And nobody will report that because it is not "news". Therefore we will see a disproportionate amount of bad installation experiences reported. Actually, expect _all_ of the bad experiences to be recounted publicly, while the happy majority stays silent.
We also hear about every major Tesla accident. In a way it feels safer this way. If single instances (from a large group of users) are newsworthy, it can't be bad compared to average rate.
I had both installed at the same time and it was pretty close to the same. Just an extra permit and they had to have engineers inspect the roof and mounting planes.
Throwing in my hat too. Mine went very well. My Tesla concierge was awesome and the whole process was timely. It took a few months (survey, permits, inspections, etc.) which is standard.
Same here, installed twice, no problems. Recently had a problem with invertor, which took some time (couple of weeks) to fix (ended up in replacing the thing), but also went fine. Must be either an exception or their processes with Powerwall are not that polished.
Lovely bit of fuckery. Customer support and ease of installation usually make or break products. That said, Tesla is probably experimenting several things by letting David be the Guinea pig.
It shouldn't need an Internet connection. Adds a point of failure. It might have one, but it shouldn't need it.
Tesla is sending some of their battery units to Puerto Rico. Will they work with the network down?
Tesla FAQ: "Powerwall needs internet (wired Ethernet or your home Wi-Fi) or cellular service to communicate with the Tesla mobile app and receive software updates. A reliable connection is required to provide new product features over time. Powerwall can function if the connection is temporarily lost but should not be installed in a location without internet or cellular service."
This is a bit unfair -- charging / discharging / safety on that scale in a home should be actively monitored and managed, otherwise you end up with real danger a few years down the road.
That's what local alarms are for. Green, yellow, and red lights, and a message display, both on the unit and remotable to the house, should be sufficient. If you want remote maintenance, you go to the unit and push the "remote maintenance" button, and then it phones home, if it can. The service it connects to probably won't last as long as the device. "Cloud" services seem to have a life of about 5 years. Sometimes less.
This is essentially how it does work, except the maintenance button is pressed automatically for you.
You can take a Darwinist approach and say anyone who forgets to press the button deserves to potentially die in a fire, or you can say if it's really a potential problem don't release it, or you can actively monitor it.
Also note that if your internet goes down the unit doesn't just shut off -- that would be a poor feature for a backup power source.
Ideally, yes. In practice, people neglect them and then sue the company for $millions if something happens because "they clearly should have made alarms more prominent so I couldn't neglect them". Remote monitoring ensures there a) independent record of what was going on and b) ability to monitor the system and take proactive steps if something goes south.
That's not even getting into situations of how unreliable the users are in reporting both what they did (the dreaded "I didn't do anything and it doesn't work!") and what happens with the system (the dreaded "it doesn't work, fix it NOW!").
If you install a complex system on user's side which requires maintenance (and what system doesn't) you better have remote diagnostics or you'd be a very frequent guest there. I don't see a reason why Tesla things would be different.
In practice, we have lethal systems at home already: the electrical system and the hot water balloon.
They have been working fine for the last decades without an Internet connection. We do have accidents, but compare to the incredible deadly danger they pose, it's very low.
How ?
Well they have fail safes that disable the system when it enters a dangerous state.
You should not need an Internet connection for anything essential in your home. Certainly not for something that is marketed to take your "off the grid".
Well, the difference is boilers are old, and Powerwalls are new. People always discount risks from old things and emphasize risks from new things. Thus, the risk of being successfully ruinously sued for boiler manufacturer, if they follow accepted industry practices and something goes wrong, are known, priced in and probably not very high. The risks of the same for manufacturer of a system that has no precedent, no established industry practices and no experience of running it into home environment for decades is much higher. And if something goes wrong, the first question that will be asked would be: why didn't you create a monitoring system?
And, also, whoever made old systems has no option for remote internet monitoring. If they were designed today, the option would probably be added.
> You should not need an Internet connection for anything essential in your home.
You don't need it. Tesla does. And you need Tesla if something goes wrong, thus by extension you need it too.
> Certainly not for something that is marketed to take your "off the grid".
You can really be "off the grid" if you can maintain this system for decades. Can you? How many of average citizens can? Given the newness of technology, you'd probably will go to Tesla for fixes within couple of years for this or that thing, and will repeat that several times over the next decade (if it keeps working). You can manage that loop without internet connection, but the fact is you and Tesla are working together for the life of the product, so why make it harder? You can design the system that works Sneakernet-style, but why?
> Well, the difference is boilers are old, and Powerwalls are new. People
The legal and perception issues are a good point. Annoying, but I get it.
