6 ms·

Tesla’s infotainment and IT infrastructure is unrelated to their safety. If this guy worked on motor control or braking system firmware then that would be scary

Tesla’s infotainment and IT infrastructure is unrelated to their safety. If this guy worked on motor control or braking system firmware then that would be scary, but he didn’t.

SideburnsOfDoom 8y ago
> Tesla’s infotainment and IT infrastructure is unrelated to their safety. Only if it's deliberately isolated in the vehicle. It should be. Aaaand, it isn't: the firmware upgrades to all other car computing elements go through it.
- freerobby 8y ago
  Runtime isolation is distinct from compile/build-time isolation. You're citing the latter, but it's the former that matters. Tesla gets this right, e.g. an interrupt in the MCU does not have any effect on braking, drive-by-wire, or ADAS systems while a car is in operation.
  - mikeash 8y ago
    Just to back this up: I have rebooted both my MCU and my instrument panel while driving. Critical systems are not affected.
  - SideburnsOfDoom 8y ago
    Fair enough, but if those bits pass through the infotainment center on the way in, controlling one allows you to control the other.
toomuchtodo 8y ago
Ignoring the infotainment system for this argument (as they firewall it off from CANBUS and other life critical systems [1]), I argue that their IT infrastructure is safety related, as it governs Tesla's velocity in getting patches and security fixes out to vehicles in a timely manner. Can you imagine a zero day being found in Windows with Windows Update being down? [1] https://www.youtube.com/watch?v=KX_0c9R4Fng https://www.youtube.com/watch?v=KX_0c9R4Fng
- mikeash 8y ago
  There's no guarantee that any given car is connected and receives updates, so the safety-critical systems need to be good enough when the car ships. They might mess up, but then they'd at least be able to patch cars faster, while other manufacturers would have to do a recall.
  - deleted 8y ago
    [deleted]
deleted 8y ago
[deleted]
devy 8y ago
If the infotainment system caused the MCUs to reboot while someone traveling "130mph on San Mateo Bridge" and that caused the break system to segfault due to unconventional way of loading parts firmware, it might be a life&death situation, easily. Examples in that threads go on, literally hundreds!
- mikeash 8y ago
  I don't understand how that could happen. MCU reboots, ???, brake system segfaults? What goes in the middle?
  - floatboth 8y ago
    Probably everything has access to everything on the CAN bus. IIRC car manufactures are irresponsibly lazy and never properly air-gap infotainment from critical stuff.
    - Globz 8y ago
      There's a firewall between the CAN bus so it cannot be affected at all by the MCU.
    - mikeash 8y ago
      Even if this were true (and as another commenter says, it's not) I don't see how that fills in this gap. It would make sense if the first step were "MCU goes crazy," but not with a simple reboot.
  - deleted 8y ago
    [deleted]
- vvanders 8y ago
  Well, you can reboot the system while driving(both console and dash), nothing special happens other than the AC turning off for a brief period of time. Brakes, wheel, throttle all respond normally. Source: Done this a few times to clear bad map data or occasional glitch.
coldtea 8y ago
>Tesla’s infotainment and IT infrastructure is unrelated to their safety Because drivers can't get distracted and crash because of a failure in the infotainment and IT infrastructure?
- mikeash 8y ago
  If that's the standard, then almost everything becomes safety critical. Drivers can easily get distracted by malfunctioning smartphones or apps. (Or, for that matter, properly functioning smartphones or apps.) Yet the prior discussion was based on the idea that things like iPhones and Facebook aren't safety critical the way this is.
  - dfox 8y ago
    It is my understanding that two major reasons for various ugly UI and unintuitive UX in automotive infotainment systems are patents and safety certifications.
  - coldtea 8y ago
    >If that's the standard, then almost everything becomes safety critical. Almost everything in a cars front panel and dashboard can be. I've read somewhere that people have been killed even because of something as quaint as the wrong placement of car ashtray.
    - coatmatter 8y ago
      One time I pulled up at the red light behind a Tesla while I was on a bicycle. Straight through the rear window I could see the driver and front passenger being distracted by the massive flat touch screen. The traffic light turned green, and had I been beside the Tesla, I would have beaten it across the intersection despite all that electric motor tech in the car. Anyway this little illustrated anecdote of mine aside, driver distraction is a genuine issue - even for drivers at red lights. The number of times I've seen this type of behaviour transcend into moving off while remaining distracted (whether that's heads down visually or just mentally) is too boringly frequent to detail. Sometimes the distracted drivers even creep forward unconsciously while traffic is flowing across them. Emergency vehicles can't get through, drivers end up splitting their attention, pressure mounts once proper movement starts again, and all the while they don't realise they don't have full attention in a changing environment. It's almost like a hypoxia. Tom Scott did a pretty good video on this: https://youtu.be/_-aDHxoblr4 https://youtu.be/_-aDHxoblr4
blub 8y ago
1. According to this source, the infotainment system arbitrates flashing other ECUs. 2. Apparently people can ssh into the infotainment system. 1 + 2 => someone hacks into the infotainment system and flashes a safety-critical ECU. I guess/hope there's some protection in place to prevent that.
outworlder 8y ago
Well, the model 3 lacks a normal speedometer, it's in the screen. For that car, it's related to safety.

