ISO/DTS 20003

Road vehicles – Human-machine interface (HMI) for over the air (OTA) software updates

This standard provides human machine interface (HMI) design specifications by Over The Air (OTA) software updates for passenger cars (including sport utility vehicles and light trucks) plus commercial vehicles (including heavy trucks and buses). These HMI specifications include state transitions, timing, HMI locations with respect to the driver, types of information, necessary notifications and warnings, confirmation of successful completion, and how deviations from the intended results will be handled, based on sequences defined in ISO24089. It covers software updates facilitated both while driving and while stationary

Véhicules routiers — Interface homme-machine (IHM) pour les mises à jour logicielles sans fil (OTA)

General Information

• Status: Not Published
• ICS: 43.040.15 - Car informatics. On board computer systems
• ICS: 43.060.50 - Electrical and electronic equipment. Control systems
• Technical Committee: ISO/TC 22 - Road vehicles
• Drafting Committee: ISO/TC 22 - Road vehicles
• Current Stage: 5020 - FDIS ballot initiated: 2 months. Proof sent to secretariat
• Start Date: 28-Jul-2025
• Completion Date: 28-Jul-2025

Standards Content (Sample)

FINAL DRAFT
Technical
Specification
ISO/TC 22/SC 39
Road vehicles – Human-machine
Secretariat: ANSI
interface (HMI) for over the air
Voting begins on:
(OTA) software updates
2025-07-28
Voting terminates on:
2025-09-22
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
FINAL DRAFT
Technical
Specification
ISO/TC 22/SC 39
Road vehicles – Human-machine
Secretariat: ANSI
interface (HMI) for over the air
Voting begins on:
(OTA) software updates
Voting terminates on:
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Design guidelines . 4
4.1 General .4
4.2 Content . .4
4.3 Visual information .4
4.3.1 General .4
4.3.2 Location .4
4.3.3 Symbol .5
4.3.4 Symbol attention .5
4.3.5 Colour .5
4.4 Driver distraction .5
Annex A (informative) OTA HMI use cases . 6
Bibliography . 19

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 22, Road vehicles, Subcommittee SC 39,
Ergonomics.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
The number of vehicles with internet connectivity capability is increasing. As a result, these vehicles are
more vulnerable to hackers accessing the vehicle. Due to this, it is important to provide safe software
updates to ensure vehicle safety.
Over the air (OTA) software updates add or modify vehicle features. Software require periodic improvements
or feature additions. For example, advanced driver-assistance systems (ADAS), entertainment systems and
navigation systems can be updated without going to the dealership.
The establishment and application of software-update engineering is important to ensure software quality,
cybersecurity and safety. ISO 24089, which defines processes and functionalities for software-update
engineering, has been established. The state of the vehicle is determined to ensure a safe software update. In
the case of an update failure, measures are taken to guarantee safety of the vehicle. If the solution requires
any exchange with the user during any of the OTA update steps, the user can be notified of the OTA update
content, can be informed about the result of the update, and can also have the need to give permission for
the update.
When the completion of an update can affect the safety of the vehicle, the vehicle manufacturer should
demonstrate how the update will be completed safely. If a human-machine interface (HMI) is part of the safe
execution for an OTA update, standardization of the HMI is needed to guarantee the customer understanding
across different products. This is also beneficial in general on any occasion where an HMI can help to explain
influences from OTA updates on the availability or quality of concerned features.
As additional explanation and support for developing specific requirements in case HMI aspects are involved
in securing the safe and/or fully understood execution of an OTA update, use case examples of potential HMI
interactions are provided in Annex A.

v
FINAL DRAFT Technical Specification ISO/DTS 20003:2025(en)
Road vehicles – Human-machine interface (HMI) for over the
air (OTA) software updates
1 Scope
This document provides human-machine interface (HMI) design specifications in case an HMI is needed to
secure the safe and/or fully understood execution of OTA software updates for passenger cars (including
sport utility vehicles and light trucks) and commercial vehicles (including heavy trucks and buses). The
vehicle operator benefits from knowing if an OTA update has been successful or not, if an OTA update
will influence the operation of the vehicle, or if the OTA update influences the quality of a feature. HMI
specifications for the OTA software update provide support in case an HMI is needed in normal conditions,
emergencies, low battery, avoidance of inadvertent actuations, alerts or specific non-standard situations.
2 Normative references
The following documents are referred to in the text in such a way that some or all their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO 15008, Road vehicles — Ergonomic aspects of transport information and control systems - Specifications
and test procedures for in-vehicle visual presentation — Image flashing
ISO 2575, Road vehicles — Symbols for controls, indicators and tell-tales
ISO 4040, Road vehicles — Location of hand controls, indicators and tell-tales in motor vehicles
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
activation
step in the software update operation when the relevant parts of an installed software update package (3.13)
become executable on a vehicle, vehicle system or electronic control unit (ECU) (3.4)
[SOURCE: ISO 24089:2023, 3.2.3, modified — Examples have been removed.]
3.2
cancel
command that stops a previously commanded function
Note 1 to entry: Depending on the software update operation stage, the system may go back to the same initial state
before the update or enter in a fail-safe state.
[SOURCE: ISO 2806:1994, 2.2.6, modified — "cancels" has been replaced by "stops" and the Note 1 to entry
has been added.]
3.3
display
electronic device capable of visually communicating information
[SOURCE: ISO 3600:2022, 3.4]
3.4
electronic control unit
ECU
embedded device in a vehicle whose software (3.12) can be updated
[SOURCE: ISO 24089:2023, 3.1.7]
3.5
ignition
power supply in a vehicle that includes an on and off state
3.6
infrastructure
processes and information systems managing any combination of software update operations, software
update campaigns (3.14), documentation and vehicle configuration information, including both digital and
manual activities
Note 1 to entry: Infrastructure can include any combination of servers, tools and manual activities used in the
software update operation.
[SOURCE: ISO 24089:2023, 3.1.10]
3.7
installation
step in the software update operation when the relevant parts of a software update package (3.13) are
written to a vehicle, vehicle system or electronic control unit (ECU) (3.4) but are not yet activated
[SOURCE: ISO 24089:2023, 3.2.2]
3.8
metadata
datasets, such as software updates, that are intended to be deployed in vehicle systems or electronic control
units (ECUs) (3.4)
Note 1 to entry: Metadata can include vehicle and safety conditions, compatibility information, software (3.12) versions,
necessary in-vehicle resources, information for user to be displayed through a human-machine interface (HMI).
3.9
over the air
OTA
data channel operated by a mobile network operator for the rem
...

