Published June 10, 2026

STM32 ECU with Live Diagnostics & Fail-Safe OTA Updates

STM32F446RE control unit: live UART diagnostics, safety state machine with watchdog, dual-bank CRC-32 bootloader with auto rollback.

AdvancedWork in progress22

STM32 ECU with Live Diagnostics & Fail-Safe OTA Updates

Things used in this project

Hardware components

STMicroelectronics STM32 Nucleo-64 Board

M5Stack ENV III Unit with Temperature Humidity Air Pressure Sensor (SHT30+QMP6988)

Seeed Studio Grove - Barometer Sensor (BMP280)

Story

The idea didn't come from a textbook or a class assignment. It came from a small frustration that wouldn't leave me alone.

Every time I watched my phone update overnight, or saw a car receive an over-the-air software fix in a press release, or noticed a smart device quietly improve itself without me having to plug anything in — I kept thinking about how invisible that magic is. The user sees nothing. No cables. No technician visit. No "please bring it to a service center." The system just gets better while it's running.

And then I'd think about all the embedded systems that don't work that way. Industrial controllers that need a technician with a JTAG cable to fix a bug. Sensors deployed in remote locations that fail and stay failed until someone physically reaches them. Old ECUs in cars that carry known software defects for years because the only way to patch them is a dealership visit.

That gap — between the seamless update experience we expect from our phones and the brittle, contact-required reality of most embedded firmware — became the seed of this project.

I wanted to build a system that could repair itself, while running, without any human touching it.

Not a phone. Not a server. A real embedded controller — the kind that sits in a vehicle, a piece of factory equipment, a remote sensor — with the discipline of a safety-critical system but the upgradability of a modern cloud service. Something that could:

Receive a new firmware image over a wire or wireless link
Verify it cryptographically before trusting it
Apply it without going offline
Roll back automatically if the new code misbehaves
Tell you, in real time, what it's doing and why

That's the project. An embedded control unit with a diagnostic interface and a secure, in-field firmware update mechanism — built on an STM32F446RE, sensing its environment through I2C devices, and exposing itself to the outside world through a structured command interface.

ECU_Firmware

/* USER CODE BEGIN Header */
/**
  ******************************************************************************
  * @file           : main.c
  * @brief          : Main program body
  ******************************************************************************
  */
/* USER CODE END Header */

/* Includes ------------------------------------------------------------------*/
#include "main.h"
#include "i2c.h"
#include "spi.h"
#include "tim.h"
#include "usart.h"
#include "gpio.h"
#include "firmware.h"
#include <stdint.h>

/* Private function prototypes -----------------------------------------------*/
void SystemClock_Config(void);

int main(void)
{
  /*
   * Application is linked at 0x08010000.
   * Required when bootloader jumps to this firmware.
   */
  SCB->VTOR = 0x08010000;
  __DSB();
  __ISB();

  HAL_Init();

  SystemClock_Config();

  MX_GPIO_Init();
  MX_USART2_UART_Init();
  MX_I2C1_Init();
  MX_SPI1_Init();
  MX_TIM2_Init();

  HAL_UART_Transmit(&huart2,
                    (uint8_t*)"\r\nAPP STARTED\r\n",
                    15,
                    HAL_MAX_DELAY);

  /*
   * Bootloader disabled interrupts before jump.
   * Re-enable them so USART2 RX and TIM2 interrupts work.
   */
  __enable_irq();

  Firmware_Init();
  Firmware_Run();

  while (1)
  {
  }
}

void SystemClock_Config(void)
{
  RCC_OscInitTypeDef RCC_OscInitStruct = {0};
  RCC_ClkInitTypeDef RCC_ClkInitStruct = {0};

  __HAL_RCC_PWR_CLK_ENABLE();
  __HAL_PWR_VOLTAGESCALING_CONFIG(PWR_REGULATOR_VOLTAGE_SCALE1);

  RCC_OscInitStruct.OscillatorType = RCC_OSCILLATORTYPE_HSE;
  RCC_OscInitStruct.HSEState = RCC_HSE_ON;
  RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON;
  RCC_OscInitStruct.PLL.PLLSource = RCC_PLLSOURCE_HSE;
  RCC_OscInitStruct.PLL.PLLM = 8;
  RCC_OscInitStruct.PLL.PLLN = 360;
  RCC_OscInitStruct.PLL.PLLP = RCC_PLLP_DIV2;
  RCC_OscInitStruct.PLL.PLLQ = 2;
  RCC_OscInitStruct.PLL.PLLR = 2;

  if (HAL_RCC_OscConfig(&RCC_OscInitStruct) != HAL_OK)
  {
    Error_Handler();
  }

  if (HAL_PWREx_EnableOverDrive() != HAL_OK)
  {
    Error_Handler();
  }

  RCC_ClkInitStruct.ClockType = RCC_CLOCKTYPE_HCLK  |
                                RCC_CLOCKTYPE_SYSCLK |
                                RCC_CLOCKTYPE_PCLK1  |
                                RCC_CLOCKTYPE_PCLK2;

  RCC_ClkInitStruct.SYSCLKSource = RCC_SYSCLKSOURCE_PLLCLK;
  RCC_ClkInitStruct.AHBCLKDivider = RCC_SYSCLK_DIV1;
  RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV4;
  RCC_ClkInitStruct.APB2CLKDivider = RCC_HCLK_DIV2;

  if (HAL_RCC_ClockConfig(&RCC_ClkInitStruct, FLASH_LATENCY_5) != HAL_OK)
  {
    Error_Handler();
  }
}

void Error_Handler(void)
{
  __disable_irq();

  while (1)
  {
  }
}

#ifdef USE_FULL_ASSERT
void assert_failed(uint8_t *file, uint32_t line)
{
}
#endif