No announcements for seasoned flyers

On a recent trip on a plane equipped with personal inflight video screens for each seat, I decided to watch a movie quickly and then have a nap. So I started watching the movie right after settling into the seat, about 20 minutes before takeoff. I figured with that I would watch the 1:30 minute movie through the meal service and be ready for the nap about an hour into the flight. What I learned instead was a greater awareness of just how many announcements there are on a typical flight these days. That’s because the in-flight system paused the video with each announcement and put it through my noise cancelling headphones.

The many announcements included:

  • The routine ones about the process of takeoff. Door closing. Seatbelt sign on. Various blah-blah-blah
  • The huge array of safety announcements and instructions I’ve seen literally hundreds of times.
  • A very few useful announcements: Destination check, reasons for delay, updates on flight time.
  • Some possibly useful announcements (cell phones off now, OK to use electronics now.)
  • Ads: Join our frequent flyer program, get our frequent flyer card, shop from the duty free cart, buy meals, buy drinks (which did not even apply to those not in coach.)

The cacophony is getting worse, almost as bad as when you’re sitting in the terminal with the endless announcements. They know people hate that in the terminals and offer the paid lounge with no announcements, but I’ve said they should just use cell phones instead and give us peace. On Japanese Shinkansen, they also offer a “quiet car” with no announcements — it is up to you to set your own alarm to make sure you don’t miss your stop if you want to sleep or relax. The trains are so on-time you can do this.

How about doing something like this, at least on a modern airplane where you have a personal screen for each seat?  read more »

Travel notes from the Alps, Davos and elsewhere

I recently went to the DLD conference in Germany, briefly to Davos during the World Economic Forum and then drove around the Alps for a few days, including a visit to an old friend in Grenoble. I have some panoramic galleries of the Alps in Winter up already.

Each trip brings some new observations and notes.

  • For the first time, I got a rental car which had a USB port in it, as I’ve been wanting for years. The USB port was really part of the radio, and if you plugged a USB stick in, it would play the music on it, but for me its main use was a handy charging port without the need for a 12v adapter. As I’ve said before, let’s see this all the time, and let’s put them in a few places — up on the dashboard ledge to power a GPS, and for front and rear seats, and even the trunk. And have a plug so the computer can access the devices, or even data about the car.
  • The huge network of tunnels in the alpine countries continues to amaze me, considering the staggering cost. Sadly, some seem to simply bypass towns that are pretty.
  • I’ve had good luck on winter travel, but this trip reminded me why there are no crowds. The weather can curse you, and especially curse your photography, though the snow-covered landscapes are wonderful when you do get sun. Three trips to Lake Constance/Bodenzee now, and never any good weather!
  • Davos was a trip. While there was a lot of security, it was far easier than say, flying in the USA. I was surprised how many people I knew at Davos. I was able to get a hotel in a village about 20 minutes away.

On to Part Two  read more »

Off to BIL and TED

Tomorrow, I will be speaking on pre-Robocar technology at BIL an unconference that parallels the famous and expensive TED conference. This is in Long Beach, CA. Unconferences are fun, cheap and often as good as expensive conferences. I will also be attending a reception at TED tonight for Singularity University, which I lecture at, so I may see you if you’re at TED as well.

Last night’s EFF bash was a great success. Thanks to Adam Savage and all the others who made it go so well.

A road-trip travel agent

I’ll have many more observations about my recent trip to DLD, Davos and the Alps soon, but one thing I’ve decided I do want to find (or train) is a travel agent/helper who can assist well with unscheduled travel (ie. a road or railpass trip.)

With unscheduled travel, you don’t know in the morning where you will end up that night. You only figure it out later in the day. Sometimes you just drive until it starts getting late and then you pick where you will end the night. It’s hard (or expensive) to do this in high season but in low season you can always find a room, and I and many others like that sort of freedom.

So when you do pick where you want to end up you have a few options:

  1. You can have a guidebook or database (such as AAA in the USA) and phone around places until you get something you like
  2. You can hunt around for web access (better if you have a data plan on your phone) and use sites like TripAdvisor and the various booking search engines (like Kayak/Sidestep) to find a decent hotel at a good price.
  3. You can just drive into town and look for Vacancy/Zimmer Frei signs and go in and ask the price.
  4. You can find somebody to do this for you.

There are problems with all these approaches. Method 3 (especially using tripadivsor) helps you avoid turkey hotels and find the better values. However, the databases cover only a fraction of the hotels, and the online reservations systems also cover only a small fraction of hotels in an area. There will be better values out there. On the other hand, many hotels offer a better price through the internet than if you call them, or will charge even more if you just walk in.  read more »

Foresight Institute Conference this weekend, Homebrew Robots and Germany

This weekend is the Foresight Institute conference on molecular nanotechnology and AI. I am on the board of Foresight Institute and will be speaking on the latest developments in robocars at the conference, along with a raft of great speakers. If you are interested in futurist issues around AI, nanotech and other accelerating technologies, this is the longest running conference in the field and the place to be. The whole conference is just $175 and you can register for it here.

