News for hackers. Stuff that matters.
Re:A case study of Toyota unintended acceleration and softwa... by PaulHoule on Monday May 02, 2022 @11:47AM (#31236696)
I'm no fan of the mitigation of killing the throttle if somebody stomps on the brake.

If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

The article also says that global variables will kill you, putting variables on the stack will kill you but doesn't say where it is safe to put variables. I can't imagine the heap is any better, that a garbage collector isn't going to pause and kill you, etc.

As an Arduino enthusiast I see statically allocated (global?) variables are frequently the way to go for an embedded system, the frontier is to be able to prove the correctness of what you're doing.

Re:A case study of Toyota unintended acceleration and softwa... by jacquesm on Monday May 02, 2022 @12:25PM (#31237274)
> If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

Sure, but that's not normal driving and even though it should be possible this situation should simply never occur outside of a racetrack, a regular driver will move their one foot from the gas and move it to the brake.

Re:A case study of Toyota unintended acceleration and softwa... by salawat on Monday May 02, 2022 @02:59PM (#31239333)
You're assuming levels of clean abstraction that not only are not guaranteed to rxist, but foolhardy to assume.

It is better to leave options open rather than to lock things behing explicit configuration in the abscence of readily available documentation.

Which I assure you, Service/Operators manuals are not.

Re:A case study of Toyota unintended acceleration and softwa... by virtue3 on Monday May 02, 2022 @11:55AM (#31236793)
256.6K Non-Comment Lines C Source + 39.5K NCSL headers (Main CPU)

Global variables in that kind of codebase might be -really- hard to keep track of how you are accessing and writing them :/.

This gets really fucking nasty when you're doing things like setting it to volatile and potentially accessing it across threads and you end up with a partial write and then doing a read, etc.

I'm sure the axiom of "it's never tested as much as we want" still probably applies here and that's slightly terrifying.

also FTA: 2272 - global variable declared with different types

“Spaghetti code”: Incomprehensible code due to unnecessary coupling, jumps, gotos, or high complexity

Yeah that sounds fun. really fun. This is why I purposefully never work on any system that could kill someone. I just can't imagine being in charge of something like that and not wanting to go insane with knowing my code wasn't checked enough. or I wasn't careful enough.

Re:A case study of Toyota unintended acceleration and softwa... by monocasa on Monday May 02, 2022 @12:42PM (#31237482)
The rumor I heard at the time was that large portions of the code were autogenned out of a Matlab model of the engine, and that was where the globals and awful code complexity metrics came from.
Re:A case study of Toyota unintended acceleration and softwa... by stefan_ on Monday May 02, 2022 @09:35PM (#31243329)
Yep. This is widespread practice in the industry and is arguably far superior to someone actually trying to model it all in C. It just looks weird in a disassembler because you end up with a million global variables and essentially no control flow.

(It's specifically Matlab Simulink for those playing along at home)

Re:A case study of Toyota unintended acceleration and softwa... by chillingeffect on Tuesday May 03, 2022 @08:15AM (#31247340)
Ive exported several simulink models. Long functions, yes. Globals, no.
Re:A case study of Toyota unintended acceleration and softwa... by monocasa on Tuesday May 03, 2022 @11:02AM (#31249197)
I've integrated several simulink models; they had an incredible amount of globals.
Re:A case study of Toyota unintended acceleration and softwa... by jacquesm on Monday May 02, 2022 @12:28PM (#31237306)
Indeed, spaghetti code is bad, but spaghetti data manipulated by spaghetti code is orders of magnitude worse.

The thing that I never got is why there are plenty of high level languages that have 'global' more or less as the default. This is asking for trouble. Side effects should be very carefully introduced and reasoned about and kept to an absolute minimum, not be the default sauce to sprinkle across your codebase, the possible number of states increases very rapidly if you do that.

Re:A case study of Toyota unintended acceleration and softwa... by kevin_thibedeau on Tuesday May 03, 2022 @12:06AM (#31244485)
Dynamic allocation is generally forbidden in this application so all system state has to be in global or static variables. Otherwise you'd have to invest in formal analysis tools to prove that memory won't be exhausted.
Re:A case study of Toyota unintended acceleration and softwa... by 2143 on Monday May 02, 2022 @02:08PM (#31238638)
> If you're trying to go around corners as fast as possible in a front-wheel drive car

1. Please don't do circus on public roads.

2. If you're on private roads, well, you know, front-wheel-drive cars tend to handle poorly in fast corners. Do yourself a favour and get a RWD or AWD or something.

