Case studies on software update Japan (Security TF of ITS/AD 30-31, August 2017 Den Hague, Netherlands)

Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA) Software updates: While post-registration updates are dealt with nationally, the group agreed to exchange further on such national processes to support them. The “S/W TAN” approach as measure to manage configuration control for the approval process (incl. pre- and post-registration issues) and checking during PTI/CTI was confirmed by the group An “offline meeting” for interested parties dealing with the S/W update approval process incl. S/W TAN was agreed (participants from GER, NL, JPN, CITA, OICA/CLEPA)

Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA) Software updates (continued): Further consideration shall be given to: Software Type Approval Number (S/W TAN): Review approach for „Whole Vehicle S/W TAN“ vs. „System-based S/W TAN“ 2) Administrative process to realize S/W TAN concept: Review approach for linking S/W versions, ECU‘s involved, etc. with S/W TAN Clarify roles and responsibilities in the process, e.g. involvement of Technical Service, etc. Role of customer involvement Information requirements to support the process

Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA) Software updates (continued): 3) Safety aspects of software updates: Develop principles/recommendations for safe execution of software updates 4) Impact of different reasons for updates on the requirements/approval process

Case studies on software update Reports of cases which ECU program updates were conducted for service campaign or recall (2014~) were collected and reviewed. Cases in which the updated program directly controlled the hardware accompanied physical inspection after the updates. In some cases, the calibration of actuator which required physical movement of the mechanism were followed to software update. These cases should be clearly separated from cases which can be enable OTA software updates.

Examples of software updates with physical inspections or calibrations Description of malfunction Update and follow up Case A (Inspections are followed) The diagnosis for catalyst condition for pollutants in the exhaust gas did not function properly because of the fail of the original software. The system would not warn the degradation of catalysis. The program of engine control unit was updated. Then, the catalysis was inspected if the lifetime was over. The catalysis was replaced in case the lifetime ended. Case B (calibrations are followed) The fuel direct injection was not controlled properly because of the fail of the original software. Then, the engine would not function properly. The program of engine control unit was updated. Then, the leaning process of injection was conducted. The relevant parts were inspected and replaced in case of getting damaged. In these cases, the updated software directly controlled hardware. Inspection or leaning process were followed after the updates. Such processes should be completed by technical experts and then OTA is not applicable for these cases.

Proposal for Case Studies on Software Update Security issues on software update have been addressed in the cyber-security session of CSTF. On the other hand, the case study of software update including OTA needs more time for summarizing. Japan proposes to postpone case studies of software update to next year (2018~) to invite experts for hardware controls.