•••• PRPROTOTEECCTEDTED 関関係者外係者外秘秘
© ISO #### – All rights reserved
1 ISO/DTS 20003
2 ISO/TC 22/SC 39/WG 3
3 Secretariat: XXXX ANSI
4 Date: 2025-07-11
5 Road Vehicles – Overvehicles – Human-machine interface
6 (HMI) for over the Airair (OTA) Software Update Human
7 Machine Interfacesoftware updates
9 WD/CD/DIS/FDIS stage
11 Warning for WDs and CDs
12 This document is not an ISO International Standard. It is distributed for review and comment. It is
13 subject to change without notice and may not be referred to as an International Standard.
14 Recipients of this draft are invited to submit, with their comments, notification of any relevant patent
15 rights of which they are aware and to provide supporting documentation.
16 To help you, this guide on writing standards was produced by the ISO/TMB and is available at
17 A model manuscript of a draft International Standard (known as “The Rice Model”) is available at
•••• PRPROTOTEECCTEDTED 関関係者外係者外秘秘
ISO #####-#:####(X)
2 © ISO #### – All rights reserved

•• PROTECTED 関係者外秘
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
Fax: [phone]
EmailE-mail: [e-mail]
Website: www.iso.orgwww.iso.org
Published in Switzerland
© ISO #### 2025 – All rights reserved
iii
•• PROTECTED 関係者外秘
Contents
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Design guidelines . 4
4.1 General. 4
4.2 Content . 5
4.3 Visual information . 5
4.4 Driver distraction . 6
Annex A (informative) OTA HMI use cases . 7
Bibliography . 24

