ST AN5247 User Manual

AN5247 Application note

Over-the-air application and wireless firmware update for STM32WB Series microcontrollers

Introduction

This document describes the procedure for over-the-air (OTA) firmware update on ST32WB devices with Bluetooth® Low Energy (BLE) connection. It explains how to use the OTA application provided within the STM32Cube firmware package.

This application can update the user application, the wireless firmware and the firmware upgrade service.

February 2021

AN5247 Rev 3

1/36

www.st.com

Contents	AN5247

Contents

1	Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	6
2	Reference documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	6
3	OTA application on STM32WB devices . . . . . . . . . . . . . . . . . . . . . . . . . .	7
	3.1 Over-the-air firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	7

3.1.1 Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.1.2 OTA application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.1.3 Memory architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.1.4 User application update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.1.5 Wireless firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2 BLE service and characteristics for firmware update . . . . . . . . . . . . . . . . 13

3.2.1 BLE application – Reboot request characteristics . . . . . . . . . . . . . . . . . 13 3.2.2 OTA application - Service and characteristics . . . . . . . . . . . . . . . . . . . . 15 3.2.3 Advertising . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.3 Flow description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 3.4 Wireless and FUS update procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.5 Updater clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.5.1 ST BLE Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.5.2 STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4	OTA step by step . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	21
	4.1 Project setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	22

4.1.1 User applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 4.1.2 OTA application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.2 Firmware update with ST BLE Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.2.1 Device connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.2.2 Update of user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 4.2.3 Update of wireless stack or FUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

4.3 Firmware update with STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . 31

4.3.1 Transparent mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 4.3.2 Update of the user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

5

Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34

2/36	AN5247 Rev 3

AN5247		Contents
6	Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . . 35

AN5247 Rev 3

3/36

List of tables	AN5247

List of tables

Table 1. Reboot request characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Table 2. OTA Service and characteristics declaration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Table 3. AD structure - Main. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Table 4. AD structure - Manufacturer specific field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Table 5. AD structure – Group B features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Table 6. Services and characteristics of example applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Table 7. Example (device Bluetooth MAC address = 80:E1:25:00:50:D6) . . . . . . . . . . . . . . . . . . . . 25 Table 8. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

4/36	AN5247 Rev 3

AN5247	List of figures

List of figures

Figure 1. STM32WB dual core FW architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Figure 2. Update of STM32WB firmware through BLE connection . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Figure 3. OTA procedure sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Figure 4. Simplified memory map of applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Figure 5. BLE application and wireless firmware architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Figure 6. User application update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Figure 7. wireless firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Figure 8. OTA reboot characteristic added in BLE user application . . . . . . . . . . . . . . . . . . . . . . . . . 14 Figure 9. OTA dataflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Figure 10. ST BLE Sensor mobile application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Figure 11. STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Figure 12. STM32CubeMonitor-RF with USB dongle in transparent mode . . . . . . . . . . . . . . . . . . . . . 20 Figure 13. Applicative projects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Figure 14. User application update - Use case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Figure 15. Peer-to-peer server device detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Figure 16. Peer-to-peer application / LED switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Figure 17. Firmware update ST BLE Sensor panel and OTA service detected. . . . . . . . . . . . . . . . . . 28 Figure 18. Download of new application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Figure 19. Heart rate profile after update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Figure 20. Update of wireless stack or FUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Figure 21. USB Dongle programming in USB DFU mode with STM32CubeProgrammer. . . . . . . . . . 32 Figure 22. Update of the user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Figure 23. Wireless or FUS update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

AN5247 Rev 3

5/36

Glossary	AN5247

1 Glossary

BLE	Bluetooth® Low Energy (Bluetooth® standard)
CPU1	Cortex® M4 (executes user application)
CPU2	Cortex® M0+ (executes FUS and wireless firmware)
IDE	Integrated development environment
IPCC	Inter-processor communication controller
FUS	Firmware update service
OTA	Over-the-air firmware update
SBRSA	Option byte - Secure backup RAM start address
SBRV	Option byte - Secure boot reset vector
SFSA	Option byte - Secure Flash memory start address
SIG	Bluetooth® special interest group
SNBRSA	Option byte - Secure non-backup RAM start address

2Reference documents

[1]RM0434: Multiprotocol wireless 32-bit MCU Arm®-based Cortex®-M4 with FPU,

®Low-Energy and 802.15.4 radio solution

[2]AN5185: STM32WB ST firmware upgrade services

[3]UM2288: STM32CubeMonitor-RF software tool for wireless performance

measurements

All these documents are available on www.st.com.

6/36	AN5247 Rev 3

AN5247	OTA application on STM32WB devices

3 OTA application on STM32WB devices

3.1Over-the-air firmware update

3.1.1Principle

Updating firmware during device lifetime is mandatory to guarantee state-of-art performance, to update the application with new features or corrected patches, and to keep the highest security level.