Re:A case study of Toyota unintended acceleration and softwa... by sidewndr46 on Monday May 02, 2022 @02:37PM (#31239036)
If you're declaring a variable as volatile and accessing it from separate threads, it is going to be "fucking nasty" in so many ways.
Re:A case study of Toyota unintended acceleration and softwa... by kayodelycaon on Monday May 02, 2022 @11:52AM (#31236750)
> If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

This does not seem like a valid use case for driving on public roads.

Re:A case study of Toyota unintended acceleration and softwa... by Swizec on Monday May 02, 2022 @12:02PM (#31236928)
> This does not seem like a valid use case for driving on public roads.

Driving in the snow often requires this because the brake acts as a poor man’s diff lock which gives you more traction. You can see the effect at speeds as low as 30kph in snow – a nice slow speed even in the city.

Re:A case study of Toyota unintended acceleration and softwa... by failedengineer on Monday May 02, 2022 @01:07PM (#31237852)
I've never heard of this, and I learned how to drive in places with very rough winters.

You just hold the brake (lightly) with one foot, and gas with the other? This doesn't sound as useful as putting the car in 2nd, or rocking back and forth?

Re:A case study of Toyota unintended acceleration and softwa... by Zak on Monday May 02, 2022 @04:18PM (#31240339)
> This doesn't sound as useful as putting the car in 2nd, or rocking back and forth?

Neither of those cause the wheel with more traction to get any torque. Applying the brakes lightly will. Rocking and manually preventing wheelspin with the brake can be combined.

In theory, traction control will as well, but traction control may also intervene and decrease power right when you need it as you're getting unstuck, so there's potential merit in turning it off and preventing excess wheelspin with the brake yourself.

Source: I learned to drive in Alaska, and I have used this technique.

Re:A case study of Toyota unintended acceleration and softwa... by failedengineer on Monday May 02, 2022 @05:13PM (#31240991)
yeah, Alaska and Sibera are pretty much the only places with worse winters than where I learned. I'll keep this in my pocket for times when I'm spinning a wheel and am out of other options. We only get a few inches a year here, but my traction control might be out someday.

Thanks!

Re:A case study of Toyota unintended acceleration and softwa... by kayodelycaon on Monday May 02, 2022 @02:26PM (#31238881)
You're using the brake to prevent a slipping tire from taking all of the power. This is a non-issue for any car made in the last decade since traction control is mandatory.
Re:A case study of Toyota unintended acceleration and softwa... by olyjohn on Monday May 02, 2022 @04:36PM (#31240574)
That assumes that all traction control systems are equal. A lot of them are hot garbage and won't get a car moving when only a single tire is off the ground.
Re:A case study of Toyota unintended acceleration and softwa... by jeffbee on Monday May 02, 2022 @12:17PM (#31237133)
Literally every car sold today does this for you.
Re:A case study of Toyota unintended acceleration and softwa... by salawat on Monday May 02, 2022 @03:05PM (#31239392)
And automated things never fail? Then what are we reading? The user should be trained to be 10% smarter than the piece of equipment.
Re:A case study of Toyota unintended acceleration and softwa... by jeffbee on Monday May 02, 2022 @04:47PM (#31240715)
There is no way that 99% of drivers under 99% of realistic conditions will be anywhere near as effective as automatic traction control, much less more effective. It is absolutely a fair tradeoff to have a drive-by-wire that's better than virtually everyone and almost as good as that one guy under perfect controlled conditions.
Re:A case study of Toyota unintended acceleration and softwa... by salawat on Tuesday May 03, 2022 @09:41AM (#31248179)
I question the practice of building solutions around people and ceasing to train people why they are there. You aren't empowering people at that point. You're creating a centralized control mechanism the information asymmetry.

If people don't come out of a system interaction smarter than they went in, you're not doing it right. You're writing checks their continued ignorance will increasingly extort hogher costs from, and which will culminate in the formation of a lever of control in the form of manufacturers making decisions for people, usurping ultimate end agency.

I just don't buy that that's how the world should work. You can't build a better world without building better, more knowledgable people. We engineers spend too long making machines that do things for people without making clear why they exist and how they work.

I'm done with the "for their own good" BS.

