Devices: Automotive, Aviation and Medical

In brief: Cars, aircraft and medical devices stay in use for decades and are full of small computers built by layers of suppliers. Changing their software is slow because it has to be re-tested and often re-approved by a regulator. Many vehicles and medical devices sold today will still be in service in 2038. No carmaker, aircraft maker or medical regulator has published a specific 2038 plan that we could find, but the risk is recognised by international standards bodies, and aviation has already had real "counter overflow" safety directives.

Overview

These three sectors share a profile: safety-critical, heavily certified, long-lived, and dependent on deep supply chains. That makes them hard to fix even when the bug is understood.

• Automotive. The ITU-T technical paper on 2038-class events notes that vehicles "rolling off production lines today contain on the order of 150 to 300 electronic control units (ECUs)", often from different suppliers, and that the carmaker's visibility into how each ECU handles time "is incomplete by design" ^[1]. Vehicle platforms stay in service 15–20 years, longer than the supplier teams that wrote the firmware ^[1].
• Aviation. Airframes fly for decades and avionics software is certified to strict standards, so even small changes are expensive. Aviation has already experienced several time- and counter-overflow safety issues (see below), which show how such bugs are handled.
• Medical. Implanted devices "operate continuously inside patients" for years, and "any modification to a deployed medical device — including firmware updates addressing time-handling exposure — requires regulatory engagement" ^[1]. In this sector "the patient is the platform" ^[1].

Technical details

Automotive

The Debian project's 2025 announcement noted that cost-sensitive 32-bit hardware is still shipping in automotive ^[3], and Kaspersky lists automobiles among at-risk device classes ^[4]. ECU resource limits make it hard to move from 32-bit to 64-bit time: microcontroller choice is driven by "cost, power consumption, thermal envelope, and certification requirements" ^[1].

Regulatory angle. UNECE Regulation No. 156 requires carmakers to operate an audited Software Update Management System as a condition of type approval, mandatory for new vehicle types since July 2022 and for all newly produced vehicles since July 2024 (in the EU via Regulation 2019/2144) ^[5]. R156 does not mention 2038, but it is the mechanism by which a 2038 fix would be delivered over the air or in a workshop. R155 (cybersecurity management) is its twin ^[5].

Aviation

No airworthiness directive specific to the 2038 time_t overflow was found. Aviation has, however, issued directives for closely related counter overflow bugs, which show the likely regulatory response:

The 248-day figure is consistent with a signed 32-bit counter of hundredths of a second (2^31 / 100 s ≈ 248.6 days); the AD itself does not state the counter width. The ITU-T paper lists aviation (avionics, air traffic management, GNSS dependencies, maintenance and certification records) as a sector with "multi-decade airframe lifecycles" and "documented prior incidents (GPS week …)", and leaves the full treatment for a later revision ^[1]. GPS week rollovers are covered on GPS-Week-Rollover.

Medical devices

The ITU-T paper's medical section is the most detailed public analysis of 2038 in healthcare ^[1]:

• Implantable devices (pacemakers, ICDs, neurostimulators, cochlear implants, insulin pumps): "a substantial fraction of currently implanted devices will remain in service past 2038", and their firmware comes from toolchains "whose 2038-class exposure was not tested during the original certification process".
• Remediation needs a clinic visit: the patient must attend, the device must be reached through manufacturer-specific programming equipment, and clinical status must be considered.
• Cross-border patients: a device updated in one jurisdiction may meet un-updated clinical equipment in another; the paper suggests a labelling scheme for 2038-remediation status.
• Hospital infrastructure: admission and registration, PACS, EHR, infusion pumps, patient monitoring, lab systems and surgical robots all depend on coherent time. Major platforms run 10–15 years.

Kaspersky cites a medical example, a bone-marrow analysis system, among equipment at risk ^[4].

Regulatory angle. The US FDA's premarket cybersecurity guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions" (February 2026, superseding the 27 June 2025 version), addresses section 524B of the FD&C Act for "cyber devices" ^[7]. It does not mention 2038 or date/time handling ^[7]. No FDA guidance specific to 2038 was found (as of 2026-10-21). The ITU-T paper mentions the FDA, the EU Medical Device Regulation, Health Canada, Japan's PMDA and the UK MHRA, and notes that any firmware change requires regulatory engagement "that may extend beyond the timeline available before rollover horizons" ^[1]. IEEE P4150 (PAR approved 2026-06-04) is developing a vendor-neutral way to document rollover readiness, which manufacturers could use as evidence ^[8].

Affected versions / products

Risk & compliance notes

• Who owns it: product safety and homologation teams (automotive), continuing-airworthiness and avionics suppliers (aviation), clinical engineering and device manufacturers (medical).
• What to inventory: for each ECU, LRU or device model: CPU word size, OS and C library versions, RTC, GNSS receiver, certificate stores, and the update path (R156 SUMS, service bulletins, FDA submissions).
• Lead times: certification and approval cycles of months to years mean 2038 fixes for these sectors need to be planned well before 2038, ideally in products launched now.
• Supplier contracts: the ITU-T paper notes remediation may require coordination with suppliers "whose contracts and operational capacities are not structured for retrofit" ^[1]. Add time-handling disclosure to supplier requirements.

Detection & mitigation

• Ask suppliers to declare time representation for each component (time_t width, protocol fields, RTC range, certificate validity handling).
• Run clock-advance tests on bench units and simulators, including 2036-02-07 (NTP), 2038-01-19 and 2038-11-20 (GPS week).
• For vehicles, plan delivery of fixes through the R156 update process; for medical devices, through the manufacturer's regulatory submission process.
• See Testing-and-Detection, Remediation-Guide and Risk-Assessment-Checklist.

See also

• Devices-and-Embedded-Systems
• Devices-Industrial-and-Infrastructure
• Devices-Networking-and-IoT
• OS-Android · OS-Embedded-and-RTOS
• GPS-Week-Rollover · Related-Date-Bugs

References

1. ITU-T Technical Paper XSTP.EPOCH, "Global coordination requirements for 2038-class rollover events" (liaison to IETF), 2026-07-21 — §10.4 electric and connected vehicles, §10.5 implantable and hospital medical devices, aviation stub.
2. 32-bit ABI bugs — Android bionic docs — 32-bit Android time_t overflows in 2038.
3. Debian isn't waiting for 2038 to blow up — The Register, 2025-07-25 — 32-bit hardware still shipping in automotive and other embedded markets.
4. Stan Kaminsky, "Epochalypse Now — or how to deal with Y2K38" — Kaspersky, 2026-01-19 — automobiles and medical equipment among at-risk classes.
5. UNECE R156 — itemis glossary — SUMS requirement; July 2022 / July 2024 applicability; relation to R155.
6. FAA AD 2015-09-07, Boeing 787 — Federal Register Vol. 80 No. 84, 2015-05-01 (EASA mirror) — GCU counter overflow after 248 days; interim power-down task.
7. Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions — US FDA, 2026-02 — section 524B cyber devices; no 2038 content.
8. IEEE P4150 — IEEE Standards Association — rollover readiness recommended practice, PAR approved 2026-06-04.