AN5247 Application note
Over-the-air application and wireless firmware update for STM32WB Series microcontrollers
Introduction
This document describes the procedure for over-the-air (OTA) firmware update on ST32WB devices with Bluetooth® Low Energy (BLE) connection. It explains how to use the OTA application provided within the STM32Cube firmware package.
This application can update the user application, the wireless firmware and the firmware upgrade service.
February 2021 |
AN5247 Rev 3 |
1/36 |
www.st.com
Contents |
AN5247 |
|
|
Contents
1 |
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
6 |
2 |
Reference documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
6 |
3 |
OTA application on STM32WB devices . . . . . . . . . . . . . . . . . . . . . . . . . . |
7 |
|
3.1 Over-the-air firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
7 |
3.1.1 Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.1.2 OTA application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.1.3 Memory architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.1.4 User application update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.1.5 Wireless firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2 BLE service and characteristics for firmware update . . . . . . . . . . . . . . . . 13
3.2.1 BLE application – Reboot request characteristics . . . . . . . . . . . . . . . . . 13 3.2.2 OTA application - Service and characteristics . . . . . . . . . . . . . . . . . . . . 15 3.2.3 Advertising . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.3 Flow description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 3.4 Wireless and FUS update procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.5 Updater clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.5.1 ST BLE Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.5.2 STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4 |
OTA step by step . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
21 |
|
4.1 Project setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
22 |
4.1.1 User applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 4.1.2 OTA application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.2 Firmware update with ST BLE Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.2.1 Device connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.2.2 Update of user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 4.2.3 Update of wireless stack or FUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
4.3 Firmware update with STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . 31
4.3.1 Transparent mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 4.3.2 Update of the user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5 |
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
34 |
2/36 |
AN5247 Rev 3 |
AN5247 |
|
Contents |
6 |
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |
. . . . 35 |
AN5247 Rev 3 |
3/36 |
List of tables |
AN5247 |
|
|
List of tables
Table 1. Reboot request characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Table 2. OTA Service and characteristics declaration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Table 3. AD structure - Main. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Table 4. AD structure - Manufacturer specific field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Table 5. AD structure – Group B features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Table 6. Services and characteristics of example applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Table 7. Example (device Bluetooth MAC address = 80:E1:25:00:50:D6) . . . . . . . . . . . . . . . . . . . . 25 Table 8. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4/36 |
AN5247 Rev 3 |
AN5247 |
List of figures |
|
|
List of figures
Figure 1. STM32WB dual core FW architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Figure 2. Update of STM32WB firmware through BLE connection . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Figure 3. OTA procedure sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Figure 4. Simplified memory map of applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Figure 5. BLE application and wireless firmware architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Figure 6. User application update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Figure 7. wireless firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Figure 8. OTA reboot characteristic added in BLE user application . . . . . . . . . . . . . . . . . . . . . . . . . 14 Figure 9. OTA dataflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Figure 10. ST BLE Sensor mobile application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Figure 11. STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Figure 12. STM32CubeMonitor-RF with USB dongle in transparent mode . . . . . . . . . . . . . . . . . . . . . 20 Figure 13. Applicative projects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Figure 14. User application update - Use case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Figure 15. Peer-to-peer server device detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Figure 16. Peer-to-peer application / LED switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Figure 17. Firmware update ST BLE Sensor panel and OTA service detected. . . . . . . . . . . . . . . . . . 28 Figure 18. Download of new application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Figure 19. Heart rate profile after update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Figure 20. Update of wireless stack or FUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Figure 21. USB Dongle programming in USB DFU mode with STM32CubeProgrammer. . . . . . . . . . 32 Figure 22. Update of the user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Figure 23. Wireless or FUS update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
AN5247 Rev 3 |
5/36 |
Glossary |
AN5247 |
|
|
BLE |
Bluetooth® Low Energy (Bluetooth® standard) |
CPU1 |
Cortex® M4 (executes user application) |
CPU2 |
Cortex® M0+ (executes FUS and wireless firmware) |
IDE |
Integrated development environment |
IPCC |
Inter-processor communication controller |
FUS |
Firmware update service |
OTA |
Over-the-air firmware update |
SBRSA |
Option byte - Secure backup RAM start address |
SBRV |
Option byte - Secure boot reset vector |
SFSA |
Option byte - Secure Flash memory start address |
SIG |
Bluetooth® special interest group |
SNBRSA |
Option byte - Secure non-backup RAM start address |
[1]RM0434: Multiprotocol wireless 32-bit MCU Arm®-based Cortex®-M4 with FPU,
®Low-Energy and 802.15.4 radio solution
[2]AN5185: STM32WB ST firmware upgrade services
[3]UM2288: STM32CubeMonitor-RF software tool for wireless performance
measurements
All these documents are available on www.st.com.
6/36 |
AN5247 Rev 3 |
AN5247 |
OTA application on STM32WB devices |
|
|
3.1Over-the-air firmware update
Updating firmware during device lifetime is mandatory to guarantee state-of-art performance, to update the application with new features or corrected patches, and to keep the highest security level.
