Subscribe

cars live much longer than phones —

VW will support software products for the “lifetime” of a car—up to 15 years

It's the answer to a question we've been pondering for some time.

-

A rendering of the VW ID.2 concept interior
Enlarge / Volkswagen is one of a number of automakers that have migrated to Android Automotive as their infotainment OS. But how long can you expect that OS to be patched and safe?
Volkswagen

Update, 1:20 pm March 24: CARIAD got in touch with Ars to clarify some of the confusion about how long it Volkswagen Group will support its software products. "As part of its development services to Volkswagen’s automotive brands, CARIAD provides operational services, updates, upgrades and new releases as well as bug fixes and patches relating to its hardware- and software-products. We usually support our hard- and software releases for extended periods of time. In some cases this can be up to 15 years after the end of production ("EOP") for hardware and 10 years after EOP for software releases. Moreover, there are legally mandatory periods we comply with, e.g. cybersecurity as well as safety updates and patches are provided for as long as a function is available. In addition, there may be individual agreements with brands for longer support periods to specifically satisfy their customers’ needs," wrote a CARIAD spokesperson.

Original Story: Android is doing a pretty good job of colonizing the in-car infotainment ecosystem. At first, Google's operating system started showing up in new vehicles as custom installations, but more recently the company developed Android Automotive, which you can find in new cars from General Motors, Polestar, Volvo, Honda, and soon, both BMW and Volkswagen Group.

A perennial question that has accompanied the spread of Android Automotive has been the question of support. A car has a much longer expected service life than a smartphone, especially an Android smartphone, and with infotainment systems so integral to a car's operations now, how long can we reasonably expect those infotainment systems to be supported?

So far, a bit more than seven years is the longest any Android phone has received support, before unsupported chips finally called time on the Fairphone. I'm not sure anyone would be OK with having their car sent to the scrap heap after just seven years, however.

I got the chance to put this question to Dirk Hilgenberg, CEO of CARIAD, Volkswagen Group's software division: Given the much longer service life of a car compared to a smartphone, how does VW plan to keep those cars patched and safe 10 or 15 years from now?

Lifetime support

"We actually have a contract with the brands, which took a while to negotiate, but lifetime support was utterly important," Hilgenberg told me.

The follow-up was obvious: How long is "lifetime"? "Fifteen years after service, and an extra option for brands who would like to have it even longer; you know, we have to guarantee updatability on all legal aspects," he said.

"So that's why we are, as you can imagine, very cautious with branches of releases because every branch we need to maintain over this long time. So when you have end of operation and EOP [end of production] and it's 15 years longer, we still have to maintain that; plus, some brands actually said 'because my vehicle is a unicorn, it's something that people want even more, they only occasionally drive it but they want to be safe,'" Hilgenberg told me.

(The unicorn reference should make sense in the context of VW Group owning Bugatti, Lamborghini, and Porsche, whose cars are often collected and can be on the road for many decades.)

In those cases, CARIAD would provide continued support, Hilgenberg said. "Especially as cybersecurity, all the legal things are concerned, you see that already. Now we do upgrades and releases, whether it's in China, whether it's in the US, whether it's in Europe, we take very cautious steps. Security and safety has, in the Volkswagen group, you know, the utmost importance, and we see it actually as an opportunity to differentiate," he said.

There is cause for optimism

At this point, our more cynical readers are probably firing up the comment section to tell us just how little they believe these claims. But there's reason to give Hilgenberg the benefit of the doubt, according to Sam Abuelsamid, principal research analyst at Guidehouse Insights.

"New E/E architectures are moving away from the old distributed arrangement with dozens of ECUs powered by low-powered and cheap microcontrollers to arrangements with a few domain controllers powered by much more powerful SoCs. These are coming with new software platforms that abstract the applications away from the hardware. Instead, these platforms (like GM’s Ultifi and MB.OS) provide APIs that applications talk to, read sensors, and send commands to actuators," Abuelsamid told Ars.

"This decouples the applications from the underlying hardware. Even if CARIAD (or any other OEM) opts to use something like Android Automotive or QNX for infotainment, it’s going to run in a container at the application layer above the abstraction layer. The computing power in these new E/E architectures should be able to support updates to those containerized OSes for much longer than a typical phone and certainly longer than in the past," Abuelsamid explained.

However, there's no guarantee that OEMs can make the business model work for this long-term support.

"They are clearly counting on generating a lot of new recurring revenue streams based on selling subscriptions to features or selling new features as OTA updates, but so far no one has actually proven there is a willingness among consumers to pay for that. Tesla gives that stuff to customers for free; with subscription fatigue being a real thing, I’m not sure how many car owners will pay up, especially if there isn’t a corresponding decrease in the upfront price of the car. This is likely to be an even bigger issue in the used car market, which accounts for three to four times the number of annual sales as new cars," Abuelsamid told me.

