Transcription
AN5247Application noteOver-the-air application and wireless firmware update forSTM32WB Series microcontrollersIntroductionThis document describes the procedure for over-the-air (OTA) firmware update onSTM32WB devices with Bluetooth Low Energy (BLE) connection. It explains how to usethe OTA application provided within the STM32Cube firmware package, enabling the updateof the user application, the wireless firmware, and the firmware upgrade service.May 2022AN5247 Rev 41/36www.st.com1
ContentsAN5247Contents1Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Reference documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63OTA application on STM32WB devices . . . . . . . . . . . . . . . . . . . . . . . . . . 73.13.24Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73.1.2OTA application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93.1.3Memory architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93.1.4User application update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123.1.5Wireless firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12BLE service and characteristics for firmware update . . . . . . . . . . . . . . . . 133.2.1BLE application – Reboot request characteristics . . . . . . . . . . . . . . . . . 133.2.2OTA application - Service and characteristics . . . . . . . . . . . . . . . . . . . . 153.2.3Advertising . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Flow description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163.4Wireless and FUS update procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173.5Updater clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183.5.1ST BLE Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183.5.2STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19OTA step by step . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214.24.32/363.1.13.34.15Over-the-air firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Project setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224.1.1User applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224.1.2OTA application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Firmware update with ST BLE Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . 254.2.1Device connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254.2.2Update of user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284.2.3Update of wireless stack or FUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31Firmware update with STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . 314.3.1Transparent mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314.3.2Update of the user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34AN5247 Rev 4
AN52476ContentsRevision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35AN5247 Rev 43/363
List of tablesAN5247List of tablesTable 1.Table 2.Table 3.Table 4.Table 5.Table 6.Table 7.Table 8.4/36Reboot request characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14OTA Service and characteristics declaration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15AD structure - Main . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16AD structure - Manufacturer specific field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16AD structure – Group B features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Services and characteristics of example applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Example (device Bluetooth MAC address 80:E1:25:00:50:D6) . . . . . . . . . . . . . . . . . . . . 25Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35AN5247 Rev 4
AN5247List of figuresList of figuresFigure 1.Figure 2.Figure 3.Figure 4.Figure 5.Figure 6.Figure 7.Figure 8.Figure 9.Figure 10.Figure 11.Figure 12.Figure 13.Figure 14.Figure 15.Figure 16.Figure 17.Figure 18.Figure 19.Figure 20.Figure 21.Figure 22.Figure 23.STM32WB dual core FW architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Update of STM32WB firmware through BLE connection . . . . . . . . . . . . . . . . . . . . . . . . . . . 8OTA procedure sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Simplified memory map of applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10BLE application and wireless firmware architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11User application update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12wireless firmware update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13OTA reboot characteristic added in BLE user application . . . . . . . . . . . . . . . . . . . . . . . . . 