IEEE Technology and Society Magazine - December 2016 - 80

Can we completely rule out the theoretical possibility that under some circumstances, A, B, and C
could conceivably occur together, as improbable as
that may be? Maybe not. But the mere possibility that
this could theoretically happen is not enough to conclude "to a reasonable degree of engineering certainty" that this is the likely explanation for this accident.
(It is all the more improbable because the facts of the
accident suggest that B did not occur. Furthermore,
no reason was given why C would ever occur under
any circumstances.)

Can we completely rule out the
theoretical possibility that under
some circumstances, A, B, and C
could conceivably occur together...

The expert emphasized that the Brake Echo Check
fail-safe only acts if the driver steps on the brake or
releases the brake. He suggested that because of this,
if the driver's foot was already on the brake when Task
X supposedly died, the Brake Echo Check fail-safe
would not act to force the throttle to idle. [Testimony,
PDF pages 89, 135-136, 233-234]. As will be shown
below, this is irrelevant. If the driver's foot was on the
brake when Task X died, then there is no need for the
Brake Echo Check fail-safe, because the throttle would
already be at idle when Task X died, and braking would
stop the vehicle.

Alternative Theory Regarding
the Death of Task X
The jury was given an alternative theory that did not
rely on assumption B (the assumption that the throttle angle variable contained a large value when Task
X supposedly died). The expert replaced B with the
assumption that, in addition to the memory corruption that flipped the bit (hypothetical failure A), a
second memory corruption caused the throttle angle
variable to be overwritten with a large value.
The jury was told that memory corruptions are like
ricocheting bullets, such that a single memory corruption can affect multiple areas of memory. The alternative
theory thus requires either two independent memory
corruptions (one that flipped the bit and another that
overwrote the throttle angle variable with a large value),
or an initial memory corruption that somehow ended
up causing these two additional corruptions.

Let's examine both possibilities:
The occurrence of two independent memory corruptions is hypothetical. The first hypothetical corruption,
the bit flip, has already been addressed. Regarding
the corruption of the throttle angle variable, the
expert did not identify any evidence that such a corruption occurred prior to the accident, or under any
circumstances. Nor did he identify any specific bug in
the software that caused a corruption of that variable.
Instead, he speculated that the problems he claimed
to have identified in the software, which he speculated might cause the bit flip, might also cause the corruption of the throttle angle variable. No connection
was established between any of those claimed problems and the throttle angle variable.
■ The occurrence of an initial memory corruption
that somehow led to the two additional corruptions
is also hypothetical. The expert did not identify evidence of any initial corruption that led to any other
corruption, let alone to the two specific corruptions
as required. Nor did he identify any specific bug in
the software that caused such an initial corruption.
Furthermore:
I) Not all possible hypothetical memory corruptions
would necessarily lead to additional memory
corruptions.
II) No explanation was provided as to how the hypothetical bit flip could ever lead to a throttle angle
variable corruption, or vice versa, nor was any evidence provided that these two locations were near
each other in memory.
Thus, the alternative theory, which relies on one of
these two possibilities, is not credible as the likely explanation for the accident for at least the following reasons:
■

a2) Assuming Two Independent Corruptions
Because no evidence was presented and no specific
bugs were identified for either of these two hypothetical corruptions, it is reasonable to treat each as a
very low probability occurrence. The probability of
both occurring together, then, would be expected to
be extremely low.

b2) Assuming Two corruptions
that resulted from an initial corruption
Because no evidence was presented and no specific
bugs were identified for an initial hypothetical corruption leading to any other corruption, it is reasonable
to treat that as a very low probability occurrence. The
probability of that occurring, and then causing hypothetical corruption of not just one but two specific
locations, would be even lower. It would be lower still
for at least reason II above, and still lower for at least
the following additional reasons:

IEEE Technology and Society Magazine

∕

DECember 2016

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2016