Booting with dual flash banks vs. bank swap

[Pavel A.]

Dear experts,

I'm reading RMs for STM32 models with dual flash banks (F4, H7...) and don't quite understand how to use bank switching.

Take the firmware update scenario when old firmware is in bank1 and new is programmed to bank2. So it programs some option byte to switch banks and next time should boot from bank2.

If the new version is bad, I'd like to boot automatically from bank1. But how? the option byte is written. Is there a way to control bank switch by external pin?

On some systems that I've seen before we did it in the following way: we made a simple watchdog (CPLD or whatever) that automatically toggles the boot selector pin.

If the CPU does not touch the watchdog in defined time since reset, it will switch the selector pin and reset again.

So if the new firmware fails to boot, the system will reboot to the old firmware.

I'd like to implement the same on STM32, with external widget if needed, but better without it.

On the other hand, for H7 you can define alternative start addresses in option bytes, for BOOT0 high and low. But without bank switch this won't be useful. My firmware is not position independent, it is built for specific addresses in 1st bank. It won't run off bank2 if banks are not switched.

Any ideas, please?

-- pa

[Amel NASRI]

Hi @Pavel A.​ ,

To understand more about dual bank implementation on STM32 products, I recommend you to have a look to AN2606: STM32 microcontroller system memory boot mode. You will find there flowcharts of  dual bank boot implementation per product.

You have also the X-CUBE-DBANK-F7 firmware which is intended to describe the STM32F7 Flash-memory dual-bank capabilities. It is the firmware package associated to AN4826 (STM32F7 Series Flash memory dual bank mode).

Here a description of Dual boot example provided there: "describes the dual boot capability either by booting in the Flash bank1 and toggling the LED1 or by booting in the Flash bank2 and toggling the LED2".

Hope this is helpful to provide some guidelines and enlightens the feature.

-Amel

[Pavel A.]

Thank you Amel. It's complicated ...

Btw, I could not find in AN2606 description of dual-bank boot for H74x/H75x like for e.g. F76xx (figure 48)

Is there document similar to AN4826 for H74x/H75x?

-- pa

[Amel NASRI · Accepted solution]

Hi @Pavel A.​ ,

That is true STM32H7 devices have a flash with Dual-bank organization, but it doesn't support dual boot at hardware level. That is why there is no dual-bank boot flowchart for STM32H7.

At documentation level, if you take RM0410, one of the main features of STM32F76x's flash is "Dual Boot mode". This is not the case for STM32H742 for example (RM0433).

-Amel

[Pavel A.]

Thank you Amel for the explanation

-- pa

[CWei .1]

Hello Amel and to all ST Employee

I am using the STM32H747 dual core series, I would like to confirm with if the sequence works

1. Bootloader is resided within M7 Code area, there is no Bootloader develop in the M4 Code area. M4 Code area will store FW application code.

2. M7 CORE will configure to be running first upon POR, system reset.

3. We will using dual memory slot FW update strategy, so let assumes FW Memory Slot 1 will be the area where Pre-existing FW is executing. and FW Memory Slot 2 will be use for downloading new FW data.

4. Once Firmware request is received during Application code execution phase. the FW application code will download into FW Memory Slot 2 first, then initiate a system reset

5. After reset, M7 bootloader will executing, it will have some flags to know that there is new FW being downloaded into the FW Memory Slot 2. M7 Bootloader will check data integrity and FW authentication process. If both are OK, it will override the FW Memory Slot 1 with FW Memory Slot 2.

6. data integrity Check again and then jump to FW Application code

Can you advice the general strategy is workable?

[Gayathrigayuv]

Hi Amel NASRI,

Is it recommended to use two separate bootloaders(Boot selection Logic) (one in each bank) on STM32G0B1 dual-bank Flash for OTA updates?

Hello,

I am working with STM32G0B1CE (512 KB dual-bank Flash) and implementing an OTA firmware update system. I understand from RM0444, AN4826, and AN4767 that bank selection is controlled via BFB2 / option bytes, and the MCU automatically remaps the selected bank to address 0x08000000 after reset. The documents describe one boot path that selects the active bank based on option bytes.

My question is: Is it recommended or supported by ST to place a separate bootloader inside each bank (Bank1 bootloader + Bank2 bootloader), each with its own state machine? Or should the architecture always follow the typical pattern: Single dedicated bootloader at the start of Flash Two application banks for old and new firmware Bootloader decides which bank to jump to Boot state and update flags stored in a shared Flash page I want clarification because maintaining two independent bootloaders (one per bank) seems complex for rollback, state handling, and consistency, and I do not see this architecture mentioned in ST’s application notes.

So my specific questions:

Does ST officially recommend one bootloader only for dual-bank devices like STM32G0B1?

Is placing two different bootloaders (one per bank) unsupported or not advised due to option-byte remap behavior or risk of inconsistency?

Can ST confirm whether dual-bank OTA should be implemented using a single boot slot + two application slots rather than dual bootloaders?

Thank you!