Comment by romwell | Hacker News Reader

Comment by romwell | Hacker News Reader

Parent Full thread

This is just one of many kinds of redundancy. Please see [1] for several ways in which redundancy is manifested (e.g. triple modular redundancy).

Specifically, uncooperative systems running at the same time was exactly how fault tolerance was achieved on the space shuttle[2]:

>For true redundancy to take place, all computers must listen to all traffic on all buses, even though they might be commanding just a few. That way they know about all the data generated in the current phase. They must also be processing that data at the same time the other computers do. If there is a failure [...], since the Shuttle's other three computers are sending apparently correct commands to their actuators, the failed computer's commands are physically out-voted

That's just one example. There's no need for the definition of the word "redundancy" to be as narrow as you said.

[1]https://en.wikipedia.org/wiki/Redundancy_(engineering)

[2]https://history.nasa.gov/computers/Ch4-4.html

Redundancy definitely does not mean running two different conflicting systems. Three (identical) - that's a different story.

Why not, I have 2 different systems that detect an imminent impact in a wall, then if the systems do not agree you stop, if your main system is experimental then having the backup system that is using different tech then it seems obvious that is safer to stop, then analyze the cause of the conflict.

So if one of these fails, the car stops? That doesn't seem like redundancy.

If you walk into a store and don't see that it is being robbed at gunpoint, it would be very nice to hear the assailant ordering the cashier to empty the til. You have two chances to steer clear.

Either your eyes or ears may fail you now and again, but you're better off with both.

No?

Nothing wrong with having a chance to steer clear, but it strikes me as an odd reaction unless you live in a society where only the criminals can defend themselves.

The question is not about failing but detecting an obstacle and braking.

If one system detects an obstacle, stop the car. Even if this system was failing and the other wasn't detecting anything.

And if one system fail, yes the car should stop if it's not safe to drive with only one of them.

Seems like a way to fail safe, which is what you should want.

unless the obstacle appears half way through an intersection where only one direction stops?

In engineering we don't rely on our feeling. We have to actually have reason and evidence. You're approaching it as if the car should be moving at all costs, but the responsible engineering task is to keep the car moving unless the automated systems indicate that it's hazardous to others.

Yes, it's redundantly _safe_, which is the thing we actually care about. Safety is job #1. Well, not at Uber apparently.

There are trade-offs here, sometimes we might decide to take a very small risk, after weighing it up. A famous example is ETOPS. Unlike propeller engines, jet engines for airliners are ridiculously reliable once running. ETOPS (jokingly "Engines Turn Or Passengers Swim") is a scheme which over the past few decades has gradually allowed twin engine jets (which obviously just become over-engineered gliders if both their engines fail) to fly over oceans and other large distances with no airports, on the rationale that although total engine failure would probably be deadly without anywhere to put the plane down, two unrelated sequential engine failures are now so unlikely as to be overall negligible risk to the passengers.

But that needs a risk we understand. If you have no idea what the risk is, you can't make that trade, so redundantly safe systems are the obvious choice.

Did you skip the part where one of the system detects hitting a wall? Why is not the normal thing to slow down and stop? You will trust the experimental system that is in testing over a safer system?

It's called a failsafe. The failure mode should be the safest option; which is for the car to stop or slow until the human driver takes over.

But they aren't conflicting: they have the same goal (not running into stuff).

In fact, there's yet another different, redundant, potentially conflicting safety system: the human safety driver.

If only one were to trigger, it still wouldn't be a conflict.

And yeah, redundancy through using non-identical systems is very much a thing, and considered much safer than having two identical things (which might make the same mistakes).

Source: I've worked on ASIL D safety-critical automotive systems, where diverse redundant subsystems were actually a design criterion.

Reply on news.ycombinator.com