What Is an Over-the-Air Update Gateway?

Software delivery

Software delivery begins outside the car. A manufacturer's backend server decides which vehicles are eligible for a given update, usually by comparing the software versions a vehicle has reported with a target configuration. When a campaign applies, the vehicle's connectivity hardware downloads an update package. This is typically a cellular modem in the telematics unit, or a Wi-Fi connection where supported. The gateway or a closely associated controller generally receives that package, stores it in local memory, and tracks download progress. That way, an interrupted transfer can resume instead of starting over. Many systems download in the background while the vehicle is driven or parked, and only move to installation once the package is complete.

An update package is more than a single file. It commonly contains software images for one or more modules, plus metadata describing which hardware and software versions each image applies to. It also carries installation instructions and cryptographic signatures. Some manufacturers send full images. Others use delta updates that carry only the differences from the installed version. Delta updates reduce download size, but the receiving side must then reconstruct the complete image correctly. At this stage, the gateway treats the package as a set of instructions rather than installing anything immediately. It checks that the package is intended for this vehicle and holds it until installation conditions are met. It also coordinates with the driver interface when the owner's consent or scheduling is required.

Module routing

A modern vehicle may contain many electronic control units spread across several networks, such as CAN, CAN FD, LIN, FlexRay and automotive Ethernet. These networks are deliberately separated, so a module on one bus cannot simply talk to a module on another. The gateway sits at the junction of these networks and forwards traffic between them according to defined rules. For updates, the gateway is the path between the downloaded package and the target module. It translates the transfer into whatever protocol and bus that module understands.

Flashing a control unit is typically done with diagnostic protocols, the same family of services a dealer scan tool uses. Unified Diagnostic Services, defined in ISO 14229, provides commands for the main steps: entering a programming session, unlocking security access, erasing memory, transferring data in blocks and resetting the module. On Ethernet-based architectures, Diagnostics over IP, defined in ISO 13400, carries these services. The gateway can act as a local update master. It opens a programming session with the target, streams the image at the rate the bus and module allow, and keeps other traffic from interfering. Some newer modules have enough storage to receive an image in the background and switch to it later. In those cases, the gateway has less of this sequencing to manage.

Routing also involves ordering. Updates often span several modules whose software must remain compatible with one another. For that reason, the gateway or its orchestration software follows a sequence and dependency list taken from the package metadata. For example, if a body controller and an instrument cluster need matching versions, both must be updated within the same campaign. Network separation matters for security as well. The gateway typically restricts which sources may send programming commands to which networks, so an external connection cannot address safety-relevant modules directly.

Verification

Verification starts before a single byte reaches a module. The manufacturer digitally signs each update package, and the gateway or receiving module checks those signatures against trusted keys stored in the vehicle. Hash values confirm that the image was not altered or corrupted during download. Uptane is a security framework developed for automotive over-the-air updates. It describes how metadata from separate signing roles can protect against tampered, outdated or mismatched images, although manufacturers implement their own approaches and the details differ. The package metadata is also compared with the vehicle's actual hardware part numbers and current software versions. As a result, an image intended for a different module revision is rejected.

More checks happen during and after installation. Modules commonly confirm each transferred block and verify the written memory before marking the new software as valid. Many target modules also use secure boot, which checks the software signature every time they start. After flashing, the gateway can query each updated module to read back its software version and confirm that it responds normally. Some modules support dual memory banks, often described as A/B partitioning. On those modules, a failed check can return the module to its previous version. Finally, the vehicle reports the outcome to the backend, which records the installed configuration. Where UN Regulation No. 156 applies, manufacturers must operate a software update management system. ISO 24089 describes engineering requirements for the update process itself.

Practical implications and limits

For owners, the gateway's design explains several everyday behaviors. Installations that touch driving-related modules usually require the vehicle to be parked, and the car may be unavailable until the process finishes. Systems commonly check battery condition before starting, because a module that loses power mid-flash may be left unusable. Keeping the battery healthy and following any charging prompt reduces the chance of a postponed or failed update. A weak cellular signal can slow or pause downloads, but it does not affect the software already installed. A notification that an update is ready generally means the package has already been downloaded and checked, with only installation remaining.

There are also limits. Not every module in a vehicle is necessarily reachable over the air. Depending on the architecture, some units may still require a dealer visit with a wired diagnostic tool. Several details are decided per vehicle: which modules can be updated, how long installation takes, and whether the owner can postpone or decline an update. The owner's manual or the manufacturer's information is the reliable reference for a particular car. Over-the-air capability also does not replace hardware repairs. A recall may still require physical work even when part of the remedy is delivered as software. Aftermarket modifications to control modules can conflict with version checks. That may cause an update to be blocked, or the update may overwrite the modifications.