Verified boot
A stage 0 bootloader checks the signature of the firmware before it runs it, with recovery over UART when an image is damaged. Tested on the board with an automated fault-injection suite.
Available for pilot customers
Groundplane: the foundation your firmware should start from
Secure boot, signed updates, crash forensics and a tested core library for Cortex-M microcontrollers, with the tools to test, measure and debug your own code on top of it. It covers the parts of the EU Cyber Resilience Act's Annex I that live in firmware, with the evidence to show it. Your team starts on the product instead of the plumbing, and you get an engineer who knows every line of it.
The problem
Every product team rebuilds the same foundation
Before a device can do anything useful, someone has to write the bootloader, the update mechanism, settings storage that survives power loss, logging, fault handling and the cryptography that ties updates to your signing key. It is necessary work that no customer ever sees, and it is where the hardest field bugs hide.
Building it from scratch takes an experienced embedded engineer the better part of a year. Building it without that experience takes longer, and the gaps show up after the product ships.
Groundplane is that foundation, already written, tested on hardware and documented, and supported by the engineer who built it.
Your product application For example BusBench's Modbus layer
Services Signed OTA updates · settings storage · logging · error counters · self-test
Core library Strong types · containers · crypto (P-256, ML-DSA, SHA-256) · FreeRTOS wrappers
Platform Stage 0 verified boot · startup and MPU · fault capture with backtraces
Hardware STM32U5 (Cortex-M33) on silicon · Cortex-M33, M55 and R5 in emulation
Development tools, for every layer Host, QEMU and board tests · benchmarks · QEMU profiler · USB command channel · static analysis
What's included
Everything below your application
Signed updates with rollback
Over-the-air updates use the flash bank swap: the new firmware boots on trial, runs its self-test, and the device reverts to the previous version automatically if it fails. Verified on hardware.
Crash forensics
When the firmware faults, Groundplane walks the stack on the device itself and stores the backtrace and fault registers in memory that survives the watchdog reset. You get a readable crash report, not a mystery reboot, and the log scripts turn every address into a function and a source line.
Current and post-quantum crypto
ECDSA P-256 in software and on the STM32U5 PKA accelerator, hardened against fault attacks. ML-DSA post-quantum signatures with hand-optimised assembly. Both tested against the Wycheproof vectors.
Logging and diagnostics
Allocation-free logging over DMA, with a log level per task that you change at runtime and that is kept in the settings. Persistent error counters, and SEGGER SystemView tracing for timing problems.
A safer C++ core
Error handling without exceptions, fixed-size containers, and memory protection set up at startup. How its types turn mistakes into compile errors is below.
Measured
Numbers from the reference board
Measured on an STM32U5A5 at 160 MHz.
45 KBstage 0 bootloader, Release build with GCC, in a 64 KiB budget
194 msfrom reset to the application, including both signature checks
2.7 sto install a 171,800-byte update over USB, end to end
0 pageserased when an update package is tampered with: it is refused before any flash is touched
Faster development
The tools Groundplane is built with, for your code too
Your team doesn't only get a foundation, it gets the setup to build on it: the same types, checks, tests and measurements that Groundplane itself goes through.
Mistakes that don't compile
Strong types, so two quantities with the same representation can't be swapped. Bounded integers whose constants are checked when they compile, and whose values from outside are checked once, where they come in. Typed wrappers for FreeRTOS tasks, mutexes and notifications. Compile-fail tests prove the misuse doesn't build.
Settings with a schema
Declare your settings once: an unknown name or the wrong type is a compile error, and a value from the host is checked before anything is stored. Wear-levelled over flash with CRC-checked slots, tested against power loss and failing reads, and kept through an update and a revert.
Static analysis in every build
clang-tidy, cppcheck and include-what-you-use, in a lint build that fails on any finding. GCC 15 and Clang 22 with conversion warnings as errors. Your application gets the same configuration from its first commit.
Tests at every level
Unit tests on your PC with sanitizers and mocks, the same tests on emulated Cortex-M33, M55 and R5, suites on the board, and Robot Framework system tests. Your application plugs into the same setup, so it is tested the way Groundplane is.
