Toyota's killer firmware

[juliog]

Pretty technical, but proof that so many car issues today come from bad software:

http://www.edn.com/design/automotive...s-consequences

[R.S-HawK]

Stack overflow. Toyota claimed only 41% of the allocated stack space was being used. Barr's investigation showed that 94% was closer to the truth. On top of that, stack-killing, MISRA-C rule-violating recursion was found in the code, and the CPU doesn't incorporate memory protection to guard against stack overflow.

A litany of other faults were found in the code, including buffer overflow, unsafe casting, and race conditions between tasks.

I would have expected better from Toyota.

And as a programmer, I find this embarrasing.

[RRnold]

Wow!!

[phrosty]

Reeks of expert testimony using a shotgun approach -- i.e. a bunch of "could-be"s versus a definite "this is what caused the issue".

Don't get me wrong, I have no doubt there are bugs -- programmers are far from perfect and even the best, most careful of practices lead to some bugs happening. Coding is hard

The correlative of this is that understanding someone else's code is hard -- I can look at someone's code and list off a ton of "could-be"s, when they've already taken care of the corner cases in some way that I'd only realize upon a deeper analysis.

Originally Posted by R.S-HawK

And as a programmer, I find this embarrasing.

The article was clearly not written by a programmer. I'd be curious to see the original technical document. This contains some very WTF wording that doesn't mean anything to a programmer:

Toyota missed some of the calls made via pointer, missed stack usage by library and assembly functions (about 350 in total), and missed RTOS use during task switching.

It lists a number of things which are not bugs, but merely describe a lack of safety nets to catch certain very specific types of bugs:

Toyota claimed the 2005 Camry's main CPU had error detecting and correcting (EDAC) RAM. It didn't.

...

Mirroring (where key data is written to redundant variables) was not always done.

...

Stack overflow. Toyota claimed only 41% of the allocated stack space was being used. Barr's investigation showed that 94% was closer to the truth. On top of that, stack-killing, MISRA-C rule-violating recursion was found

And some things here which could be bugs but the rest of the article leads me to think they just mean a potential for bugs -- this kind of code has been deemed attention-worthy by the software industry due to being difficult to get right and being the most common areas to find bugs:

A litany of other faults were found in the code, including buffer overflow, unsafe casting, and race conditions between tasks.

[suaveflooder]

time for an aftermarket tune!

[ft_sjo]

Originally Posted by suaveflooder

time for an aftermarket tune!

No. A tune does not touch any of this.

[fistpoint]

Originally Posted by phrosty

The correlative of this is that understanding someone else's code is hard -- I can look at someone's code and list off a ton of "could-be"s, when they've already taken care of the corner cases in some way that I'd only realize upon a deeper analysis.

Sounds like you are describing an inefficient programmer, partially what the article is saying.

[Anthony]

Originally Posted by suaveflooder

time for an aftermarket tune!

Originally Posted by ft_sjo

No. A tune does not touch any of this.

[PantsDants]

Originally Posted by ft_sjo

No. A tune does not touch any of this.

Exactly. My understanding is that all a tune does is change a bunch of constants (the spreadsheets/data tables of tuning parameters) that the ECU code passes into its functions to Do Things. (Is function the right term here? I come from the land of objects, I dunno about this low-level stuff.)

A tune has nothing to do with said functions nor can it change their implementation.

[ft_sjo]

Originally Posted by PantsDants

Exactly. My understanding is that all a tune does is change a bunch of constants (the spreadsheets/data tables of tuning parameters) that the ECU code passes into its functions to Do Things. (Is function the right term here? I come from the land of objects, I dunno about this low-level stuff.)

A tune has nothing to do with said functions nor can it change their implementation.

The flash (or multiples of) will contain program areas and data areas. Tuning typically affects the latter, however people like EcuTek bastardise the program area for their 'RaceROM' thing. It can lead to instability issues though, which was exhibited on our cars with the fuel gauge playing up, for example. I believe they pulled that code/hack now.

[ZZT86]

For a long time now Toyota has been ruled by Committee not Passion ! They still have an enviable reputation for design & build quality but it has been slipping . . . . unfortunately :/

[azian_advanced]

everytime i read "unintended acceleration" on the internet, i always think of this:
http://www.nasa.gov/topics/nasalife/...ota-study.html

[phrosty]

Originally Posted by fistpoint

Sounds like you are describing an inefficient programmer

Indeed. In my experience, programmers who don't write straightforward code outnumber the ones who do.

[Tromatic]

Originally Posted by suaveflooder

time for an aftermarket tune!

"Firmware" means hardware. You may be able to flash a new version of the firmware, but if the hardware itself is busticated there's not much you can do.

If I were Toyota, I'd be having a lawyer make a phone call about this headline:
Toyota's killer firmware: Bad design and its consequences