Imagine only having one copy of the system so when a situation like this occurs, you lack the ability to automatically switch to a working one, re-download and retry, without danger of this occurring.
This was fixed a decade ago with Android. They could have literally taken the source code from aosp and added it, or at least converted it (if in different programming language), and never had this issue. It would cost $0 and minimal time. But no. That won't ever happen. It's built ford tough.
While the implementation of an A/B update system wouldn't be drag and drop from Android to a different OS, they absolutely could implement the same idea to prevent this issue.
The likely reason as to why is storage space, you need two copies of the system, while only one is running at a time. They probably put as little space into these infotainment systems as possible.
If they put more in new models, they'd then have to support two methods of updating the system. It's easier to tell the customer on the rare occasion that an error does happen "oops we made a fucky wucky it's on you to fix it"
There's no way storage space is the issue. It would cost pennies per car and take up no additional space or power. The size of map/gps data would dwarf the OS by an order of magnitude or more.
Yeah likely, and I'd be super pissed about this. You're (ford) telling me you cheap fucks couldn't be asked to install two like, shit, even cheap-ass comsumer-grade 100gb ssds or something at the cost of like $10 a pop, before 'economies of scale', in my fucking 50k vehicle. I want the tow bill comped, I want the repair comped, I want an equivalent rental vehicle comped for the entire duration of the repair, I want it in writing that if this shit happens again that I'm going to get the same treatment as I am now, and my time isn't free either so I want complementary maintenance the next time I'm in here; or I'm driving straight through the front window as soon as the repair is done, and I'm not stopping with the first vehicle I crash into.
Even some decent modern Wi-Fi routers have such protection. There's working and backup partition. If a firmware update fails, it boots using the previous working partition.
This is a better explanation (in this case for Cisco Linksys EA3500):
Like several other Linksys devices, the EA3500 has a dual firmware layout: working and backup partitions. Unless you manually choose which partition by doing a manual uboot/tftp install, firmware flashes occur on the backup partition and the EA3500 shall reboot from the backup partition following from a firmware flash. The backup partition becomes the new working partition when the reboot was successful. The former working partition becomes the new backup partition.
I remember a few years back when farmers were in the news for using Russian hacks to get around this type of shit in their John Deere tractors. I thought, surely that won't become a problem for regular cars... That was back when I still had some faith left in humanity to overcome capitalism's bullshit.
I think it's steps for the tow truck operator to perform before they can tow the now-undriveable car. Like getting it in neutral, disabling parking break, maybe disconnecting batteries.
Yeah that sounds completely unessesary to have such features when they can be done manually and probably with better compatibility (I'm guessing Ford tow trucks only connect to their proprietary standard)
They need to have a solution in place other than brick your vehicle. Even if it only allows your nav to go to the nearest dealership or some shit. Will it be ignored? Yup, but at least I can get to my job. Or to my house where I can, ya know... Update.
Don't care. If I buy a car and your software makes the decision to disable it, fuck you forever and you'll never see another nickel from me. If you sold me a car that isn't safe to drive in the first place, fuck you forever and you'll never see another nickel from me.
More like them overtaking the controls at the moment and driving you off the road, whatever there is a bush, a hole or a guarding rail with nor reason no care at all