User application, wireless firmware and FUS update
The STM32WB Series microcontrollers are based on a dual Arm®(a) core.
The user application runs on CPU1 (Cortex® M4), while wireless firmware and FUS run on CPU2 (Cortex® M0+). The three applications can be updated independently.
As wireless and FUS are delivered in encrypted format, their update procedure relies on the STM32WB secure firmware for decryption and installation in the protected area of the Flash memory.
CPU2 |
Wireless stack |
FUS |
|
|
|
Updatable by |
|
|
|
OTA |
|
|
|
Not updatable |
|
|
BLE user |
by OTA |
|
CPU1 |
OTA |
||
application |
application |
||
|
|||
|
|
MS51778V3 |
Over the air
Update of firmware can be done thanks to typical physical links such as USB, UART or I2C but this procedure requires a physical access with specific connectors on the device. Thanks to OTA it is possible to remotely update the firmware by using a wireless connection. In this application note, the wireless connection uses the BLE protocol.
a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.
AN5247 Rev 3 |
7/36 |
OTA application on STM32WB devices |
AN5247 |
|
|
Update clients
Update procedure follows a client/server architecture. It is initiated by an external client and the device acts as a server, responding to the request by installing the new firmware.
In this application note two examples (see Figure 2) of BLE-based OTA clients provided by STMicroelectronics are presented:
ST BLE Sensor: a mobile application for Android™ or iOS devices
STMCubeMonitor-RF: a PC tool communicating with a BLE USE dongle configured in HCI transparent mode
8/36 |
AN5247 Rev 3 |
AN5247 |
OTA application on STM32WB devices |
|
|
OTA application is designed as a standalone application with BLE services for managing firmware transfer on client request, and its installation at the right place in the Flash memory. It is active and executed by CPU1 after an OTA request has been received by the user application.
The sequence is shown in Figure 3, where the numbers in red indicate the different stages.
Initial state is the user application running (1). When an OTA request is received (2), a system reset is triggered (3) and the OTA application becomes active (4) listening for client requests (5). Different services are provided for the update of wireless firmware or user application (6 and 7).
|
3 Reboot service |
System reset |
|
|
|
||
OTA client |
1 No |
OTA request? |
|
User app |
|||
|
2 OTA request |
4 Yes |
|
|
OTA client |
OTA app |
5 OTA app active |
|
6 User FW or |
7 Update |
|
|
wireless stack |
||
|
|
|
|
|
update request |
|
|
|
Application |
|
Wireless |
|
update service |
update service |
|
|
|
|
RSS wireless |
|
|
|
update service |
|
|
|
MS51780V1 |
Note: |
With this firmware architecture, the current user application is responsible for receiving OTA |
|
requests for both the user application and the wireless firmware. This is the entry point of |
|
the procedure. OTA application then communicates with the client to update either one or |
|
the other firmware. |
The Flash memory of STM32WB is split in two parts, a user and a secure one. The user part is accessible by CPU1 and contains the OTA application as well as the user application code and data. The secure part is accessible by CPU2 only, and contains FUS and the wireless firmware. This part is not accessible by the debug port, by the user application or by the bootloader. The boundary between the two areas is given by the option byte SFSA, the memory above is secure (see Figure 4). The SFSA value depends on the wireless firmware size, it is adjusted during the install procedure.
AN5247 Rev 3 |
9/36 |
OTA application on STM32WB devices |
AN5247 |
|
|
The location of firmware involved on the OTA procedure is shown in Figure 4.
0x080FFFFF
FUS
CPU2
Wireless FW
SFSA
Free area
User application
CPU1
User data
OTA application
0x080000000
Flash memory
<![endif]>Secure
<![if ! IE]><![endif]>part User
MS51781V2
FUS
FUS is stored at the top of the Flash memory. It embeds the secure firmware for wireless firmware decryption and authentication. It also offers a secure storage for cryptographic keys. Refer to [2] for a detailed description of its features.
Wireless firmware
It is stored just below FUS. This firmware drives the RF part of the MCU. Several protocols are supported: full BLE stack, BLE HCI only layer, Thread MTD, Thread FTD, concurrent mode (BLE + Thread FTD) and MAC 802.15.4 (low-level access to RF MAC). All stacks are available on www.st.com.
For BLE, the stack implements the real-time aspects. It contains the LE controller and LE host needed to manage all real time link layer and radio PHY interaction (Figure 5).
10/36 |
AN5247 Rev 3 |
AN5247 |
OTA application on STM32WB devices |
|
|
|
User application and data |
|
This is the main user application. It is the applicative part of the device, implementing the |
|
BLE profiles and services relying on a wireless protocol. Communication between the user |
|
application and the wireless part is done through a mailbox system implemented thanks to |
|
the SRAM2 and IPCC hardware blocks (Figure 5). It is stored just above the OTA |
|
application in the user Flash memory. |
|
For convenience, a sector for application data not be erased during firmware update can be |
|
reserved between the two applications. |
Note: |
A free area of the Flash memory must be available for the new wireless image download in |
|
case of updates. |
AN5247 Rev 3 |
11/36 |