"Update not successful, vehicle cannot be driven"

[squirrels2nuts]

This is going around on twitter, but I couldn't find any mentions of it here.
Is this even real? the phone number, when googled doesn't turn up anything official

Sponsored

 

[generaltso]

https://www.macheforum.com/site/thr...ld-really-think-about-a-mobile-service.32314/

https://www.macheforum.com/site/threads/ota-bricked-car.32561/

 

[squirrels2nuts]

https://www.macheforum.com/site/thr...ld-really-think-about-a-mobile-service.32314/

https://www.macheforum.com/site/threads/ota-bricked-car.32561/

sorry, i searched "vehicle cannot be driven" like on the screen not "car"

 

[Mach-Lee]

Yes, that photo is going around everywhere online. That's the message you will see on the rare occasion that an OTA fails. It's a special customer service phone number for dealing with failed OTAs. It's from a user on Reddit, his car has since been fixed and is back to normal FYI.

 

[squirrels2nuts]

thanks for the clarifications. the rare exception has brought out thousands and thousands of ppl raging against electric cars :\

 

[AhardFSU]

thanks for the clarifications. the rare exception has brought out thousands and thousands of ppl raging against electric cars :\

Seems about right. I hope those people know that some ICE vehicles also get OTA software updates.

 

[Krom2040]

Just bought my MME last week and I love it, but I have to agree with the general sentiment - there's no reason for this screen to ever occur. Like, ever. If an OTA update fails in such a way that this screen would be necessary, they should automatically revert to the last working state and notify the user.

This is essentially a solved problem in the world of computing. I'm sure there's some wrinkles that make it difficult, but it's fundamentally something that they should change their systems to make it impossible.

 

[Vulnox]

Seems about right. I hope those people know that some ICE vehicles also get OTA software updates.

Yeah I commented to that effect on Reddit. It's not an EV issue, it was a failed OTA update, and we don't even know all the circumstances around it or what module it was (or maybe someone does now).

Then someone responded "Well find me an example of this happening to an ICE vehicle", and within 10 seconds I found an article about Volvo X60s (or XC60... something 60) that received an OTA update a year ago that was bricking a bunch of them because it was activating a theft deterrent system. Same end result though, drivers couldn't use the vehicle and it had to be towed.

The person, in typical Reddit fashion, just said the article was "Hearsay", despite having as much if not more evidence around the issue than a single image of a Ford infotainment screen.

Lesson learned, or at least reinforced, if people want something to be true and are already set against it, they will just move goalposts as needed to secure their position.

 

[Okuma]

I'm still dealing with a failed OTA update. My 6.2.0 was incomplete. Called @Ford Motor Company and they confirmed the failed update and stated the update would try again within 30 days. 60 days later, with no update, they sent me to a dealer for service. Dealer claimed to have updated the software. My car was delivered to my home and nothing was fixed. In fact, my software reverted to 4.2.1. Now my service manager has no idea what to do. I can't change drive modes, open trunk or frunk, and pre-collision warning turns on all the time. I can still drive but with limited capability. Feels like a car with a sprained ankle.

 

[agoldman]

I'm still dealing with a failed OTA update. My 6.2.0 was incomplete. Called @Ford Motor Company and they confirmed the failed update and stated the update would try again within 30 days. 60 days later, with no update, they sent me to a dealer for service. Dealer claimed to have updated the software. My car was delivered to my home and nothing was fixed. In fact, my software reverted to 4.2.1. Now my service manager has no idea what to do. I can't change drive modes, open trunk or frunk, and pre-collision warning turns on all the time. I can still drive but with limited capability. Feels like a car with a sprained ankle.

I think this outcome is probably more common than we would like to believe.

 

[Neil4Real]

You know what they say, no publicity is bad publicity!

 

[bigredx86]

Just bought my MME last week and I love it, but I have to agree with the general sentiment - there's no reason for this screen to ever occur. Like, ever. If an OTA update fails in such a way that this screen would be necessary, they should automatically revert to the last working state and notify the user.

This is essentially a solved problem in the world of computing. I'm sure there's some wrinkles that make it difficult, but it's fundamentally something that they should change their systems to make it impossible.

Sorry this simply just isn’t a realistic truth here. Updates always have a potential risk associated with them, despite them being small, doesn’t matter the product. I’ve seen iPhones to even Teslas bricked over a software update, rare but it can happen and simply reverting to the last known config without a commit only works when the storage hasn’t also been corrupted.

If you firmly believe this, then you simply don’t understand how technology or software works, plain and simple.

 

[Krom2040]

t I have to agree with the general sentiment - there's no reason for this screen to ever occur. Like, ever. If an OTA update fails in such a way that this screen would be necessary, they should automatically revert to the last working state and notify the user.

