Testing the Interrupted Update: A Fault-Injection Method for Verifying Recovery in Automotive Over-the-Air Software Updates

Abstract

Interrupted over-the-air (OTA) software updates can leave uncertainty about whether an automotive controller will complete the update, retry the operation, roll back to a valid image, or enter a safe state. This paper presents a fault-injection method for verifying recovery behavior during automotive OTA software updates. The method combines controlled interruption points, fault types, vehicle-state conditions, and evidence requirements into repeatable test cases. It defines a hardware-in-the-loop test arrangement and an evidence timeline for correlating update-service events, communication behavior, power changes, controller responses, recovery actions, and final software-state verification. The approach is intended to help engineering teams identify recovery defects before customer deployment and provide traceable evidence that an interrupted update reaches an acceptable final state. The method is presented as a practical validation approach for connected-vehicle software update testing.