User application, wireless firmware and FUS update

The STM32WB Series microcontrollers are based on a dual Arm®(a) core.

The user application runs on CPU1 (Cortex® M4), while wireless firmware and FUS run on CPU2 (Cortex® M0+). The three applications can be updated independently.

As wireless and FUS are delivered in encrypted format, their update procedure relies on the STM32WB secure firmware for decryption and installation in the protected area of the Flash memory.

Figure 1. STM32WB dual core FW architecture

	CPU2	Wireless stack	FUS
			Updatable by
			OTA
			Not updatable
		BLE user	by OTA
	CPU1		OTA
		application	application
			MS51778V3

Over the air

Update of firmware can be done thanks to typical physical links such as USB, UART or I2C but this procedure requires a physical access with specific connectors on the device. Thanks to OTA it is possible to remotely update the firmware by using a wireless connection. In this application note, the wireless connection uses the BLE protocol.

a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

AN5247 Rev 3

7/36

OTA application on STM32WB devices	AN5247

Update clients

Update procedure follows a client/server architecture. It is initiated by an external client and the device acts as a server, responding to the request by installing the new firmware.

In this application note two examples (see Figure 2) of BLE-based OTA clients provided by STMicroelectronics are presented:

ST BLE Sensor: a mobile application for Android™ or iOS devices

STMCubeMonitor-RF: a PC tool communicating with a BLE USE dongle configured in HCI transparent mode

Figure 2. Update of STM32WB firmware through BLE connection

8/36	AN5247 Rev 3

AN5247	OTA application on STM32WB devices

3.1.2OTA application

OTA application is designed as a standalone application with BLE services for managing firmware transfer on client request, and its installation at the right place in the Flash memory. It is active and executed by CPU1 after an OTA request has been received by the user application.

The sequence is shown in Figure 3, where the numbers in red indicate the different stages.

Initial state is the user application running (1). When an OTA request is received (2), a system reset is triggered (3) and the OTA application becomes active (4) listening for client requests (5). Different services are provided for the update of wireless firmware or user application (6 and 7).

Figure 3. OTA procedure sequence

	3 Reboot service	System reset
OTA client	1 No	OTA request?
	User app
	2 OTA request	4 Yes
	OTA client	OTA app	5 OTA app active
	6 User FW or	7 Update
	wireless stack
	update request
	Application		Wireless
	update service		update service
			RSS wireless
			update service
			MS51780V1

Note:	With this firmware architecture, the current user application is responsible for receiving OTA
	requests for both the user application and the wireless firmware. This is the entry point of
	the procedure. OTA application then communicates with the client to update either one or
	the other firmware.

3.1.3Memory architecture

The Flash memory of STM32WB is split in two parts, a user and a secure one. The user part is accessible by CPU1 and contains the OTA application as well as the user application code and data. The secure part is accessible by CPU2 only, and contains FUS and the wireless firmware. This part is not accessible by the debug port, by the user application or by the bootloader. The boundary between the two areas is given by the option byte SFSA, the memory above is secure (see Figure 4). The SFSA value depends on the wireless firmware size, it is adjusted during the install procedure.

AN5247 Rev 3

9/36

OTA application on STM32WB devices	AN5247

The location of firmware involved on the OTA procedure is shown in Figure 4.

Figure 4. Simplified memory map of applications

0x080FFFFF

FUS

CPU2

Wireless FW

SFSA

Free area

User application

CPU1

User data

OTA application

0x080000000

Flash memory

<![if ! IE]>

<![endif]>Secure

<![if ! IE]>

<![endif]>part User

MS51781V2

FUS

FUS is stored at the top of the Flash memory. It embeds the secure firmware for wireless firmware decryption and authentication. It also offers a secure storage for cryptographic keys. Refer to [2] for a detailed description of its features.

Wireless firmware

It is stored just below FUS. This firmware drives the RF part of the MCU. Several protocols are supported: full BLE stack, BLE HCI only layer, Thread MTD, Thread FTD, concurrent mode (BLE + Thread FTD) and MAC 802.15.4 (low-level access to RF MAC). All stacks are available on www.st.com.

For BLE, the stack implements the real-time aspects. It contains the LE controller and LE host needed to manage all real time link layer and radio PHY interaction (Figure 5).

10/36

AN5247 Rev 3

AN5247	OTA application on STM32WB devices

Figure 5. BLE application and wireless firmware architecture

	User application and data
	This is the main user application. It is the applicative part of the device, implementing the
	BLE profiles and services relying on a wireless protocol. Communication between the user
	application and the wireless part is done through a mailbox system implemented thanks to
	the SRAM2 and IPCC hardware blocks (Figure 5). It is stored just above the OTA
	application in the user Flash memory.
	For convenience, a sector for application data not be erased during firmware update can be
	reserved between the two applications.
Note:	A free area of the Flash memory must be available for the new wireless image download in
	case of updates.

AN5247 Rev 3

11/36