14OTA dataflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17ST BLE Sensor mobile application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18STM32CubeMonitor-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19STM32CubeMonitor-RF with USB dongle in transparent mode . . . . . . . . . . . . . . . . . . . . . 20Applicative projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21User application update - Use case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Peer-to-peer server device detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Peer-to-peer application / LED switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Firmware update ST BLE Sensor panel and OTA service detected. . . . . . . . . . . . . . . . . . 28Download of new application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Heart rate profile after update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Update of wireless stack or FUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31USB Dongle programming in USB DFU mode with STM32CubeProgrammer. . . . . . . . . . 32Update of the user application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Wireless or FUS update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33AN5247 Rev 45/365
Glossary1AN5247GlossaryBLEBluetooth Low Energy (Bluetooth standard)CPU1Cortex M4 (executes user application)CPU2Cortex M0 (executes FUS and wireless firmware)IDEIntegrated development environmentIPCCInter-processor communication controllerFUSFirmware update serviceOTAOver-the-air firmware updateSBRSAOption byte - Secure backup RAM start addressSBRVOption byte - Secure boot reset vectorSFSAOption byte - Secure Flash memory start addressSIGBluetooth special interest groupSNBRSA Option byte - Secure non-backup RAM start address2Reference documents[1] RM0434:Multiprotocol wireless 32-bit MCU Arm -based Cortex -M4 with FPU,Bluetooth Low-Energy and 802.15.4 radio solution[2] AN5185:STM32WB ST firmware upgrade services[3] UM2288:STM32CubeMonitor-RF software tool for wireless performancemeasurementsAll these documents are available on www.st.com.6/36AN5247 Rev 4
AN5247OTA application on STM32WB devices3OTA application on STM32WB devices3.1Over-the-air firmware update3.1.1PrincipleUpdating firmware during device lifetime is mandatory to guarantee state-of-artperformance, to update the application with new features or corrected patches, and to keepthe highest security level.User application, wireless firmware and FUS updateThe STM32WB Series microcontrollers are based on a dual Arm (a) core.The user application runs on CPU1 (Cortex M4), while wireless firmware and FUS run onCPU2 (Cortex M0 ). The three applications can be updated independently.As wireless and FUS are delivered in encrypted format, their update procedure relies on theSTM32WB secure firmware for decryption and installation in the protected area of the Flashmemory.Figure 1. STM32WB dual core FW architectureCPU2Wireless stackFUSUpdatable byOTACPU1BLE userapplicationOTAapplicationNot updatableby OTAMS51778V3Over the airUpdate of firmware can be done thanks to typical physical links such as USB, UART or I2Cbut this procedure requires a physical access with specific connectors on the device.Thanks to OTA it is possible to remotely update the firmware by using a wireless connection.In this application note, the wireless connection uses the BLE protocol.a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.AN5247 Rev 47/3635
OTA application on STM32WB devicesAN5247Update clientsUpdate procedure follows a client/server architecture. It is initiated by an external client andthe device acts as a server, responding to the request by installing the new firmware.In this application note two examples (see Figure 2) of BLE-based OTA clients provided bySTMicroelectronics are presented: ST BLE Sensor: a mobile application for Android or iOS devices STMCubeMonitor-RF: a PC tool communicating with a BLE USE dongle configured inHCI transparent modeFigure 2. Update of STM32WB firmware through BLE connection8/36AN5247 Rev 4
