Canon 5D Mk II dSLR firmware update bug illustrates interconnected firmware problems

Canon recently released a firmware update for its 5D Mk II full-frame dSLR that added 24-fps video abilities to the camera. This was a highly desired feature due to the “film-like” qualities of 24 fps versus 25, 30, 50, or 60 fps used by most video systems. Film aficionados can see the difference in video shot at 24 fps although I usually can’t. In any case, the 5D Mk II dSLR firmware upgrade broke something unexpected and Canon has had to pull the firmware update back temporarily. In Canon’s words, here’s what broke: “Recently we have discovered a malfunction that occurs with Firmware Version 2.0.3, in which the manual recording levels for C1/C2/C3 are changed and the camera becomes unable to record audio if the power is turned off (or if Auto power off takes effect) after registering "Sound Recording: Manual" in the camera user settings.” No doubt, Canon will have a revised firmware update available in a few days. (Note: Canon announced the repaired firmware update, 2.0.4, on March 19, 2009.)

However, talk about your unexpected consequences. This firmware bug points out the interconnected nature of features in today’s complex, multifunction embedded products. Something related to powering the camera down is messing up the camera’s audio settings and whatever it is was introduced in the latest firmware update because the audio wasn’t broken before the update. Toyota’s current woes with its cars may well be another example and these are just two examples out of many that demonstrate how we’re dangerously overlaying so many interconnected features onto our embedded designs and adding so much complexity that we cannot test quality into our systems. We must design it in from the start.

This overlaid firmware complexity frequently causes seemingly unrelated bugs to surface in system operation. Canon’s latest firmware bug eloquently makes the case for more formal firmware development practices that encapsulate independent functions as much as possible. A properly functioning audio function should never disable audio recording when parameters are properly set, just as a braking system should never disable a vehicle’s brakes no matter how rough the road gets. An encapsulated audio-recording module or braking module should always work and it’s the firmware team’s job to make sure that it does.