RealtimeOTA | Deterministic Over-the-Air Updates & Fleet SUMS Architecture
Standardized technical reference architecture for automotive OEMs, Tier-1 electronic suppliers, and autonomous mobility fleets. Implementing UNECE R156 SUMS, ISO 24089, dual-bank A/B atomic rollback, and post-quantum Uptane code signing.
Deterministic OTA Execution Architecture Modes
- 01. UNECE R156 SUMS & Dual-Bank Rollback: Dual-bank A/B memory isolation with hardware-enforced boot counters, ensuring zero-brick atomic rollback within 420 ms if post-update health checks fail. (Flow: Target ECU -> Primary Bank Active -> Flash Secondary Bank -> Health Assertions -> Atomic Commit (< 420 ms))
- 02. Uptane & Post-Quantum Supply Chain: Uptane IEEE-ISTO 6100 framework separating Director and Image repositories, attested via FIPS 204 ML-DSA-87 quantum-resistant signatures to eliminate supply-chain vulnerabilities. (Flow: Offline Root HSM -> Director & Image Repositories -> FIPS 204 ML-DSA-87 Signatures -> In-Vehicle Attestation)
- 03. Deterministic TSN & CAN-XL Delta Flashing: Binary differential compression cutting update payloads by 91.8%, dispatched across deterministic IEEE 802.1Qbv TSN backbones and 100 Mbps CAN-XL buses to zonal ECUs. (Flow: Courgette/bsdiff Binary Delta -> 91.8% Compression -> IEEE 802.1Qbv TSN Shaper -> CAN-XL 100 Mbps ECU Bus)
- 04. Fleet Campaign Orchestration & Telemetry: Multi-ring staged campaign engine (Canary 0.1% to Global 100%) enforced by strict vehicle interlocks (Parked, Engine Off, SOC > 50%) and sub-35 ms abort broadcasts over QUIC. (Flow: Canary Ring (0.1% -> 100%) -> Geofenced Vehicle Interlocks -> MQTT v5 over QUIC -> Sub-Second Fleet Abort)
End-to-End OTA Architecture Layers
- Layer 01: Cloud & OEM Uptane Repositories: Director and Image repositories with offline root key protection, software bill of materials (SBOM) tracking, and FIPS 204 ML-DSA-87 signatures.
- Layer 02: In-Vehicle Telematics Control Unit (TCU): Uptane Primary client terminating mTLS 1.3, verifying director metadata, decompressing Courgette binary deltas, and scheduling campaign staging.
- Layer 03: Deterministic TSN & SOME/IP Bus Dispatch: IEEE 802.1Qbv time-aware shapers and SOME/IP diagnostic routing delivering 100 Mbps CAN-XL firmware packets without starving critical ADAS frames.
- Layer 04: Zonal Target ECUs & Atomic Flash Banks: Secondary bank staging, ISO 26262 ASIL D watchdog verification, boot attempt counters, and sub-420 ms fail-safe rollback to active bank.
OTA Performance & Reliability Benchmarks: 91.8% (Delta Compression Ratio) | < 420 ms (Hardware Atomic Rollback) | 1.8 ms (ML-DSA-87 Verification) | < 35 ms (Fleet Abort QUIC Broadcast)
Core Specifications
- Deterministic Dual-Bank A/B Rollback & Watchdog Interlocks — In software-defined vehicles, firmware flashing cannot be an all-or-nothing hazard. The dual-bank A/B architecture maintains an active, validated golden bank while the staging bank receives verified differential chunks.
- TSN IEEE 802.1Qbv & SOME/IP In-Vehicle Flashing — Modern zonal vehicle architectures deploy multi-gigabit Ethernet spines connected to CAN-XL sub-buses. RealtimeOTA utilizes IEEE 802.1Qbv Time-Aware Shapers to reserve dedicated time slots for firmware transfer.
- UNECE R156 SUMS & RxSWIN Type-Approval Architecture — Under UNECE Regulation 156, any software update that affects vehicle emissions, safety systems, or functional characteristics requires strict traceability through a Software Update Management System (SUMS).
Technical Whitepapers & Research