This template allows you to work with default MS Word functions and styles. You can use these if you want to
maintain the Table of Contents automatically and apply auto-numbering.
To update the Table of Contents please select it and press "F9".
© ISO #### 2025 – All rights reserved
iv
•• PROTECTED 関係者外秘
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
ISO documentsdocument should be noted. This document was drafted in accordance with the editorial rules
of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawnISO draws attention to the possibility that some of the elementsimplementation of this
document may beinvolve the subjectuse of (a) patent(s). ISO takes no position concerning the evidence,
validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this
document, ISO had not received notice of (a) patent(s) which may be required to implement this document.
However, implementers are cautioned that this may not represent the latest information, which may be
obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for
identifying any or all such patent rights. Details of any patent rights identified during the development of the
document will be in the Introduction and/or on the ISO list of patent declarations received (see ).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 22, Road Vehiclesvehicles, Subcommittee SC 39,
Ergonomics.
A list of all parts in the ISO ##### series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
© ISO #### 2025 – All rights reserved
v
•• PROTECTED 関係者外秘
Introduction
The number of vehicles with internet connectivity capability is increasing. As a result, these vehicles are more
vulnerable to hackers accessing the vehicle. Due to this, it is important to provide safe software updates to
ensure vehicle safety.
Over the air (OTA) software updates add or modify vehicle features. Software requiresrequire periodic
improvements or feature additions. For example, Advanced Driver-Assistance Systemsadvanced driver-
assistance systems (ADAS), entertainment systems and navigation systems can be updated without going to
the dealer. dealership.
The establishment and application of software-update engineering is important to ensure software quality,
cybersecurity, and safety. ISO 24089, which defines processes and functionalities for software-update
engineering, has been established. The state of the vehicle is determined to ensure a safe software update. In
the case of an update failure, measures will beare taken to guarantee safety of the vehicle. If the solution
requires any exchange with the user during any of the OTA update steps, the user can be notified of the OTA
update content;, can be informed about the result of the update;, and can also have the need to give permission
for the update.
When the completion of an update can affect the safety of the vehicle, the vehicle manufacturer shallshould
demonstrate how the update will be completed safely. If a Human Machine Interfacehuman-machine interface
(HMI) is part of the safe execution for an OTA update, standardization of the HMI is needed to guarantee the
customer understanding across different products. This is also beneficial in general on any occasion where an
HMI can help to explain influences from OTA updates on the availability or quality of concerned features.
As additional explanation and support for developing specific requirements in case HMI aspects are involved
in securing the safe and/or fully understood execution of an OTA update, use case examples of potential HMI
interactions are provided in Annex AAnnex A. .
© ISO #### 2025 – All rights reserved
vi
Road Vehicles – Overvehicles – Human-machine interface (HMI) for
over the Airair (OTA) Software Update Human Machine
Interfacesoftware updates
1 1 Scope
This document provides human-machine interface (HMI) design specifications in case an HMI is needed to
secure the safe and/or fully understood execution of OTA software updates for passenger cars (including sport
utility vehicles and light trucks) and commercial vehicles (including heavy trucks and buses). The vehicle
operator benefits from knowing if an OTA update has been successful or not, if an OTA update will influence
the operation of the vehicle, or if the OTA update influences the quality of a feature. HMI specifications for the
OTA software update provide support in case an HMI is needed in normal conditions, emergencies, low
battery, avoidance of inadvertent actuations, alerts, and / or specific non-standard situations.
2 2 Normative references
The following documents are referred to in the text in such a way that some or all their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO 24089:2023 Road vehicles — Software update engineering
ISO 15008, Road vehicles — Ergonomic aspects of transport information and control systems - Specifications and
test procedures for in-vehicle visual presentation — Image flashing
ISO 2575, Road vehicles — Symbols for controls, indicators and tell-tales
ISO 4040, Road vehicles — Location of hand controls, indicators and tell-tales in motor vehicles
ISO 20080 Road vehicles — Information for remote diagnostic support — General requirements, definitions
and use cases
ISO 9241-302:2008 — Ergonomics of human-system interaction Part 302: Terminology for electronic visual
displays
3 3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminologicalterminology databases for use in standardization at the following
addresses:
— ISO Online browsing platform: available at https://www.iso.org/obphttps://www.iso.org/obp
— IEC Electropedia: available at https://www.electropedia.org/
3.1 3.1
activation
step in the software update operation when the relevant parts of an installed software update package (3.13)
become executable on a vehicle, vehicle system, or electronic control unit (ECU) (3.4)
[SOURCE: ISO 24089:2023, 3.2.3], modified — Examples have been removed.]
3.2 3.2
cancel
command (2.4.3) that cancelsstops a previously commanded function
Note 1 to entry: depending Depending on the software update operation stage, the system may go back to the same
initial state before the update or enter in a fail-safe state.
[SOURCE: ISO 2806:1994 (en),, 2.2.6], modified — "cancels" has been replaced by "stops" and the Note 1 to
entry has been added.]
3.3 3.3
display
electronic display device capable of visiblyvisually communicating information
[SOURCE: 9241-302:2008ISO 3600:2022, 3.4.6]
3.4 3.4
electronic control unit
(ECU)
embedded device in a vehicle whose software (3.12) can be updated
[SOURCE: ISO 24089:2023, 3.1.7]
3.5 3.5
ignition
power supply in a vehicle that includes an on and off state
3.6 3.6
infrastructure
processes and information systems managing any combination of software update operations (3.1.19),,
software update campaigns (3.14(3.1.16),), documentation, and vehicle configuration information (3.1.24),,
including both digital and manual activities
Note 1 to entry: Infrastructure can include any combination of servers, tools, and manual activities used in the software
update operation.
[SOURCE: ISO 24089:2023, 3.1.10]
3.7 3.7
installation
step in the software update operation when the relevant parts of a software update package (3.13) are written
to a vehicle, vehicle system, or electronic control unit (ECU) (3.4) but are not yet activated
[SOURCE: ISO 24089:2023, 3.2.2]
3.8 3.8
metadata
datasets, such as software updates, that are intended to be deployed in vehicle systems or electronic control
units (ECUs) (3.4)
Note 1 to entry: Metadata can include vehicle and safety conditions, compatibility information, software (3.12SW)
versions, necessary in-vehicle resources, information for user to be displayed through a human-machine interface (HMI).
3.9 3.9
over the air
(OTA)
data channel operated by a mobile network operator (3.28) for the remote management of components
resident in the mobile device (3.24)
Note 1 to entry: Over the air is the software update distribution method that acts as a mechanism for distributing
software update packages (3.13) during software update campaigns (3.14) in ISO 24089.
[SOURCE: ISO 12812-1:2017(en),, 3.37], modified — Note 1 to entry has been added.]
3.10 3.10
potential risk
state in which the vehicle cannot be driven or has similar functional restrictions
3.11 3.11
receipt
step in the software update operation when a tool, vehicle, vehicle system, or electronic control unit (ECU)
(3.4) receives a software update package (3.13)
[SOURCE: ISO 24089:2023, 3.2.1], modified — Examples have been removed.]
3.12 3.1
...