks are not touching, and there are places where they are," she said. http://www.wired.com/2008/01/dreamliner-security/
"had"? So it's fixed now, did they rewire the whole network?
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#336Earlier quoted context omitted.
...and you're basing this on what, exactly? It's easy to pontificate about what people "didn't bother to test" based on zero information.
First bug: In a failure case, it should remove the failing config, not all of them. Pretty hard thing to miss if you test for it with any level of basic unit test or similar. Second bug: canary failure should prevent further propogation of the bad config. A little more difficult to test with automated tests due to requiring a connection. It sounds like this was in fact tested, but the usage between the two bits of so…
Because you have an apparently incredibly simple mental model for the system and so of course tests for it seem simple?
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#337Earlier quoted context omitted.
First bug: In a failure case, it should remove the failing config, not all of them. Pretty hard thing to miss if you test for it with any level of basic unit test or similar. Second bug: canary failure should prevent further propogation of the bad config. A little more difficult to test with automated tests due to requiring a connection. It sounds like this was in fact tested, but the usage between the two bits of so…
> I'm not really sure why I got downvoted for this. Because you have an apparently incredibly simple mental model for the system and so of course tests for it seem simple?
I don't doubt that Google's infrastructure is as complicated and nuanced as it can get. Configuration software just simply isn't.
I still don't really see the point you're trying to make here. There isn't enough detail in the two sentences they gave us on the actual cause of the problem to really say much more in any further detail than I did.
But I guess that just proves my other point. Postmortem was 90% fluff.
Yet in googles defence, the information they gave was thorough enough for me. My only gripe was how it was being treated here. It just wasn't a very interesting situation and turned out to be something quite mundane.
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#338Earlier quoted context omitted.
Especially since "driver-error" is the cause of 94% of motor vehicle crashes in the U.S.[1], with 32,675 people killed and 2.3 million injured in 2014.[2] Worldwide, motor-vehicle crashes cause over 1.2 million deaths each year and are the leading cause of death for people between the ages of 15-29 years old.[3] It's estimated that self-driving cars could reduce vehicle crashes by approximately 90%! [4] [1] http://ww…
This is true for a single car, but self driving cars are introducing something that did not happen before. Imagine majority of cars are self driving cars and they all malfunctions due to bug in software update.
That's assuming everyone with a self driving car is driving the exact same model and they all updated at the exact same time. Chances are there will be many different models and manufactures so an OTA update with a bug will only affect a much smaller percentage of the self driving cars.
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#339Earlier quoted context omitted.
At a certain point the policy question will inevitably be: why should any regular person be even allowed to drive given the superior abilities of the machines? There are certain ideological assumptions that will then have to be debated. Making your own mistakes is a consequence of freedom. Limiting the freedom to make mistakes for the overall benefit to society is not uncontroversial - (see the gun control debate), a…
Cars are already extremely regulated. You can only drive at speeds dictated by the government in directions dictated by the government, turn in ways prescribed by the government. Your car has to be identifiable in specific ways by the government. You have a lowered expectation of privacy in a car. I hardly think the argument will be difficult to just prohibit cars.
Sure... so you're saying that your steering wheel blocks when you're trying to make an uncharted turn? Or that your throttle has a variable hard limit, depending on the road you're on?
Where do you live, if I may ask?
Re: Post-Mortem for Google Compute Engine’s Global Outage on April 11
#340Earlier quoted context omitted.
Source? What kind of failure are you talking about? Minor hiccups or full failures which stop the car entirely?
Google's report from December 2015: http://static.googleusercontent.com/media/www.google.com/en/... Over 424,000 miles driven: 272 times the car had a 'system failure' and immediately returned control to the driver with only a couple seconds of warning. (Approx. every 1,558 miles.) A car mid-traffic spontaneously dropping control of the vehicle would likely create a large number of accidents. 13 car accidents prevent…
"Our test drivers are trained and prepared for these events and the average driver response time of all measurable events was 0.84 seconds."
Secondly, you fail to mention:
"“Immediate manual control” disengage thresholds are set conservatively. Our objective is not to minimize disengages; rather, it is to gather as much data as possible to enable us to improve our self-driving system."
Thirdly, you fail to mention that the rate has dropped significantly:
"The rate of this type of disengagement has dropped significantly from 785 miles per disengagement in the fourth quarter of 2014 to 5318 miles per disengagement in the fourth quarter of 2015. "
On the contact events, you fail to mention:
"From April 2015 to November 2015, our cars self-drove more than 230,000 miles without a single such event."
Lastly, your comparison with human drivers fails to take into account the environment:
"The setting in which our SDCs and our drivers operate most frequently is important. Mastering autonomous driving on city streets -- rather than freeways, interstates or highways -- requires us to navigate complex road environments such as multi-lane intersections or unprotected left-hand turns, a larger variety of road users including cyclists and pedestrians, and more unpredictable behavior from other road users. This differs from the driving undertaken by an average American driver who will spend a larger proportion of their driving miles on less complex roads such as freeways. Not surprisingly, 89 percent of our reportable disengagements have occurred in this complex street environment"
I don't think self-driving cars are quite ready yet, but you are not representing the state of the art accurately by making out it is as bad as you say.