Over-the-air software update process

Over-the-air (OTA) or firmware-over-the-air (FOTA) software updates must be developed, tested, and uploaded to a secure cloud-based server accessible by the vehicle to be executed. The vehicle, in turn, must be able to download and store the update, whether in the central compute system, zone controllers, or edge ECUs. Given that an ECU restart is typically required for the update to take effect, the update process must occur while the vehicle is in a safe state.

With an update being available, one option is to notify the driver of an available update and let the driver confirm the start of the update once the vehicle has been safely parked. Alternatively, by tracking vehicle usage times, the system can guess the best time to perform a software update without user intervention. The vehicle may be temporarily inoperable during this time, so the update must be completed efficiently to minimize downtime. The ECU must remain powered throughout the update, and consideration must be given to the vehicle's battery capacity. To mitigate risks, the ECU may be designed to store both the current software version and the new update in memory, allowing it to switch to the updated version during the next startup. If the update fails, the system can revert to the previous software version, ensuring continued vehicle functionality.

When vehicle functions are distributed across multiple ECUs, updates must be coordinated through carefully planned update campaigns. These campaigns involve deploying update packages to all affected ECUs to ensure system-wide compatibility and performance.