It seems that the ability to trivially roll back any update would be a better choice, at least for this. (But I'm sure there are downstream effects I haven't thought about if that were implemented.)
Giving user’s control over when the update runs allows them to be in a safe and secure setting when that update happens. Allowing them time, gives them and Jeep the ability to slow roll the update so they can halt it if initial feedback is negative.
I say this as a Mac user who does not allow auto updates for MacOS. I wait a week or so until the chatter validates it as non-breaking. They pushed an OS update several years ago that broke a few things I rely on. So I don’t trust them now, but these things just happen on OS’s with third party software. I expect it. But, I also don’t want to be forced to deal with the headaches immediately. I’d rather let the third parties run updates and advise how to deal, before I have to dive into fixing things. With car firmware, there’s really no excuse for this except poor engineering / processes.
FTFA:
> The buggy update doesn't appear to brick the car immediately. Instead, the failure appears to occur while driving — a far more serious problem
And from the GP upthread:
> There is no way to tell if you received the bad update.
> There is no way to tell if you received the 'fix' either.
Many security compliances require auto-updates to be on. It's thought of to be a lesser evil, because many (most) users never update their OS/browsers, which is worse.
If there are security related updates where the risk is severe then they may auto update.
This does not fix any QA process that is broken. And frankly you should not need to update any control unit firmware after it is sold. The fact that they're even doing this is broken.
Unless your Mac is somehow attached to 5000 pounds of metal going 65 on the highway, the same standards should probably not apply.
Oh you sweet summer child
The NASA space probes are constantly uploaded with new software that has greatly increased the scope of their mission.
If they didn't make "safety" right from the first time, why do you think they will do it better the second time, when the fixes are more expensive and the time pressure is enormous ?
...all of which is just an excuse to show this great picture of Margaret Hamilton [1] lead developer on the Apollo guidance system standing next to (and slightly shorter than) the printouts of the source code https://en.wikipedia.org/wiki/File:Margaret_Hamilton_-_resto...
[1] Who was admittedly quite short apparently
I've worked on some interesting software with lives on the line as well and the amount of test code absolutely dwarfed the functional part. I wonder whether at the time of the effort you linked that was already common practice and if it was what the fraction of that code was tests.
Assuming she's 1.65 meters tall and 66 lines per page (quite common back then), at 0.2 mm thickness per page that's 8K pages times 66 lines / page is ~550K lines. Pretty impressive!
The idea that one can create complex bug-free software is a fantasy. The correct mindset is to learn how to deal with failure. (This is how airliners are designed.)
As for cost, surely you can ask Ford's lawyers who worked there in the 70s to give you a good calculation on life vs recall costs.
That is why Samsung push update to disable note 7 even after recalling them.
In Germany we let the Kraftfahrtbundesamt handle this. You are required by law to keep your address updated with the authorities, and all vehicles have to be registered to get a license plate. When a recall for safety reasons happens, the Kraftfahrtbundesamt writes a notification letter, and if you do not respond in time with evidence of having the recall issue remediated by a qualified shop (or doing it yourself and getting a sign-off from a licensed inspector), eventually they write to your local DMV office that can ban your vehicle from the roads, and if you miss that the police shows up at your home and physically removes the license sticker from the table.
And heaven forbid you get actually caught driving the car after having gotten the notification letter from your local DMV. That's automatically felony territory. Our authorities really, really do not mess around.
[1] https://www.kba.de/DE/Themen/Marktueberwachung/Rueckrufe/rue...
No. You test it. And release it if and when it is fully tested. (you know, V-cycle). But we are Agile now and testing is expensive.
Let’s not let perfection obstruct progress.
Yup, my test is not perfect, but "Let’s not let perfection obstruct progress".
In all scenarios, tricky bugs will happen. Something inconceivable will go untested. But that’s not what happened here. This is basically functionality being lost that very obviously should have been tested.
In that sense, they could have made progress. Nobody is expecting perfection. You seem to be hung up on the distinction
I would bet most updates, especially from a company this bumbling, will be more along the lines of increasing telemetry or pointless UI changes than releasing actually useful features and bug fixes.
I certainly wouldn’t accept one while I was still driving the car!
The solution here is that the manufacturer needs to test their damn update before any of their customer get them.
