The pieces for rolling out software to a fleet of devices have been open source, mature and running in production for years. Most companies still cannot do it reliably, and the reason is not technical.
Kai Hackbarth · kaihackbarth.com
Since 2000
Remote update was in the first specification.
01
OSGi, May 2000: install and update software modules without bringing the system down, administered by a remote service provider.
02
Nearly every customer used it. Not as an advanced feature, as the normal way you keep a shipped product working.
The hard part was never the technology.
What it costs when this goes wrong
Three cases, each failing at a different point.
A rollout that reached the wrong devices
Rivian, November 2023: the wrong build with the wrong security certificates. Screens and defroster controls went dark. Cancelled inside two hours, 1,463 vehicles affected, all fixed over the air within six days.
The firmware write path used as a weapon
Routers on one provider’s network, October 2023: the Chalubo trojan left devices permanently inoperable. Hundreds of thousands lost. They could not be reflashed, only replaced.
A channel that did not cover the part that broke
Hyundai, May 2026: more than 421,000 Tucson and Santa Cruz vehicles recalled over front camera software. The fix is software only. Every owner still drives to a dealer.
Do the maths
What does one software fix cost you in visits?
over the airvisit needed
40,000 visits at a workshop or on site, for one software update
Your visits40,000
Hyundai, May 2026over 421,000
Nothing you enter leaves this page.
An update is not just a file
What has to be true before one device accepts one new build.
Every one of these has a known answer. None of them has an automatic one.
01
Generations: another CPU, another operating system, less flash. The 2019 device is the one still in the field.
02
Dependencies: the install succeeds, and the device is broken in the only way that counts.
03
Physical limits: no room for a second image, no headroom to verify a signature, a metered link.
04
The customer: none of their configuration may be worse after the update than before.
05
Scale: offline for a week, radio certification, updates that cannot be rolled back.
Every one of these has a known answer. None of them has an automatic one.
What Eclipse hawkBit already does
Every component exists in open source.
01
Staged rollouts: groups advance on a success threshold, and the whole campaign stops at an error threshold.
02
Downloading is not installing: the install waits for a maintenance window the plant defines.
03
Generations are first-class: an image for the 2026 board cannot be assigned to the 2019 device.
04
The fleet converges: devices that were offline arrive at the right version without a new campaign.
05
Consent: an install can wait for confirmation when the machine is not yours.
Version 1.0 in March 2026, EPL 2.0. Disclosure: I worked in the Bosch group until May 2026. No vendor named here pays me anything.
Why so few industrial companies have an update path that works
Five reasons. Not one is a missing feature.
01
They evaluate the server: and the server is the easy half. The safety requirements live on the device.
02
The demo is not the system: database, storage, deployment, monitoring, backup, scale: a project, not a configuration afternoon.
03
Nobody owns it: product, embedded, IT and security each have a reason to treat it as someone else’s job.
04
The trust question arrives last: the server stores hashes and signs nothing. Signing belongs to the integrator, verification to the device. CRA reporting has applied since 11 September 2026.
05
It is an operating capability: service life of ten to twenty years; under the CRA a support period with a five-year floor.
The number that settles it
An update channel keeps earning for as long as it runs.
Double-digit eurosper vehicle per year
During my time as Business Owner at Bosch.IO I was responsible for a customer running FOTA across several million vehicles.
A different budget conversation from a project with a launch date.
What I would actually do
Four things, in this order.
If you cannot name that person, nothing else will hold.
01
Name the owner: with authority over device and server. If you cannot name that person, nothing else will hold.
02
Choose the device side next: safety, rollback and recovery live there.
03
Ask where your trust chain is, in writing: who signs, with which key, stored where, verified how, revoked how.
04
Budget it as an operating capability: a five-year floor, a fifteen-year expectation. Self-hosting and buying are both defensible.
The technology has been ready for a decade. What is usually missing is somebody whose job it is to care.