AUTOMOTIVE ARCHITECTURE

Automotive OTA

Updating a phone is one endpoint with spare flash and mains power. Updating a vehicle is fifty to a hundred and fifty endpoints, most of them small microcontrollers on CAN or LIN with no room for a second image, reached through a gateway, on a battery that must still start the car afterwards. The single-device update problem is solved. The campaign problem is not.

Multi-ECUCAN & LINUDSFlash bootloaderDeltaR155/R156Campaign

The endpoints What is hard Campaign flow Security

One campaign, from release to a vehicle that still starts

THE ENDPOINTS

Three classes of target, and they behave nothing alike.

A campaign has to accommodate all three at once. Designing for the easiest class and retrofitting the others is the common and expensive mistake.

Update targets in one vehicle
Class	What it runs	How it updates
High-performance compute	Linux or Adaptive AUTOSAR on a domain or zonal controller	A/B partitions, atomic switch, rollback — closest to conventional device update
Classic ECU on CAN	Classic AUTOSAR or bare-metal on a microcontroller, 256 kB to 4 MB flash	Flash bootloader entered over UDS; erase-then-write, usually with no room for a second image
LIN node	Small actuator or sensor node behind a CAN master, often 20 kbit/s	Reprogrammed through its master where supported at all; frequently excluded from campaigns entirely

The gateway is the only node with enough memory to stage images, which makes it the campaign engine whether or not it was specified as one.

WHAT IS ACTUALLY HARD

Eight problems, and none of them is the download.

No second image on most ECUs — a classic ECU rarely has flash for an inactive bank, so the update is destructive. The one structure that must survive is the flash bootloader: locked, never erased, and always able to re-request an image. That decision determines whether a failed update is a retry or a workshop visit.
Bus bandwidth sets campaign duration — classic CAN at 500 kbit/s delivers far less than its headline once diagnostic framing and flow control are accounted for. A megabyte-class ECU takes minutes; a thirty-ECU campaign can take hours. CAN FD helps and does not eliminate the problem.
Delta updates are not optional at fleet scale — sending full images to millions of vehicles over cellular is a data bill and a flashing-time problem simultaneously. Differential encoding against a known base version cuts both, at the cost of tracking precisely which base every vehicle holds.
Power loss mid-write — erase-then-write has a window in which an interruption leaves the ECU with no valid application. Battery state of charge is therefore a precondition, not a courtesy check: a long campaign on a weak battery turns an update into a recovery truck.
Preconditions are a safety argument — ignition state, gear position, vehicle motion, charge level and absence of active faults are all gates. Flashing a chassis ECU on a moving vehicle is the failure mode that ends a programme, so the interlocks are designed and reviewed as safety functions.
The campaign is a transaction, not a queue — ECUs have version dependencies on one another. Updating seven of twelve and failing on the eighth leaves a combination nobody tested. A compatibility matrix and a defined reversion path for the whole set matter more than any single-device mechanism.
Rollback without A/B means reflashing — reverting a classic ECU means writing the previous image back, so the previous images must still be retained and the bus time budgeted twice. Campaigns are planned around that cost rather than assuming an atomic switch.
Signature verification belongs at the target — if only the gateway checks the signature, a compromised gateway can write anything it likes to every ECU behind it. Each target verifying its own image is what makes the gateway untrusted infrastructure rather than a single point of total compromise.

CAMPAIGN FLOW

From release to a vehicle that still starts.

Release and compatibility

Images signed, versions registered, and the dependency matrix established across the affected set. A release is a combination of versions, not a file.

Distribution

Delta packages against each vehicle's known base, delivered over cellular with resumable transfer and integrity checked on arrival.

Staging at the gateway

The gateway holds the images and verifies what it can, but is not trusted to be the only thing that verifies.

Preconditions and consent

Ignition, motion, gear, battery charge, fault state and driver consent. A campaign that cannot meet its preconditions waits rather than proceeds.