Huh ? What a stoopid idea. Who would protect your security ? Who will protect the children ? /s
OTA software updates should be a convenience, not a requirement, never be automatic, and be otherwise treated just like a visit to a car repair shop.
Similarly, no manufacturer should be able to tell you "oh, but it's a software problem" if your thing doesn't work as expected (I had Apple tell me this, for example).
Well, they should if they provided you with the hardware and you got the software from someone else. But that's the other problem: They prevent you from doing that, and then if their software is crap or they decide to turn off the servers, what do you do?
Watch for some carmaker to try to say that the car only had a 10 year warranty and then brick them by turning off some servers after they're over 10 years old, or just go out of business with the same result. It's a travesty that people even put up with that for electronics.
In this case, it appears somehow that an infotainment system update impacted the drivetrain. In my fully "fly by wire" computerized vehicle from 1999 (M-B E300), even if it somehow could receive OTA updates, these systems are physically separate. The ABS system is a different module from the transmission controller, which is different from the engine controller. They all communicate over CAN, but the only way one could crash another is if somehow it responds poorly to incorrect CAN messages.. And even if these computers crash the mechanical components they control will probably keep working more or less.. What has happened in the intervening quarter century that made it possible for this failure to happen?
I do not see reason, why CEOs of big companies should be exempt from this!
If bus driver makes mistake, or someone drives drunk.... They get punished. This is the same thing!
The current regulations are written for a time where cars didn't have rolling computers in them. And even then, the regulations don't account for Tesla-style linked systems. So I say we do need new regulations.
This is the standard I have been living by for decades, we didn't need to enter the OTA software update era to know that.
Anyone who drives their products now is just a person with no life skills in the product purchasing process. They make some of the worst-ranked vehicles for reliability, some of the most visually obvious bad assembly quality, some of the most tired and outdated vehicles on the road, and yet people just keep buying Jeep Wranglers for no discernible reason other than that they like to compromise their vision with rubber ducks.
No way. Testing is expensive. /s
This has happened to me twice with a Nissan Leaf. I paid money to get a read out from the computer system, and there were no timestamps on the screens of data.
Modern cars "computers on wheels" are dreadful.
Is it possible to disconnect the power from the radios used for "over the air" nonsense? Then at least they would be stable.
I've read online that for some cars, you have to dig deep inside to disconnect the cellular antenna.
I'm a little more lucky. On my car, you can pop out the SIM card from a slot in the ceiling, behind the rear-view mirror.
This assumes you haven't given your car access to your home WiFi. (Some people do this so they don't have to pay for a data plan for their car, and it kinda sorta "syncs" when you get home.)
It will throw a perpetual "check engine" light and disable the hands-free microphone, but OVMS users have made a "dummy TCU" that gets around that annoyance.
I have the opposite problem. The specific infotainment system update I need requires a $200 visit to a dealership with a specific model of a USB 2.0 SanDisk Flash Drive (NI-52727-1). Not available OTA despite the Leaf's OTA capabilities.
Buying a modern car seems to come with too many strings attached these days.
> The buggy update doesn't appear to brick the car immediately. Instead, the failure appears to occur while driving—a far more serious problem.
> My 4xe died in my driveway on Saturday after the update.
It seems not driving bricks as well.
https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...
A GPS update kills your entire powertrain. Appears to also engage parking for some users, super dangerous. Catbones, "Almost died on the thruway today ... with an 18-wheeler behind me. ... Jeep died, locked its hand brake and jolted so hard my face almost ended up in the steering wheel at 70mph." [1]
[1] Wrangler 4xe forum, JeepCares and Catbones accounts: https://www.4xeforums.com/threads/wrangler-4xe-ota-update-10...
Personal bet: Jeep accidentally enabled the remote kill switch for repossessing automobiles. [2] Possibly the "impaired driver" kill switch. [3]
[2] Stateline, Late Payment Kill Switch: https://stateline.org/2018/11/27/late-payment-a-kill-switch-...
[3] Trackhawk, Federal Kill Switch Law: https://trackhawkgps.com/blog/kill-switch-law
This seems extraordinary.
I was going to ask: Are you really saying they kill the vehicle's power system, effictively the engine, while the vehicle is being driven on the highway?
But no need to ask, the article says yes, that's what is reported:
> Instead, the failure appears to occur while driving—a far more serious problem. For some, this happened close to home and at low speed, but others claim to have experienced a powertrain failure at highway speeds.
Wow.