I will also be doing my general Robocar talk on Wednesday, February 24th at the “Homebrew Robotics Club” of Silicon Valley. This is a great group of people who hack robotics as a hobby, and it meets at the CMU building at NASA Ames Research Center. This event is free and open to the public.

Finally, in 2 weeks I will be attending the DLD 10 conference in Munich Germany, and may try to make my way into some parties at the World Economic Forum in Davos while doing a little Alpine road trip after DLD.

Note for those who can’t attend the Foresight conference, you can watch it stream live

Border Travel in an underpants bomber world

I just landed on a flight from Toronto to San Francisco. If you were inside the USA you may not have heard about the various crazy rules applied to travel to the USA, or at least not experienced them. While we were away the rules changed every day, and perhaps every hour.

Toronto was hit the hardest because it has the most flights to the USA of any airport in the world (with a few other Canadian airports not far behind.) Due to the busy border, you clear U.S. customs and immigration through their satellite office in Toronto, so your plane lands you at domestic gates in the USA, making connections far easier.

The USA started insisting on intimate pat-downs on all passengers and complete hand screening of all carry-ons. For a while there was even a regulation that passengers would have to sit in their seats with nothing on their laps (not blankets, not books, not computers) for the last hour of the flight. That got reverted to “pilot’s discretion” and in our case there was no talk of this.

The heavy search requirements brought Toronto’s heavy to-USA traffic to a standstill. Even with extra mounties pitching in, there was now way to get all those people through the terminal, so the CATSA brought in a near-ban on carry-ons. You could only carry on items from a short list. Notable things not on the list (ie. banned) included books, kid’s toys, lenses and various items people bring on not because they need them in flight, but because they are essential to their trip, or are fragile.

After a few days of reduced carry-ons, they got the processing down, as long as you got there 3 hours in advance, sometimes more. A real burden on 1 hour flights to New York, Boston or Washington. Still a burden on my 5 hour flight to SFO, since that was at 7am, meaning getting to the airport at 4am, (1am Pacific Time, about the time I would get to bed.)

The process included the fairly standard x-ray (with agents making various exceptions for people, generally allowing books that could be paged through and even some small knapsacks) with pat down only if you set off the alarm. Then, shortly after you started walking down the row of gates was a 2nd checkpoint. There you got a serious patdown that might remind you of a massage, and a complete hand inspection of everything in your bags. (I suggest they should let you pay extra for a real massage, which also of course detects anything on your body.) Many checks of ID and boarding pass and you are on your way.

There are many disturbing things about the reaction to the underpants bomber but a few stand out.

  • It is certain that the TSA and all other major agencies knew about the risk of somebody strapping explosives to their legs and taking them through the magnetometer. So a plan should have been in place long ago about what to do about it, and how to react at the first public incident.
  • In spite of this the agencies are out running around like chickens with their heads cut off, changing plans every day, no sign of forethought. Are they just testing the public to see what they will tolerate?
  • Lots of talk of thz scanners to see everybody naked. Is this a way to get those accepted, after people complained?
  • For Toronto, and most of the Canadian airports, a bad guy can quite readily drive just 90 minutes and go to another airport like Buffalo and get no special screening! While the public does not like this extra trek, it’s no burden to the terrorist to do this. Only the innocent are punished.
  • You could still smuggle your stuff inside a laptop, or a body cavity or several other places I noticed.
  • Keep this up and people will stop flying, and they will definitely go to airports like Buffalo.
  • As I have suggested before, appointments for security inspections are one answer to the 3 hour early arrival.
  • For me the worst thing was packing lenses in checked bag. I had to improvise protection for them. When such a rule is put in place by surprise over Christmas, you have to expect a lot of people brought stuff that they needed to carry on on the way back, even if they would not plan a new trip today expecting to carry on their fragiles.

With some irony, all this came after a lunch with Peter Watts. If you didn’t hear, Peter was crossing back into Canada at Port Huron/Sarnia and got pull over for exit inspection leaving the USA. Because he wasn’t a complete little sheep, he reports he was beaten up by the border patrol and now is charged with assaulting an officer. I really doubt he did those things, but the most disturbing thing are those who comment on the story saying it’s his fault for not being subservient enough. I understand the reasons for letting police do their jobs, but when you are just inspecting people driving out of the country, with no special reason to believe they are criminals or worthy of above average suspicion or anything but the presumption of innocence we are all owed, then there should be standards, and better defined rights for the subject of the inspections. If a person is not a known threat, why should they not get to ask questions about what is being done to them and their vehicle? Yes, one time in many thousands, an actual nasty criminal might do something odd and need to be set upon with force. It’s one of the risks people take doing an armed policing job. It can happen anywhere, any time. But must the people give up their rights and be complete sheep because of it?

Can’t we have a system where different situations suggest different levels of police control? Where the police, while they may have the power to give you orders and you have to obey without much chance to question, get in trouble if they abuse that power in a non-hostile situation? Where they have a simple way of explaining that they think the situation has escalated, and a way to declare it that we are taught in school to understand? So if the copy says, “I’m escalation — get on the ground now” you have to get on the ground, but the cop has to justify later why he escalated. Simply being a citizen who is mindful of his rights doesn’t seem much grounds for that.