Reprogramming

Each ECU entered into its flash bootloader over UDS, erased and written, with the bootloader itself untouched. Signature verified by the target before the application is marked valid.

Verification and activation

Version readback across the whole set, checked against the matrix. Activation only when every member is where it should be.

Reversion or completion

Either the set is complete, or the affected members are written back to their previous images and the vehicle is left in a combination that was tested.

Record

Software versions per vehicle retained for type approval and for the next delta to have a known base.

SECURITY AND HOMOLOGATION

Update stopped being a feature and became a type-approval requirement.

UNECE R156 — a software update management system is required for type approval in adopting markets, including records of which software versions are on which vehicle and an assessment of whether an update affects the approval itself.
UNECE R155 — a cybersecurity management system covering the vehicle lifecycle, not just the launch date, with threat analysis and a route to respond to vulnerabilities found in the field.
ISO/SAE 21434 — the engineering practice underneath those regulations: threat analysis and risk assessment, secure development, and monitoring across the service life.
Signing and key handling — images signed off-vehicle, verified on-vehicle, with keys held in a hardware security module rather than in application flash. The signing process has to remain operable and defensible in year ten.
Anti-rollback — monotonic version counters so a known-vulnerable image cannot be reinstalled by an attacker with bus access, balanced against the legitimate need to revert a failed campaign.
Diagnostic access control — the reprogramming path is also an attack path. Authenticated diagnostic sessions rather than the legacy seed-and-key exchange, and a considered position on what the port permits once the vehicle leaves the factory.

WHERE THIS APPLIES

Industries this serves.

Automotive & Mobility Transportation & Rail Industrial & Manufacturing

COMMON QUESTIONS

What engineers ask about this.

Why is automotive OTA harder than updating a phone?

A phone is one endpoint with spare flash and mains power. A vehicle is fifty to a hundred and fifty endpoints, most of them small microcontrollers on CAN or LIN with no room for a second image, reached through a gateway, on a battery that has to start the car afterwards. The single-device problem is solved; the campaign problem is where the difficulty is.

How are ECUs without A/B partitions updated safely?

The update is destructive — erase then write — so safety comes from the flash bootloader, which is locked, never erased, and always able to re-request an image. If power is lost mid-write the ECU has no valid application but can still be recovered over the bus, which is the difference between a retry and a workshop visit.

How long does a multi-ECU campaign take?

Bus bandwidth sets it. Classic CAN at 500 kbit/s delivers considerably less than its headline once diagnostic framing and flow control are counted, so a megabyte-class ECU takes minutes and a thirty-ECU campaign can take hours. CAN FD helps without eliminating the constraint, which is why delta updates matter.

Can LIN nodes be updated over the air?

Sometimes, through their CAN master where the design supports it. At typical LIN rates, reprogramming is slow enough that many programmes exclude LIN nodes from campaigns and handle them at service instead. That is a decision to take deliberately at architecture rather than discover during a rollout.

What happens if one ECU in a campaign fails?

The campaign is a transaction across a version combination, not a queue of independent updates. If a member fails, the affected members are written back to their previous images so the vehicle is left in a combination that was actually tested. Without A/B that means reflashing, so the bus time is budgeted twice.

Why must each ECU verify its own signature?

Because if only the gateway verifies, a compromised gateway can write anything it likes to every ECU behind it. Verification at the target makes the gateway untrusted infrastructure rather than a single point of total compromise.

Is over-the-air update a regulatory requirement now?

In adopting markets, yes. UNECE R156 requires a software update management system for type approval and R155 a cybersecurity management system, with ISO/SAE 21434 as the engineering practice underneath. Update capability moved from a product feature to a homologation obligation.

KEEP READING

Related work.

TECHNOLOGY

Bring us the difficult part.

Tell us the specification, the constraint and the deadline. Programmes that cross silicon, radio, embedded and AI are where Faststream is strongest.

Start a project Request an architecture review