Re:A case study of Toyota unintended acceleration and softwa... by guicho271828 on Monday May 02, 2022 @12:05PM (#31236958)
Cars are not built only for public roads.
Re:A case study of Toyota unintended acceleration and softwa... by brimble on Monday May 02, 2022 @12:13PM (#31237082)
I don't think anyone is considering doing this to race cars.
Re:A case study of Toyota unintended acceleration and softwa... by vesrah on Monday May 02, 2022 @12:41PM (#31237461)
Which is fine, as long as there is some kind of sane defeat for originally street cars that might see the track.
Re:A case study of Toyota unintended acceleration and softwa... by robonerd on Monday May 02, 2022 @01:41PM (#31238279)
Frankly it's also fine if there isn't. Taking street cars to the track is a tiny niche and Toyota needn't cater to it. Aftermarket modding is an option anyway.
Re:A case study of Toyota unintended acceleration and softwa... by salawat on Monday May 02, 2022 @03:03PM (#31239378)
No, it isn't fine, what you're seeing here is the push to use manufacturing infra to impose one group's will on another. Tools should be neutral.

We should empower people, not manipulate them through engineering usecases to/to not accommodate.

Re:A case study of Toyota unintended acceleration and softwa... by brimble on Monday May 02, 2022 @03:18PM (#31239556)
I feel empowered when I don't have to worry as much about how to safely operate my car, and it's just automatically safer. And when I don't have to worry as much about other drivers on public roads because their cars are automatically safer. The amount I'd be happy to pay to make that functionality configurable in order to accommodate people with different preferences, is $0.00.
Re:A case study of Toyota unintended acceleration and softwa... by BoorishBears on Monday May 02, 2022 @01:44PM (#31238323)
If you're serious about racing you'll have an aftermarket ECU
Re:A case study of Toyota unintended acceleration and softwa... by olyjohn on Monday May 02, 2022 @04:32PM (#31240527)
That would depend on what kind of racing you do. I'm pretty sure Spec Miata requires you to run a stock ECU. And it's literally the most popular racing series on the planet.
Re:A case study of Toyota unintended acceleration and softwa... by BoorishBears on Monday May 02, 2022 @11:26PM (#31244182)
The most modern iteration of Spec Miata (Spec MX-5) get an upgraded ECU:

https://www.mazdamotorsports.com/2019/02/07/a-better-faster-...

And Spec Miata is a pretty terrible example anyways... at the point where you're dumping 10k into a $500 motor I don't think you can talk about stock anything...

Re:A case study of Toyota unintended acceleration and softwa... by DSMan195276 on Monday May 02, 2022 @12:30PM (#31237334)
> As an Arduino enthusiast I see statically allocated (global?) variables are frequently the way to go for an embedded system, the frontier is to be able to prove the correctness of what you're doing.

Worth noting that 'statically allocated' and 'global' aren't the same thing. Whether they're making that distinction in the powerpoint I'm not really sure because it's more of a language specific thing and the document isn't quite that technical.

As for how you do that, in C/C++ you can add `static` to a global variable declaration to make it "local" to the file/compilation-unit it is declared in. The variable itself still works the same from within the file, but a static variable cannot be "seen" outside the file even with an `extern`, so it can only be (easily) modified from functions inside the file. Doing it this way allows you the big advantages of static allocation (in many cases the only real option) while still allowing you to encapsulate the variables within a sane API that the rest of the code uses.

Edit: Actually page 39 references this, saying that 89% of the variables are not locally scoped. There are still ways to achieve some level of encapsulation even without using `static` but it's effectiveness drops a lot since anyone can just write an `extern` line and ruin your day...

Re:A case study of Toyota unintended acceleration and softwa... by robonerd on Monday May 02, 2022 @12:08PM (#31237008)
> If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

If you want a race car, buy a race car.

Re:A case study of Toyota unintended acceleration and softwa... by hatsunearu on Monday May 02, 2022 @07:18PM (#31242403)
I track my street-legal Miata. It's a garbage argument to say "it's not a race car"--plenty of cars out there have not stupidly shoddy software and don't need crutches like brake override to get their safety.
Re:A case study of Toyota unintended acceleration and softwa... by bonestamp2 on Monday May 02, 2022 @12:20PM (#31237187)
> If you're trying to go around corners as fast as possible

Why do you need the brakes? The nearest freeway on ramp to my home is unusually short, and it's a 270 degree turn. I've had to get very good at getting my vehicle to accelerate as quickly as possible around that curve so that I can merge safely when the on ramp ends.

I don't need the brakes to do that, in fact the front brakes in most vehicles are usually much stronger and the braking bias is usually weighted greatly in favor of the front brakes. So again, I really don't know why you need the brake, especially in a front wheel drive car... you're just fighting the engine and the brakes can usually win that fight (except for in high powered rear wheel drive cars where the rear brakes are weak and the engine can overpower them).

