Bosch researcher Sekar Kulandaivel has developed Patchlings, an update mechanism that lets deeply embedded ECUs receive secure patches without the dual-bank flash memory most designs assume, a constraint that blocks many vehicles from meeting UN R155 and R156 update mandates.
Modern regulations require automakers to support long-term updates, including ECUs never designed for post-deployment patching. The usual answer is dual-bank flash, where two copies of firmware let a system roll back on failure. That approach is costly and impractical for many single-bank platforms.
Patchlings keeps the original firmware as an immutable baseline and redirects bounded control flow to a dedicated patch region. A dual-sector redirection-table commit gives A/B-equivalent power-fail safety with atomic activation, and the mechanism supports both bootloader and application updates without rewriting validated software.
The researcher validated the design through implementation and power-fail testing on an NXP S32K board, and presented the work at VehicleSec ’26.
The approach matters as regulators push software-defined vehicles: update capability is now a compliance requirement, and automakers need patch paths that fit cheap, memory-constrained ECUs rather than hardware redesigns. Making rollback-safe updates affordable for the whole vehicle, not just flagship controllers, is what lets the industry close the gap between regulation and reality.