AN52473.1.2OTA application on STM32WB devicesOTA applicationOTA application is designed as a standalone application with BLE services for managingfirmware transfer on client request, and its installation at the right place in the Flash memory.It is active and executed by CPU1 after an OTA request has been received by the userapplication.The sequence is shown in Figure 3, where the numbers in red indicate the different stages.Initial state is the user application running (1). When an OTA request is received (2), asystem reset is triggered (3) and the OTA application becomes active (4) listening for clientrequests (5). Different services are provided for the update of wireless firmware or userapplication (6 and 7).Figure 3. OTA procedure sequence3 Reboot serviceOTA client1 NoUser appSystem resetOTA request?2 OTA request4 YesOTA clientOTA app6 User FW orwireless stackupdate request5 OTA app active7 UpdateApplicationupdate serviceWirelessupdate serviceRSS wirelessupdate serviceMS51780V1Note:With this firmware architecture, the current user application is responsible for receiving OTArequests for both the user application and the wireless firmware. This is the entry point ofthe procedure. OTA application then communicates with the client to update either one orthe other firmware.3.1.3Memory architectureThe Flash memory of STM32WB is split in two parts, a user and a secure one. The user partis accessible by CPU1 and contains the OTA application as well as the user applicationcode and data. The secure part is accessible by CPU2 only, and contains FUS and thewireless firmware. This part is not accessible by the debug port, by the user application orby the bootloader. The boundary between the two areas is given by the option byte SFSA,the memory above is secure (see Figure 4). The SFSA value depends on the wirelessfirmware size, it is adjusted during the install procedure.AN5247 Rev 49/3635
OTA application on STM32WB devicesAN5247The location of firmware involved on the OTA procedure is shown in Figure 4.Figure 4. Simplified memory map of applications0x080FFFFFWireless FWSecureCPU2FUSSFSACPU1User applicationUser dataUser partFree areaOTA application0x080000000Flash memoryMS51781V2FUSFUS is stored at the top of the Flash memory. It embeds the secure firmware for wirelessfirmware decryption and authentication. It also offers a secure storage for cryptographickeys. Refer to [2] for a detailed description of its features.Wireless firmwareIt is stored just below FUS. This firmware drives the RF part of the MCU. Several protocolsare supported: full BLE stack, BLE HCI only layer, Thread MTD, Thread FTD, concurrentmode (BLE Thread FTD) and MAC 802.15.4 (low-level access to RF MAC). All stacks areavailable on www.st.com.For BLE, the stack implements the real-time aspects. It contains the LE controller and LEhost needed to manage all real time link layer and radio PHY interaction (Figure 5).10/36AN5247 Rev 4
AN5247OTA application on STM32WB devicesFigure 5. BLE application and wireless firmware architectureUser application and dataThis is the main user application. It is the applicative part of the device, implementing theBLE profiles and services relying on a wireless protocol. Communication between the userapplication and the wireless part is done through a mailbox system implemented thanks tothe SRAM2 and IPCC hardware blocks (Figure 5). It is stored just above the OTAapplication in the user Flash memory.For convenience, a sector for application data not be erased during firmware update can bereserved between the two applications.Note:A free area of the Flash memory must be available for the new wireless image download incase of updates.AN5247 Rev 411/3635
OTA application on STM32WB devicesAN5247OTA applicationIt is stored in the six first sectors of the Flash memory ([0x08000000: 0x08006000]). It is theactive process just after a system reset (CPU1 boot address is at the beginning of the Flashmemory). If no OTA request has been issued, the application jumps directly to the userapplication after having checked it has been fully programmed, otherwise the OTAapplication is running and is ready to receive commands from the client.Note:OTA application must be not be removed; if a problem occurs during the procedure, thedevice cannot recover. It is advised to set a write protection around the OTA application.3.1.4User application updateFigure 6 shows the sequence of operation performed by OTA application once a requesthas been sent for user application update.Figure 6. User application updateFUS WirelessFUS WirelessFUS WirelessSFSASFSASFSAFree areaFree areaFree areaBLE userapplicationNew BLE userapplicationOTA applicationOTA applicationOTA applicationInitial stateCurrent applicationremovalDownload of newapplicationMS51782V2First, the sectors receiving the new firmware are deleted. This procedure is mandatory to beable to reprogram the Flash memory. It is advised to write-protect areas containingapplication data that need to remain unchanged.The second step consists in downloading the new image. When firmware transfer iscomplete, OTA application jumps to the new application.3.1.5Wireless firmware updateWireless firmware is delivered encrypted and signed. A secure FUS firmware is required todecrypt the stack and install it within the secure part of the Flash memory.First step of the wireless installation is the same as for user application: sectors of the userFlash memory needed to store the encrypted image are deleted (“Free area” in Figure 7).In the second step, OTA application downloads the encrypted stack (including the newfirmware, in gray in Figure 7) and FUS update service is requested.12/36AN5247 Rev 4