Robocars of the future from 1958 and Google Tech Talk

You may have seen it already but it’s amusing to watch this encoding of a 1958 Disney show on the highway of the future:

This highway features a mixture of human driven cars, robocars and PRT style robocars on private guideways. Much of it is typical of ancient predictions of the future, with an expectation of remarkably cheap and strong materials and portable atomic power, but some of it is on the mark (like urban sprawl.) The roles of mom and dad don’t change in 50 years. It is always humbling to go back into the past and see how futurists have got it wrong, and wonder where you are going wrong in your own predictions. (I’ve learned you should never predict dates for things because while you might have a sense about how long it would take to develop the technology, you can’t as easily predict how markets and governments will react.)

However, I will be prognosticating again next week, giving my Robocar talk in the Google “Tech Talk” series at Google HQ in Mountain View on Dec 14 at 11am. While not generally open to the public, I can bring in guests if they all come in at around 10:30am. Contact me if this is of interest. They will put the talk up on Google Video when done. Of course, if you are a Googler, I hope to see you there.

It’s amusing to note that many of the vision seen in the movie “Minority Report” are found in this Disney video from much earlier.

911 should be able to stop a train

It was over 5 years ago that I blogged about a robot that would travel in front of a train to spot cars stuck on the tracks in time to stop.

I recently read a local story about an RV that was demolished while stuck on the tracks here. The couple had time to talk to 911, who told them to get out, and it’s not clear from the story but it seems like a moderate amount of time may have passed (a couple of minutes) before their RV was smashed.

Here’s what should happen, and perhaps it does happen in some places:

  1. The 911 service should receive GPS and cell tower location on the caller. The moment the caller indicates they are stuck on the tracks, the 911 operator should push a button which figures out which tracks it might be and which trains might be approaching that crossing.
  2. Ideally trains are reporting their location with GPS as some do, but schedules can be used, or all trains anywhere near the area can be alerted.
  3. Signal lights close to the crossing should immediately go red, and cell phones of operators on the relevant trains should be called, and the computer or 911 operator can indicate which crossing is blocked. If the engineer is approaching that crossing they can emergency brake.

This can be enhanced a few ways:

  • Each crossing can have a big sign, “If stuck, get out of vehicle immediately, clear track (show direction) and call 911, and give this crossing number NNN.” The crossing number would work even if GPS and cell towers don’t locate the crossing.
  • Alternately, there could be a 10 digit phone number, different for each crossing. There is, however, some risk of abuse and false reports. You don’t want a war dialing telemarketer to stop trains. An operator may still need to confirm.
  • As noted, the sign should try to tell people to clear to the area slightly “upstream” (ie. towards the oncoming train, but not on the tracks, obviously.) That’s because when the train hits the car it throws it sideways and forward, never backwards along the path the train came from.
  • If you don’t see or hear a train, it makes slight sense to get out and call while walking so the call comes sooner. If you can see the train they can see you and it’s probably too late anyway. But human safety is more important.
  • The trains may have another way to reach the engineer, such as a private radio system, but just having a cell phone on each train (plus knowing trains staff personal cell phones and calling all of them) seems like a quick and easy solution. The cell in the train can have a very loud and flashing ringer, especially if it’s an emergency call.

It takes a long time to stop a train, but I bet most vehicles that get stuck on the tracks are stuck minutes before the train comes.

Can we stop electric cars from playing music for safety?

I struck a nerve several years ago when I blogged about the horrible beep-beep noise made by heavy equipment when it backs up. Eventually a British company came up with a solution: a pulsed burst of white noise which is very evident when you are near the backing up vehicle but which disperses quickly so it doesn’t travel and annoy people a mile away as the beeps do.

Now I am seeing more and more suggestions that electric cars, which run quite silently when slow, make some noise for safety. This is fine, but there are also suggestions that there will be music and vanity noises, like ringtones or “cartones.” I can certainly see why this would appeal to people. (Already many think that their car is the place to play mind-numbing bass to announce musical taste to all others on the street.) There are even proposed laws.

While the cartones would be quieter than the backup beep or the heavy bass, I really fear that people will overdo what they think is the purpose — being attention grabbing. They will want to distract, and that will create a cacophony on the roads. It’s hard to make sounds that are meant to be attention grabbing (or vanity oriented) not travel beyond the range that you need them for safety.

I don’t want to imagine what it might be like living as I do with a 3-way stop outside my window, with each car singing a different tune or strange noise every time it slows down and starts up again. Who will want to live near intersections or parking lots?

I have a few proposals:

  1. Like the beep-beep solution, use white noise that just doesn’t travel very far, but is easily noticed when close.
  2. Use natural sounds, like waves crashing, birds chirping, wind blowing. We are tuned to hear those sounds in an otherwise silent environment, but our brains also can easily ignore them in background form.
  3. Do indeed tune the volume based on ambient noise. This is suggested in the O’Reilly article linked above. They propose it to be loud enough. It should also be quiet enough.
  4. Don’t do it at a speed where the tires and wind and electric motors are making enough noise already.
  5. As robocar sensors become more common, such as LIDAR and radar, only make the noise when there are people who might come in contact with the vehicle. Otherwise, be silent.
  6. Since robocars will not hit people in any normal operation, even people who don’t know they are there, such vehicles need not make any noise. HOwever, if they see a human or anything else on a collision course, let them make a more loud and useful noise that really gets attention, like a burst of white or pink noise, or even a horn if they ignore that. Start quiet, get louder if it is not reacted to in a human reaction time.

