Verified boot
A stage 0 bootloader checks the signature of the firmware before it runs it, with recovery over UART when an image is damaged. Tested on the board with an automated fault-injection suite.
Available for pilot customers
Groundplane: the foundation your firmware should start from
Secure boot, signed updates, crash forensics and a tested core library for Cortex-M microcontrollers. Your team starts on the product instead of the plumbing, and you get an engineer who knows every line of it.
The problem
Every product team rebuilds the same foundation
Before a device can do anything useful, someone has to write the bootloader, the update mechanism, settings storage that survives power loss, logging, fault handling and the cryptography that ties updates to your signing key. It is necessary work that no customer ever sees, and it is where the hardest field bugs hide.
Building it from scratch takes an experienced embedded engineer the better part of a year. Building it without that experience takes longer, and the gaps show up after the product ships.
Groundplane is that foundation, already written, tested on hardware and documented, and supported by the engineer who built it.
Your product application For example BusBench's Modbus layer
Services Signed OTA updates · settings storage · logging · error counters · self-test
Core library Strong types · containers · crypto (P-256, ML-DSA, SHA-256) · FreeRTOS wrappers
Platform Stage 0 verified boot · startup and MPU · fault capture with backtraces
Hardware STM32U5 (Cortex-M33) on silicon · Cortex-M33, M55 and R5 in emulation
What's included
Everything below your application
Signed updates with rollback
Over-the-air updates use the flash bank swap: the new firmware boots on trial, runs its self-test, and the device reverts to the previous version automatically if it fails. Verified on hardware.
Crash forensics
When the firmware faults, Groundplane walks the stack on the device itself and stores the backtrace and fault registers in memory that survives the watchdog reset. You get a readable crash report, not a mystery reboot.
Current and post-quantum crypto
ECDSA P-256 in software and on the STM32U5 PKA accelerator, hardened against fault attacks. ML-DSA post-quantum signatures with hand-optimised assembly. Both tested against the Wycheproof vectors.
Settings and diagnostics
Wear-levelled settings storage, persistent error counters, allocation-free logging over DMA, and SEGGER SystemView tracing for timing problems.
A safer C++ core
Strong types and bounded integers that turn unit and range mistakes into compile errors, error handling without exceptions, fixed-size containers, FreeRTOS wrappers, and memory protection set up at startup.
Engineering discipline
Tested like it will be audited
The foundation of a product deserves more scrutiny than the product itself, because everything else depends on it. Groundplane is checked with:
- Hundreds of automated tests on the host and on emulated Cortex-M33, Cortex-M55 and Cortex-R5 targets, plus test suites on the real board
- Host tests under AddressSanitizer and UndefinedBehaviorSanitizer
- Compile-fail tests that prove misuse of the API does not build
- cppcheck, clang-tidy and include-what-you-use, with a lint build that fails on any finding
- GCC 15 and Clang 22 with warnings as errors, conversion warnings and per-function stack limits
- A coding standard based on the C++ Core Guidelines and MISRA C++:2023, with every deviation documented
Supported hardware
| Target | Status |
|---|---|
| STM32U5 (Cortex-M33) | Runs on hardware, reference target |
| Cortex-M33 (QEMU mps2-an505) | Test suite in emulation |
| Cortex-M55 (QEMU mps3-an547) | Test suite in emulation |
| Cortex-R5 (QEMU zcu102) | Test suite in emulation |
| Your Cortex-M part | Ported as part of a pilot |
Built with CMake and Ninja. No vendor IDE required.
How a pilot works
From first call to long-term support
Introduction
We go through your product, hardware, constraints and schedule, and decide whether Groundplane fits.
Evaluation
Your team gets access to the source code and a walkthrough of the architecture and the test setup.
Integration
I port Groundplane to your board and bring up boot, updates and diagnostics together with your engineers.
Support
A source licence and a support agreement sized to your product's lifetime, up to ten years.
Questions
Frequently asked
Why FreeRTOS and not Zephyr?
Because of the support promise. The FreeRTOS kernel is a small set of MIT-licensed files whose API has barely changed in fifteen years. I can read all of it, pin it to one version and support a product on it for a decade. Zephyr moves quickly, with a large and changing dependency surface, which makes a ten-year commitment much harder to keep. If you need Zephyr's connectivity stacks, Groundplane is probably not the right choice, and I'll tell you so.
Do we get the source code?
Yes. Groundplane is delivered as complete source code with its build system and tests, built with standard tools (CMake, GCC or Clang). There are no binary blobs.
Is Groundplane certified for functional safety?
No. Its coding standard is based on MISRA C++:2023 and it is tested heavily, but it is not certified to IEC 61508 or a similar standard. If your product needs certification, let's discuss what evidence you need and whether Groundplane can help produce it.
We run embedded Linux. Is Groundplane for us?
Groundplane targets microcontrollers. Many machines have both: a Linux SoC and one or more microcontrollers next to it. For the Linux side (Yocto, Buildroot, real-time Linux), see services.
Is anything built on it?
Yes: BusBench, the Modbus test fixture, runs on Groundplane. It's how the foundation gets used every day.