Over-the-Air Vehicle Updates
Also known as: OTA update, over-the-air update, vehicle software update, connected car update
Over-the-air (OTA) vehicle updates are software and firmware updates delivered wirelessly to a connected vehicle via the internet: analogous to automatic software updates on a smartphone.
OTA updates allow manufacturers to fix bugs, patch security vulnerabilities, improve performance, update maps and navigation data, and add new features to vehicles already sold, without the vehicle needing to visit a dealership. Tesla popularized OTA updates in the automotive industry from 2012; most major manufacturers now offer OTA capability on newer vehicles.
Over-the-Air Vehicle Updates, explained at three levels
At home
OTA vehicle updates work the same way as app updates on your phone: the car connects to the internet via Wi-Fi or mobile data, downloads a software update, and installs it, often while you are asleep. You might wake up to find your car drives slightly better, has new features on the infotainment screen, or has had a safety issue fixed: all without taking it to a dealership. Tesla has used OTA updates to add features like new driving modes and to fix problems that would have previously required a recall.
At work
For fleet managers, OTA updates significantly reduce the cost and logistics of keeping vehicle software current. A traditional fleet requiring dealership software updates across hundreds of vehicles means scheduling appointments, taking vehicles off the road, and paying technician time. OTA updates can be staged across the fleet overnight with vehicles remaining in service. However, fleet operators need policies governing when updates are applied (to avoid unexpected behaviour changes mid-shift) and how to roll back if an update causes issues.
At home
OTA updates in vehicles are more complex than phone updates because they can affect safety-critical systems. Updates to infotainment, navigation, and telematics systems carry relatively low risk. Updates to powertrain control software, braking systems, or driver assistance systems affect safety-critical functionality and require more rigorous development, testing, and regulatory oversight. Manufacturers typically run safety-critical OTA updates through the same ASPICE and functional safety validation process as the original software, and some jurisdictions require regulator notification or approval for safety-critical OTA updates.
At work
Cybersecurity is a critical consideration for vehicle OTA systems. A vehicle's OTA system is a potential attack surface: a malicious actor who could push unauthorized software to a vehicle could potentially compromise safety-critical systems. OTA systems must implement code signing (the vehicle verifies the update is from a trusted source before installing), encrypted transmission, secure boot (the vehicle verifies software authenticity on every start), and rollback capability. The 2015 Jeep Cherokee hack (where researchers remotely took control of a vehicle's steering and brakes via an unprotected cellular connection) was a formative incident driving cybersecurity investment in connected vehicles.
At home
OTA updates enable the concept of the software-defined vehicle: a vehicle whose features and capabilities can be upgraded through software, more like a platform than a fixed product. Manufacturers including BMW, Mercedes, and Tesla have sold features unlocked via OTA after purchase, such as extra acceleration or driver-assistance packages, though BMW dropped its widely criticized heated-seat subscription in 2023. This model represents a significant shift in automotive business models, extending the revenue relationship between manufacturer and owner beyond the initial vehicle purchase.
At work
From a practitioner standpoint, fleet management systems must account for OTA updates in vehicle configuration management: tracking the software version on each vehicle, the update state (update available, update staged, update installed, update failed), and the ability to defer or schedule updates to minimise operational disruption. Safety-critical updates (especially those addressing a safety recall) may need mandatory application timelines. Non-critical feature updates can be scheduled to align with vehicle downtime.
Real-world examples
At home
Thomas owns a connected electric car. One morning he woke up and his car notified him that an OTA update installed overnight had improved regenerative braking calibration and added a new park assist mode. He did not need to book a service appointment or do anything: the car updated itself while he slept.
At work
A car rental company operating 800 connected vehicles received an OTA safety update from a manufacturer addressing a braking system calibration issue. Rather than scheduling 800 service appointments (which would have taken weeks and removed vehicles from the fleet), the fleet management platform staged the OTA update to all affected vehicles to install during overnight off-hire periods. All 800 vehicles were updated within four days with zero service appointments.
Common confusions
- OTA updates are not all the same risk level. An update to the music streaming app in the infotainment system carries minimal risk. An update to the adaptive cruise control system's control logic affects safety-critical functionality and requires the same rigorous validation as the original software. Grouping all OTA updates as equivalently low-risk is incorrect: safety-critical OTA updates in the automotive industry are held to the same functional safety standards as original software development.
- OTA updates do not make vehicles immune to recalls. Safety recalls can be addressed via OTA updates if the root cause is a software issue, but hardware defects still require physical service. A recall for a faulty airbag inflator cannot be fixed by OTA; a recall for a software error in the stability control algorithm often can be. The distinction matters for fleet managers estimating recall logistics.
- OTA updates can introduce regressions as well as improvements. Software updates that improve one system can inadvertently affect other systems. Fleet operators should not automatically apply all OTA updates immediately: staging updates to a subset of vehicles first, monitoring for issues, and rolling out to the full fleet if no problems emerge is a safer approach.
For analysts
In BA artefacts, OTA update requirements surface in connected vehicle fleet management, vehicle procurement specifications, and cybersecurity governance. When documenting requirements for fleet management systems, include: 'The system must track OTA update availability, staged status, and installation status for each vehicle. Safety-critical updates must be flagged and require acknowledgement from the fleet manager before staging. The system must support scheduling update installation windows aligned with vehicle downtime to minimise operational disruption.' Procurement requirements should specify OTA capability, the manufacturer's OTA update policy (whether updates are free or subscription-based), and cybersecurity certification for the OTA system.
History & origin
Tesla pioneered automotive OTA updates at scale from 2012, using them to fix bugs, improve performance, and add features (including Autopilot capability) to vehicles already in customers' hands. The automotive industry largely relied on dealer-performed software updates (requiring a physical visit) before Tesla's model proved the viability and customer acceptance of OTA. General Motors' OnStar system had offered limited telematics OTA capabilities from 1996 but not comprehensive software updates. By the early 2020s, virtually all major OEMs announced OTA capability for their new EV and software-defined vehicle platforms, both because of Tesla's competitive example and because the growing complexity of vehicle software made dealer-based updates impractical.