Software updates
With the increased digitalisation of vehicles, safety is taking on a new dimension. The number of connected cars on the road is growing exponentially. Software updates therefore play an increasingly critical role, both in the functioning of the vehicle and in road safety.
Vehicles are rapidly becoming more digital. There are now around 110 million connected cars on the road, a number that will run into 200 million in 2025. These technical innovations bring about new risks: cybercrime is on the rise.
Attacks on car systems, especially in smart and connected vehicles, pose a risk to the driver, passengers and other road users. This makes adequate software updates a matter of national and European interest.
The R156 sets new requirements for manufacturers, starting with the design of the Software Updates Management System (SUMS). Manufacturers record and demonstrate how they safeguard, monitor and maintain the quality of the associated digital service. The quality is to be maintained by the SUMS at organisational level and by complying with specific requirements at vehicle-type level. The SUMS applies to the development and (post) production phase of the vehicle.
Once the SUMS has been developed, RDW or a technical service designated by the RDW tests it on the basis of an audit.
If the system complies with the regulations, RDW issues a Certificate of Compliance (COC). RDW issues this COC for a maximum of 3 years, provided that the requirements continue to be met. The RDW verifies this on an on-going basis with the aid of information and cooperation provided by the manufacturer. The COC can be changed or withdrawn before the end of its validity.
Once the COC has been issued, the RDW experts validate the tests or carry out tests themselves. In the Netherlands, a number of technical services have now been (pre-conditionally) designated to do this as well. If the quality management systems have passed the assessments, the manufacturer can apply for a type-approval for the vehicle with the certification department of RDW.
This application is carefully assessed: all safety aspects must have been met. Also, information is exchanged at European level. If all requirements are met, the vehicle is approved and may be produced as specified.
Manufacturers remain responsible for the proper functioning of the digital service and the interaction with the mechanics of the vehicle throughout its entire life cycle. The aim is to ensure that the protection of the vehicle against cyberattacks is always up-to-date, through continuous monitoring and if necessary by implementing improvements via software updates in the event of a cyber threat, danger or vulnerability.
At the national level, RDW noticed at an early stage that the far-reaching increase in digitisation and cybercrime brings about a new dimension for the safety of the vehicle and therefore the citizen. This awareness has already led to the development of the Vehicle Safety & Security Framework (VSSF), a framework for assessing digital technologies used in vehicles.
Together with external partners such as other admission authorities, manufacturers and (foreign) technical services, RDW is working towards achieving safe traffic in the future. The manufacturer is responsible for cybersecurity and all associated systems. RDW checks whether the manufacturer takes up this responsibility.
RDW is among the European entities taking the lead in addressing these developments. As a Type Approval Authority and as a Technical Services organisation, RDW needs to be innovative and creative. After all, the playing field of cybersecurity is constantly changing.