Connectors & Protocols
OTA Firmware Updates for EV Chargers: What to Require From Your Supplier
How over-the-air firmware updates work on EV chargers, what can go wrong, and the supplier questions that protect an operator’s uptime and compliance.
- Prepared by
- VULTAE Engineering Team
- Published
- Reading time
- 3 min
- Sources
- 3 references
Key takeaways
- 1OTA (over-the-air) updates let an operator fix bugs, close security holes and add features without a site visit. They are the cheapest way to keep a charger fleet healthy — and a risk when done badly.
- 2The charger should accept only signed firmware, keep the old image so it can roll back, and report the update status to the back end. In OCPP this uses UpdateFirmware and FirmwareStatusNotification; signed updates need the security extension (1.6) or OCPP 2.0.1.
- 3A firmware change can affect certification and metering approval. Ask which updates need re-testing and who is responsible.
- 4Contract points: who hosts the update server, how long updates are supported, a changelog for every version, and a test charger to try updates before the fleet.
Contents
Short answer: over-the-air (OTA) updates are how you fix bugs and close security holes without a site visit. A good setup uses signed firmware, a rollback option, status reporting to the back end and a staged rollout. Ask the supplier who hosts the updates, how long they are supported, and which updates need re-certification.
How an OTA update works
- The back end tells the charger to update, with the file location and a time (OCPP UpdateFirmware).
- The charger downloads the file and verifies the signature and checksum.
- It installs the update when idle and restarts.
- It reports FirmwareStatusNotification messages to the back end: downloading, downloaded, installing, installed — or failed.
- The back end checks the new version and records it.
OCPP 1.6J has the basic commands; signed firmware is part of the security extension of 1.6 and is built into OCPP 2.0.1. See OCPP 1.6J vs 2.0.1.
What can go wrong
| Risk | What happens | Control |
|---|---|---|
| Interrupted download or power cut | The charger stops working or reboots into an old image | Two firmware slots, recovery mode, checksum before install |
| A bad version | A bug appears on all chargers at once | Test on a pilot unit; staged rollout in small groups |
| Unsigned or tampered file | A malicious image runs on the charger | Signature check; keys held by the manufacturer |
| Update during a session | A driver’s charge stops | Install only when idle; schedule for off-peak hours |
| Version drift | Chargers on many versions that are hard to support | Report the version to the back end; standard release policy |
| Certification mismatch | A new version changes safety or metering behaviour | Change control with the lab; re-test where needed |
Who is in the loop
Three parties touch OTA updates: the manufacturer who builds and signs the firmware, the operator who triggers the update, and the back-end provider that delivers it. Be explicit about who does what.
| Party | Typical responsibility |
|---|---|
| Manufacturer | Develops, tests and signs firmware; publishes a changelog; keeps the private key |
| Operator | Decides when to roll out; keeps a test charger; monitors results |
| Back-end provider | Delivers the file, tracks status, shows the version per charger |
Supplier questions
- Is the firmware signed, and who keeps the key?
- Does the charger have rollback or a recovery mode?
- How long will updates and security patches be available for this model?
- Is there a changelog for each version, with a note when behaviour changes?
- Which changes need re-testing for certificates or metering approval?
- Can we get a test charger and a staging firmware before the fleet?
- What is the process if the supplier stops supporting the model — can we receive the signing process, source escrow or a final image?
Add these to the tender specification. The security side is explained in EV charger cybersecurity requirements.
Cost angle
Without OTA, a firmware fix means a technician visit. At several hundred dollars a visit and hundreds of chargers, that is a big sum. OTA also reduces downtime. The cost sits in the process: a pilot unit, release notes and a support agreement.
What VULTAE provides
Our chargers support remote operation over OCPP 1.6J / 2.0.1 and can be updated through the back end. For a project, we agree the update process, the changelog format and the support period in the contract, and confirm which versions are covered by the certificates of the exact model.
Questions buyers ask
- What is an OTA firmware update on an EV charger?
- The charger downloads new software from a server over its network connection, checks that it is genuine, installs it and restarts. The back end usually triggers it with an OCPP command and receives status messages during the process.
- How do I avoid bricking chargers during an update?
- Use a charger with dual firmware slots or a recovery mode, update a test unit first, roll out in small groups and avoid updating during peak hours. Check that the charger verifies the file’s signature and checksum before it installs.
- Does updating firmware affect certification?
- It can. A change to safety-relevant functions or to metering can invalidate a test report or a meter approval. Ask the supplier which changes are in scope of the certificates and whether the new version needs to be re-tested.
- Who should own the update server?
- Either the manufacturer or the operator’s back end, but it has to be clear in the contract. If the manufacturer hosts it, ask about uptime and what happens if the supplier stops. If the operator hosts it, the supplier must provide signed images and a clear process.
References
- [1]Open Charge Point Protocol (OCPP). Open Charge Alliance.
- [2]Commission Delegated Regulation (EU) 2022/30 — cybersecurity of radio equipment. EUR-Lex.
- [3]Regulations: electric vehicle smart charge points. GOV.UK.