> And you need Tesla if something goes wrong, thus by extension you need it too.
No, what you mean is that they can get away with it, because among their customer base, more people don't care that people that do.
> And you need Tesla if something goes wrong, thus by extension you need it too.
Trying to get "off the grid" rarely is extreme to the point that you cut yourself from civilization completely. It's ok to have external help from time to time. It's just that your daily operation should not depends on it.
In 2007 there was an estimated 7,200 reported home structure fires involving water heaters resulting in 30 civilian deaths, 340 civilian injuries and $75 million in direct property damage.
I'm not sure why there is no outrage about this, probably because it's an old technology and people got used to danger?
Yes, they do, just like every other product, including dangerous products. Some of those products handle similar amounts of energy and some involved chemistry that was just as hazardous as LiNiMnCoO2 orLiNiCoAlO2. To accommodate these hazards sometimes we required the end user to get special training/licensing (e.g. cars). The most important safety feature that we've learned over the last few centuries is that hazardous products must be designed to fail safely.
> Remote monitoring ensures
This is useless for safety[1], because the network isn't a reliable to the degree that is required for safety. You have to assume the network will not be available, sometimes for long periods of time (months), sometimes for reasons outside the user's control.
Anybody selling a product that ignores the lesson of the Therac-25 should be held criminally liable for any damage/injury caused by their product.
[1] it may be useful for other reasons unrelated to safety
Not killing the user is only the first step. Suppose we made it to fail safely in any doubtful case - just shut down. And then the user calls you and screams "I am without power, fix it NOW!" and you have zero data why it happened. And that happens thousands of times over thousands of places. Wouldn't you want to have some data to allow you to see what's going on? Maybe you noticed how many products have this "report crash to developers" dialog when something goes wrong. It's not random. But software devs usually can't make user send them data before crash happened, to see what is going on. If they could, they'd probably prefer having that. Tesla wants having that too. From their side, from their point of view, it is very natural to want that.
That's absolute nonsense. I shouldn't need to phone home for my electricity to work, it's functioned just fine for a hundred years without Internet access. If you can't build a self-contained system to handle a home-level amount of electricity, you shouldn't be allowed to participate in the market.
"What if you can do it, but you're not certain of all the possible modes of failure over a decade of use in people's garages?
"
You aren't serious, right?
This is not a new thing to be thinking about. You should be certain of all the possible modes of failure over a decade of use.
Otherwise, as the comment said, you shouldn't be allowed to participate in the market.
This isn't new secret whizbang technology. The only major difference is battery type. If Tesla doesn't know enough to know what may happen there over a decade of use, ...
I'd like to know what sort of monitoring Tesla does before arguing either way.
If they are actively monitoring for devices that are about to catch fire, and if so will call the fire department to come to your house, and your neighbours to evacuate, then sure it makes sense - but I assume they are just monitoring 'usage analytics', and the fault detection could work just as safely by shutting off the device and prompting the user for action, as another comment suggested.
It's the same with their cars, although having a constant connection to HQ allows faults to be diagnosed quicker, I'd rather it just show a check engine light and go to a dealer (oh wait...).
But to maintain a functional safe state, you do not need Internet access. If you need Internet access to maintain a functional safe state, then you are doing it wrong.
There is also no reason at all to make availability depending on Internet access. Especially, when you are providing a solution that is intended for a self-contained, self-sufficient use case: "Make" power, store power, use power.
However, putting a large number, of potentially very dangerous Lithium Ion batteries in peoples home is a new and novel application with potentially fatal consequences.
I guess the risk is that there's some unknown failure mode, such as after X hours of continuous discharge there's a higher possibility of thermal runaway etc. Being able to disable a unit, or deploy an updated firmware seems valuable in those situations.
At least, this is how I imagine it would be sold to management and users.
> the risk is that there's some unknown failure mode
Estimating and mitigating those risks are part of the safety analysis that should be happening for every product before it's sold too the public. If there is still a legitimate concern about the possibility of future catastrophic failure, the product isn't ready to be sold.
> possibility of thermal runaway etc
It would be incredibly negligent If protection against thermal runaway[1] isn't already part of the design from the very beginning.
> as after X hours
If a completely novel problem happens is discovered, that's what recalls are for.
> deploy an updated firmware
The network is not reliable. Where did everyone get the idea that the internet is acceptable when safety must be guaranteed>? 0Everyone has experienced network outages.
> seems valuable
Video games demonstrate that the ability to fix problems after purchase causes laziness. "Search/test for problems before purchase becomes "that's a minor bug, fix it after-launch", and eventually "We don't fix bugs in old products".
