Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013) • Hacker News Board

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#51

Post by snowwrestler » Fri, Oct 23, 2015, 2:44 PM UTC

hoorayimhelping wrote: post #25

swiley wrote: post #2

Critical systems should be open source by law.

I love magic bullets! As we've recently seen with things like Heartbleed, open source has no vulnerabilities, no bugs, no errors, and is free from all the problems of proprietary software.

Heartbleed is the perfect example of why critical code should be open source. It was discovered by developers who were not the original coders, and they were able to talk about it freely, essentially marketing it to create awareness.

If OpenSSL was closed-source my servers would probably still be vulnerable today.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#52

Post by snowwrestler » Fri, Oct 23, 2015, 2:56 PM UTC

TeMPOraL wrote: post #18

PakG1 wrote: post #13

Earlier quoted context omitted.

The point is that a world of coders who would be mulling over the code due to interest and spare time would likely find critical issues and shine light onto them, making it a PR issue for those companies. If those companies ever get around to offering bounties for issues relating to safety or security, even easier to get an army of eyes on the code.

That's the point. We already know it doesn't work. Most recent examples would be Heartbleed, ShellShock, etc.

Heartbleed and ShellShock are examples of why open source is better. Both were found by folks who were not the software maintainers, but were reviewing the source code independently.

In comparison, it took multiple deaths and a major lawsuit to create the same level of visibility into Toyota's codebase. And what reviewers found was code quality far worse than that of OpenSSL or bash.

Someone else said this in another HN thread, but I love it: imagine a world in which Consumer Reports car reviews include a code audit report. That would be far, far better for overall safety than the current situation.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#53

Post by briHass » Fri, Oct 23, 2015, 2:59 PM UTC

delinka wrote: post #39

Jansemon wrote: post #37

How can breaks not stop the engine?! Parking break being a different thing, but the main ones?

"Brakes" are at the wheels. The only time stopping a car from rolling also affects the engine is when everything remains engaged (manual transmission, manual clutch; in gear, clutch not depressed to the floor.) In a vehicle with an automatic transmission, the transmission begins to disengage from the wheels as the wheels spin slower than the engine is pushing. (Very simplified explanation...) i.e. brakes on cars are…

I assume the post above yours was referring to the brakes being able to stop a moving car that also has the engine's power being applied, which they easily can do. If the brakes are engaged enough, even a full throttle engine won't be able to keep the car moving.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#54

Post by snowwrestler » Fri, Oct 23, 2015, 3:01 PM UTC

wodenokoto wrote: post #23

TerraHertz wrote: post #3

I'm a retired electronics design engineer and embedded programmer, and I will NEVER own a car with any kind of vehicle/engine management computer. Old cars for me, forever. I flatly refuse anything but fully manual and direct mechanical gears, clutch, steering, brakes and throttle. Curiously the chief engineer I knew at a major car service center, also felt the same way. And that's not even touching on the insanity o…

You feel the same about planes?

The flight-critical software in planes is at least somewhat reviewed and regulated by the FAA and other national aviation agencies. AFAIK, software in cars is totally unregulated.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#55

Post by Spooky23 » Fri, Oct 23, 2015, 3:06 PM UTC

benihana wrote: post #27

TerraHertz wrote: post #3

I'm a retired electronics design engineer and embedded programmer, and I will NEVER own a car with any kind of vehicle/engine management computer. Old cars for me, forever. I flatly refuse anything but fully manual and direct mechanical gears, clutch, steering, brakes and throttle. Curiously the chief engineer I knew at a major car service center, also felt the same way. And that's not even touching on the insanity o…

I love the absurdity of this and arbitrariness. You'll happily drive in a car, one of the most dangerous machines people use regularly. But if it has a computer in it, no siree, that's when things get too deadly to deal with. All of the other thousands of moving parts, like the thing that takes energy-dense hydrocarbons and ignites them several thousand times a second in hot, high pressure tubes - that's fine and tot…

It's not absurd at all. For the questionable benefit of the ECU, you get a black box system that may or may not be garbage controlling the primary engine input, that may or may not fail safe. Give me the thing that grandpa designed 75 years ago.

In the olden times, the throttle was controlled by a mechanical device and tensioned springs. The failure characteristics were studied for 150+ years, and the state of the mechanical components could be assessed by visual or physical inspection. The failure scenarios for open throttle are also non-obvious things to workaround. What do you do? Pump the brake? Take the car out of gear? Depress the accelerator to reset? Turn the key? It's a complex decision matrix with life-and-death consequences, and the correct answer will vary by car configuration and vendor.