A USB command channel
JSON commands over USB, on TinyUSB. A new command is one handler, tested on the host like any other code. Commands to read and change settings and log levels, read diagnostics and error counters, and list what the device supports come with it.
Measure, then optimise
Benchmarks that count cycles on the board, run from SRAM where the code fits. A QEMU plugin that counts every instruction a function and everything it calls execute, so you know where the time goes before the hardware exists.
Cyber Resilience Act
What Groundplane covers in the CRA
The firmware clauses of Annex I, with their status on each supported microcontroller. The full table, with the clauses that stay with you, is on the CRA page.
| Annex I | Groundplane | STM32U5 | STM32C5 |
|---|---|---|---|
| (2)(c) security updates | Signed update, trial boot, automatic rollback | Works today | Works today |
| (2)(f) integrity | ECDSA P-256 and ML-DSA-65, both checked on every boot; packages checked before any erase | Works today | Works today |
| (2)(h) availability after an incident | Up to three counted trial boots under the watchdog, then revert; UART recovery | Works today | Works today |
| (2)(l) recording activity | Crash reports that survive the watchdog reset, update and boot counters; security event log planned | In part | In part |
| (2)(d) unauthorised access | Signature checks today; locked bootloader planned (TrustZone on the STM32U5 only) | In part | In part |
| (2)(m) remove data and settings | Factory reset | Planned | Planned |
| (2)(e) confidentiality | Image encryption | Planned | Planned |
| Part II (1) SBOM | Generated by the build, CycloneDX | Planned | Planned |
| Part II (4)–(6) vulnerability handling | Disclosure policy, contact and advisories for Groundplane itself | Works today | Works today |
Groundplane answers these sub-clauses of Annex I for you, with the evidence for your technical file. You remain responsible for the processes and the other obligations the CRA gives you as the manufacturer of your product.
More than code
What you buy with the licence
Your due diligence on a component has to cover its supplier, not only its source. This is what comes with Groundplane:
The source, complete
All source code with its build system, tests and design documents, from day one. No binary blobs. Another senior engineer can carry on from there.
Evidence for your file
The Annex I mapping for the clauses Groundplane covers, the test reports, and design documents with measured numbers.
A manufacturer that answers for it
Volt Software is Groundplane's manufacturer under the CRA: a published vulnerability process, advisories, and reporting to ENISA when it's needed.
A declared support period
Free security updates for Groundplane 1.x until December 2032, never less than five years after your purchase. Extended security updates up to ten years are available as an option.
A short bill of materials
FreeRTOS, TinyUSB, a handful of libraries and the ST HAL, each pinned to one version. Short enough for one engineer to watch for vulnerabilities, every week.
The engineer who wrote it
Questions go to the person who wrote every line. An optional yearly support agreement adds response times, engineering days and integration work on your board.
Engineering discipline
Tested like it will be audited
The foundation of a product deserves more scrutiny than the product itself, because everything else depends on it. Groundplane is checked with:
- Hundreds of automated tests on the host and on emulated Cortex-M33, Cortex-M55 and Cortex-R5 targets, plus test suites on the real board
- Host tests under AddressSanitizer and UndefinedBehaviorSanitizer
- Compile-fail and link-fail tests that prove misuse of the API does not build
- Fault injection into the settings storage: failing reads, corrupted slots and power lost partway through a write
- Per-function stack limits, checked by the compiler
- A coding standard based on the C++ Core Guidelines and MISRA C++:2023, with every deviation documented
The static analysis and compiler settings are in the development tools above.
Supported hardware
| Target | Status |
|---|---|
| STM32U5 (Cortex-M33) | Supported, reference target |
| STM32C5 (Cortex-M33, no TrustZone) | Supported |
| Cortex-M33 (QEMU mps2-an505) | Test suite in emulation |
| Cortex-M55 (QEMU mps3-an547) | Test suite in emulation |
| Cortex-R5 (QEMU zcu102) | Test suite in emulation |
| Your board, or another Cortex-M part | Quoted separately |
Built with CMake and Ninja. No vendor IDE required.