> sold to management
I guarantee that the managers will be sold on the dream of monetizing everyone's "pattern of life" profit, which should be easy to infer from electricity usage rates.
Having spent an entire summer as an intern doing little but study the dynamics of batteries, I'm well aware of the failure modes of lithium chemistry batteries.
If they get too hot? Cut power. If voltage is too high? Cut power. If voltage ever goes below X? Permanently disable battery.
It's not complicated. It's a few thresholds to keep track of. Every laptop does it without an Internet connection and as laptops are used, they're very capable of burning your house down just the same as a powerwall. It's just going to be code on some computer across the Internet watching the battery metrics anyway, adding a network doesn't add any value.
I understand that companies really want constant telemetry from every product they produce. It's certainly possible these days, but it's ridiculous when a basic human necessity depends on your Internet working.
Sounds like the issue is stemming from the PowerWall (Tesla) side of things more than the panel (SolarCity) side. Not surprising, since Tesla has been more product & marketing focused and likely has some growing pains for something as involved as a home installation.
It feels like this could still be in the window of two large-ish business units coming together and working out the kinks (~9 months post acquisition), so it will be interesting to see if more of these stories of clearly botched service emerge or if OP is just unlucky on timing.
Errr. Seems infinitely more their style so far to use whatever data the customer has given them to point out why it's entirely the customer's fault that something happened.
I have asked this question before on HN and did not receive an answer: Tesla's level of access and handling of customer data scares me. Are there any car manufacturers who respect their customer's privacy? Or does buying a car in 2017 mean I should expect my every move watched by the manufacturer and available to them to use as they please without my consent?
I would be OK if the black box is just that: a black box. A data source that can only be accessed via physical connection does not concern me. But 24/7 data transmission to manufacturer's severs is way too 1984 for my taste.
I have mixed opinions about the "black boxes" in vehicles.
In theory, it sounds like a good idea but I learned recently that police can quite easily download the data from them (via the OBD port) and apparently it is common for them to do so when investigating accidents -- especially fatal ones. AIUI, they are not required to obtain a warrant in order to grab this data and that is my primary concern.
In the EU in 2018, stricter data protection laws are coming into place which includes a 'Right to object' [0]. Until it's tested in court it's hard to say what effect it will have though as it's worded quite vaguely. However, it'll be hard to argue that consumer apps like Spotify don't need to collect your usage data, as recommendations are a main chunk of their service, but a car doesn't need to track where, when and how you are driving so it should be possible to opt out of that.
[0] https://gdpr-info.eu/art-21-gdpr/ -
They are already in place at a EU level, but member states have until 2018 to bring them into national law.
> Or does buying a car in 2017 mean I should expect my every move watched by the manufacturer and available to them to use as they please without my consent?
I can't say with 100% certainty that it is happening, of course, but I do think that, yes, you should expect that it is. If, by some chance, it isn't happening, well, I'm sure it's just because they haven't figured out a way to make a dollar from the data yet. Give 'em time.
I am actually pretty convinced that my truck "phones home" at regular intervals and sends at least some data back to the mothership (odometer data, in particular, but who knows what else), especially after a recent OTA-delivered software update (the first that I am aware of since purchasing the truck). I would not be surprised at all to learn that my car also does so. Both vehicles have built-in (3G) cellular connectivity and both have apps available for interacting with them in various ways from a mobile phone (FWIW, I have never installed them, set up the necessary accounts online, etc., and never will).
In addition, ISTR hearing about (maybe a year or two ago?) some "data broker" that was purchasing vehicle data from manufacturers (or planning to do so, perhaps) and turning around and selling that data to automobile insurance companies. "Oh, he likes to drive 15 MPH over the speed limit? He's never been in an accident or been cited but let's go ahead and raise his rates anyways!".
I have thought before about looking into how to disconnect the cellular radios in my vehicles (especially the Dodge RAM -- cf. Charlie Miller's work) but, now, I think I may go through with it.
N.B.: My vehicles are 2013 (Dodge) and 2014 (Nissan) models. I'm sure things have only gotten worse in the few years since then.
As a South African this just sounds like a standard process for doing anything at all in this country. Took me 8 months to get a fiber line and several strange holes in my wall.
52 comments
[ 3.2 ms ] story [ 52.4 ms ] thread18.85kW system with 2x Powerwalls in Florida.
It shouldn't need an Internet connection. Adds a point of failure. It might have one, but it shouldn't need it.
