STM32WB55RGV6 with FUS v0.0.0

[noler]

Hello,

I'm working on a product that uses the STM32WB55RGV6 MCU.
Currently, we have produced several batches of 500 units each, and we are experiencing issues with 1-2% of them.

During the production process, we update the wireless stack to our validated version (v1.17.2). However, for some unknown reason, a few units enter a weird state. It appears that, after the production process, the FUS (Firmware Upgrade Services) is missing on these MCUs (reported as v0.0.0), and we are unable to recover from this condition.

After investigating, I suspect option byte corruption, as the SFSA value is 0x00.

According to AN5185, when SFSA = 0x00, setting the C2BOOT bit to 1 should trigger the safeboot process, leading to one of the following scenarios:

If FUS v1.1.0 or later is present → A factory reset should occur, restoring the option bytes.

If FUS is below v1.1.0 → The device should become locked, meaning all flash memory would be protected and unreadable.

However, neither of these actions seem to take place. After setting C2BOOT = 1, I am still able to read the flash memory, and SFSA remains 0x00.

Could you help me understand what is happening and how to restore the devices?

Below is the MCU’s option byte status:

-------------------------------------------------------------------
STM32CubeProgrammer v2.18.0
-------------------------------------------------------------------

ST-LINK SN : 49FF70066670485128081067
ST-LINK FW : V2J38S7
Board : --
Voltage : 2.92V
SWD freq : 4000 KHz
Connect mode: Normal
Reset mode : Software reset
Device ID : 0x495
Revision ID : Rev X
Device name : STM32WB5x/35xx
Flash size : 1 MBytes
Device type : MCU
Device CPU : Cortex-M4
BL Version : 0xD5
Debug in Low Power mode enabled

UPLOADING OPTION BYTES DATA ...

Bank : 0x00
Address : 0x58004020
Size : 96 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x01
Address : 0x58004080
Size : 8 Bytes

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

Read Out Protection:

RDP : 0xAA (Level 0, no protection)

BOR Level:

BOR_LEV : 0x0 (BOR Level 0 reset level threshold is around 1.7 V)

User Configuration:

nBOOT0 : 0x1 (nBOOT0=1 Boot from main Flash)
nBOOT1 : 0x1 (Boot from code area if BOOT0=0 otherwise system Flash)
nSWBOOT0 : 0x0 (BOOT0 taken from the option bit nBOOT0)
SRAM2RST : 0x0 (SRAM2 erased when a system reset occurs)
SRAM2PE : 0x1 (SRAM2 parity check disable)
nRST_STOP : 0x1 (No reset generated when entering the Stop mode)
nRST_STDBY : 0x1 (No reset generated when entering the Standby mode)
nRSTSHDW : 0x1 (No reset generated when entering the Shutdown mode)
WWDGSW : 0x1 (Software window watchdog)
IWDGSTDBY : 0x1 (Independent watchdog counter running in Standby mode)
IWDGSTOP : 0x1 (Independent watchdog counter running in Stop mode)
IWDGSW : 0x1 (Software independent watchdog)
IPCCDBA : 0x0 (0x0)

Security Configuration Option bytes - 1:

ESE : 0x1 (Security enabled)

PCROP Protection:

PCROP1A_STRT : 0x1FF (0x80FF800)
PCROP1A_END : 0x0 (0x8000800)
PCROP_RDP : 0x1 (PCROP zone is erased when RDP is decreased)
PCROP1B_STRT : 0x1FF (0x80FF800)
PCROP1B_END : 0x0 (0x8000800)

Write Protection:

WRP1A_STRT : 0xFF (0x80FF000)
WRP1A_END : 0x0 (0x8000000)
WRP1B_STRT : 0xFF (0x80FF000)
WRP1B_END : 0x0 (0x8000000)
OPTION BYTES BANK: 1

Security Configuration Option bytes - 2:

SFSA : 0xCE (0x80CE000)
FSD : 0x0 (System and Flash secure)
DDS : 0x1 (CPU2 debug access disabled)
C2OPT : 0x1 (SBRV will address Flash)
NBRSD : 0x0 (SRAM2b is secure)
SNBRSA : 0x10 (0x2003C000)
BRSD : 0x1 (SRAM2a is non-secure)
SBRSA : 0x0 (0x20030000)
SBRV : 0x3FC00 (0x20000000)