Showing results for 
Search instead for 
Did you mean: 



Hi everyone.

I Have worked with STM32h723 arm processor FDCAN bootloader. but I faced a strange problem in writing data into flash. I can successfully make processor go to FDCAN bootloader and get responses from it but can't write data in some address.(see images)

for example, I can write data in address 0x08000000 and 0x08000004 but I can't write data in 0x08000008 or 0x0800000C. it will filled with 0 or remains 0xFFFFFFFF.

I read AN2606 and AN5405 ST's documentation but has no results. also, I tested the bootloader in many ways and always it responds with ACK message, but data hasn't written in some addresses. Also I have worked on CAN bootloader on STM32F4 and that was so straightforward and worked perfectly but FDCAN bootloader in STM32H723 has painful behavior.

Lead II

Hello @majid1 

Have you verified that your configurations are compatible with configuration in system memory boot mode :



 Best regards.


ST Employee

Hello @majid1 @Issamos,

Thank you for bringing attention to this I've just checked PH13 /PH14 are not detailed in the datasheet. So, you need to configure PD0/PD1 instead. An internal ticket 161018 is submitted to update AN2606.


To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.


Hi. Thank you for your attention.

I configured PD0/PD1 Before as said in AN2606 and I can get responses from FDCAN bootloader. but I can't write data to some address. for example, I successfully wrote data in 0x08000000 but I can't write in 0x08000008(I attached images in my last post in this conversation) with write command. Also I checked that RDP and write data protection be off. every time I can wrtie in 0x08000000 but with same write command with different address like 0x08000008 data remains 0xFFFFFFFF or become zero.

Again, thanks for your attention. @FBL 



Please tell me how you are getting responses from the ROM bootloader on FDCAN1?! I have tried everything in AN5405 with no response. What is your CAN configuration (bit rate, data bit rate, etc.), what message are you sending to "wake up" the bootloader to get an ACK response, do you have anything else connected to the CAN bus besides the programmer and the target STM32...

AN5405 says bit rates should be 250k/1M based on tq/tseg1/2, and that the message filter only accepts ID 0x111 in FD mode and with BSR set. I've tried multiple timings, multiple messages, 0 DLC, a few bytes DLC, 64 bytes DLC... I get no response (no ACK in fact) to any of my messages, suggesting that my timing isn't right. I've even stopped the bootloader with the debugger and verified the FDCAN and GPIOD (I don't have PH13/14 on my package) register settings. Pulling my hair out here.


I have a working Application to programm my STM32H730 MCU, but I'm always loading blocks of 256 Byte (maximum possibile), I have never tried to write single words, but reading the Reference Manual (RM0468 rev3, 4.2 FLASH main features ) I see that there is a limit of the minimal number of bit's to write to the flash (256 Bits in case of my H730), I think this is because of the ECC correction used on the flash. So probably you have to limit the flash write command address to 32 Byte bounderies, and write at least 32 Bytes per command.

As for the request of anotherandrew: 

The Baudrate is 250kBit/1Mbit, when the MCU is in boot mode she will rispond to messages with the ID's defined in AN5405 (for example 0x002 for the check CPUID command), My application is written in C# an used the PCAN FD can dongle from PEAK.


Thank you for the quick reply!

So 250k/1M, BSR and you're not sending anything as a "wakeup" (like the ID 0x079 used in the "classic" CAN bootloader app note AN3154)? Just boot to ROM  bootloader and send 0x002 with DLC=0 and you get three CAN frames in response (0x002, DLC=1 with data 0x79 for ACK, 0x002, DLC=2 with ID, and 0x002, DLC=1 with DLC=1 and 0x79 for ACK) ?

I am going to hook a scope up and verify that what linux `cansend` is saying it's sending is actually what it truly is sending, this should NOT be this difficult.

Hi  anotherandrew,

Yes, I'm not certain about the ID of the answer (my application assumes there are only two nodes on the bus, so I don't check the answer ID).