Tesla is sending some of their battery units to Puerto Rico. Will they work with the network down?
Tesla FAQ: "Powerwall needs internet (wired Ethernet or your home Wi-Fi) or cellular service to communicate with the Tesla mobile app and receive software updates. A reliable connection is required to provide new product features over time. Powerwall can function if the connection is temporarily lost but should not be installed in a location without internet or cellular service."
You can take a Darwinist approach and say anyone who forgets to press the button deserves to potentially die in a fire, or you can say if it's really a potential problem don't release it, or you can actively monitor it.
Also note that if your internet goes down the unit doesn't just shut off -- that would be a poor feature for a backup power source.
Ideally, yes. In practice, people neglect them and then sue the company for $millions if something happens because "they clearly should have made alarms more prominent so I couldn't neglect them". Remote monitoring ensures there a) independent record of what was going on and b) ability to monitor the system and take proactive steps if something goes south.
That's not even getting into situations of how unreliable the users are in reporting both what they did (the dreaded "I didn't do anything and it doesn't work!") and what happens with the system (the dreaded "it doesn't work, fix it NOW!").
If you install a complex system on user's side which requires maintenance (and what system doesn't) you better have remote diagnostics or you'd be a very frequent guest there. I don't see a reason why Tesla things would be different.
They have been working fine for the last decades without an Internet connection. We do have accidents, but compare to the incredible deadly danger they pose, it's very low.
How ?
Well they have fail safes that disable the system when it enters a dangerous state.
You should not need an Internet connection for anything essential in your home. Certainly not for something that is marketed to take your "off the grid".
And, also, whoever made old systems has no option for remote internet monitoring. If they were designed today, the option would probably be added.
> You should not need an Internet connection for anything essential in your home.
You don't need it. Tesla does. And you need Tesla if something goes wrong, thus by extension you need it too.
> Certainly not for something that is marketed to take your "off the grid".
You can really be "off the grid" if you can maintain this system for decades. Can you? How many of average citizens can? Given the newness of technology, you'd probably will go to Tesla for fixes within couple of years for this or that thing, and will repeat that several times over the next decade (if it keeps working). You can manage that loop without internet connection, but the fact is you and Tesla are working together for the life of the product, so why make it harder? You can design the system that works Sneakernet-style, but why?
The legal and perception issues are a good point. Annoying, but I get it.
> And you need Tesla if something goes wrong, thus by extension you need it too.
No, what you mean is that they can get away with it, because among their customer base, more people don't care that people that do.
> And you need Tesla if something goes wrong, thus by extension you need it too.
Trying to get "off the grid" rarely is extreme to the point that you cut yourself from civilization completely. It's ok to have external help from time to time. It's just that your daily operation should not depends on it.
In 2007 there was an estimated 7,200 reported home structure fires involving water heaters resulting in 30 civilian deaths, 340 civilian injuries and $75 million in direct property damage.
I'm not sure why there is no outrage about this, probably because it's an old technology and people got used to danger?
Yes, they do, just like every other product, including dangerous products. Some of those products handle similar amounts of energy and some involved chemistry that was just as hazardous as LiNiMnCoO2 orLiNiCoAlO2. To accommodate these hazards sometimes we required the end user to get special training/licensing (e.g. cars). The most important safety feature that we've learned over the last few centuries is that hazardous products must be designed to fail safely.
> Remote monitoring ensures
This is useless for safety[1], because the network isn't a reliable to the degree that is required for safety. You have to assume the network will not be available, sometimes for long periods of time (months), sometimes for reasons outside the user's control.
Anybody selling a product that ignores the lesson of the Therac-25 should be held criminally liable for any damage/injury caused by their product.
[1] it may be useful for other reasons unrelated to safety
[2] (pdf) http://sunnyday.mit.edu/papers/therac.pdf
What if you can do it, but you're not certain of all the possible modes of failure over a decade of use in people's garages?
You aren't serious, right? This is not a new thing to be thinking about. You should be certain of all the possible modes of failure over a decade of use. Otherwise, as the comment said, you shouldn't be allowed to participate in the market. This isn't new secret whizbang technology. The only major difference is battery type. If Tesla doesn't know enough to know what may happen there over a decade of use, ...
That's the part to be worried about.
https://www.youtube.com/watch?v=AAZ62tUtc0w
The PowerWall seems to be impressively safe:
https://electrek.co/2016/12/19/tesla-fire-powerpack-test-saf...
But I can still understand a desire to keep in constantly monitored.
