2399857_en-US

[#1]

S32K OTA Rollback

Hello everyone, I'd like to inquire about the HSE ABSwap OTA rollback mechanism for the S32K3 series. My understanding is that if partition A is a stable partition, switching from partition A to partition B will cause errors such as Hardfault or watchdog timeout to occur in partition B. The OTA error counter will decrease, and when the error counter reaches 0, the program will consider partition B an unstable partition and switch back to partition A. Is this mechanism correct? If not, what is the OTA rollback mechanism?

Re: S32K OTA Rollback

Hi @RootOf3 

For S32K3 HSE AB Swap, the rollback mechanism is not based on HSE monitoring runtime failures such as HardFaults or watchdog resets.

HSE itself does not determine whether the newly activated application is stable based on the application runtime behavior. After the AB Swap is performed, the new image becomes active, and it is typically the responsibility of the user bootloader/application to decide whether the update was successful or whether a rollback should be requested.

Secure Boot can also be used as part of the recovery strategy. If authentication of the active image fails, the boot flow can be designed to execute an alternate image or a dedicated recovery image, depending on the configured boot flow and the customer’s software design. Once a valid recovery or alternate image is running, the software can request another AB Swap if needed.

So, in summary, HSE provides the mechanisms for Secure Boot, image authentication, and AB Swap, but the actual rollback policy, including how runtime failures are detected and when the system switches back to the previous image, is implemented by the user bootloader/application.

Regards,

Lukas