Method for updating a control unit for an automotive vehicle, the control unit comprising a runtime system (22, 122) with a virtualization layer (32, 132) adapted to run on the processor, the virtualization layer being adapted to assign processor time and memory space to a plurality of guest systems (24, 26, 28, 30, 124, 126, 128, 130, 158), the plurality of guest systems comprising a first trusted guest system (24, 124) and a first untrusted guest system (26, 126), wherein the first trusted guest system (24, 124) runs a system supervisor server (34, 134) the system supervisor server (34, 134) being adapted to stop and boot a guest system, the method comprising: downloading, by a first update client (38, 40, 138, 140) of the first untrusted guest system (26, 28) running on the virtualization layer (32, 132), one or more first update files or data segments from a first remote server (44, 46, 48, 144, 146, 148); storing, by the first update client (38, 40, 138, 140), the one or more first update files or data segments in an untrusted memory accessible to the first untrusted guest system and verifying, by the first update client, whether the one or more update files or data segments are complete; - generating a shared secret by the first trusted guest system (24, 124); sending the shared secret to the first remote server (44, 46, 48, 144, 146, 148); receiving, by the first trusted system (24, 124), a reboot signal, wherein the reboot signal received by the first trusted guest system (24, 124) is encrypted by the first remote server (44, 46, 48, 144, 146, 148) with a one-time password based on the shared secret, and decrypted by the first trusted guest system; - verifying, by the first trusted guest system (24, 124), whether one-time password is correct; if the one-time password is correct, executing, by the system supervisor server (34, 134), the signal and rebooting, by the system supervisor server (34, 134), the control unit; booting an update operating system (58, 158) adapted to update one or more files or data segments of the control unit; retrieving, by the updating operating system (58, 158), the one or more first update files or data segments from the untrusted memory; - verifying, by the updating operating system (58, 158), the one or more first update files or data segments; and updating (1108, 1110, 1112, 1114) the one or more files or data segments of the control unit. downloading, by a first update client (38, 40, 138, 140) of the first untrusted guest system (26, 28) running on the virtualization layer (32, 132), one or more first update files or data segments from a first remote server (44, 46, 48, 144, 146, 148); storing, by the first update client (38, 40, 138, 140), the one or more first update files or data segments in an untrusted memory accessible to the first untrusted guest system and verifying, by the first update client, whether the one or more update files or data segments are complete; - generating a shared secret by the first trusted guest system (24, 124); sending the shared secret to the first remote server (44, 46, 48, 144, 146, 148); - generating a shared secret by the first trusted guest system (24, 124); sending the shared secret to the first remote server (44, 46, 48, 144, 146, 148); receiving, by the first trusted system (24, 124), a reboot signal, wherein the reboot signal received by the first trusted guest system (24, 124) is encrypted by the first remote server (44, 46, 48, 144, 146, 148) with a one-time password based on the shared secret, and decrypted by the first trusted guest system; - verifying, by the first trusted guest system (24, 124), whether one-time password is correct; if the one-time password is correct, executing, by the system supervisor server (34, 134), the signal and rebooting, by the system supervisor server (34, 134), the control unit; - verifying, by the first trusted guest system (24, 124), whether one-time password is correct; booting an update operating system (58, 158) adapted to update one or more files or data segments of the control unit; retrieving, by the updating operating system (58, 158), the one or more first update files or data segments from the untrusted memory; - verifying, by the updating operating system (58, 158), the one or more first update files or data segments; and - verifying, by the updating operating system (58, 158), the one or more first update files or data segments; and updating (1108, 1110, 1112, 1114) the one or more files or data segments of the control unit.