GB/T 45493-2025Requirements of implementation of motor vehicle products recall based on over-the-air update technology (English PDF)

3.1 Software

The part of an electronic control system that consists of digital data and instructions. [Source. GB 44496-2024, 3.1]

3.2 Software update

The process of updating a certain version of software (3.1) to a new version (including changing the configuration parameters of the software) through an update package.

3.3 Over-the-air update; OTA update

A software update (3.2) in which the update is transferred to the vehicle wirelessly rather than using cables or other local connections.

3.4 Software download

The process of transferring software (3.1) from one computer system to another.

NOTE. The computer system includes vehicles, backend servers, etc.

3.5 Update package

Software package for software update (3.2).

[Source. GB 44496-2024, 3.6, modified]

3.6 Rollback

The process of undoing the current operation or change and restoring the system to the original version state before the operation or change was performed.

3.7 Recall activity based on over-the-air update

The entire process by which manufacturers take measures to eliminate defects or emission hazards in already sold automotive products through over-the-air update.

3.8 Technical service activities based on over-the-air update technology

The process by which manufacturers provide technical solutions to non-defect issues for already sold automotive products through over-the-air update.

3.9 Update scope

The boundary involved by over-the-air update to solve problems, add new features or improve performance.

NOTE. For example, product production start and end dates, production batch number or batch, etc.

3.10 Recall parts

Electronic control units and software that implements recall activities through over-the- air update to eliminate defects.

5.1 Over-the-air update activities include technical service activities based on over-the-

air update technology and recall activity based on over-the-air update.

5.2 The implementing entities of over-the-air update activities include manufacturers,

recall authorities, recall technical institutions, etc.

5.3 Manufacturers shall comply with the implementation procedures shown in Figure 1

when carrying out technical service activities based on over-the-air update technology and recall activity based on over-the-air update.

6.2.2 When manufacturers use over-the-air update technology to add new functions or

improve performance, they shall conduct risk assessment or emission hazard assessment on the updated automotive products. Activities are classified according to the assessment results.

6.3 Security guarantee requirements

Manufacturers shall establish management systems and guarantee capabilities that are compatible with over-the-air update activities to ensure the safety of vehicles during and after the implementation of recall activity based on over-the-air update and technical service activities based on over-the-air update technology.

- The process of over-the-air update shall comply with the requirements of Chapter 4 and Chapter 5 of GB 44496-2024;

- It is not advisable to update while driving unless the update procedure requires it.

In this case, make sure the vehicle is in a safe state during the update process;

- For the execution process of over-the-air updates that may affect the safe use of the vehicle, other technical measures shall be taken to ensure the safety of the vehicle during the update process;

- For vehicle over-the-air updates that may fail or have errors, ensure that the on- board software update system is restored to a previously available version or the vehicle is in a safe state in a timely manner.

7.1 Filing for technical service activities based on over-the-air update technology

The time requirements for manufacturers to file technical service activities based on over-the-air update technology are as follows.

7.1.2 Filing contents

When a manufacturer records a technical service activity based on over-the-air update, the content of the record includes basic vehicle information, basic update service information, update package information, cloud platform information and safety protection information.

7.2 Filing for recall activity based on over-the-air update

7.2.1 Filing time

The time requirements for manufacturers to file recall activity based on over-the-air update are as follows.

- The manufacturer shall complete the recall plan filing in accordance with the requirements of the recall authority within 5 working days after confirming the defect or emission hazard;

- The manufacturer shall complete the over-the-air update information filing within

7.2.2 Filing contents

7.2.2.1 Recall plan

The recall plan for recall activity based on over-the-air update filed by the manufacturer shall clearly state the update scope, recall measures and principles, proof of effectiveness of measures, planned recall completion rate, etc.

7.2.2.2 Update information

7.2.2.2.1 Basic information Basic information includes basic vehicle information, basic update service information, update package information, cloud platform information and security protection information.

If the manufacturer has not completed the preparation of over-the-air update information when filing a recall plan, the manufacturer shall clearly state the principles of the over-the-air update recall measures and the effectiveness proof of the measures in the recall plan filing materials, and then issue a recall announcement.

