Need clarify of Flash corruption when operation is interrupted.

[MasterPhi]

It's an expected behavior that Flash could be corrupted if the write operation is interrupted, such as by power loss or reset, as stated in RM0360, RM0444 etc.

But there is no information about the distribution of the corruption. Only the data writing is corrupted, the whole page, or the whole Flash ?

We are using Flash to stock parameters, if the Flash corruption is local, we can deal it with checksum and backup on different pages, if the Flash corruption is global, it will be complicated.

[Tesla DeLorean]

It is most likely to occur at the line level. The words in the newer designs contain ECC bits so can nominally correct or detect failure at that level. These are perhaps concerns you should share/discuss with your local FAE as deeper architectural details aren't discussed publicly.

For calibration, serialization, configuration type data I would tend to use a structure which is signed with a CRC, and also journalled across a flash sector so the last valid one can be recovered.

[Tesla DeLorean]

Biggest killer obviously is the "update" scenario where you erase the whole device and power/reset even occurs. Best strategy here is to have a loader in the first sector(s) which you don't ever erase, and can do integrity checking and recovery, so you don't leave devices bricked in the field.

The supply is important, higher voltages are generated internally to erase/write the array.

[MasterPhi]

Indeed I'm using a write protected bootloader for the dfu propose and app validation when booting. And "A B partitions" is used for the app, so if power loss happened during update it can at least revert to the last version. 

However if the flash corruption is distributed across the whole flash, it will be hard to recover.