We are currently running an application on an STM32F207 MCU. We are using the first two sectors of flash for a bootloader and the rest for our actual application. We are are write protecting the bootloader sectors during initialization of our application.
We received a returned field unit with very little detail of what was happening/when the failure occurred. But on the surface it looked like a FW Update was unsuccessful and afterward the STM had been fully erased.
The way our update process works is we have another micro that transfers the STM application image to the STM and the STM saves it to some "temp" sectors and jumps into the bootloader, which obviously applies the update to the application area sectors. We do not change the WRP option bytes anywhere else but setting the write protection in the application initialization (as stated above).
When we received the unit back from the field, using the ST-Link utility I can see that the whole Flash has been erased and looking at the option bytes, the first 2 sectors still have the write protection enabled. So I'm a bit of a loss here, and was curious if something like this has been seen before?