7.2.2.2.2 Update strategy information The update strategy information includes but is not limited to the following.

- Update strategy, clearly specify the implementation plan and goals in batches or regions;

- Update strategy effectiveness evaluation plan, grayscale definition, supporting after-sales strategy and emergency response measures.

7.2.2.2.3 Update package information The update package information includes but is not limited to the following.

- Update package naming rules, data format, and corresponding controller version information before and after the update;

- Update package security policy, including certificate information, encryption algorithm or mode (if encrypted).

Certification that the update package information security complies with GB 44495- 2024 provided by the manufacturer OR update package security evaluation report and vulnerability security test report provided by a third-party testing agency. If the over- the-air update method is differential update, the original update package, as well as differential algorithm or restoration method, and signature verification method related information shall be provided.

7.2.2.2.4 Update component information The update component information includes but is not limited to the following.

- Basic information of the update component, including the main MCU, operating system, software version and other hardware and software information and their functional changes;

- Software and hardware information of controllers related to the update component and their functional changes;

- Electronic and electrical architecture information such as network topology and in- vehicle network communication methods related to the system involved in the update component;

- Units, subsystems and vehicle functions and information security test reports of the update component and related systems.

8.1 Recall notice

8.1.1 Notice content

The content of the recall notice shall at least include the recall parts, description of the defect, possible consequences of the defect, update duration, vehicle condition conditions that must be met during the update, and disposal measures for update failure.

8.1.2 Notification method

8.1.2.1 The manufacturer may issue a recall notice in the following ways, including but not limited to. - Registered mail;

- Vehicle-side methods such as vehicle-mounted HMI, vehicle-mounted IVI, instrumentation, HUD, etc.;

- Mobile phone text messages, mobile phone applications (Apps), etc.

8.1.2.2 The vehicle-side notification method shall be preferred. If the vehicle-side

notification method cannot be used due to vehicle hardware or software problems, the vehicle-side method can be used, but the notification shall be recordable and traceable.

8.1.2.3 If the vehicle user still has not updated after the manufacturer has confirmed and notified the vehicle user 5 times or more, a symbolic warning reminder can be issued on the vehicle end. The warning reminder is designed by the manufacturer and shall include obvious warning words.

8.2 Update log

8.2.1 Log transmission

The manufacturer shall upload the update log to the intelligent connected vehicle safety big data cloud platform in a timely manner.

8.2.2 Log content

The update log shall include but not be limited to the following.

- Cloud service platform system management log, including update completion status, update failure reason information and information security logs during the update process;

- Vehicle-cloud interaction log, including information, time, version number information before and after the update, update result, and update completion time information received by the vehicle-side over-the-air update request from the cloud;

- Execution log of the controller to be updated on the vehicle-side, including version information before and after the update of the controller to be updated, update execution time, update times, update results, update result judgment, and controller version information after the update;

- User HMI confirmation log, including user HMI confirmation information display time, display mode, user confirmation over-the-air update time, and user confirmation over-the-air update result information;

- In-vehicle over-the-air update communication log, including update scope confirmation, update package download time, over-the-air update vehicle status, and update start and end time information.

8.3 Supervision of over-the-air update process

8.3.1 Manufacturers

8.3.2 Recall authority

8.3.2.1 The recall authority shall review the over-the-air update log submitted by the

manufacturer to verify whether the recall notice issued by the manufacturer complies with the requirements of the recall authority, whether the vehicle users can receive the remote recall notice, and whether the implementation of the recall activity complies with the recall plan filed by the manufacturer.

9.1 Evaluation method

The recall of automobile products based on over-the-air update technology shall be evaluated in accordance with GB/T 39603-2020.The overall completion of over-the- air update and offline update shall be comprehensively evaluated. If necessary, the effectiveness of the recall measures shall be verified.

9.2 Verification of the effectiveness of recall measures

After the recall of over-the-air update is implemented, if a large number of user complaints occur, the effectiveness of the measures shall be verified from the aspects of functional verification and information security verification. Among them, a large number of user complaints refers to when the number of valid complaints is greater than or equal to 50, or when the number of valid complaints is less than 50 but the ratio is greater than 5/1000. ......