AUTOSAR Classic is the standard for embedded, real-time control units, and its output is specifications. AUTOSAR Adaptive targets demanding uses like automated driving and over the air updates, runs on a POSIX based operating system, is written in C++ and includes an implementation. The change affects how updates, communication and code review work.
Background
AUTOSAR, short for AUTomotive Open System ARchitecture, is a global development partnership founded in 2003. BMW, Robert Bosch, Continental, Daimler, Siemens VDO and Volkswagen formed it in July 2003. It aims to create an open and standardized software architecture for automotive control units, with scalability, portability, safety, availability and maintainability.
Classic Platform
Classic is the standard for embedded real-time units based on OSEK. Its main output is specifications. It separates software into application, runtime environment and basic software layers, and its Virtual Functional Bus lets applications communicate without depending on the hardware or network underneath. Development ran in phases from 2004 to 2013, then moved to continuous work.
Adaptive Platform
Work on Adaptive began in 2016 with an initial release in early 2017. It was created for demanding use cases such as automated driving, Car-2-X communication and over the air updates. Its core is a POSIX based operating system and it is written in C++. It uses service oriented communication, with SOME/IP over Ethernet as the in vehicle protocol. Unlike Classic, it includes an implementation as well as specifications.
Side by side
| Aspect | Classic | Adaptive |
|---|---|---|
| Target units | Embedded, real-time | High-compute, updatable |
| Foundation | OSEK based | POSIX based OS |
| Communication | Virtual Functional Bus | Service oriented, SOME/IP over Ethernet |
| Output | Specifications | Specifications and an implementation |
What this means for a security review
These points are reasoning from the differences above, not claims from the source.
- Updates. Adaptive was designed with over the air updates in mind. A review should focus on signed images, rollback and the update records that UN R156 expects.
- Memory safety. C++ code brings familiar memory safety risks. Static analysis, fuzzing and dependency review matter more for services than for small fixed function code.
- Service interfaces. Service oriented communication exposes callable services. Check which services each application may call and how that is enforced.
- Third party code. A POSIX based system pulls in an operating system and libraries. That is a software supply chain surface, and a bill of materials helps track it.
- Isolation. Ask how applications are separated from each other, and what a compromised one can reach.
The AUTOSAR article notes that the Adaptive Platform needs secure on board communication. It does not describe a particular mechanism, so check the AUTOSAR specifications for the one you use.
Quick check
Does Adaptive replace Classic?
No. They address different kinds of control units and can coexist in one vehicle.
Sources
Last reviewed: 19 October 2026.