Alternatives
Groundplane, MCUboot or wolfBoot?
Both are good bootloaders, and for some teams the better choice. This is how they compare, read from their repositories in October 2026 (MCUboot at commit a9767a0, wolfBoot at commit 80a186f) and from ST's documentation of OEMiRoT.
| MCUboot | wolfBoot | Groundplane | |
|---|---|---|---|
| What it is | Secure bootloader, usually with Zephyr | Secure bootloader, independent of the RTOS | Bootloader plus the foundation above it: updates, crash forensics, settings, logging, crypto, on FreeRTOS |
| Licence and support | Apache-2.0, community; security under the TrustedFirmware.org policy | GPLv3, or commercial with paid support from wolfSSL | Commercial source licence; free security updates for a declared period |
| Signatures | ECDSA, Ed25519 or RSA | ECC, Ed25519/448, RSA, ML-DSA, LMS, XMSS; optionally two at once | ECDSA P-256 and ML-DSA-65, always both |
| Immutable first stage | Not in MCUboot itself; ST's OEMiRoT for the STM32U5 and STM32C5 is built on MCUboot and adds it | Runs as the OEM-iRoT on the STM32H5; locking it is left to you | An immutable stage 0 as the root of trust, locked with write protection, hide protection and boot lock, that checks the ECDSA and ML-DSA signatures |
| Where it leads | Encrypted images, fault-injection hardening, measured boot, many targets | Encryption, attestation, an SBOM generator, glitch hardening, many targets | Trial boots supervised by the watchdog, crash reports that survive the reset, settings that survive an update and a revert |
| Tools for your application | A simulator for the bootloader itself; Zephyr's ztest and Twister if you're on Zephyr | A simulator target and unit tests for the bootloader itself; nothing for your application | Host, emulation and board tests, benchmarks, a QEMU profiler and a USB command channel, used for your code too |
| Where it lacks | No post-quantum signatures; nothing above the bootloader without Zephyr | Nothing above the bootloader | No image encryption yet (planned) and no attestation; two microcontroller families |
Choose MCUboot
if you're on Zephyr and community support is enough for you, or if ST's MCUboot-based OEMiRoT gives you the immutable root of trust you need.
Choose wolfBoot
if you need many targets, attestation or FIPS, or image encryption today.
Choose Groundplane
if you're on FreeRTOS, want the whole foundation and one accountable supplier for up to ten years.
Roadmap
Everything below is done by 1 November 2027
Six weeks before the CRA applies in full. Each item says which microcontrollers it covers.
| Item | STM32U5 | STM32C5 |
|---|---|---|
| SBOM generated by the build (CycloneDX) | Planned | Planned |
| Security event log with an opt-out | Planned | Planned |
| Factory reset of settings and user data | Planned | Planned |
| Locked bootloader: readout protection, write protection, boot lock, OEM keys | Planned | Planned |
| Isolation of the bootloader and keys from the application | PlannedTrustZone | PlannedHide protection; no TrustZone on this part |
| Key revocation in OTP memory | Planned | Planned |
| Firmware image encryption, with the AES hardware | Planned | Planned |
| Submitted for class I conformity assessment | Planned | Planned |
Not part of the dates above: on the STM32U5, Groundplane aims for a SESIP evaluation at assurance level 2 against GlobalPlatform's SESIP Profile for PSA Certified Level 2, with the chip and Groundplane evaluated together on the NUCLEO-U5A5ZJ-Q. It hasn't been evaluated yet and no date is set. It comes on top of the class I conformity assessment, not instead of it, and doesn't cover the STM32C5, which has no TrustZone.
How a pilot works
Three months, a fixed price, written criteria
EUR 14,000 excl. VAT, including the product-line licence when the pilot succeeds. That is 30% off the EUR 20,000 list price, for the first five customers. Five places.
Introduction
We go through your product, hardware, constraints and schedule, and decide whether Groundplane fits.
Evaluation
Your team gets the source code and a walkthrough of the architecture and the test setup.
Integration
On the reference board, or on your board where it already runs an STM32U5 or STM32C5, I bring up boot, updates and diagnostics together with your engineers.
Licence and support
The licence comes with free security updates until your release line's end date. A yearly engineering support agreement is optional.
The pilot succeeds when
- Groundplane runs on the reference board, or on your board with a supported microcontroller
- A signed update installs, and a bad one rolls back
- A crash report is read out after a watchdog reset
- You have the Annex I mapping for the clauses Groundplane covers, in your configuration
- Your engineers add a USB command of their own and test it on the host
Not included: bringing up your own board, porting to a microcontroller that isn't supported yet, and an assessment of your whole product. Board bring-up and ports are quoted separately.
Questions
Frequently asked
Does Groundplane make our product CRA compliant?
It answers several sub-clauses of Annex I for you: the ones listed above, implemented in the firmware, with the evidence for your technical file. As the manufacturer of your product, you are still responsible for the processes and the other obligations under the CRA, such as the risk assessment, handling vulnerabilities in your product and the declaration of conformity.
Is Groundplane itself covered by the CRA?
Yes. A bootloader is a "boot manager", an important product in class I. Volt Software is Groundplane's manufacturer: it handles vulnerabilities, reports to ENISA when required, and will submit Groundplane for class I conformity assessment by 1 November 2027.
Do security updates cost extra?
No. Until the end date of your release line (Groundplane 1.x: currently December 2032, and never less than five years after your purchase), fixes for vulnerabilities come in new releases you can install free of charge, with an advisory for each. If your product needs longer, you can buy extended security updates up to ten years after your purchase.
The optional yearly support agreement buys my time: response times, engineering days, integrating and testing new releases on your board, and backports to an older release you have pinned.
What does a pilot cost?
EUR 14,000 excl. VAT for the first five customers: three months on an STM32U5 or STM32C5, the success criteria above, and the product-line licence when it succeeds. The list price is EUR 20,000. Bringing up your own board, or porting to a microcontroller that isn't supported yet, is quoted separately.
What happens if you stop?
You have the complete source, build system, tests and design documents from day one. Another senior embedded engineer can carry on from there.
Why post-quantum signatures?
Every update is signed with ECDSA P-256 and ML-DSA-65, and the bootloader checks both. The CRA doesn't require post-quantum signatures, but a product supported past 2030 should not depend on ECDSA alone.
Why FreeRTOS and not Zephyr?
Because of the support promise. The FreeRTOS kernel is a small set of MIT-licensed files whose API has barely changed in fifteen years. I can read all of it, pin it to one version and support a product on it for a decade. Zephyr moves quickly, with a large and changing dependency surface, which makes a ten-year commitment much harder to keep. If you need Zephyr's connectivity stacks, Groundplane is probably not the right choice, and I'll tell you so.
Do we get the source code?
Yes. Groundplane is delivered as complete source code with its build system and tests, built with standard tools (CMake, GCC or Clang). There are no binary blobs.
Does it fit our CI and our tools?
Groundplane builds with CMake and Ninja, and every test level (host, QEMU and board) runs from the command line, so any CI system that can run a script can run it. No vendor IDE is needed; use the editor and debugger your team already has.
The QEMU profiler is GPL. Does that affect our firmware?
No. The profiler is a plugin that QEMU loads on your PC, and it is GPL-2.0 because it includes QEMU's plugin header. It is never linked into the firmware, so your product's licence doesn't change.
Is Groundplane certified for functional safety?
No. Its coding standard is based on MISRA C++:2023 and it is tested heavily, but it is not certified to IEC 61508 or a similar standard. If your product needs certification, let's discuss what evidence you need and whether Groundplane can help produce it.
We run embedded Linux. Is Groundplane for us?
Groundplane targets microcontrollers. Many machines have both: a Linux SoC and one or more microcontrollers next to it. For the Linux side (Yocto, Buildroot, real-time Linux), see services.
Is anything built on it?
Yes: BusBench, the Modbus test fixture, runs on Groundplane. It's how the foundation gets used every day.