OTA Dual-Bank STM32 Update System

ATLANTIS OTA UPDATE SYSTEM – DEV PROMPT (WIFI TEST FIRMWARE)
Objective
Implement a production-grade OTA firmware update system for Atlantis controllers that is safe, rollback-capable, power-loss tolerant, and integrates with Blynk NCP (ESP32 runs unmodified NCP firmware).
Deliver test firmware that validates the entire OTA lifecycle over Wi-Fi before Blynk integration.
System Overview
Hardware
Primary MCU: STM32H723VIT6 (main firmware; Arduino sketch runtime)
Connectivity MCU: ESP32 running Blynk NCP binary (not modifiable)
Dealer flashing: Android Dealer Toolkit via USB-C UART, toggling BOOT0 + NRST, using STM32 ROM bootloader
Dealer flashing is force-install / recovery
Dealer flashing does NOT interact with running firmware
Dealer flashing does NOT write OTA metadata
Non-Negotiable Constraints
Dealer Toolkit behavior
Dealer Toolkit:
toggles BOOT0 + RESET
flashes using STM32 ROM bootloader
writes raw firmware bytes only
does NOT manage OTA state
does NOT write metadata
does NOT participate in A/B logic
Equivalent to Arduino IDE / STM32CubeProgrammer.
Boot stub protection
Boot stub lives at 0x08000000
Boot stub region must be write-protected via option bytes
Dealer flashing must never erase or overwrite boot stub pages
OTA behavior
OTA lifecycle is handled exclusively by:
STM32 boot stub
STM32 application Update Service
ESP32 NCP is transport only
suggested Architecture
Protected Boot Stub (STM32)
Lives at 0x08000000
Write-protected
Responsibilities:
Read OTA metadata
Select Slot A or Slot B
Enforce trial / confirm / rollback
Ignore Slot B unless metadata explicitly marks it pending
Must be deterministic and minimal (safety / cert friendly)
Firmware Slots
Slot A: Bank 1 (after boot stub)
Slot B: Bank 2
Only one slot may be confirmed at any time
OTA Metadata
Stored at fixed flash location
Written only by running firmware (for OTA begin/commit)
Updated by boot stub only for confirm/rollback transitions
Metadata fields must include:
magic / version
product_id
hw_revision / board config
confirmed_slot
pending_slot
fw_build (monotonic integer)
image_size
image_crc32 (minimum)
optional sha256 / signature
trial_counter
confirm_flag
metadata_crc
Boot Behavior Rules (strict)
If pending metadata exists → validate → trial boot → require confirm → rollback on failure.
If no metadata exists → boot Slot A.
Boot stub never invents metadata and never guesses intent.
STM32 Application Responsibilities (Update Service)
Receives firmware chunks from Blynk/NCP
Writes firmware to inactive slot only
Handles:
correct STM32H7 erase strategy
correct programming granularity
CRC32 verification (min), signature hook (preferred)
Commits OTA metadata
Reboots into trial
Confirms firmware after successful first boot
Blynk OTA Integration
Blynk/NCP provides a reliable binary streaming path from cloud → device.
Required abstract primitives:
OTA_BEGIN(size, fw_build, crc32[, sha256])
OTA_CHUNK(offset, data)
OTA_END
OTA_ABORT
ACK / NAK
Retry + resume
Progress reporting
Blynk does not manage flash, slots, or metadata.
REQUIRED DELIVERABLES (WITH WIFI TEST FIRMWARE)
A) Boot Stub Package
bootstub/
source
linker script
flash layout
option byte configuration
write-protection instructions
B) STM32 Update Service Module
updateservice/
Arduino-compatible module
OTA protocol handler
flash writer
metadata commit
confirm API
C) Blynk Integration Spec
BLYNK_NCP_OTA_STREAMING_SPEC.md
OTA message definitions
expected responses
retry & resume rules
idempotency requirements
progress events
D) Test Firmware (Wi-Fi based – mandatory)
D1) STM32 Test Firmware A & B
Provide multiple test builds that:
Include distinct fw_build numbers
Clearly indicate:
slot (A or B)
build/version
trial vs confirmed
Expose status via:
serial output
LED blink pattern
Include modes:
Auto-confirm firmware
Delayed confirm firmware
Fail-to-confirm firmware (forces rollback)
D2) Wi-Fi OTA Validation Firmware
Provide test firmware that:
Connects to Wi-Fi (using ESP32 NCP path as in production)
Accepts OTA firmware delivered through the same Update Service used for Blynk OTA
Logs OTA progress, metadata writes, slot selection, and confirmation
Allows full OTA testing without dealer flashing
(No PC scripts, no fake NCP, no UART simulators.)
E) Test Plan
ATLANTIS_OTA_TEST_PLAN.md including:
normal OTA success
interrupted OTA + resume
power loss during write
corrupted chunk handling
rollback after crash / no-confirm
dealer force-flash followed by OTA
“no metadata → Slot A boots”
“latest OTA fw_build wins”
Explicit Non-Goals
Do NOT modify Dealer Toolkit
Do NOT allow dealer flashing to write metadata
One-Sentence Principle
Dealer flashing installs firmware directly; Blynk OTA manages firmware lifecycle and rollback.