The ridiculous positions taken by posters here are indicative of how engineering fail like this happens.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#56

Post by TeMPOraL » Fri, Oct 23, 2015, 3:07 PM UTC

snowwrestler wrote: post #52

TeMPOraL wrote: post #18

Earlier quoted context omitted.

That's the point. We already know it doesn't work. Most recent examples would be Heartbleed, ShellShock, etc.

Heartbleed and ShellShock are examples of why open source is better. Both were found by folks who were not the software maintainers, but were reviewing the source code independently. In comparison, it took multiple deaths and a major lawsuit to create the same level of visibility into Toyota's codebase. And what reviewers found was code quality far worse than that of OpenSSL or bash. Someone else said this in another…

I agree. I might have stated my point too strongly.

I just think that going Open Source won't magically fix things. ShellShock and Heartbleed were out there for many years before someone reported on them, with (AFAIR) evidence of those holes being exploited by malicious actors. Trying to force a switch to Open Source won't improve situation very much, while requiring a serious overhaul of how the entire world does business. It doesn't seem to be worth it without introducing additional ways to fix the software creation and testing process.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#57

Post by achr2 » Fri, Oct 23, 2015, 3:12 PM UTC

Isn't it time for an oversight agency that looks at code quality within safety-critical systems? The FDA forces oversight of drugs that less than 100,000 people a year will take. Yet there is no agency looking into the software quality of a car management system that millions of people will drive with every day.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#58

Post by Dav3xor » Fri, Oct 23, 2015, 3:13 PM UTC

I've worked on safety critical software, for a couple different companies. Code quality is a very real problem.

One company, the guy in charge of software was a CE, who would have been fine as long as the hardware was at the level of sophistication as what he was taught at school (He knew 8051 microcontrollers really well). He was really good at giant switch-case statements. Function pointers were a little newfangled and suspect.

Basically, he knew enough software engineering to get the hardware working.

That's one big problem that needs to be addressed -- there aren't a lot of people being trained in the software side of embedded systems. You have CS grads who for the most part aren't given much training on the low end of the abstraction spectrum, and the opposite for CE people, so there tends to be a very fuzzy area in the middle that causes arguments between the two camps.

The other company I worked for literally had crazy coding standards that basically dictated 20,000 line functions and a bizarre sort of anti-DRY mindset that I will never understand. You were encouraged to c-c c-v a block of code, change one line, move on!

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#59

Post by kozak » Fri, Oct 23, 2015, 3:15 PM UTC

TerraHertz wrote: post #3

I'm a retired electronics design engineer and embedded programmer, and I will NEVER own a car with any kind of vehicle/engine management computer. Old cars for me, forever. I flatly refuse anything but fully manual and direct mechanical gears, clutch, steering, brakes and throttle. Curiously the chief engineer I knew at a major car service center, also felt the same way. And that's not even touching on the insanity o…

Do you fly airplanes of commercial airlines? If yes, I have bad news for you. They are almost all fly-by-wire already.

Re: Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code (2013)

#60

Post by qbrass » Fri, Oct 23, 2015, 3:19 PM UTC

ebbv wrote: post #34

stretchwithme wrote: post #9

These unintended acceleration incidents seem to happen mostly to elderly drivers. http://www.theatlantic.com/business/archive/2010/03/how-real...

And more importantly than that there are a couple of underlying facts that invalidate the whole premise that unintended acceleration means automatic accidents/death: 1) None of these cars are 700hp Supras that accelerate at drastic speeds. These were normal consumer cars that frankly aren't that fast even with the throttle fully depressed. 2) The brakes in all of these vehicles are many times more powerful than the e…

>2) The brakes in all of these vehicles are many times more powerful than the engine. Pressing the brakes would have stopped the vehicles, even if the engine were attempting to accelerate full throttle.

The brakes in 2004 and newer models are controlled by the computer. It controls the hydraulic pressure to the brakes to maximize the amount of work the regenerative braking system can do. It uses a pump and accumulator to store hydraulic pressure, and solenoids to send it to the brakes as well as provide pedal feedback. The only time you directly control the brakes is if the main system loses all accumulated pressure. Until then, you're just sending pedal input to the computer and it does what it wants.