kevinferron.comKevin Ferron

The over-the-air pipeline

How an update reaches a car: a staged rollout, an install that has to restore the old version or reach a safe state if it fails, and the regulation and standard that govern it.

  • UNECE R156
  • ISO 24089

An over-the-air update is a release process with a car at the end of it. The package is built, protected, aimed at a set of vehicles, rolled out, installed and checked. UN Regulation 156 is written around that path, and so is ISO 24089.

R156 asks two things. The manufacturer needs a software update management system: unique version identification, a check that an update fits each target car, and an assessment of what it does to type-approved systems. And the car needs to cope: restore the old version or reach a safe state if an update fails, have enough power to finish, and not be driven if updating mid-drive could be unsafe.

ISO 24089 works at the level of engineering practice. It sets requirements for the organisation and for each project, across vehicles, systems, ECUs, infrastructure and update packages, and does not pick a technology.

Step through the pipeline below and each stage shows the clauses that bear on it. Where I have placed a clause on a stage, that is my reading of it. The staged rollout is SDVGuru’s framing, drawn as an ordered sequence with no figures: no source I used gives rollout percentages, update sizes or campaign durations.

The two-slot install is an illustration too. The sources say what an install has to achieve, restore or safe state, not how a car gets there.

Install outcome

1. Build

The release is built into an update package. The package is a new version of the software, and can be as small as a change to configuration parameters.

What the sources ask at this step

  • UN R156 · 7.1.1

    The manufacturer’s software update management system must identify every software version uniquely, with integrity validation data.

    UN R156: 7.1.1: processes of the software update management system

  • UN R156 · 2.2

    Software that matters to type approval is tied to an identifier the manufacturer defines (the RXSWIN).

    UN R156: 2.2: definition of RXSWIN

  • UN R156 · 2.3

    A software update counts even when it only changes configuration parameters.

    UN R156: 2.3: definition of software update

  • ISO 24089 · abstract

    Sets engineering requirements and recommendations for update packages, among other things, at organisation and project level.

    ISO 24089: Catalogue abstract: scope includes update packages

Around the whole pipeline

  • ISO 24089 sets engineering requirements and recommendations for software updates at organisation and project level. It covers vehicles, systems, ECUs, infrastructure and update packages and prescribes no specific technology, so it applies along the whole pipeline.ISO 24089: Catalogue abstract: scope; no specific technology
  • R156 asks for a certificate for the manufacturer’s update management system, valid for up to three years. Existing type approvals stay valid if it expires.UN R156: 6.6 and 6.10
  • R156 applies to vehicles of categories M, N, O, R, S and T that permit software updates. The original text has been in force since 22 January 2021.UN R156: Scope; in force 22 January 2021

Sources

  1. UN R156 UN Regulation No 156: Software update and software update management system. Original text, OJ L 82/60, 9 March 2021.

    • Software update management system and update requirements
    • 7.1.1 processes
    • 7.2.2.1 and 7.2.2.3
    • 7.2.2.1
    • 7.1.1: processes of the software update management system
    • 2.2: definition of RXSWIN
    • 2.3: definition of software update
    • 7.2.1.1
    • 7.1.3: security
    • 7.1.1: target vehicles, compatibility, effect on type-approved systems
    • 7.1.1: informing the vehicle user
    • 7.2.2.2
    • 7.2.2.3
    • 7.2.2.4 and 7.2.2.5
    • 7.2.1.2.2
    • 6.6 and 6.10
    • Scope; in force 22 January 2021

  2. ISO 24089 Road vehicles — Software update engineering. Ed. 1, 2023; Amd 1:2024 (catalogue abstract).

    • Catalogue abstract: software update engineering
    • Catalogue abstract: scope
    • Catalogue abstract: scope includes update packages
    • Catalogue abstract: scope includes infrastructure
    • Catalogue abstract: scope; no specific technology

  3. SDVGuru SDV Architecture 2026: The Definitive Guide (S. Amin). June 2026; framing only, no figures.

    • Framing only: staged rollout from a canary fleet to a small share, a larger share, then the rest
    • Framing only: staged rollout from canary fleet to ~1%, ~10%, then the rest
    • Framing only: telemetry-triggered rollback

  4. UN R155 UN Regulation No 155: Cyber security and cyber security management system. Original text, OJ L 82/30, 9 March 2021.

    • Annex 5 part A: threats on update procedures

  5. AUTOSAR Adaptive AUTOSAR Adaptive Platform. R25-11.

    • Vehicle Update and Config Management
    • Vehicle Update and Config Management functions

Everything here is paraphrased from the pinned sources, not quoted, and figures are attributed to them. Anything illustrative is labelled as such. Where a source is silent the page says so instead of filling the gap.