Still working on good blog posts to explain and introduce it though.
Our OTAU architecture uses A/B system updates [1]. Core idea is that both the kernel and the rootfs (read-only) partitions had 2 different bootslots in storage, and the OTAU would only write to the bootslot that is unused. Hence, if something went wrong, the system would automatically fallback to the previous version by just switching the bootslot used. Over the numerous years that that architecture was used, I couldn't find a single post-mortem that resulted in devices being bricked. Something to note is that the rootfs partition was overlaid with a writable partition for persisting state data etc.
Now that was a $two-figure USD device, not a $5/6-figure USD electric SUV. Is this a cost-cutting measure? At those price levels, doubling your NAND size is not even half of a percent of the total cost of the vehicle.
Unless there was a serious issue that the used bootslot corrupted the unused bootslot, then I don't see how this could have happened.
It's saddening that car manufacturers are so unserious about the code they're deploying.
I adopt rather the opposite virutes. Imprudence, risk, throwing-your-self-at-a-wall-until-you-cant, intemperance (conflict, debate, disagreement, competition) and pragmatism (address what is rather than what should be).
Behind each of the stoic virutues is a psychological position to dettach, dissociate and live in a more abstracted conceptual space. This can be theraputic if you are in grief, etc.
Outside of that, personally I think: attach too much, risk more than you ought, and participate in the world ("dirty your hands") by making the best of it, rather than anything more abstract.
Professors of stocism like to make a virute of dying quiety -- this i think absurd. If the plane is falling from the sky, i envy the people screaming -- they have the right levels of attachemnt to their own lives.
For me, on the other hand, it was very freeing to encounter Stoicism, because I felt like it was okay that I didn't feel or react as strongly as people around me expected me to.
Frequency is also impacted by load: the greater the load on the generator the more torque required at its input shaft to maintain the same RPM. If the generator's input engine is already at max torque then RPM must decrease all else equal. That in turn requires that every other generator on the grid also slow down to match.
When a huge chunk of generating capacity disappears there isn't enough power feeding the remaining generator input shafts (all else equal) to maintain RPM so the grid frequency must drop. That tends to destroy customer equipment among other problems.
Generators are motors and motors are generators. If the capacity disappears too quickly the grid _drives the generator as a motor_ potentially with megawatts of capacity all trying to instantly make that 100 ton rotor change from 3600 RPM to 2800 RPM or whatever. Inertia puts its $0.02 and the net result is a disintegrating rotor slinging molten metal and chunks of itself out while the bearings turn into dust.
Protective equipment sees this happening and trips the generator offline to protect it. Usually the coordinating grid entity keeps spare capacity available at all times to respond to loss of other capacity or demand changes. This is also the point of "load shedding": if spare capacity drops below a set level loads are turned off.
If spare capacity is not maintained or transmission line choke points present problems then capacity trip outs can cause progressive collapse as each generator sees excessive load, trips, and in turn pushes excess load to the next generator. If your grid control systems are well designed they can detect this from a central location and command parts of the grid to "island" into balanced chunks of load/capacity so the entire grid does not fully collapse.
Of course when you want to reconnect the islands it takes careful shifting of frequency to get them aligned before you can do that.
If all generators collapse you end up in a black start situation that requires careful staging lest more load than you expected jumps on the grid (maybe due to control devices being unpowered or stuck somewhere), triggering a secondary collapse.
Caveat: not a grid engineer so I may have gotten some of this wrong but hopefully it helps anyone who wonders why load shedding exists or how a grid can "collapse" and what the consequences are if you don't do those things and just let it ride.
I've seen a lot of extremely bright, talented and hardworking people trying to play that game - all failed, some ruined their entire lives simply for refusing to give up for too long. While those who went into cash business - as simple as an outsourcing shop - are almost all doing fine.
Nudging people to try for "equity business" is a dangerous advice to give.
Deleted Comment