UN Regulation No. 156: software update and software update management system
A vehicle type that permits software updates can be approved only if the manufacturer runs a certified software update management system that records every software version, identifies target vehicles, checks compatibility and effect on type-approved systems before an update is issued, and protects updates from manipulation. Over-the-air updates must not affect safety, must run only when preconditions such as sufficient power are met, must inform the user, and must let the vehicle restore the previous version or reach a safe state if an update fails.
Scope. Reaches a US vehicle manufacturer seeking type approval in a market that applies UN Regulation No. 156, such as the EU, which published it in its Official Journal; not in force in the United States.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Recovery assets outside the failure domain C-R1 | Implied | Paragraph 7.2.2.1.1: 'the vehicle is able to restore systems to their previous version in case of a failed or interrupted update or that the vehicle can be placed into a safe state'. Rollback is one of two permitted alternatives, so it is not strictly required. | high | not yet seen missing in a case |
| Actor identity verification C-A1 | Implied | Paragraph 7.2.1.1: 'The authenticity and integrity of software updates shall be protected to reasonably prevent their compromise and reasonably prevent invalid updates'; 7.1.3.1-7.1.3.2. | medium | 8 cases |
| Provenance of the actor's software and hardware C-A3 | Implied | Paragraph 7.1.1.2: all initial and updated software versions, 'including integrity validation data', uniquely identified; 7.1.2.3: 'an auditable register describing all the software relevant to the RXSWIN'. | medium | 1 case |
| Pre-execution validation C-D1 | Implied | Paragraph 7.1.1.7: confirm compatibility with target vehicles 'before it is issued'; 7.1.1.8: assess and record whether an update will affect type-approved systems. | medium | 4 cases |
| Destructive-action gate C-E3 | Implied | Paragraphs 7.2.2.1.2 (enough power), 7.2.2.3 (vehicle cannot be driven during an unsafe update), 7.2.2.5 ('preconditions have to be met before the software update is executed'). | medium | 12 cases |
| Independent audit log C-V1 | Implied | Paragraph 7.1.2: the manufacturer 'shall record, and store' defined information for each update applied to a vehicle type. | low | 1 case |
| Mandate disclosed to supervisor C-M1 | Implied | Paragraphs 7.2.2.2 and 7.2.2.4(a): the user is informed about an update before it is executed and of its success or failure. | low | 1 case |