Jonathan M. Gitlin Jonathan is the Automotive Editor at Ars Technica. He has a BSc and PhD in Pharmacology. In 2014 he decided to indulge his lifelong passion for the car by leaving the National Human Genome Research Institute and launching Ars Technica's automotive coverage. He lives in Washington, DC.

Promoted Comments

15 years is entirely reasonable. In the US, manufacturers are only required to keep parts available for 7 years after the car is manufactured, and 15 years is going to be the far side of the downward slope of OEM parts availability for most cars (at an average of 15,000 miles a year, that's 180,000 miles). As long as there's a robust way to airgap the system after it leaves mainstream support, I don't see a problem. You people keeping 30 and 40 year old cars on the road are not VW's target customers (though more power to you), and I don't really see why they should be catering to you.
From TFA (emphasis added):
when you have end of operation and EOP [end of production] and it's 15 years longer, we still have to maintain that
I read this to mean that it's 15 years after the last car of that model rolls off the assembly line. But it's also worth noting that, in the US anyway, IIRC OEMs are only required to provide replacement parts for 10 years after EOP. We'll have to see if the aftermarket steps in to further extend the life of infotainment systems in the same way that they have to provide replacement parts.
To all the people making snide remarks about VW and/or how cars last more than 15 years... that might all be true, but cars are designed only for a lifetime of 15 years or 100,000 km, whichever comes first. For semiconductor, where I'm coming from, this dictates, e.g., how thick/wide you have to make your metal lines inside the chip so that they will still work reliably after 15 years of electro migration eating away at them. Since there is a lot of buffer worked in to ensure that even the odd outlier will still work for the required lifetime, you have lots of devices that work for far longer than the designed-for lifetime, which explains your observations.
  • I can only speak for semiconductor, and calculating required metal line widths for a given process technology and voltage/current requirements is rather straightforward, which may not be true for other types of components. But I expect other suppliers facing the same requirements need to have a similar way of dealing with them... An OEM breathing down your neck has a way of making things happen.
  • I can only speak for what I've seen at my company, but I have reason to believe that the 15 years lifetime thing is a general requirement for all companies in the supply chain. So I'm pretty sure that every car on the road, including the ones you're boasting still work, has been designed with these same requirements in mind.
Of course the VW person will only talk about the lifetime they design their cars for, even if you may reasonably expect a much longer service life. They cannot commit to anything else. And since the topic came up...
Even assuming good faith on the part of the auto makers, there's the issue of maintainability. Let's say you have a 15 year old platform, and a serious flaw is found. How many people are there that will be able to understand, debug, and fix 15-year-old code? Are you still going to have test suites lying around that can test the fix, along with people who can run the tests? Is your software toolchain still going to work?
I'm not sure if it is a legal requirement or something to do with liability insurance, but you have to keep everything related to your product design for 16 years after end of production, and you need to be able to, e.g., fire up a simulation, in case a design issue is suspected.
I've always wanted to share this bit... a long time ago in a former life, I was responsible for the design environment for my company's automotive products. At the time, I was having a hard time convincing the IT person responsible for the server farm that supporting decade-old design environments for some automotive niche products was a thing he needed to do, so I brought a product design manager to one of our discussions. I feel a bit bad about it now, but it was one of the most gratifying experiences in my work life to see it dawn on the IT person that the ridiculous, impossible demands I had been making would have to be made possible after all to avoid damage to the company. (I think they're just using virtual machines nowadays, but at the time, it meant they would keep a SunOS 5 capable machine around in their server farm, with a few others kept in reserve for spare parts because you could not get parts anymore and newer machines would not support SunOS 5.)
It's weird that people seem to making the assumption that these cars will someone become completely useless after that 15 year mark. They'll continue to function just as they functioned for the previous 15, minus any connectivity to VW.

The simple answer here is after that 15 year (or whatever) window has closed, manufacturers must provide a final update that disables phone-home capabilities, in order to prevent hacking, etc. If they won't voluntarily do this, they can be forced by the NHTSA or some other regulatory body.

So far as I know, Android Auto really only powers the infotainment systems in cars, so it's really not even much of (if at all) a safety risk outside of software security concerns; it's not like a hacker would be able to control, say, the throttle of a hacked vehicle. I could be wrong about this, but I'd be very surprised if I was – I can't imagine that safety-critical systems wouldn't be air-gapped from something like AA.

Channel Ars Technica

Related Stories

    Today on Ars