Let’s not give up on this opportunity to return peace to our public spaces as electric cars and robocars become popular.

Computerized road trains in Europe

A proposal is being floated in Europe for computerized convoys or road trains within the next decade. This is a proposal for a system where cars can hand over control to a lead car and follow in a train or convoy, without physical connection.

This idea comes up a lot as an early robocar technology. It is particularly common because it’s much easier to do — a human driver still is in charge, and the robotic control is limited to a very limited and simple environment. It’s safe to say that we could make this work very quickly if we wanted to. There is no navigation or vision required, no recognition of obstacles, no choice of speeds or turns. Cars that come together in a convoy can draft to get a serious boost in fuel efficiency, and of course the un-drivers can now relax and read or work on the trip.

As a robocar booster, people are surprised when I say I am not too thrilled about this idea, at least as an early technology. Rather I think it’s a great idea for later. In spite of the enthusiasm with which I write, the robocar problem is not a simple one. This much simpler problem is tempting but has some snags.

First of all, if you have a bug in a standalone robocar system, it may cause an accident, and that may injure or kill the occupants of the robocar, and perhaps one or two other cars. Death is less likely at urban speeds of course. A problem with a computerized convoy could have terrible results, involving scores of cars. Since most people want this for the highway, the problem would also occur at lethal speed. Convoys are just not the first place we want to test our systems and have our first accidents.

Secondly, forming convoys requires a critical mass of suitably equipped cars. Of course, you don’t need a dozen full robocars to make a train, all you would need is cars with drive-by-wire and some much simpler control circuitry. But even so, the incentive to get a car with this feature has to get over a critical mass hump if it’s going to be worthwhile. It’s not quite as bad as fully ad-hoc trains, since you can have scheduled trains, lead by a bus or truck driver, and cars can see such a lead vehicle and get in behind it. But at first, the odds of many cars all finding one another at the same time is low. If the train is going faster than regular traffic in a carpool lane, as we hope it would, it will not be easy to join a train that moves past you on the highway. If it moves slower than traffic, it is easy to slow down and join it, but then it has to move slower, with all the attendant problems.

Computerized convoys have advantages and disadvantages over physical ones. Physical ones probably can only be formed while stopped, and probably only unformed that way too. One could see the last car in a physical convoy undocking while moving, so with correct ordering it might work out, but it’s a far cry from a virtual convoy which allows anybody to join and leave at any time.

Physical convoys however can transmit power. This is useful if you expect people to be driving short-range electric cars. They would take their short range car and join a convoy, and be powered by the lead locomotive while operating, and even be recharging a bit. After dispersion, the vehicles would only need to go a short destination to their target and back to the evening train.

Physical coupling makes it harder for one car to leave the train due to a failure. On the other hand it means that if the lead car wants to change lanes, all cars must do so. If the lead car leaves the road, they all do. Jack-knifing is a real worry, which is one reason that today even cargo road trains are limited to 2 trailers in urban areas, and 3 trailers in rural areas, if they are allowed at all.

Physical coupling requires specially modified vehicles. This is even more the case if the locomotive will actually be towing the vehicles physically rather than providing them with electricity for their motors and batteries. Either of these is a major modification, while virtual coupling only requires a drive-by-wire car and a small matter of programming.

Even full robocars probably should not form convoys right away. We should wait until our confidence is even higher, in spite of the fuel savings. If one car goes bad, or its occupants try to take over and move to manual driving, the consequences could be nasty in any convoy. And of course, the first robocars on the road will never get to join convoys as they will not meet the others. That’s why you need to solve the solo navigation problem first, and then you get enough on the road to work on the cooperation problems.

Robocar Talk, Volvo automatic pedestrian avoidance

First: I will be speaking on robocars tomorrow, Tuesday Nov 9, at 6:30 pm for the meeting of the Jewish High Tech Community in Silicon Valley. The talk is at 6:30pm at the conference center of Fenwick and West at Castro & California in Mountain View. The public is welcome to attend, there is a $10 fee for non-members. This will be similar to my talk at Stanford 2 weeks ago, and a bit more extensive than the one in New York early in October, which Forbes said was the audience favorite at the event.

Volvo has built a brand around safe cars, and last year committed that nobody would die in a newer Volvo by 2020. They plan to do much of this with better passenger safety systems, akin to the work they have done on airbags and crumple zones. However, they also intend to use a lot of computerized technologies to make it happen. Other teams are pushing to expand the goal inside Volvo to also stop people from being killed by Volvos. To that end, next year’s Volvo S60 will come with a “Pedestrian Avoidance System” which uses a camera and machine vision to identify pedestrians and calculate if the vehicle is about to hit one. If it sees a potential pedestrian collision it will beep and alert the driver. If the driver does nothing, the car will brake.

