OTA Software Update (July 17, 2023)!

[ciaranob]

I did just post in the SoH thread. I specifically ordered mine to do the before/after readings from the update. Basically I fell into the camp of "zero change."

Also, what is the deal with the fan shrouds? That's for the thing that fixes if gravel is getting stuck in there or something right? I have to drop mine off at the dealer to fix the AC charger which stopped working, so wondering if this shroud can only be asked for if an issue has already come up first.

Yes I had a video and photographed every step in the process of my identifying and removing the gravel stuck in my LHS fan shroud.

You will need both of these to 'qualify' for the new kit unless of course they actually hear and fix an issue at the dealership itself.

And yes again, it is a re-designed fan shroud cover that has a lip to stop gravel getting stuck between spinning fan outer surface ring and the container shroud (of which I of course I claim the they stole my suggestion from way back !) - all 2023 models now have this redesign but not being offered up to previous builds unless the problem actually happens (brilliant right!).

Sponsored

 

[bluedonkey]

@bluedonkey … or anyone else for that matter that have received this OTA update, would you be kind enough to post your new software version…… there are a lot of posters on here that would love to know if they are indeed up to date …. Not FOMO just curious …..?

PCM>Settings>system>software information>version information ……….

This is the screen from my MY2020 (which is an old version)….

I’lltake a look later, but the message said the update was for the high voltage CU so not sure it will show up in the PCM software versions display.

 

[JamesS]

I just received it too... it would be nice to see the details of the update. I plan on waiting to see how many people brick their car before I attempt.

 

[BRZtoTaycan]

Just received this update today for 2023 RWD

 

[W1NGE]

Ma


I can't speak for the UK but this hasn't been the case in the US. The last big update ended up taking two weeks at the dealer for me. The only things that have been coming OTA were map updates. That's why they sent the email out - they're finally pushing updates to critical functionality OTA.

That's simply not true - see my earlier post with the link to other important OTAs. Flawless for many.

The big screw up was the upgrade to MY23 software release which took a day at the dealer (turned into a nightmare for many). Fortunately too important for an OTA.

 

[CarpeDM]

Yes! Exact same issue. Car worked fine for one drive. Now the PCM partially works (eg, i can use spotify from my phone) but the screen is basically non operational. I wondered if it was because I was at relatively low charge (ie, 50 miles left). I left the car charging at an airport. I'm hoping it heals itself when I get back to it. Frustrating.

BTW...I just got back and the car was fully charged and PCM operated normally. No issues.

 

[magnitude]

2020s are known for not being able to support plug and charge. OTA would require a similar capability - attesting itself to a remote server using some built-in key - as a starting point, as obviously OTA is far more complex of a process after downloading. So I wonder if that means there will never be OTA for first-year models.. /end of speculation

Very interesting thought, but my gut feeling is that these things are totally separate. For one, it's more likely that there is a central component, attached to one of the communication modules (or maybe even part of a communication module) that is in charge of performing the software updates of the car's various modules. Including attestation, authentication, and just generally talking to the right Porsche servers. Yes, there may be (likely is) also some attestation and maybe even authentication within the car and between the modules, but that's likely separate.

Plug & Charge on the other hand is a part of the charging system talking to the charging provider via the cable. This may happen directly, or maybe with some involvement of a communication module, or maybe even just relaying messages from and to a communication module.

But even in the latter case, attestation and authentication of a "fixed" asset with services of the manufacturer are very different from doing the same with third party services.

All of what I wrote is speculation as well. It's still possible that you are right, but from my experience, it "smells" as if they are very separate things. At least, I myself wouldn't design a system where the software updates of my product's critical components shares significant infrastructure with authentication for a special service entirely provided by 3rd parties, which is totally uncritical. (If it doesn't work, you only have to take out your phone or wallet.)

It's a bit like saying that an iPhone's ability to update its OS and firmware would share infrastructure with the LinkedIn app's ability to authenticate to LinkedIn's web services. A bit of a ridiculous and exaggerated example to bring the point across.


It is interesting to ask the question why MY2020 can't support plug and charge then.

 

[magnitude]

except for Hardware, which is H9J1035092AH.
Since I did not look at this before the update, no idea whether update changed any of these values, or not.

Unlikely. I've noticed before that the "Hardware" version seems to be more a hardware configuration thing instead of any actual software version (this can both mean actual hardware revisions or different individual hardware pieces chosen from an available set of hardware pieces, e.g. per market), and in this case the update likely targeted some other module, part of the charging infrastructure, than the PCM software itself (i.e. what you foremost perceive as the thing on the center screen that you interact with).

Though, if you go into the engineering menu with the 2-finger reboot, you potentially could have had been able to find a version difference in some of the many components there. Not that that's super interesting information from the outside...

 

[WasserGKuehlt]

Very interesting thought, but my gut feeling is that these things are totally separate. For one, it's more likely that there is a central component, attached to one of the communication modules (or maybe even part of a communication module) that is in charge of performing the software updates of the car's various modules. Including attestation, authentication, and just generally talking to the right Porsche servers. Yes, there may be (likely is) also some attestation and maybe even authentication within the car and between the modules, but that's likely separate.

Plug & Charge on the other hand is a part of the charging system talking to the charging provider via the cable. This may happen directly, or maybe with some involvement of a communication module, or maybe even just relaying messages from and to a communication module.

But even in the latter case, attestation and authentication of a "fixed" asset with services of the manufacturer are very different from doing the same with third party services.

All of what I wrote is speculation as well. It's still possible that you are right, but from my experience, it "smells" as if they are very separate things. At least, I myself wouldn't design a system where the software updates of my product's critical components shares significant infrastructure with authentication for a special service entirely provided by 3rd parties, which is totally uncritical. (If it doesn't work, you only have to take out your phone or wallet.)