AN5247OTA application on STM32WB devicesThe third step is performed by the FUS running on CPU2. It authenticates, decrypts andinstalls the stack. Option bytes related to security boundary (SFSA, SBRSA and SNBRSA)and reset vector (SBRV) are automatically set at the end of the install.The current wireless firmware is replaced only after all authentication and integrity checkshave been passed to secure the connection capability of the device.Figure 7. wireless firmware updateFUSFUSFUSCurrentwireless FWCurrentwireless FWNewwireless FWSFSASFSASFSAFree areaEncrypted newwireless FWFree areaBLE userapplicationBLE userapplicationBLE userapplicationOTA applicationOTA applicationOTA applicationInitial stateDownload of newencrypted stackDecryption andinstallation of new stackMS51783V2For FW wireless stack update, the BLE user app can be deleted or overwritten by encryptednew wireless FW, to free up memory space, making it possible to download a largerwireless FW stack compared to the case where the user application is kept. The BLE userapplication is then downloaded after decryption and installation of the new stack.3.2BLE service and characteristics for firmware update3.2.1BLE application – Reboot request characteristicsBLE service and characteristicsThe user application considered in this application note is a BLE application. It supportsspecific GATT services: either standard ones defined for SIG profiles (such as beacon, heartrate) or user-defined ones. These services own a set of characteristic values with specificaccess rights.The developer has the possibility of extending the number of characteristics used by aservice, even the standardized ones. In order to call the OTA application from the user a“reboot characteristic” (yellow box in Figure 8) is added to a service supported by theapplication. When this characteristic is written by the client through the BLE protocol theuser application jumps to the OTA application.AN5247 Rev 413/3635
OTA application on STM32WB devicesAN5247Figure 8. OTA reboot characteristic added in BLE user applicationBLE user applicationService #0Characteristic #0Characteristic #1Reboot requestcharacteristicCharacteristic #mService #nCharacteristicsMS51784V1Reboot requestReboot request has three different fields to be notified by the client:1.the boot mode, either user application restart or jump to OTA application2.the first sector index where the new application is downloaded3.the number of sectors to be deleted (size of new firmware with 4 KBytes granularityThe service in which the characteristic is included depends upon the user application.Table 1. Reboot request characteristicsServiceOne of the BLEuser applicationUUID-CharacteristicsBase addressFunctionRequest device reboot for OTA 4c-21edae82ed19Fields14/360Boot Mode:0x00 Application0x01 OTA application1Sector Index0xXX - 0x080XX0003Number of sectors to erase0x00 – 0xFFAN5247 Rev 4
AN52473.2.2OTA application on STM32WB devicesOTA application - Service and characteristicsOTA application is a standard BLE application. It provides a specific service withcharacteristics to fulfill the update.Table 2. OTA Service and characteristics declarationServiceOTA nctionAddress to store the e82ed19Characteristics0Actions0x00: STOP all upload0x01: START wireless file upload0x02: START user application file upload0x07: File upload finished0x08: Cancel upload1-3Address0x007000Base addressFieldsFile uploadconfirmationrebootOTA raw dataFunctionConfirm the reboot of the application after file 4c-21edae82ed19Fields0FunctionData to transfer file (split by 20 bytes)Size20ModeWrite without elds0-190x01RebootRaw dataThis service is recognized by the client application after an advertising sequence.3.2.3AdvertisingAvailability of the reboot request has to be advertised when the connection between thedevice and the client is established.The information is added in a manufacturer specific advertising field (type 0xFF). Theencapsulated structures are described in the next tables. Reboot request capability isspecified in GroupB features (bit 13).AN5247 Rev 415/3635