Here is a video of the S60 in action:

It’s impressive, though pure machine vision suffers problems as lighting changes, which is one reason most work recently has been on LIDAR. It’s also interesting to see if they will be able to avoid making it too conservative. If the warning goes off all the time, even for a pedestrian who will (to the human eye) clearly slide by the side of the car at places like a crosswalk, drivers may learn to ignore the alarm, or get very annoyed and shut the whole system off it it brakes for them when they know an impact is not imminent. I’m hoping to learn more about Volvo’s efforts in the future. No other company has put as much effort into building a brand around safety, so we can expect Volvo, which has slipped in this status of late, to work very hard to maintain it and adapt robocar technologies to safer human driving and fully autonomous driving as well.

Dense triple parking

I have written of a simple algorithm to allow dense Valet style parking of robocars, such as triple parking on the roadsides. In this algorithm, one gap is left in the outer lanes, and the Robocars are able to move together, as an entire row segment, to “move the gap” as quickly as a single car can move. That way, if a car needs to get out from an inner lane, it can signal, and if the gap is currently ahead of it, for example, all the cars from the one next to it to the gap can move forward one space (at the same time) to put the gap next to the vehicle that needs to leave. This can happen in all the other rows and is easy, quiet and efficient for electric cars. It does not even need radio communication, as robocars will sense a car moving behind them or ahead of them, and immediately move in reaction. This request will move up the chain of cars to the gap. Of course, if one car does not move, the car behind it will only move a very short distance before refusing to go further, which would stop the whole effort (or in the case of an error, cause a very slow impact if the car behind keeps coming) and signal a need for human attention.

It seems like this should be possible even without many gaps, as long as there is enough spare space to allow a vehicle to wiggle out of its space. If there is just one gap, and a bit of wiggle room in the other rows, any car can still get out, just a bit more slowly. This is probably better done with a protocol for communication to assure it works quickly.

In this case, a gap on the outside lane (where there must be at least one) can be temporarily moved to the inside, and then back out. Consider 3 lanes of cars, with a gap in the outer late (lane #3) and a car in lane #1 (the curb lane) wanting out. First the lane #3 cars would adjust to move the gap to the right place, a bit forward of our target car. Next, a car from lane #2 would move into this gap, leaving a gap in lane #2 into which our target car can move. This leaves a gap in lane #3 which can be filled by a car from lane #2 which is willing to move in, ideally right next to our target car. Likewise a car from lane #3 can now move into that gap, and the resulting gap in the outer lane #3 can be moved to allow exit by our target car.

This requires a great deal more car moving, though again with electric cars this may not be too expensive. If the cars can turn all their wheels, they can move horizontally as some concept cars can already do. Even without that, a robotic car can wiggle out without much room, and of course the gap would not be placed exactly in place with the target car, but probably slightly forward to allow transfer with fewer wiggles. The result is a whole valet lot with just one blank space needed to get any car reasonably quickly. Of course, this would only be done when the lot needed to be totally full. For any partially full lot, gaps would be left to minimize the car moves needed to get any car out. However, if space is at a premium — so much so as to justify the extra moving — it can be done.

Software recalls and quick fixes to safety-critical computers in robocars

While giving a talk on robocars to a Stanford class on automative innovation on Wednesday, I outlined the growing problem of software recalls and how they might effect cars. If a company discovers a safety problem in a car’s software, it may be advised by its lawyers to shut down or cripple the cars by remote command until a fix is available. Sebastian Thrun, who had invited me to address this class, felt this could be dealt with through the ability to remotely patch the software.

This brings up an issue I have written about before — the giant dangers of automatic software updates. Automatic software updates are a huge security hole in today’s computer systems. On typical home computers, there are now many packages that do automatic updates. Due to the lack of security in these OSs, a variety of companies have been “given the keys” to full administrative access on the millions of computers which run their auto-updater. Companies which go to all sorts of lengths to secure their computers and networks are routinely granting all these software companies top level access (ie. the ability to run arbitrary code on demand) without thinking about it. Most of these software companies are good and would never abuse this, but this doesn’t mean that they don’t have employees who can’t be bribed or suborned, or security holes in their own networks which would let an attacker in to make a malicious update which is automatically sent out.

I once asked the man who ran the server room where the servers for Pointcast (the first big auto-updating application) were housed, how many fingers somebody would need to break to get into his server room. “They would not have to break any. Any physical threat and they would probably get in,” I heard. This is not unusual, and often there are ways in needing far less than this.

So now let’s consider software systems which control our safety. We are trusting our safety to computers more and more these days. Every elevator or airplane has a computer which could kill us if maliciously programmed. More and more cars have them, and more will over time, long before we ride in robocars. All around the world are electric devices with computer controls which could, if programmed maliciously, probably overload and start many fires, too. Of course, voting machines with malicious programs could even elect the wrong candidates and start baseless wars. (Not that I’m saying this has happened, just that it could.)

However these systems do not have automatic update. The temptation for automatic update will become strong over time, both because it is cheap and it allows the ability to fix safety problems, and we like that for critical systems. While the internal software systems of a robocar would not be connected to the internet in a traditional way, they might be programmed to, every so often, request and accept certified updates to their firmware from the components of the car’s computer systems which are connected to the net.