It's a bit like saying that an iPhone's ability to update its OS and firmware would share infrastructure with the LinkedIn app's ability to authenticate to LinkedIn's web services. A bit of a ridiculous and exaggerated example to bring the point across.


It is interesting to ask the question why MY2020 can't support plug and charge then.

Plug and charge is a 3-party handshake: car, user and charger. (There’s also the Porsche backend, but I rolled that into “car”.) The charger may have its own back channel dialog with the Porsche backend for authorization.

Think of it this way: charger issues a challenge to the car, car sends a token/cert signing request to its backend, for itself on behalf of the logged-in user. The result is then presented to the charger, which may verify it locally (with a well-known signing key), or asking a well-known endpoint (EA and/or Porsche) to validate.

For OTA, the handshake is simpler - just car to backend, unless Porsche is rolling out the update by users, in which case it’d be the same as above.

 

[magnitude]

Plug and charge is a 3-party handshake: car, user and charger. (There’s also the Porsche backend, but I rolled that into “car”.) The charger may have its own back channel dialog with the Porsche backend for authorization.

Think of it this way: charger issues a challenge to the car, car sends a token/cert signing request to its backend, for itself on behalf of the logged-in user. The result is then presented to the charger, which may verify it locally (with a well-known signing key), or asking a well-known endpoint (EA and/or Porsche) to validate.

For OTA, the handshake is simpler - just car to backend, unless Porsche is rolling out the update by users, in which case it’d be the same as above.

Yes, I get that. Does not mean that Plug & Charge and OTA share the same hardware or software components... at all. I mean, maybe they reuse the same crypto library (though that may just be "reused the source code", they may not even run on the same processor), but there does not have to be any overlap in what performs OTA with what performs Plug & Charge.

As said, given how critical one is (OTA), and how absolutely uncritical the other is (Plug & Charge), I'd want to keep them as separate as possible for several reasons.

Would be "fun" if a bug in an ASN.1 DER parser accessible through the charge port pins could directly lead to compromise of the firmware of a battery management module.

 

[WasserGKuehlt]

Yes, I get that. Does not mean that Plug & Charge and OTA share the same hardware or software components... at all. I mean, maybe they reuse the same crypto library (though that may just be "reused the source code", they may not even run on the same processor), but there does not have to be any overlap in what performs OTA with what performs Plug & Charge.

As said, given how critical one is (OTA), and how absolutely uncritical the other is (Plug & Charge), I'd want to keep them as separate as possible for several reasons.

Would be "fun" if a bug in an ASN.1 DER parser accessible through the charge port pins could directly lead to compromise of the firmware of a battery management module.

I get that, too ?, but it’d be odd for the car to have different modules that perform the same function - authenticating itself. You wouldn’t want every distinct subsystem of the car to have direct access to the burnt-in key either. My speculation is that both PnC and OTA are calling into this authentication module - precisely given that you would not want to take any random software updates (as in from an untrusted source), just as you wouldn’t want to authorize payment for the wrong car and/or user.

I didn’t say there was a direct path from one to another, just speculating that first year model are missing a hardware cryptographic primitive (or they changed the stack).And I’m sure the risk of hacking the car via the charging port is real/non-0.

 

[rs38]

this OTA is newly rolled out in Germany:

it's talking about remote parking and power steering ECU but deployed also on cars without sorround view or more.

 

[Deleted member 7514]

No news on the update here in the UK as yet. Hoepfully fixes the need to reboot PCM every so often...

 

[MissionC]

2020s are known for not being able to support plug and charge. OTA would require a similar capability - attesting itself to a remote server using some built-in key - as a starting point, as obviously OTA is far more complex of a process after downloading. So I wonder if that means there will never be OTA for first-year models.. /end of speculation

I don’t think this is the case. My uncle has a 2020 Turbo that came off the production line at the same time as my 4S and his car received the update the other day. It’d be bizarre that a Turbo and a 4S from the same model year would have different PCM hardware/software to allow OTA. Maybe it’s just a slower rollout schedule for some reason?

 

[Iben]

Very interesting thought, but my gut feeling is that these things are totally separate. For one, it's more likely that there is a central component, attached to one of the communication modules (or maybe even part of a communication module) that is in charge of performing the software updates of the car's various modules. Including attestation, authentication, and just generally talking to the right Porsche servers. Yes, there may be (likely is) also some attestation and maybe even authentication within the car and between the modules, but that's likely separate.

Plug & Charge on the other hand is a part of the charging system talking to the charging provider via the cable. This may happen directly, or maybe with some involvement of a communication module, or maybe even just relaying messages from and to a communication module.

But even in the latter case, attestation and authentication of a "fixed" asset with services of the manufacturer are very different from doing the same with third party services.

All of what I wrote is speculation as well. It's still possible that you are right, but from my experience, it "smells" as if they are very separate things. At least, I myself wouldn't design a system where the software updates of my product's critical components shares significant infrastructure with authentication for a special service entirely provided by 3rd parties, which is totally uncritical. (If it doesn't work, you only have to take out your phone or wallet.)

It's a bit like saying that an iPhone's ability to update its OS and firmware would share infrastructure with the LinkedIn app's ability to authenticate to LinkedIn's web services. A bit of a ridiculous and exaggerated example to bring the point across.


It is interesting to ask the question why MY2020 can't support plug and charge then.

I asked the Porsche dealer about the Plug & Charge issue and he told me that the 2020 model lack som sort of chip (can`t be bought / installed at a later stage).

Sponsored