OTA application on STM32WB devicesAN5247Table 3. AD structure - MainAD Field NameAD TypeAD LenRecord sizeTX POWER LEVEL0x0A23COMPLETE NAME0x0989MANUF SPECIFIC0xFF1314FLAGS0x0123Table 4. AD structure - Manufacturer specific 0x00 - 0xFF4CommentManufacturer specific0x86 for OTA loaderFeature group A5ReservedBit field6Feature group B78-130x20 for OTA enabled devicePublic device addressBytesOptionalTable 5. AD structure – Group B featuresBit(s)15Reserved14Thread support13OTA reboot request12-03.3FieldReservedFlow descriptionFigure 9 details the messages and data exchanges between the device and the client duringan update procedure.The first connection is made by the user application. It advertises a Reboot requestcharacteristic to the client (step 1). When the client requests for a device reboot a newconnection is established, this time between OTA application and the client (step 2).16/36AN5247 Rev 4
AN5247OTA application on STM32WB devicesFigure 9. OTA dataflow3.4Wireless and FUS update procedureWireless stack and FUS are encrypted. After their download a FUS service is called todecrypt and install at the right place the new firmware.The new wireless stack may be moved from its download area by FUS to optimize memoryspace.If the new FUS image size is larger than existing one, the upgrade may result in moving thewireless stack lower in Flash memory (address defined by FUS). If a user code is written inthe sectors close to the wireless stack start sector, these sectors risk to be erased duringthis operation. For details refer to [2].AN5247 Rev 417/3635
OTA application on STM32WB devices3.5AN5247Updater clientsOTA request comes from a BLE client with dedicated applications. STMicroelectronicsprovides two clients with this capability:3.5.11.ST BLE Sensor, a mobile application that supports both types of update (applicationand wireless firmware)2.STM32CubeMonitor RF, a PC tool that allows the user to update its application with adongle featuring a BLE transparent mode implementation.ST BLE SensorThe ST BLE Sensor application is used in conjunction with an ST development board andfirmware compatible with the BLE protocol. It gives access to all sensor data available onboard that can be logged to different cloud providers. It supports also the firmware OTAupdate procedure.The application is available on both App Store and Google Play (Figure 10). In addition,both SDK and application source code are freely available at dedicated pages onhttps://github.com.Figure 10. ST BLE Sensor mobile application18/36AN5247 Rev 4
AN52473.5.2OTA application on STM32WB devicesSTM32CubeMonitor-RFSTM32CubeMonitor-RF (Figure 11) is a software tool, which helps designers to test theirproducts based on STM32 microcontrollers.Figure 11. STM32CubeMonitor-RFThe tool performs the following operations: sends and receives test packets to check the efficiency of radio frequency boards andcompute packet error rate (PER) sends commands to a Bluetooth low energy (BLE) controller for standardized tests sends and receives BLE commands for fast application prototyping configures a variety of beacons via BLE commands transfers data over-the-air (OTA) from one device to another, in order to configure orprogram a remote device without wired connection sends commands to an OpenThread device for application prototyping.STM32CubeMonitor-RF is usually connected to the targeted device STM32WB devicethrough UART (physical link). OTA operation however requires the use of a STM32WB55USB dongle loaded with a special firmware called ‘transparent mode’ (Figure 12). Data andcommand sent/received by the PC tool are directly transmitted to the HCI interface of thedevice to be updated. The firmware of “transparent mode” application is provided withinSTM32Cube FW WB package.AN5247 Rev 419/3635
OTA application on STM32WB devicesAN5247Figure 12. STM32CubeMonitor-RF with USB dongle in transparent modeTransparent modeDevice to be updated by OTAThe OTA procedure with STM32CubeMonitor-RF is detailed in Section 4.3.20/36AN5247 Rev 4
AN52474OTA step by stepOTA step by stepThis section describes how to update firmware of a STM32WB device on Nucleo-WB55RGboard. Two use-cases are described:1.user application with ST BLE Sensor mobile application2.user application with STM32CubeMonitor-RF tool and USB dongle.Three applicative projects plus the dongle transparent mode firmware (highlighted inFigure 13) are considered in this document. They are all provided within theSTM32Cube FW WB package available on www.st.com.The target device is a Nucleo board, porting to all STM32WB devices and boards isstraightforward.Figure 13. Applicative projectsMS52611V1AN5247 Rev 421/3635