This is essentially a solved problem in the world of computing. I'm sure there's some wrinkles that make it difficult, but it's fundamentally something that they should chan

Yes, it's obvious that there's always *some* set of circumstances that will yield an unexpected failure. But let's look at what's been said about this error:

(1) It's happened to numerous people
(2) It's ultimately been resolved by getting towed to Ford who then made no hardware changes, but instead resolved it by plugging it in and doing something on a laptop

From #2, we can deduce that there's no some catastrophic hardware failure involved. If there's something that they can do by connecting via cable, then there's clearly something they could have done differently in some part of their overall system to avoid this scenario. It doesn't mean that it's feasible within their *current software ecosystem*, which may rely on some amount of glued-together modules from third parties. But there is most likely a resolution there *somewhere*, even if it involves going back to basics. There are even plenty of ways to deal with intermittent storage faults - there's a reason that checksum validations are so common. If they need a redundant storage system specifically for storing their backup blobs, then that's a small price to pay in the scheme of things.

And from point #1, we can deduce that this isn't some one-off thing that only happened because all the planets aligned.

As a professional software engineer, I'm well aware that computer systems are difficult to design in a fault-tolerant way. But I also know that there are many different tiers to fault-avoidant design, and in this case, avoiding catastrophic errors in your OTA updates is a big fucking deal that warrants a high degree of caution. If people can't trust that their car won't be bricked overnight by a software update, then they're more likely to turn off updates altogether or, worse, start to doubt that your company has the technical expertise to build a reliable vehicle in an industry that increasingly revolves around features that are entirely software-based. "This could happen to anybody" is a silly and extremely non-technical dismissal of a serious issue.

 

[Vulnox]

Yes, it's obvious that there's always *some* set of circumstances that will yield an unexpected failure. But let's look at what's been said about this error:

(1) It's happened to numerous people
(2) It's ultimately been resolved by getting towed to Ford who then made no hardware changes, but instead resolved it by plugging it in and doing something on a laptop

From #2, we can deduce that there's no some catastrophic hardware failure involved. If there's something that they can do by connecting via cable, then there's clearly something they could have done differently in some part of their overall system to avoid this scenario. It doesn't mean that it's feasible within their *current software ecosystem*, which may rely on some amount of glued-together modules from third parties. But there is most likely a resolution there *somewhere*, even if it involves going back to basics. There are even plenty of ways to deal with intermittent storage faults - there's a reason that checksum validations are so common. If they need a redundant storage system specifically for storing their backup blobs, then that's a small price to pay in the scheme of things.

And from point #1, we can deduce that this isn't some one-off thing that only happened because all the planets aligned.

As a professional software engineer, I'm well aware that computer systems are difficult to design in a fault-tolerant way. But I also know that there are many different tiers to fault-avoidant design, and in this case, avoiding catastrophic errors in your OTA updates is a big fucking deal that warrants a high degree of caution. If people can't trust that their car won't be bricked overnight by a software update, then they're more likely to turn off updates altogether or, worse, start to doubt that your company has the technical expertise to build a reliable vehicle in an industry that increasingly revolves around features that are entirely software-based. "This could happen to anybody" is a silly and extremely non-technical dismissal of a serious issue.

Where are these numerous people? I am genuinely asking, I think we have seen this one and there was supposedly another instance from some months ago. I don't doubt that there are more that just don't make it online, but based on available evidence I haven't seen "numerous" people, just the same picture reposted in a hundred places recently.

As for number 2, bigredx86 didn't say hardware failure. There are a lot of issues that can come up that make reverting impossible. Corrupted storage, as was said, is one possibility. Especially if there was power loss during a write. The fact is, we have no idea what happened prior to this screen. Could the owner have pulled the 12v for some reason? Could a fuse have gone out messing with the update process?

Also, while redundancy is possible, how much more cost and complexity are customers willing to take on to avoid a 1 in, let's say, million chance of an issue like this? Do we need redundant modules and entire APIMs? If we do, why do we suddenly need these things for a super rare failure like this but have survived for a century with ICE vehicles that have blown head gaskets, busted timing chains, blown spark plugs out of the block, and any number of other things that require a tow if the owner isn't experienced enough to fix it themselves? Those are also rare issues that have impacted "numerous" people that aren't problems for BEVs. But a couple pictures show up on the internet and suddenly this cannot stand!

 

[azerik]

It's really just a back up/ roll back strategy that was never put into place for these types of things. I think Ford thinks it's safer if it's towed in and some poor guy gets to play "what went wrong" on the FDRS to attempt to undo it. Firmware is firmware. It's tiny. But if it's not backed up and bricks it's not going anywhere. They probably have a recovery step/system to unbrick the module but coding that process into automagic mode would be a nightmare for Ford. The one in a few can be towed and handled probably better than the groups of cars auto-reverting to an older module version over and over if something won't go through.

Sponsored