<story><title>A recent software update was not successful. Your vehicle cannot be driven</title><url>https://twitter.com/danluu/status/1739387245034139692</url></story><parent_chain><item><author>onetimeuse92304</author><text>Some 20 years ago I was asked to prepare OS distribution with OTA upgrade capability for some PoS system.&lt;p&gt;I think I prepared two system partitions and a custom MBR which would alternate the system partition on every start (uses one bit of non-volatile memory to alternate selection of partitions on each boot).&lt;p&gt;When the system starts, it does self-test. If it fails the self-test it just restarts. If it succeeds -- it writes the result on its partition and then looks at the other partition. If the other partition did not succeed the test, it reports the fact back to HQ and overwrites it with the current system.&lt;p&gt;The upgrade procedure is extremely simple -- the current system writes to the other partition, then restarts. If the upgrade is interrupted at any point in time, the other system will know it was interrupted and will just restart immediately. In any case, after two restarts we are back to the system that initiated the upgrade and if it checks the other system did not start and self-tested successfully, it can redo the upgrade as many time as we want and you still have a working system.&lt;p&gt;Could it be done better? Probably it could. It took me one day to think up and implement.&lt;p&gt;I would think Ford could do it better (Edited: yes, not a Tesla)</text></item></parent_chain><comment><author>rollcat</author><text>A&amp;#x2F;B boot is old, good, and proven, but what do you do when you have dozens of separate microcontrollers, each governing a semi-independent subsystem, all running their own software that needs its own updates? It would make sense from safety&amp;#x2F;reliability PoV when a crash&amp;#x2F;bug in a slightly less critical system (like adjusting mirrors) does not affect a slightly more critical system (like indicators). What do you do when updating only one of the components fails? Do you rollback everything? Do you continue with the rest?&lt;p&gt;Just to be clear, I&amp;#x27;m firmly in the &amp;quot;less smart = more reliable&amp;quot; camp, but even a SoC resembles a distributed system nowadays, and this architecture has its merits. The GPU on my M1 Mac crashed, rebooted itself, and all I saw was 1-2s of glitched graphics - no application noticed. Of course ideally GPUs wouldn&amp;#x27;t crash, but the same could be said of cars.</text></comment>
<story><title>A recent software update was not successful. Your vehicle cannot be driven</title><url>https://twitter.com/danluu/status/1739387245034139692</url></story><parent_chain><item><author>onetimeuse92304</author><text>Some 20 years ago I was asked to prepare OS distribution with OTA upgrade capability for some PoS system.&lt;p&gt;I think I prepared two system partitions and a custom MBR which would alternate the system partition on every start (uses one bit of non-volatile memory to alternate selection of partitions on each boot).&lt;p&gt;When the system starts, it does self-test. If it fails the self-test it just restarts. If it succeeds -- it writes the result on its partition and then looks at the other partition. If the other partition did not succeed the test, it reports the fact back to HQ and overwrites it with the current system.&lt;p&gt;The upgrade procedure is extremely simple -- the current system writes to the other partition, then restarts. If the upgrade is interrupted at any point in time, the other system will know it was interrupted and will just restart immediately. In any case, after two restarts we are back to the system that initiated the upgrade and if it checks the other system did not start and self-tested successfully, it can redo the upgrade as many time as we want and you still have a working system.&lt;p&gt;Could it be done better? Probably it could. It took me one day to think up and implement.&lt;p&gt;I would think Ford could do it better (Edited: yes, not a Tesla)</text></item></parent_chain><comment><author>Kirby64</author><text>This is a Ford Mach-E, not a Tesla.</text></comment>