Re:A case study of Toyota unintended acceleration and softwa... by tcoff91 on Monday May 02, 2022 @01:08PM (#31237867)
Using the brakes all the way into the apex of the corner helps to increase cornering speed by transferring more weight to the front wheels to increase grip. It's called trail braking.

This isn't relevant for your example as in your example, you are entering the freeway on-ramp at a low speed and accelerating throughout the entire corner. Navigating a corner at highest possible speed means you're arriving at the corner at a high speed and must decelerate in order to make the corner.

It's not immediately clear to me why you would use gas and brake at the same time in an automatic transmission vehicle. The only reason I can think of would be to keep the revs of the engine in the powerband and prevent the car from downshifting so that you can immediately have full power when you accelerate out of the apex. In a manual transmission vehicle, there's a technique called heel-and-toe where you blip the gas pedal with your heel to rev-match the engine on your downshift while braking with your toe and depressing the clutch with your left foot, but you're never introducing force to the front wheels that would counter the force of the brakes.

Re:A case study of Toyota unintended acceleration and softwa... by moron4hire on Monday May 02, 2022 @03:32PM (#31239730)
Yes, that's exactly right, it's to keep the engine in the powerband. Automatic transmissions take both engine speed and throttle position into account when selecting a gear. More throttle while braking pushes the transmission to downshift more aggressively.
Re:A case study of Toyota unintended acceleration and softwa... by closewith on Monday May 02, 2022 @12:51PM (#31237602)
You use the brakes to control loading on the front wheels to maximise grip. You need to control brakes and throttle to corner quickly.
Re:A case study of Toyota unintended acceleration and softwa... by tcoff91 on Monday May 02, 2022 @01:12PM (#31237909)
Yeah the trail braking part makes sense to me, but I can't think of why you'd be continuing to press the throttle when you're in the braking zone. Is this some kind of trick to prevent an automatic transmission from downshifting out of the power band while you're in the braking zone?
Re:A case study of Toyota unintended acceleration and softwa... by Toutouxc on Tuesday May 03, 2022 @01:24AM (#31244956)
Nope, OP wasn't even talking about "trail braking" but about poor-man's-LSD-braking.

When cornering hard, because of weight transfer, the inner wheel loses almost all traction, which makes it impossible to send any torque to it without wheel spin. This means that you can't really accelerate out of a sharp turn with an open-diff vehicle, because an open diff always sends the same torque to both wheels, i.e. if the inner wheel spins without much resistance, that resistance equals the torque sent to the outer wheel.

A poor-man's-LSD-solution to this is applying a bit of brakes while also giving it a lot of gas. The brakes prevent the inner wheel from spinning freely and add artificial resistance, which increases the torque available at the outer wheel.

Ideally you'd only want to apply the brake on the inner wheel, which is what some cars actually do automatically as a fake-LSD solution, but applying both and wasting engine power is better than nothing.

Re:A case study of Toyota unintended acceleration and softwa... by Jtsummers on Monday May 02, 2022 @01:03PM (#31237798)
> As an Arduino enthusiast I see statically allocated (global?) variables are frequently the way to go for an embedded system, the frontier is to be able to prove the correctness of what you're doing.

As a professional in the embedded and safety critical systems space: No, they aren't "the way to go". You often end up with a small number (think "singletons" for OO people) but the rest can be done properly with local variables or more limited scope variables instead of garbage global variables to manage complex system state.

Re:A case study of Toyota unintended acceleration and softwa... by LeifCarrotson on Monday May 02, 2022 @04:11PM (#31240261)
> The article also says that global variables will kill you, putting variables on the stack will kill you but doesn't say where it is safe to put variables. I can't imagine the heap is any better, that a garbage collector isn't going to pause and kill you, etc.

Function-scope static or file-scope static variables are the best place for variables in an embedded system written in C. They don't pollute the shared namespace, nor do they require allocation and de-allocation.

