Product · Embedded · Secure update suite
Autotech Bootloader
A secure flash bootloader for automotive ECUs. It reprograms over UDS, checks every software part before it runs, and has been hardened by serial production since 2016, together with Encrypt and Diag Com Stack.
0units bricked by Diadrom's software since 2016Power-on or reset
Primary bootloader. Secure boot: every part checked valid, complete and compatible. Protected from normal flashing.
Valid
Application. Only parts marked valid can start.
Update over UDS
Secondary bootloader, loaded into RAM. Writes, verifies, marks valid.
Diag Com StackUDS server · CAN · DoIP
EncryptAUTOSAR CSM API · HSM or SHE
Autotech Bootloader
What the bootloader does.
The production flash bootloader that stands between a routine update and a controller that no longer starts. Lightweight and robust, with a modular design that adapts to new hardware platforms and communication protocols.
- 01
Two stages, each with one job
A primary bootloader starts at power-on or reset and initialises the MCU. A secondary bootloader is loaded into RAM to program the flash. The primary bootloader has no write access to flash and is protected from normal flashing, and the same protection can cover other sensitive areas, such as cryptographic keys.
- 02
Secure boot, at every start-up
Before anything starts, the primary bootloader checks that every software part is valid, complete and compatible. A SHA-256 hash over the secure memory area is verified by the SHE or HSM, and the result is logged and readable over diagnostics. Only parts marked valid can start.
- 03
Signed software, verified before it runs
Each software part carries a table of per-block hashes, and a root hash signed by the OEM trust centre is verified before the new software is marked valid. Suppliers sign with a development key and the OEM re-signs for production, so one binary moves from rig to vehicle without a rebuild.
- 04
Reprogramming over UDS
Programming follows ISO 14229: DiagnosticSessionControl and SecurityAccess, then RequestDownload, TransferData and RequestTransferExit (0x34, 0x36, 0x37). The services it implements include those listed below.
- 05
Recoverable when an update goes wrong
The primary bootloader is never erased by a normal update, so an interrupted download is recoverable rather than fatal. If an application is valid but does not work, the ECU can stay in the primary bootloader, so a secondary bootloader can be downloaded and the application replaced.
- 06
Hardware cryptography behind one interface
Cryptography runs through Encrypt behind the AUTOSAR Crypto Service Manager API, with the silicon vendor's crypto library and hardware acceleration underneath. A hardware abstraction layer towards the HSM cuts the time it takes to adapt the bootloader to a new customer and hardware platform.
Encrypt · Cyber-security stack
Encrypt: the keys and the cryptography underneath.
Encrypt makes sure software gets into the vehicle safely and stays trustworthy. It abstracts the cryptographic and key-storage layer, so the same security behaviour carries across hardware.
- 07
The HSM as hardware root of trust
Keys and cryptographic operations sit in the Hardware Security Module, or the SHE where that is the hardware: the root of trust for every software package, with secure boot letting only trusted software run.
- 08
One API, whatever the silicon
Cryptography and key storage sit behind the AUTOSAR Crypto Service Manager API, so the same secure-boot and SecurityAccess behaviour carries across hardware. Polled jobs or interrupts, the results come back the same way.
- 09
Authenticated access
SecurityAccess (UDS 0x27) as a challenge-response: AES-CMAC and AES-CTR over random challenges, with request rate limiting, false-attempt counters and delay timers.
- 10
Secure storage and key management
Trust-store integrity is verified by MAC before every access. Initial keys are set at the supplier, production keys are programmed at the OEM, and key status is readable.
Licensed on its own, or added to an existing Bootloader engagement.Encrypt datasheet · PDF
Diag Com Stack · On the ECU
Diag Com Stack: the ECU side of every diagnostic conversation.
The in-vehicle backbone every off-board tool talks to. It absorbs the transport-layer complexity, so the diagnostic conversation stays dependable.
- 11
The UDS server on the control unit
The server side of UDS (ISO 14229): the ECU side of the conversation that DiagStudio and other off-board tools hold.
- 12
Over CAN and DoIP
Transport over CAN and DoIP (ISO 13400). The suite delivery for Volvo Cars' suppliers ran over CAN, CAN FD, LIN, GMSL and DoIP.
- 13
It carries the download
The software-download sequence the Bootloader executes runs over Diag Com Stack, with SecurityAccess backed by the suite's HSM-based security.
Licensed on its own, or as part of the suite with the Bootloader and Encrypt.Diag Com Stack datasheet · PDF
For the engineers in the room
What it speaks, what it runs on, how it is proven.
- UDS services
- ISO 14229, including: 0x10 DiagnosticSessionControl · 0x11 ECUReset · 0x22 ReadDataByIdentifier · 0x27 SecurityAccess · 0x2E WriteDataByIdentifier · 0x31 RoutineControl · 0x34 RequestDownload · 0x36 TransferData · 0x37 RequestTransferExit · 0x3E TesterPresent
- Transports
- UDS over CAN, CAN FD, LIN, GMSL and DoIP (ISO 13400)
- Security
- HSM or SHE as hardware root of trust · AUTOSAR Crypto Service Manager API · secure boot · signed software · SecurityAccess (UDS 0x27)
- Silicon
- Infineon AURIX TC3xx, NXP S32K, NXP MWCT2xxxS, Renesas RH850, Renesas RL78, STMicroelectronics STM32 and Microchip PIC32CZ CA, adapted per customer and OEM; a proof-of-concept integration on NXP S32K148 over CAN and CAN FD
- Verification
- ~550 test cases across ~30 releases, about 16,000 test executions in one project; the communication layers and the software download tested automatically with Dolphin
- Evidence
- ASPICE requirements traceability · unit, system and stress tests traced to every requirement · MISRA C:2012 analysis · an SBOM in CycloneDX format with every delivery
- UN R156
- Built to produce the evidence a manufacturer's UNECE R156 software-update management system has to show: signed packages verified before an application is marked valid, and a traceable record of what was updated. R156 certifies the manufacturer's process, not a component.
Algorithms and key lengths per programme, HSM interfaces, compilers and memory footprint are not published here. Ask us below.
Proof
In serial production, not on a slide.
0units bricked by Diadrom's software since 2016
~550test cases across ~30 releases
Watch the proof · 0:52Illustration, AI-generated
Licensing
Two ways to take the suite.
- 01
Licence with adaptation
Diadrom adapts the Bootloader to your MCU and OEM requirements, and you license the result — the form it has taken with Volvo Cars' suppliers since 2016.
- 02
Reuse licence
An implementation you already run, licensed for a new vehicle manufacturer, with no development project attached — as Nippon Seiki did in 2022.
Licences are perpetual or term-based, agreed per programme. Source-code escrow is available. Support and further development run under a maintenance agreement. More on how our products are licensed.
Read deeper
The engineering behind it.
Related products
The suite works with DiagStudio in the workshop and Dolphin in the test chain.
Ask us
Question about the Bootloader?
Two fields, straight to the engineers. We reply within one business day.