Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 22, Road vehicles, Subcommittee SC 39, Ergonomics.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

The number of vehicles with internet connectivity capability is increasing. As a result, these vehicles are more vulnerable to hackers accessing the vehicle. Due to this, it is important to provide safe software updates to ensure vehicle safety.

Over the air (OTA) software updates add or modify vehicle features. Software require periodic improvements or feature additions. For example, advanced driver-assistance systems (ADAS), entertainment systems and navigation systems can be updated without going to the dealership.

The establishment and application of software-update engineering is important to ensure software quality, cybersecurity and safety. ISO 24089, which defines processes and functionalities for software-update engineering, has been established. The state of the vehicle is determined to ensure a safe software update. In the case of an update failure, measures are taken to guarantee safety of the vehicle. If the solution requires any exchange with the user during any of the OTA update steps, the user can be notified of the OTA update content, can be informed about the result of the update, and can also have the need to give permission for the update.

When the completion of an update can affect the safety of the vehicle, the vehicle manufacturer should demonstrate how the update will be completed safely. If a human-machine interface (HMI) is part of the safe execution for an OTA update, standardization of the HMI is needed to guarantee the customer understanding across different products. This is also beneficial in general on any occasion where an HMI can help to explain influences from OTA updates on the availability or quality of concerned features.

As additional explanation and support for developing specific requirements in case HMI aspects are involved in securing the safe and/or fully understood execution of an OTA update, use case examples of potential HMI interactions are provided in Annex A.

1 Scope

This document provides human-machine interface (HMI) design specifications in case an HMI is needed to secure the safe and/or fully understood execution of over the air (OTA) software updates for passenger cars (including sport utility vehicles and light trucks) and commercial vehicles (including heavy trucks and buses). The vehicle operator benefits from knowing if an OTA update has been successful or not, if an OTA update will influence the operation of the vehicle, or if the OTA update influences the quality of a feature. HMI specifications for the OTA software update provide support in case an HMI is needed in normal conditions, emergencies, low battery, avoidance of inadvertent actuations, alerts or specific non-standard situations.

2 Normative references

3 Terms and definitions

4 Design guidelines

4.1 General

4.2 Content

4.3 Visual information

4.4 Driver distraction

Bibliography