IEEE Technology and Society Magazine - December 2016 - 82

ramp, which means the throttle was likely at idle (discussed in more detail later):
Q. And you understand that Ms. Bookout successfully
slowed her vehicle and exited on the exit ramp for
Texanna Road, correct?
A. I do.
Q. And you know that Ms. Bookout told us in her
deposition that she applied the brake to slow the
car so as to exit on Highway 69, do you understand that?
A. I do.
...
Q. And you understand that the exit ramp there from
the Highway 69 to Texanna Road is fairly long,
somewhere in the neighborhood of a thousand
feet or more?
A. That is about the distance I understand.
Q. It's your belief that the alleged unintended acceleration incident began somewhere on the exit
ramp, correct?
A. That's my understanding. [Testimony, PDF pages
223-224]

As with all non-trivial software,
there likely were bugs in the
defendant's software.

Unreliable Brake Echo Check Hypothesis
Descriptions of the intended operation of the Brake
Echo Check can be found in Testimony, PDF pages 135,
174, 225-226, and 245.
No evidence was presented to support the expert's
assertion that the Brake Echo Check was unreliable. He
testified that there were unspecified reasons why the
Brake Echo Check might not work as designed, but
never identified any such reasons or presented any supporting evidence. Furthermore, it worked as designed in
every test he discussed:
A. Just simply from my analysis of the source
code, there are several reasons. I put them in
my report my [sic] this brake echo check is
also nonreliable.
Q. And why is that?
A. There is some reasons why it's not - it's not designed
to be 100 percent reliable. There are several reasons,
I'd have to look at my report to refresh my memory.
[Testimony, PDF page 147] See also Slide 42.

A. In the limited testing that's been done within
the essentially infinite space of vehicle and
software states, it is true in that limited testing
the brake echo check has stepped in if her
foot was on the gas pedal and then she transitioned to the brake pedal. However, that
doesn't rule out that the brake echo would not
act for a number of reasons. [Testimony, PDF
page 225]
See also Testimony, PDF pages 233-234.
What's more, whether or not the Brake Echo Check
works reliably is irrelevant if the throttle was not open
when Task X supposedly died (and as discussed, the
throttle would likely have been at idle). If the throttle
was at idle, then the driver would have been able to
stop the car by braking.
Let's examine all 3 possible cases of driver foot position at the time of the hypothesized bit flip:
I) The driver's foot was pressing the gas pedal when
Task X supposedly died, or
II) the driver's foot was pressing the brake pedal when
Task X supposedly died, or
III) the driver's foot was on neither pedal when Task
X supposedly died.7
As shown below, case II would not require the
Brake Echo Check, and case III would only require
the Brake Echo Check if the supposed death of Task
X occurred during a small timing window. In all
cases, the driver would be able to stop the vehicle
by braking:
I) In this case, when the driver subsequently stepped
on the brake, the Brake Echo Check would have
forced the throttle to idle 200 ms later. This would
have ensured that the vehicle could be stopped by
braking.
II) In this case, the driver would have first taken her
foot off the gas pedal. Soon after that, Task X would
have executed (it executes multiple times per
second), recognized that the gas pedal was not
depressed, and set the throttle angle variable to
idle. By the time the driver stepped on the brake,
the throttle angle variable would be at idle. Then
when Task X supposedly died, the throttle angle
variable would be left at idle. Braking would have
stopped the vehicle, without requiring the Brake
Echo Check.8
7
The driver pressing both pedals simultaneously is explicitly excluded by
the expert. He assumed there was no "pedal misapplication, human mistake." [Testimony, PDF pages 187-188, and Slide 54.]
8
Theoretically it might be possible for the driver to take her foot off the gas
and then step on the brake so quickly that Task X does not have a chance
to execute between those 2 events. Whether this is possible would depend
on how frequently Task X executes and how long it takes to move one's
foot from the gas to the brake. If Task X executes every 8 ms, it would
seem impossible, based on studies of driver braking (e.g., [21]). In any
event, no argument was presented that this occurred.

IEEE Technology and Society Magazine

∕

DECember 2016

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2016