Imagine a big car company with 20 million robocars on the road, and an automatic software update facility. This would allow a malicious person, if they could suborn that automatic update ability, to load in nasty software which could kill tens of millions. Not just the people riding in the robocars would be affected, because the malicious software could command idle cars to start moving and hit other cars or run down pedestrians. It would be a catastrophe of grand proportions, greater than a major epidemic or multiple nuclear bombs. That’s no small statement.

There are steps that can be taken to limit this. Software updates should be digitally signed, and they should be signed by multiple independent parties. This stops any one of the official parties from being suborned (either by being a mole, or being tortured, or having a child kidnapped, etc.) to send out an update. But it doesn’t stop the fact that the 5 executives who have to sign an update will still be trusting the programming team to have delivered them a safe update. Assuring that requires a major code review of every new update, by a team that carefully examines all source changes and compiles the source themselves. Right now this just isn’t common practice.

However, it gets worse than this. An attacker can also suborn the development tools, such as the C compilers and linkers which build the final binaries. The source might be clean, but few companies keep perfect security on all their tools. Doing so requires that all the tool vendors have a similar attention to security in all their releases. And on all the tools they use.

One has to ask if this is even possible. Can such a level of security be maintained on all the components, enough to stop a terrorist programmer or a foreign government from inserting a trojan into a tool used by a compiler vendor who then sends certified compilers to the developers of safety-critical software such as robocars? Can every machine on every network at every tool vendor be kept safe from this?

We will try but the answer is probably not. As such, one result may be that automatic updates are a bad idea. If updates spread more slowly, with the individual participation of each machine owner, it gives more time to spot malicious code. It doesn’t mean that malicious code can’t be spread, as individual owners who install updates certainly won’t be checking everything they approve. But it can stop the instantaneous spread, and give a chance to find logic bombs set to go off later.

Normally we don’t want to go overboard worrying about “movie plot” threats like these. But when a single person can kill tens of millions because of a software administration practice, it starts to be worthy of notice.

New Robocar center at Stanford, Audi TT to race up Pikes Peak

Saturday saw the dedication of a new autonomous vehicle research center at Stanford, sponsored by Volkswagen. VW provided the hardware for Stanley and Junior, which came 1st and 2nd in the 2nd and 3rd Darpa Grand Challenges, and Junior was on display at the event, driving through the parking lot and along the Stanford streets, then parking itself to a cheering crowd.

Junior continues to be a testing platform with its nice array of sensors and computers, though the driving it did on Saturday was largely done with the Velodyne LIDAR that spins on top of it, and an internal map of the geometry of the streets at Stanford.

New and interesting was a demonstration of the “Valet Parking” mode of a new test vehicle, for now just called Junior 3. What’s interesting about J3 is that it is almost entirely stock. All that is added are two lower-cost LIDAR sensors on the rear fenders. It also has a camera at the rear-view mirror (which is stock in cars with night-assist mode) and a few radar sensors used in the fixed-distance cruise control system. J3 is otherwise a Passat. Well, the trunk is filled with computers, but there is no reason what it does could not be done with a hidden embedded computer.

What it does is valet park itself. This is an earlier than expected implementation of one of the steps I outlined in the roadmap to Robocars as robo-valet parking. J3 relies on the fact the “valet” lot is empty of everything but cars and pillars. Its sensors are not good enough to deal well with random civilians, so this technology would only work in an enclosed lot where only employees enter the lot if needed. To use it, the driver brings the car to an entrance marked by 4 spots on the ground the car can see. Then the driver leaves and the car takes over. In this case, it has a map of the garage in its computer, but it could also download that on arrival in a parking lot. Using the map, and just the odometer, it is able to cruise the lanes of the parking lot, looking for an empty spot, which it sees using the radar. (Big metal cars of course show clearly on the radar.) It then drives into the spot.

 read more »

Nissan emulates school of fish, and Singularity Summit Robocar notes

Some time ago I proposed the “School of Fish Test” as a sort of turing test for robocars. In addition to being a test for the cars, it is also intended to be a way to demonstrate to the public when the vehicles have reached a certain level of safety. (In the test, a swarm of robocars moves ona track, and a skeptic in a sportscar is unable to hit one no matter what they do, like a diver trying to touch fish when swimming through a school.)

I was interested to read this month that Nissan has built test cars based on fish-derived algorithms as part of a series of experiments based on observing how animals swarm. (I presume this is coincidental, and the Nissan team did not know of my proposed test.)

The Nissan work (building on earlier work on bees) is based upon a swarm of robots which cooperate. The biggest test involves combining cooperating robots, non-cooperating robots and (mostly non-cooperating) human drivers, cyclists and pedestrians. Since the first robocars on the road will be alone, it is necessary to develop fully safe systems that do not depend on any cooperation with other cars. It can of course be useful to communicate with other cars, determine how much you trust them, and then cooperate with them, but this is something that can only be exploited later rather than sooner. In particular, while many people propose to me that building convoys of cars which draft one another is a good initial application of robotics (and indeed you can already get cars with cruise control that follows at a fixed distance) the problem is not just one of critical mass. A safety failure among cooperating cars runs the risk of causing a multi-car collision, with possible multiple injured parties, and this is a risk that should not be taken in early deployments of the technology.

