Sekar Kulandaivel, Bosch
Modern vehicles must support long-term updates under cybersecurity and type-approval regulations such as UN R155/156, including deeply embedded ECUs not originally designed for post-deployment updates. Dual-bank flash is costly, memory-intensive, and impractical for many single-bank platforms. We present Patchlings, a safety-aware update mechanism that preserves original firmware as an immutable baseline while redirecting bounded control flow to a dedicated patch region. Patchlings provides A/B-equivalent power-fail safety using dual-sector redirection-table commits with atomic activation, supports bootloader and application updates, and avoids full-image rewrite of validated software. We validate feasibility through implementation and power-fail testing on an NXP S32K board.
