Under UN R156, a manufacturer must define routines for update failures, and a vehicle must be restorable to its previous state if an update fails or is interrupted, according to UL's summary. In practice that means keeping a known good image, verifying before switching and recording what happened.
What the regulation summary says
UL's overview of R156 lists restore capability as part of a software update management system. It adds that the confidentiality, integrity and availability of the update must be protected, and that an update should be tested and validated before release because updates can introduce new vulnerabilities or safety issues.
The wording above is from a summary. Check the regulation text for the exact requirement in your market.
Common patterns that make restore possible
The sources do not prescribe a design, so these are general engineering patterns.
- Keep the old version until the new one is proven. The reference page on over the air updates describes Android installing to a second partition in the background and switching on the next reboot. The same idea applies to control units with enough memory for two images.
- Verify before activation. Check authenticity and integrity of the image first, then switch.
- Check after activation. The car should verify the integrity of affected systems after the update.
- Use a watchdog or health check. If the new version does not report healthy, fall back.
- Handle power loss. Interrupted writes should leave a bootable state.
Where it gets hard
Control units with little memory cannot always hold two images. Such units may rely on a special recovery mode, a workshop procedure or a smaller recovery image. The interactions between units matter too: updating one unit to a version that expects a newer neighbor can break the group, which is why records of interdependencies are part of the documentation UL lists.
Questions to ask your supplier
- Which units can roll back by themselves, and which need a workshop?
- What state is the vehicle in if power is lost mid write?
- How is a failed update recorded and reported to the manufacturer?
- How does the owner find out?
- Is the old image kept long enough to allow restore, and can an attacker abuse that to force a downgrade?
The last question is the tension. Restore needs an old image, while rollback protection wants old versions refused. Designs usually allow a controlled fallback to the previous known good version and reject anything older.
Informing the owner
UL notes that the manufacturer must define how owners are informed of updates. A failed update is a good case to design that message for before it happens.
Quick check
Is the ability to roll back the same as allowing any old version?
No. Restore usually means returning to the immediately previous good version, while arbitrary downgrades are a known attack.
Sources
Last reviewed: 19 October 2026.