Tesla’s infotainment and IT infrastructure is unrelated to their safety. If this guy worked on motor control or braking system firmware then that would be scary, but he didn’t.

SideburnsOfDoom 8y ago

> Tesla’s infotainment and IT infrastructure is unrelated to their safety. Only if it's deliberately isolated in the vehicle. It should be. Aaaand, it isn't: the firmware upgrades to all other car computing elements go through it.

freerobby 8y ago
Runtime isolation is distinct from compile/build-time isolation. You're citing the latter, but it's the former that matters. Tesla gets this right, e.g. an interrupt in the MCU does not have any effect on braking, drive-by-wire, or ADAS systems while a car is in operation.
- mikeash 8y ago
  Just to back this up: I have rebooted both my MCU and my instrument panel while driving. Critical systems are not affected.
- SideburnsOfDoom 8y ago
  Fair enough, but if those bits pass through the infotainment center on the way in, controlling one allows you to control the other.

toomuchtodo 8y ago

Ignoring the infotainment system for this argument (as they firewall it off from CANBUS and other life critical systems [1]), I argue that their IT infrastructure is safety related, as it governs Tesla's velocity in getting patches and security fixes out to vehicles in a timely manner. Can you imagine a zero day being found in Windows with Windows Update being down? [1] https://www.youtube.com/watch?v=KX_0c9R4Fng https://www.youtube.com/watch?v=KX_0c9R4Fng

mikeash 8y ago
There's no guarantee that any given car is connected and receives updates, so the safety-critical systems need to be good enough when the car ships. They might mess up, but then they'd at least be able to patch cars faster, while other manufacturers would have to do a recall.
- deleted 8y ago
  [deleted]

deleted 8y ago

[deleted]

devy 8y ago

If the infotainment system caused the MCUs to reboot while someone traveling "130mph on San Mateo Bridge" and that caused the break system to segfault due to unconventional way of loading parts firmware, it might be a life&death situation, easily. Examples in that threads go on, literally hundreds!

mikeash 8y ago
I don't understand how that could happen. MCU reboots, ???, brake system segfaults? What goes in the middle?
- floatboth 8y ago
  Probably everything has access to everything on the CAN bus. IIRC car manufactures are irresponsibly lazy and never properly air-gap infotainment from critical stuff.
  - Globz 8y ago
    There's a firewall between the CAN bus so it cannot be affected at all by the MCU.
  - mikeash 8y ago
    Even if this were true (and as another commenter says, it's not) I don't see how that fills in this gap. It would make sense if the first step were "MCU goes crazy," but not with a simple reboot.
- deleted 8y ago
  [deleted]
vvanders 8y ago
Well, you can reboot the system while driving(both console and dash), nothing special happens other than the AC turning off for a brief period of time. Brakes, wheel, throttle all respond normally. Source: Done this a few times to clear bad map data or occasional glitch.

coldtea 8y ago

>Tesla’s infotainment and IT infrastructure is unrelated to their safety Because drivers can't get distracted and crash because of a failure in the infotainment and IT infrastructure?

mikeash 8y ago
If that's the standard, then almost everything becomes safety critical. Drivers can easily get distracted by malfunctioning smartphones or apps. (Or, for that matter, properly functioning smartphones or apps.) Yet the prior discussion was based on the idea that things like iPhones and Facebook aren't safety critical the way this is.
- dfox 8y ago
  It is my understanding that two major reasons for various ugly UI and unintuitive UX in automotive infotainment systems are patents and safety certifications.
- coldtea 8y ago
  >If that's the standard, then almost everything becomes safety critical. Almost everything in a cars front panel and dashboard can be. I've read somewhere that people have been killed even because of something as quaint as the wrong placement of car ashtray.
  - coatmatter 8y ago
    One time I pulled up at the red light behind a Tesla while I was on a bicycle. Straight through the rear window I could see the driver and front passenger being distracted by the massive flat touch screen. The traffic light turned green, and had I been beside the Tesla, I would have beaten it across the intersection despite all that electric motor tech in the car. Anyway this little illustrated anecdote of mine aside, driver distraction is a genuine issue - even for drivers at red lights. The number of times I've seen this type of behaviour transcend into moving off while remaining distracted (whether that's heads down visually or just mentally) is too boringly frequent to detail. Sometimes the distracted drivers even creep forward unconsciously while traffic is flowing across them. Emergency vehicles can't get through, drivers end up splitting their attention, pressure mounts once proper movement starts again, and all the while they don't realise they don't have full attention in a changing environment. It's almost like a hypoxia. Tom Scott did a pretty good video on this: https://youtu.be/_-aDHxoblr4 https://youtu.be/_-aDHxoblr4

blub 8y ago

1. According to this source, the infotainment system arbitrates flashing other ECUs. 2. Apparently people can ssh into the infotainment system. 1 + 2 => someone hacks into the infotainment system and flashes a safety-critical ECU. I guess/hope there's some protection in place to prevent that.

outworlder 8y ago

Well, the model 3 lacks a normal speedometer, it's in the screen. For that car, it's related to safety.