Design Con 2015
Breaking News
Comments
Newest First | Oldest First | Threaded View
B. Benjaminson
User Rank
Manager
Re: No Process?
B. Benjaminson   4/7/2014 11:35:05 PM
NO RATINGS
@Alvie

If there is a proper safety critical engineering process in place, do you think it is even possible for Toyota engineers like this Mr. Ikura to be guessing why vehicles are misbehaving on the road, after the fact, and that their guesswork involves vehicle electrical systems?

Here is a quote from a Toyota internal email that is almost surely is in the possession of the DOJ, one among perhaps a hundred similar emails:

"This is Ikura from 2SE-6G.

-Is it possible that the RPMs rise due to radio wave interference? And what level are the European standards?

(Previously, when I was in charge of Hilux in the Japan domestic service division, I experienced an engine stall malfunction due to radio wave interference from a nearby U.S. Naval Base in Yokohama. At that time I was told that it could absolutely never occur.)

→ Frankly, I (2SE) really do not understand this.  At the very least, departments concerned with various electrical items must be gotten involved in a discussion."

****************

What could that "discussion" entail? 

I also find it astonishing that poor Mr. Ikura was treated to the same mind-bending response from his colleagues--basically, their claim that he did not experience what he experienced--in a weird echo of the treatment reported by many hundreds, even thousands, of Toyota's customers.

*******************

I have drafted a letter to a U.S. Senator to request an oversight review of the DOJ investigation scope. Anyone who wants to sign this letter with me can be in touch via my blog -- betsybenjaminson.blogspot.co.il

 

 

 

 

 

rob18767
User Rank
Manager
Safety critical systems
rob18767   4/1/2014 10:01:28 AM
NO RATINGS
It's not just the software though. Computer based train signalling and flight controls have redundancy in their systems. 

The software is developed using N version programming. They also use ADA (and even then asubset called SPARK ADA) for coding as it is much more strongly typed than a language like C. 

MISRA C is a much lower standard, without a certification process, than the true super safety critical systems found on aircraft and railways. 

 

rob18767
User Rank
Manager
Safety critical systems
rob18767   4/1/2014 10:01:25 AM
NO RATINGS
It's not just the software though. Computer based train signalling and flight controls have redundancy in their systems. 

The software is developed using N version programming. They also use ADA (and even then asubset called SPARK ADA) for coding as it is much more strongly typed than a language like C. 

MISRA C is a much lower standard, without a certification process, than the true super safety critical systems found on aircraft and railways. 

 

B. Benjaminson
User Rank
Manager
Toyota and industry standards
B. Benjaminson   4/1/2014 1:29:56 AM
Toyota's engineering documents on vehicle development and determining the causes of SUA (most of these were the same docs as the ones turned over to the DOJ) have been reviewed by experts who know those standards very well, and I can say with confidence they saw no evidence that Toyota was following the standards. One of them, a software expert who specializes in safety-critical software development, said that he was "shocked."

It bears noting that much of Toyota's code was written before ISO26262 was published.

Barr's testimony indicates that the MISRA-C standard was more relevant. But Toyota did not follow its rules either.

I saw many references to "Toyota Standards" but also instances where people inside Toyota were attempting to change test protocols or pass/fail criteria for the throttle or ECU (one such attempt came from a throttle supplier, and one such attempt came from Toyota to Denso), and these seemed to be based on cost considerations. "We lack sufficient budget, so can we please just test once instead of the prescribed X times?"

 

 

Alvie
User Rank
Blogger
No Process?
Alvie   3/31/2014 5:12:28 PM
NO RATINGS
Are you telling me that they did not follow even ISO26262/IEC61508 ?

I find it very hard (according to your analysis) that so many issues arise from firmware, when the process is so exhaustive.

Or, they did not follow any process at all. But they are required to, as far as I know. So I will assume a process was followed, but it [miserably] failed.

If this is the case, processes must be revised to minimize these things from happening. Although process is not itself a guarantee of high-quality, it is indeed a requirement for the high-quality to be achieved.

Alvie



Most Recent Comments
BinaryJudy
 
BinaryJudy
 
BinaryJudy
 
BinaryJudy
 
BinaryJudy
 
TonyTib
 
BinaryJudy
 
ROOMTEMPSC
 
jnissen
Top Comments of the Week
Flash Poll
Like Us on Facebook

Datasheets.com Parts Search

185 million searchable parts
(please enter a part number or hit search to begin)
EE Life
Frankenstein's Fix, Teardowns, Sideshows, Design Contests, Reader Content & More
Max Maxfield

Recommended Reads From the Engineer's Bookshelf
Max Maxfield
2 comments
I'm not sure if I read more than most folks or not, but I do I know that I spend quite a lot of time reading. I hate to be idle, so I always have a book or two somewhere about my person -- ...

Aubrey Kagan

Have You Ever Been Blindsided by Your Own Design?
Aubrey Kagan
37 comments
I recently read GCHQ: The uncensored story of Britain's most sensitive intelligence agency by Richard J. Aldrich. The Government Communication Headquarters (GCHQ), Britain's equivalent of ...

Martin Rowe

No 2014 Punkin Chunkin, What Will You Do?
Martin Rowe
2 comments
American Thanksgiving is next week, and while some people watch (American) football all day, the real competition on TV has become Punkin Chunkin. But there will be no Punkin Chunkin on TV ...

Rich Quinnell

Making the Grade in Industrial Design
Rich Quinnell
15 comments
As every developer knows, there are the paper specifications for a product design, and then there are the real requirements. The paper specs are dry, bland, and rigidly numeric, making ...

Special Video Section
The LT8640 is a 42V, 5A synchronous step-down regulator ...
The LTC2000 high-speed DAC has low noise and excellent ...
How do you protect the load and ensure output continues to ...
General-purpose DACs have applications in instrumentation, ...
Linear Technology demonstrates its latest measurement ...
10:29
Demos from Maxim Integrated at Electronica 2014 show ...
Bosch CEO Stefan Finkbeiner shows off latest combo and ...
STMicroelectronics demoed this simple gesture control ...
Keysight shows you what signals lurk in real-time at 510MHz ...
TE Connectivity's clear-plastic, full-size model car shows ...
Why culture makes Linear Tech a winner.
Recently formed Architects of Modern Power consortium ...
Specially modified Corvette C7 Stingray responds to ex Indy ...
Avago’s ACPL-K30T is the first solid-state driver qualified ...
NXP launches its line of multi-gate, multifunction, ...
Doug Bailey, VP of marketing at Power Integrations, gives a ...
See how to ease software bring-up with DesignWare IP ...
DesignWare IP Prototyping Kits enable fast software ...
This video explores the LT3086, a new member of our LDO+ ...
In today’s modern electronic systems, the need for power ...