An OTA update, or over-the-air update, is the wireless delivery and installation of new software to a vehicle through a cellular or Wi-Fi connection, without a visit to a workshop. In vehicle software for electric vehicles and modern connected cars, OTA updates can change anything from map data and infotainment apps to the firmware of the battery management system, motor inverter or driver assistance functions.
OTA capability turns a car from a product that is finished at the factory into a platform that changes over its life. It lets manufacturers fix defects, close security vulnerabilities, satisfy recalls and add features remotely, but it also demands strict security, safety validation and regulatory compliance, because faulty code can affect how the vehicle drives.
How an OTA update reaches the vehicle
An OTA update follows a controlled pipeline from the manufacturer’s update server to the target electronic control units (ECUs). The server selects eligible vehicles by model, configuration and current software version, then the car’s telematics control unit downloads a signed package, verifies it and hands it to an onboard update manager that installs it on each ECU.
- Campaign definition: the manufacturer defines which vehicles, versions and regions receive the package.
- Download: the telematics unit fetches the package over LTE, 5G or home Wi-Fi, often in the background while driving or parked.
- Verification: cryptographic signatures and hashes confirm the package is authentic and intact.
- Installation: the update manager flashes each target ECU, usually while parked and with the driver’s consent.
- Validation and reporting: the car checks that every ECU runs the new version and reports success or failure back to the server.
Packages are often sent as delta updates that contain only the changed parts of the software, which reduces download size and data cost. Many vehicles use A/B partitions, installing the new version on an inactive memory bank so the old version stays available if activation fails.
Types of OTA update
OTA updates differ by which software layer they change and therefore by their risk. Industry usage distinguishes updates to non-safety content from deeper firmware updates, although manufacturers name them differently.
| Type | What it changes | Risk level | Typical install condition |
|---|---|---|---|
| Data update | Navigation maps, charging station lists, voice models | Low | In the background |
| SOTA (software over the air) | Infotainment, apps, user interface | Low to medium | Often while driving or parked |
| FOTA (firmware over the air) | ECU firmware such as battery, motor or brakes | High | Parked, ignition off, sufficient charge |
| Configuration or feature activation | Unlocks hardware already fitted in the car | Low to medium | Usually immediate |
| Security patch | Fixes vulnerabilities in connected components | Medium | Priority rollout |
Security and regulation of OTA updates
Because an OTA channel can reach thousands of cars at once, it is also an attractive attack surface. Protection rests on end-to-end cryptographic signing, secure boot on each ECU, encrypted transport and a hardware security module that stores keys. The Uptane framework is a widely discussed reference design for securing automotive update systems against compromised servers.
In many markets, OTA capability is now regulated. UN Regulation No. 155 requires a certified cybersecurity management system, and UN Regulation No. 156 requires a software update management system that records software versions, assesses the impact of each update on type approval and ensures safe installation. The related identifier RXSWIN tracks the software relevant to a vehicle’s type approval.
| Safeguard | Purpose | Failure it prevents |
|---|---|---|
| Code signing | Proves the package comes from the manufacturer | Malicious or tampered software |
| Secure boot | ECU runs only verified code at startup | Persistent compromise of a unit |
| Version rollback protection | Blocks installation of older vulnerable versions | Downgrade attacks |
| A/B partitions | Keeps a working fallback image | Bricked ECU after a failed install |
| Preconditions check | Verifies charge level, parking and gear state | Interrupted flashing or unsafe state |
OTA updates compared with workshop updates
Before OTA, software changes required a dealer visit with a diagnostic tester, which made recalls slow and expensive and left many cars on outdated versions. OTA updates reach a whole fleet within days or weeks, although manufacturers usually roll out in staged waves to detect problems on a small group first.
| Aspect | Workshop update | OTA update |
|---|---|---|
| Speed of fleet coverage | Months, depends on visits | Days to weeks |
| Cost per vehicle | Labor and downtime | Mostly data and server cost |
| Scope | Any ECU with a tester connection | Only ECUs designed for remote flashing |
| Failure recovery | Technician on site | Rollback or remote retry, otherwise workshop |
Not every ECU is OTA-capable. Older or simpler controllers may lack the memory, bootloader or network bandwidth for remote flashing, so the share of the vehicle that can be updated depends on its electrical and electronic architecture. Centralized, software-defined vehicle architectures make far more of the car updatable.
Practical considerations and pitfalls
For owners, an OTA update is usually simple: accept the prompt, keep the car parked and wait. Installations of major firmware can take from several minutes to over an hour, during which the car may not be drivable. Most systems require a minimum battery state of charge, both for the traction battery and the 12-volt auxiliary battery.
- Weak connectivity in underground garages can stall downloads; home Wi-Fi is often faster and avoids mobile data limits.
- Interrupted installations are designed to recover, but a failed flash may still require a workshop visit.
- Feature changes are not always additions. An update can modify or remove behavior, so release notes deserve attention.
- Paid feature unlocks delivered over the air raise questions about ownership of hardware already built into the car.
- Long-term support varies; a car may stop receiving updates once its platform is no longer maintained.
The short version
An OTA update works much like a software update on a smartphone, but for the car. The vehicle downloads new software through its own mobile connection or home Wi-Fi, installs it while parked, and then behaves a little differently or better than before.
This means a car can receive fixes and new features without a trip to the garage. Because car software also controls things like braking and charging, these updates are protected and tested much more strictly than ordinary phone apps.
Where it makes a difference
A manufacturer discovers that a control parameter in the battery management system causes slower fast charging in cold weather on about 50,000 electric cars already on the road. Instead of a workshop recall, it prepares a firmware update of roughly 300 MB, signs it and releases it first to 2 percent of the fleet.
After a week with no reported failures, the update reaches the remaining cars. Owners receive a prompt, schedule installation overnight while plugged in, and the process takes about 40 minutes. Winter charging times fall noticeably within a month, and the manufacturer records each new software version for its type-approval documentation, all without a single dealer appointment.