I think I have my problems fixed. Here is what I found. Jump in and correct if I am in error:
When issuing swap command the Flash hardware will update the swap indicators in the active block. Care is taken in the driver to move the command to RAM but if you have interrupts active that execute out of the active flash block you will need to disable those. For my purposes I modified the flash driver and added global interrupt disable and enable around the call to flash_command_sequence in the function FLASH_SwapControl.
It is easy to believe that you don't have to worry about interrupts as you might think that you are only executing Flash operations on the inactive block. It would be good if the driver example emphasized that the SWAP commands do alter the active block and if you are interrupts can occur during their execution then you need to disable them. The example doesn't have this issue.
After getting this working I started testing. I found that while the implementation of FLASH_Swap is easy to use, however it does not implement the swap system in a fashion that the designer intended. I believe that the intention is that the inactive block be updated with new firmware while in the Update or Update Erased state, that way if the update fails the Swap state is left in Update Erased and the application can now know that the upper block is potentially corrupted and resolve the issue before issuing a swap which would brick your device. The FLASH_Swap function will not allow this. If my assumptions are true then the driver example should be fixed.
