STM32 Bootloader: FAA DO-178 Certification?

[Niramas]

Is the internal bootloader on the STM32H723 DO-178 certified?   It just dawned on me that the whole line of CPUs might be disqualified for aircraft use because the bootloader code "flies" with the aircraft and all such code must be certified to the level declared by the system (DAL levels A-D).   Do you have avionics customers that use these?  Can the bootloader be erased?

Regards,

Mark

[Pavel A.]

For unmanned avionics (aka drones) be assured that people use STM32H7's and have no complaints about the internal bootloader.

> Can the bootloader be erased?

No, unfortunately.

[Amel NASRI]

Hi @Niramas ,

Our current STM32 MCUs are general purpose ones and not qualified for aircraft usage.

This post has been escalated to the ST Online Support Team for additional assistance. They may contact you directly in case they have some farther information to add.

-Amel

[Niramas]

The question has to do with FAA certification, not whether it works.

[Niramas]

Thank you for the response.   Can you verify that the BL area cannot be erased?  Can it come unprogrammed by special order?   This question matters in that we have product that would be OK at low verification levels (e.g. controlling seat positions)  but would be disqualified at higher safety levels (e.g. controlling landing gear).

[Amel NASRI]

As already answered by Pavel, the BL area cannot be erased.

Special orders should be discussed with Sales, better to submit your complete request in OLS in this case.

-Amel

[Pavel A.]

Would it help to know that STM32H7 can be programmed so that the internal bootloader is never activated?  (both boot addresses are set to the user app) 

[Roger SHIVELY · Accepted solution]

Hello @Niramas 

This post has been escalated to the ST Online Support Team for additional assistance.

Regards.

Roger

[Niramas]

The FAA expects all code that flies with the plane be certified to the safety level of the system.  

[Pavel A.]

Well then if I fly with a laptop full of Windows and other stuff, do I have to certify it? If the answer is no because it is not connected to the systems, then the passive part of STM32 firmware is not connected too.