In an Arduino program, for example, you might have something like this, with a sketch.ino file:

    #include <stdint.h>
    #include "MyFile.h"
    
    uint32_t Bad_Global_Variable;
    
    // This doesn't conflict with same name in MyFile.cpp
    static uint8_t state = 1;
    
    void setup() {
       setup_myFile();
       state = 0;
    }
    
    void loop() {
      loop_myFile();
    }
a MyFile.h header:

    #ifndef _MY_FILE_H_
    #define _MY_FILE_H_
    
    #include <stdint.h>
    
    void setup_myFile(void);
    void loop_myFile(void);
    
    #endif // End include guard
and a MyFile.cpp library:

    #include "MyFile.h"
    static uint32_t MyFileScopeVariable = 0;
    
    // This doesn't conflict with same name in sketch.ino
    static uint8_t state = 0;
    
    void setup_myFile(void)
    {
      MyFileScopeVariable = 1;
      // Can't access or have conflicts with myFunctionScopeVariable here
      state = 1;
    }
    
    void loop_myFile(void)
    {
      static uint32_t myFunctionScopeVariable = 0;
      MyFileScopeVariable++;
      myFunctionScopeVariable++;
    }
Statically allocated variables are definitely the only the way to go.

Statically allocated global variables are easy and available, suitable for small embedded systems written by one person or a small group of collaborators who can be expected to know about every variable in the program or at least to be able to refactor their code if it collides with an existing name. Adding a prefix to your statically allocated global variables (eg. 'mf_state' for a global variable in the MyFile library above) is another way to reduce collisions, but isn't compiler-enforced.

Statically allocated file-scope or function-scope variables are a best practice in an automotive ECU scale projects, and can reduce issues if you've got lots of vendors each contributing code and not a lot of visibility between projects.

Re:A case study of Toyota unintended acceleration and softwa... by adolph on Monday May 02, 2022 @12:45PM (#31237520)
> If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

Mario, when you do this move, is your third foot on the clutch?

Heel-and-toe shifting is used before entry into a turn while a vehicle is under braking, preparing the transmission to be in the optimal range of rpm to accelerate out of the turn.

https://en.wikipedia.org/wiki/Heel-and-toe_shifting

Re:A case study of Toyota unintended acceleration and softwa... by gedy on Monday May 02, 2022 @12:08PM (#31236999)
> you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

There are vastly more people who are just bad drivers who use both feet like this out of poor skills or bad habit. Afaik this was the main cause of "unintended acceleration" with panicked drivers.

Re:A case study of Toyota unintended acceleration and softwa... by DakotaR on Monday May 02, 2022 @12:33PM (#31237381)
Besides driving manual on hills, I've had to use both feet to creep up oil change ramps.
Re:A case study of Toyota unintended acceleration and softwa... by throwaway0a5e on Monday May 02, 2022 @02:08PM (#31238637)
Or the "drive one way, hold brake, put it in the other gear, add some gas, release brake" trick for getting mildly stuck vehicles unstuck.
Re:A case study of Toyota unintended acceleration and softwa... by cameronh90 on Monday May 02, 2022 @12:55PM (#31237667)
That's what the handbrake is for.
Re:A case study of Toyota unintended acceleration and softwa... by DakotaR on Saturday May 14, 2022 @03:23AM (#31375808)
I hate that technique, maybe it's a motorcycle instinct to use the foot brake for finer control. But more importantly, the Mercedes I had to two-foot up onto the ramps didn't have a handbrake. My current car has hill assist but I still have to use two feet for backing up sharp hills.
Re:A case study of Toyota unintended acceleration and softwa... by Gordonjcp on Monday May 02, 2022 @12:26PM (#31237276)
> If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

No you won't.

> As an Arduino enthusiast I see statically allocated (global?) variables are frequently the way to go for an embedded system, the frontier is to be able to prove the correctness of what you're doing.

When you have 2kB of RAM to play with you haven't got a lot of stack or heap to sling function parameters around on, so it's Through The Looking Glass and you do it all backwards - everything goes in a global unless you have a really really good reason for having local scope (loop counters would be a good example).

Re:A case study of Toyota unintended acceleration and softwa... by ranger_danger on Tuesday May 03, 2022 @02:35AM (#31245371)
It doesn't say that global or stack variables will kill you, you're reading it wrong. Their problem was using excessive amounts of both, including corruption and accessing variables in very unsafe ways. There's nothing inherently wrong with either globals or stack space, and both are used heavily in even more critical software such as on space-grade parts.
Re:A case study of Toyota unintended acceleration and softwa... by quickthrowman on Monday May 02, 2022 @12:42PM (#31237479)
> If you're trying to go around corners as fast as possible in a front-wheel drive car you're going to drive with one foot on the brake and one foot on the gas and will apply the brakes and the gas at the same time.

If you’re going around corners as fast as possible in a front wheel drive car, sell it and buy an AWD or RWD car that doesn’t understeer.