My talk at the Singularity Summit on robocars was quite well received. Many were glad to see a talk on more near-future modest AI after a number of talks on full human level AI, while others wanted only the latter. A few questions raised some interesting issues:

  • One person asked about the insurance and car repair industries. I got a big laugh by saying, “fuck ‘em.” While I am not actually that mean spirited about it, and I understand why some would react negatively to trends which will obsolete their industries, we can’t really be that backwards-looking.
  • Another wondered if, after children discover that they nice cars will never hit them, they then travel to less safe roads without having learned proper safety instincts. This is a valid point, though I have already worried about what to do about the disruption to passengers who have to swerve around kids who play in the streets when it is not so clearly dangerous. Certain types of jaywalking that interfere with traffic will need to be discouraged or punished, though safe jaywalking, when no car is near, should be allowed and even encouraged.
  • One woman asked if we might become disassociated with our environments if we spend our time in cars reading or chatting, never looking out. This is already true in a taxicab city like New York, though only limos offer face-to-face chat. I think the ability to read or work instead of focus on the road is mostly a feature and not a bug, but she does have a point. Still, we get even more divorced from the environment on things like subways.

As expected, the New York audience, unlike other U.S. audiences, saw no problem with giving up driving. Everywhere else I go, people swear that Americans love their cars and love driving and will never give it up. While some do feel that way, it’s obviously not a permanent condition.

Some other (non-transportation) observations from Singularity Summit are forthcoming.

BTW, I will be giving a Robocar talk next Wednesday, Oct 28 at Stanford University for the ME302 - Future of the Automobile class. (This is open to the general Stanford community, affiliates of their CARS institute, and a small number of the public. You can email if you would like to go.)

European intelligent vehicle test

Robocar news:

This press release describes a European research project on various intelligent vehicle technologies which will take place next year. As I outline in the roadmap a number of pre-robocar technologies are making their way into regular cars, so they can be sold as safer and more convenient. This project will actively collect data to learn about and improve the systems.

Today’s systems are fairly simple of course, and will learn a lot from this. This matches my prediction for how a robocar test suite will be developed, by gathering millions and later billions of miles of sample data including all accidents and anomalous events, over time with better and better sensors. Today’s sensors are very simple of course but this will change over time.

Initial reaction to these systems (which will have early flaws) may colour user opinion of them. For example, some adaptive cruise controls reportedly are too eager to decide there is a stopped car and will suddenly stop a vehicle. One of the challenges of automatic vehicle design will be finding ways to keep it safe without it being too conservative because real drivers are not very conservative. (They are also not very safe, but this defines the standards people expect.)

Text me if you lose my luggage

Just back from a weeklong tour including speaking at Singularity Summit, teaching classes at Cushing Academy and a big Thanksgiving dinner (well, Thanksgiving is actually today but we had it earlier) and drive through fabulous fall colour in Muskoka.

This time United Airlines managed to misplace my luggage in both directions. (A reminder of why I don’t like to check luggage.) The first time the had an “excuse” in that we checked it only about 10 minutes before the baggage check deadline and the TSA took extra time on it. The way back it missed a 1 hour, 30 minute connection — no excuse for that.

However, again, my rule for judging companies is how they handle their mistakes as well as how often they make them. And, in JFK, when we went to baggage claim, they actually had somebody call our name and tell us the bag was not on the flight, so we went directly to file the missing luggage report. However, on the return flight, connecting in Denver to San Jose, we got the more “normal” experience — wait a long time at the baggage claim until you realize no more bags are coming and you’re among the last people waiting, and then go file a lost luggage report.

This made me realize — with modern bag tracking systems, the airline knows your bag is not on the plane at the time they close the cargo hold door, well before takeoff. They need to know that as this is part of the passenger-to-bag matching system they tried to build after the Pan Am 103 Lockerbie bombing. So the following things should be done:

  • If they know my mobile number (and they do, because they text me delays and gate changes) they should text me that my luggage did not make the plane.
  • The text should contain a URL where I can fill out my lost luggage report or track where my luggage actually is.
  • Failing this, they should have a screen at the gate when you arrive with messages for passengers, including lost luggage reports. Or just have the gate agent print it and put it on the board if a screen costs too much.
  • Failing this, they should have a screen at the baggage claim with notes for passengers about lost luggage so you don’t sit and wait.
  • Failing this, an employee can go to the baggage claim and page the names of passengers, which is what they did in JFK.
  • Like some airlines do, they should put a box with “Last Bag, Flight nnn” written on it on the luggage conveyor belt when the last bag has gone through, so people know not to wait in vain.

I might very well learn my luggage is not on before the plane closes the door. In that case I might even elect to not take the flight, though I can see that the airline might not want people to do this as they are usually about to close the door, if they have not already closed it.

Letting me fill out the form on the web saves the airline time and saves me time. I can probably do it right on the plane after it lands and cell phone use is allowed. I don’t even have to go to baggage claim. Make it mobile browser friendly of course.

