Comprehensive guide to automotive firmware design, hardware root of trust, dual-bank A/B memory layout, delta compression, and fail-safe recovery in SDVs.
In an SDV, firmware cannot block vehicle operation while flashing. Modern microcontrollers and SoCs allocate two identical memory regions: Bank A (currently running active software) and Bank B (inactive target). The new image streams into Bank B while driving, followed by signature validation. Upon key-off, the bootloader points the reset vector to Bank B.
If a newly updated image fails during initialization or triggers memory corruption, the hardware watchdog timer expires without a heartbeat acknowledgment. The bootloader detects the failed boot counter and automatically reverts the reset vector to the previous validated bank, ensuring that vehicles never become bricked in the field.