OTA step by stepAN52474.1Project setup4.1.1User applicationsThe example developed here considers a device functionality modification. The device isinitially programmed with peer-to-peer server application then, after the update, it supportsthe typical heart rate profile (Figure 14).Figure 14. User application update - Use caseFUSFUSWireless FWWireless FWSFSASFSAFree areaFree areaPeer to peerserver( 30 Kbytes)Heart rate profile( 12 Kbytes)OTA applicationOTA applicationMS51786V2Both are BLE applications providing services, with the characteristics defined in Table 6.A Reboot request, as defined in Section 3.2.1 is added to their main service. Even if theuse-case presented here uses this capability for the peer-to-peer server, it is added in theHeart profile too for future updates.Table 6. Services and characteristics of example applicationsApplicationPeer-to-peer serverService (UUID)CharacteristicsP2P WRITE CHARP2P SERVICEP2P NOTIFY0000FE40-cc7a-482a-984a-7fed5b3e58fREBOOT REQUESTMANUFACTURER NAMEDEVICE INFORMATION SERVICE(0x180A)MODEL NUMBERSERIAL NUMBERHARDWARE REVISION Heart rate SIG profileHEART RATE MEASUREMENTHEART RATE SERVICE(0x180D)SENSOR LOCATIONCONTROL POINTREBOOT REQUEST22/36AN5247 Rev 4
AN5247OTA step by stepTable 6. Services and characteristics of example applications (continued)ApplicationOTA applicationService (UUID)CharacteristicsOTA BASE ADR CHAROTAS SVCOTA CONF CHAR:0000fe20-cc7a-482a-984a-7f2ed5b3e58fOTA RAW DATA CHARAdd REBOOT REQUEST characteristicFor both applications the file ble conf.h must be modified to include the new characteristic.Set BLE CFG OTA REBOOT CHAR to 1 to add **************************** Over The Air Feature (OTA) - STM **********************************/#define BLE CFG OTA REBOOT CHARCHARACTERISTIC */1 /** REBOOT OTA MODEChange linker fileTo take into account the new memory placement of the user application (above OTAapplication), the linker file must be modified. The binary is generated with a reset vectormoved up from seven sectors.IAR ICF fileA four bytes offset on SRAM1 is added because the first 32-bit word is used by the “Rebootrequest” characteristic to indicate an OTA request after a system reboot./*-CPU Vector Table- Without OTA support*/define symbol ICFEDIT intvec start 0x08000000;/*-Memory Regions-*/define symbol ICFEDIT region ROM start 0x08000000;define symbol ICFEDIT region ROM end 0x0807FFFF;define symbol ICFEDIT region RAM1 start 0x20000004;define symbol ICFEDIT region RAM1 end 0x2002FFFF;/*-CPU Vector Table- With OTA application*/define symbol ICFEDIT intvec start 0x08007000;/*-Memory Regions-*/define symbol ICFEDIT region ROM start 0x08007000;define symbol ICFEDIT region ROM end 0x0807FFFF;define symbol ICFEDIT region RAM1 start 0x20000004;define symbol ICFEDIT region RAM1 end 0x2002FFFF;Keil scatter file/*-CPU Vector Table- Without OTA support*/LR IROM1 0x08000000 0x00080000{ER IROM1 0x08000000 0x00080000; load region size region{; load address execution addressAN5247 Rev 423/3635
OTA step by stepAN5247*.o (RESET, First)*(InRoot Sections).ANY ( RO)}RW IRAM10x20000004 0x2FFFC{; RW data.ANY ( RW ZI)}/*-CPU Vector Table- With OTA application*/LR IROM1 0x08007000 0x260 {; load region size regionER IROM1 LOW 0x08007000 0x260{; load address execution address*.o(RESET, First)*.o (TAG OTA START)}RW IRAM1 0x20000004 0x0002FFFC{; RW data.ANY ( RW ZI)}Delete the VTOR table configurationWhen the application is expected to be downloaded by OTA, the SCB VTOR must be notmodified as it has already been set to the correct value by the BLE Ota application beforejumping to the current application.Comment out this line of code in SstemInit():// SCB- VTOR VECT TAB OFFSET;Compilation and programmingCompile and download peer-to-peer application in the Nucleo board.Compile Heart rate application. The generated binary is downloaded by the OTA client. WithEWARM IDE, the file is available in the project under EWARM/with ota/Exe directoryBLE HeartRate ota.bin.Copy this binary to the smartphone running the ST BLE Sensor application.4.1.2OTA applicationOTA application setup is straightforward. Compile and download the binary at the beginningof Flash memory (0x08000000).To check if the full firmware has been written, a magic keyword is written at the end
Update procedure follows a client/server architectu re. It is initiated by an external client and the device acts as a server, responding to the request by installing the new firmware. In this application note two examples (see . Figure 2) of BLE-based OTA clients provided by STMicroelectronics are presented:
