Problem
Manufacturers needed a cleaner way to program the downstream flash boot image during production. The legacy path depended on JTAG, which adds station complexity and makes the factory flow more fragile. The replacement needed to receive an image over UART, erase/program SPI NOR flash, and leave the normal secure boot path responsible for authenticity.
The public Qualcomm E51 page describes an industrial IoT modem with eCosPro, UART, SPI, GPIO, low-power features, and compact deployment goals. That product context matters: a factory programming feature on this class of device has to be small, deterministic, and compatible with a constrained boot chain.
System context
Factory programming tool
|
v
High-speed UART receive path
|
v
Immutable OTP boot environment
|
v
Erase / program external SPI NOR flash
|
v
Existing flash boot verification pathThe updater did not try to become a second secure boot implementation. Its job was to make the production image transfer and flash programming path reliable enough that the established trust chain could validate the programmed image afterward.
Engineering challenge
OTP code has almost no room for mistakes because it cannot be patched like normal firmware. The implementation had to fit into an extremely small remaining memory budget, handle transport and flash behavior, survive interrupted programming attempts through restartable recovery, and avoid duplicating large verification logic that already existed in the boot chain.
One UART issue required investigation below the ordinary driver layer. The symptom looked like a receive failure, but the useful fix depended on understanding a register-level behavior that was not clearly exposed by the available documentation.
Implementation approach
Keep the trust boundary clean
Program the image in OTP, then rely on the established secure verification path instead of copying a large authentication design into the updater.
Design recovery around restart
Use a compact erase/program/retry model so an interrupted factory attempt can be repeated without consuming space for a heavy rollback scheme.
Validate before OTP commitment
Use a flash-simulation development path to prove behavior before committing code to the immutable boot area.
Optimize for production reality
Make the feature small enough for the existing boot memory while still understandable to SI/PV teams responsible for integration and test coverage.
Outcome
The resulting flow reduced the routine JTAG dependency for this programming stage and connected factory delivery to the same secure boot behavior used by the product. It demonstrates production embedded work at the boundary of UART transport, flash programming, immutable memory, and system security.