If they are actively monitoring for devices that are about to catch fire, and if so will call the fire department to come to your house, and your neighbours to evacuate, then sure it makes sense - but I assume they are just monitoring 'usage analytics', and the fault detection could work just as safely by shutting off the device and prompting the user for action, as another comment suggested.
It's the same with their cars, although having a constant connection to HQ allows faults to be diagnosed quicker, I'd rather it just show a check engine light and go to a dealer (oh wait...).
There is also no reason at all to make availability depending on Internet access. Especially, when you are providing a solution that is intended for a self-contained, self-sufficient use case: "Make" power, store power, use power.
However, putting a large number, of potentially very dangerous Lithium Ion batteries in peoples home is a new and novel application with potentially fatal consequences.
I guess the risk is that there's some unknown failure mode, such as after X hours of continuous discharge there's a higher possibility of thermal runaway etc. Being able to disable a unit, or deploy an updated firmware seems valuable in those situations.
At least, this is how I imagine it would be sold to management and users.
Estimating and mitigating those risks are part of the safety analysis that should be happening for every product before it's sold too the public. If there is still a legitimate concern about the possibility of future catastrophic failure, the product isn't ready to be sold.
> possibility of thermal runaway etc
It would be incredibly negligent If protection against thermal runaway[1] isn't already part of the design from the very beginning.
> as after X hours
If a completely novel problem happens is discovered, that's what recalls are for.
> deploy an updated firmware
The network is not reliable. Where did everyone get the idea that the internet is acceptable when safety must be guaranteed>? 0Everyone has experienced network outages.
> seems valuable
Video games demonstrate that the ability to fix problems after purchase causes laziness. "Search/test for problems before purchase becomes "that's a minor bug, fix it after-launch", and eventually "We don't fix bugs in old products".
> sold to management
I guarantee that the managers will be sold on the dream of monetizing everyone's "pattern of life" profit, which should be easy to infer from electricity usage rates.
If they get too hot? Cut power. If voltage is too high? Cut power. If voltage ever goes below X? Permanently disable battery.
It's not complicated. It's a few thresholds to keep track of. Every laptop does it without an Internet connection and as laptops are used, they're very capable of burning your house down just the same as a powerwall. It's just going to be code on some computer across the Internet watching the battery metrics anyway, adding a network doesn't add any value.
I understand that companies really want constant telemetry from every product they produce. It's certainly possible these days, but it's ridiculous when a basic human necessity depends on your Internet working.
It feels like this could still be in the window of two large-ish business units coming together and working out the kinks (~9 months post acquisition), so it will be interesting to see if more of these stories of clearly botched service emerge or if OP is just unlucky on timing.
They are also required by law (IIRC) to include more and more invasive black boxes in the cars anyway.
So i guess they figure they might as well use the data.
(I'm just waiting till my car says "Tired of stomping on the brake so much? Maybe you should stop commuting and try UberPool!")
In theory, it sounds like a good idea but I learned recently that police can quite easily download the data from them (via the OBD port) and apparently it is common for them to do so when investigating accidents -- especially fatal ones. AIUI, they are not required to obtain a warrant in order to grab this data and that is my primary concern.
[0] https://gdpr-info.eu/art-21-gdpr/ - They are already in place at a EU level, but member states have until 2018 to bring them into national law.
I can't say with 100% certainty that it is happening, of course, but I do think that, yes, you should expect that it is. If, by some chance, it isn't happening, well, I'm sure it's just because they haven't figured out a way to make a dollar from the data yet. Give 'em time.
I am actually pretty convinced that my truck "phones home" at regular intervals and sends at least some data back to the mothership (odometer data, in particular, but who knows what else), especially after a recent OTA-delivered software update (the first that I am aware of since purchasing the truck). I would not be surprised at all to learn that my car also does so. Both vehicles have built-in (3G) cellular connectivity and both have apps available for interacting with them in various ways from a mobile phone (FWIW, I have never installed them, set up the necessary accounts online, etc., and never will).
In addition, ISTR hearing about (maybe a year or two ago?) some "data broker" that was purchasing vehicle data from manufacturers (or planning to do so, perhaps) and turning around and selling that data to automobile insurance companies. "Oh, he likes to drive 15 MPH over the speed limit? He's never been in an accident or been cited but let's go ahead and raise his rates anyways!".
I have thought before about looking into how to disconnect the cellular radios in my vehicles (especially the Dodge RAM -- cf. Charlie Miller's work) but, now, I think I may go through with it.
N.B.: My vehicles are 2013 (Dodge) and 2014 (Nissan) models. I'm sure things have only gotten worse in the few years since then.