IEEE Technology and Society Magazine - December 2016 - 83

III)This is similar to the preceding case. Soon after
taking her foot off the gas, Task X would have
executed, recognized that the gas pedal was not
depressed, and set the throttle angle variable to
idle. When Task X supposedly died, the throttle
angle variable would be left at idle. Subsequent
braking would have stopped the vehicle, without
requiring the Brake Echo Check. There could be
a small timing window (milliseconds) between
when the driver takes her foot off the gas and
when Task X executes. If Task X were to die within
that timing window, before it had a chance to execute and set the throttle angle variable to idle,
then that is the same as Task X dying while the
driver was pressing on the gas, which is addressed
by case i.

Two Hypothesized Memory Corruptions
The expert presented the slide in Figure 3, and he testified as follows:
A. ... And so, either if task X is dead, you can get a
stuck throttle, which is the last calculated command, or the last computed one over here, or it
can change it to a corrupt value through an additional memory corruption.
...
Q. Does the task death of X in that scenario involving the throttle angle variable have to occur first
or after the memory corruption of the throttle
angle variable?
A. If they are close in time, the two memory corruptions are close in time, it could be an either/or. If
task X was dead for a while though, and then the
second memory corruption happened some time
later, then it could also happen that way. So if the
two corruptions happen close in time, which is
likely when you have memory corruption, often
it's not just a single - when it's a software bug or
even hardware bit flip, it can be ricochet and
bounce around like a bullet inside, and so it can
cause multiple memory locations to be damaged.
And so that can begin small and grow over time.
And so, if they both happen right about the same
time, it could be that the throttle command is
corrupted first and then the task dies. But there's
more time opportunity the other way [Testimony,
PDF pages 130-132] See also Testimony, PDF
page 56.
He did not identify specific evidence of any memory
corruption having occurred, let alone both specific corruptions (the bit flip and the overwriting of the throttle
angle variable) having occurred together. Nor did he
identify any specific bug that caused either of these
hypothesized corruptions.
DECember 2016

∕

FigUrE 3. Slide 37.

Related Testimony and Slides
There are a number of trial slides that apparently are
intended to provide evidence for the expert's accident
theories, but in fact they do not. For example:
■ Slide 20: This slide shows a test in which killing
Task X during cruise control "resume" resulted in
unintended acceleration until the brake was
pressed, because Task X is responsible for detecting when the cruise control set speed has been
reached [Testimony, PDF pages 81-82, 88, 260-
263]. This test is not relevant to the expert's accident theories, because by his own testimony,
cruise control was not enabled at the time of the
accident [Testimony, PDF page 223]. Furthermore,
this slide shows that even if Task X died during
cruise control "resume," stepping on the brake
would close the throttle via the Brake Echo Check
and stop the vehicle [Testimony, PDF pages 82-83,
88-89].
■ Slide 53: This slide shows a test in which the driver
had been pressing on both the brake and the accelerator for 20 seconds at the time Task X was killed
[Testimony, PDF pages 184-186]. It demonstrates
that if Task X dies while both pedals are pressed,
the Brake Echo Check would not close the throttle
until the driver took her foot off the brake. But this
is not what happened in this accident, according to
the expert's theories. As discussed previously, he
assumed there was no "pedal misapplication,
human mistake." Note also that the tests shown in
slides 20 and 53 are the only tests involving Task X
death presented by the expert.
■ Slide 49: This slide says that the expert found what
"NASA sought," including that a "single memory
corruption results in UA." Similarly, at Testimony
PDF page 193, when discussing single points of failure, the expert said "we've demonstrated that a single byte can cause a UA that can go on until you
run out of fuel." These statements do not accurately reflect the expert's accident theories, which
require more than just a single memory corruption.
As discussed previously, his first theory requires a
memory corruption (a specific bit flip) plus a simultaneous failure of the Brake Echo Check. And his
alternative theory requires the same memory

IEEE Technology and Society Magazine

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2016