Events: Randall Monroe (xkcd) tonight in SF, Singularity Summit Oct 3-4 in NYC

Two events I will be at…

Tonight, at 111 Minna Gallery in San Francisco, we at EFF will be hosting a reading by Randall Monroe, creator of the popular nerd comic “xkcd.” There is a regular ticket ($30) and a VIP reception ticket ($100) and just a few are still available. Payments are contributions to the EFF.

In two weeks, on Oct 3-4, I will be speaking on the future of robot cars at the Singularity Summit in New York City. Lots of other good speakers on the podium too.

See you there…

Are Frequent Flyer Mile credit cards a good idea?

I just decided to cancel my AAdvantage credit card for a 1% cashback card with no annual fee. Many people have the frequent flyer cards so let’s consider the math on them. They typically come with a high annual fee (around $80) while other cards have no fee and other rewards.

Let’s say you spend $25,000 per year on the card, which is enough for 25,000 miles or one domestic flight on the typical airline. With a typical cashback card you get 1% back though some cards give 2% or even 4% back on certain classes of purchases. I have an Amex from Costco that gives 3% on gasoline and 2% on travel expenses, but Amex is not as accepted as Visa or MC.

  • Your cash cost for the 25K miles is $250 plus the $80 annual fee = $320
  • There are varying taxes and fees on award tickets, as low as $8 but sometimes much higher
  • If you are booking less than 3 weeks in advance, fees of $50 to $100 will apply
  • Finding available award seats can be quite difficult, the supply is far lower than for cash seats in most cases. There are also blackouts.
  • You will not receive miles for your trip. A typical cross-country return is 5,000 miles, of $50 at the 1% rate, $80-$100 at the rate airlines claim
  • Most people use miles long after they earn them, and in fact have a large balance. So a time discount should apply. Miles sitting in accounts earn no interest, cash does.

As such the free trip is harder to get and costs $400 to $500. But that is not far from (and sometimes more than) the cash price of a ticket. But cash is of course a much more flexible thing — you can use it for anything, not just airline tickets. There are a raft of cards out there now which tout “miles on any airline” and what they really give you is a 1% cashback that is only good on airlines. General 1% cashback is much better.

There is an argument that upgrades do much better. Upgrading with miles can be cheaper than upgrading with cash, since the cash price of business class seats is very high. However, as you learn if you are not a top elite flyer, upgrades are quite hard to get. Others are ahead of you in line. AA also instituted a cash co-pay on upgrades making them more expensive than before when done with miles.

If you spend less than $25K per year on the card, the math gets even worse. At $12.5K per year, you gave up at least $460 to $550 for your free ticket, and when the tickets are available on miles, the cash fare is often lower. If you spend much more a year, the cost may make some sense.

A common trick for people who have mileage cards is to pick up group checks at restaurants and have everybody pay you cash. However, the cards that give 3% cashback at restaurants like the Amex are much better for this.

RV daisy chain power grid

After every RV trip (I’m back from Burning Man) I think of more I want RVs to do. This year, as we have for many years, we built a power distribution system with a master generator rather than having each RV run its own noisy, smelly and inefficient generator. However, this is expensive and a lot of work for a small group, it is cheap and a lot of work for a larger group.

There’s been a revolution in small generator design of late thanks to the declining cost of inverters and other power conversion. A modern quality generator feeds the output of its windings to circuits to step up and step down the voltage to produce the required power. The output power is cleaner and more stable, and the generator is spun at different RPMs based on the power load, making it quieter and more efficient. With many models, you can also combine the internal output of two generators to produce a higher power generator.

RVs have come with expensive old-style generators that are quieter than cheap ones, and which produce better power, but today they are moving to inverter generators. With an inverter generator, it’s also possible to draw on the RV batteries for power surges (such as starting an AC or microwave) beyond what the generator can do.

I’m interested in the potential for smarter power, so what I would like to see is a way for a group of RVs with new generation power systems to plug together. In this way, they could all make use of the power in the other vehicles, and in most cases only a fraction of the generators would need to be running to provide power to all. (For example, at night, only one generator could power a whole cluster. In the day, with ACs running, several would need to run, but it would be very unlikely to have to run all, or even 75% of them.)  read more »

RV water tank should have UV disinfector

RVs all have a fresh water tank. When you rent one, they will often tell you not to drink that water. That’s because the tanks are being filled up in all sorts of random places, out of the control of the rental company, and while it’s probably safe, they don’t want to promise it, nor disinfect the tank every rental.

I recently got a small “pen” which you put in a cup of water and it shines a UV light for 30 seconds to kill any nasties in the water. While I have not tried to test it on infected water, I presume that it works.

So it seems it makes sense to me to install this sort of UV tube in the fresh water tank of RVs. Run it from time to time, and particularly after a fill, and be sure the water is clean. Indeed, with an appropriate filter, and a 2nd pump, such an RV could happily fill its water tank from clear lakes and streams, allowing longer dry camping which should have a market. Though of course the gray/black water tanks still will get full, but outside showers and drinking do not fill those tanks. A urination-only toilet could also be done if near a stream or lake.

Syndicate content