A story about the fact that the software is penetrating more and more in our daily life. However, with the comfort and usefulness come new dangers. Now we deal with the bugs not only sitting at the computer, but driving on a road.
(10 months later)
(3 years later)
The National Highways Traffic Safety Administration (NHTSA), have evaluated that in the 10 year period from 2000 till 2010, in accidents caused by defective electronics, 89 people died and 57 people were seriously injured.
Toyota denies its fault, and states, based on their own research, that it's all because of "sticking" accelerator pedals, and a design flaw that enabled accelerator pedals to become trapped by floor mats, but recalls nearly 8 million vehicles around the world because of these two defects.
Still, there are more complaints coming.
We recommend that those with a nervous disposition not watch this video.
NHTSA started their own investigation, asking NASA to help.
During the 10-month investigation, NASA specialists claimed that the software does not comply with MISRA standards (Motor Industry Software Reliability Association), and contains 7134 violations. Toyota responded, saying that they have their own standards.
December 20 2010, Toyota rejects all the accusations, but pays 16 billion dollars in pre-trial actions, releases software updates for some car models, and recalls 5.5 million vehicles.
After the announcement of the results of NASA's research, Toyota shares on the Tokyo Stock Exchange went up by 4.6%.
In the year 2013, an action is filed in Oklahoma Court in regards to an accident in 2007, involving two girls in a 2005 Toyota Camry. One of them died, the other spent five months in a hospital with injuries to the back and head. Toyota has not admitted its guilt. They said that the cause of the accident was the driver confusing the gas pedal and the brakes; when she realized her mistake and started braking — it was too late.
Two engineers started the investigation. Michael Barr and Philip Koopman. It took them 20 months to review 280 000 lines of code and write a 800-page long report. Each.
The address was kept in secret. The hotel room, where the engineers worked was guarded 24 hours a day - security ensured that nobody was bringing in or taking out any papers. All the phones and internet connections were disabled.
Toyota recalled more than 10 million vehicles worldwide. Still, they have never admitted their guilt.
According to Michael Barr, their report was classified as secret. The same thing was done with the contract which gave them access to Toyota's source code. Barr recommends Googling the transcript of the hearing material.
Here is where the analysts worked:
Here is the report they wrote:
The main program in the dock is the electronic throttle control system (ETCS).
NASA experts scanned the chips with x-rays.
Cosmic rays were also considered as a possible cause of errors.
They checked the C code:
And then they finally got at the code.
According to estimates, every 30 MISRA standard violations lead to one "serious bug".
Toyota took only 11 rules from MISRA.
NASA analysis tools were able to check 35 MISRA rules, and 14 of them were violated.
The source - NASA report, appendix A: Software, page 28]
Total: 7134 (NASA estimation), or 81 514 (according to Michael Barra's estimations).
10 rules of NASA
The Power of Ten - 10 Rules for Writing Safety Critical Code
[The source - spinroot.com/p10]
The function length is limited to 60-75 code strings, after removing empty strings and comments. More than 200 functions in Camry05 code exceeded the specified length. One of the functions was 740 strings long.
31 names were declared several times in different scopes. The most frequent name is sts_flags1, which appeared in 57 different scopes.
This is worth a closer look.
A graph of the flow control of a simple program.
Cyclomatic complexity of the program above 50 - an indicator that the program cannot be tested.
In the ETCS-code Toyota has:
Programmers used the recursion in the Toyota code, every issue related to its usage led to the restart of the processor (CPU reset).
The amount of shitty code, on which the lives of people depends on, gets bigger. The example of the Toyota company, shows that the system developers can screw the code on an elementary level, not to mention, on the level of accepting the ethical decisions of the artificial intelligence. Although the main trouble is not that there are errors, but the fact that the owners hinder their process of finding and fixing the issues. These people are powerful enough to push on NASA.
"Applications programming is a race between software engineers, who strive to produce idiot-proof programs, and the universe which strives to produce bigger idiots. So far the Universe is winning."
- Rick Cook, writer
An exhaustive presentation of Philippe Kupmana's:
NASA Report on Toyota Unintended Acceleration Investigation
NASA Executive SummaryNASA Full Report
NHTSA Report on Toyota Unintended Acceleration Investigation
Four years before that
Wherever I'm going, I'll be there to apply the formula. I'll keep the secret intact.
It's simple arithmetic.
It's a story problem.
If a new car built by my company leaves Chicago traveling west at 60 miles per hour, and the rear differential locks up, and the car crashes and burns with everyone trapped inside, does my company initiate a recall?
You take the population of vehicles in the field (A) and multiply it by the probable rate of failure (B), then multiply the result by the average cost of an out-of-court settlement (C). A times B times C equals X. This is what it will cost if we don't initiate a recall.
If X is greater than the cost of a recall, we recall the cars and no one gets hurt.
If X is less than the cost of a recall, then we don't recall.
- Chuck Palahniuk "Fight club", 1996
- How often do such accidents happen?
- You won't believe it.
- Which company do you work for?
- Oh, it's a very large one.
- "Fight club", film, 1999.
This article was originally published (in Russian) on habrahabr.ru. The original and translated versions were posted on our blog with the permission of the author.