Hi @RootOf3
For S32K3 HSE AB Swap, the rollback mechanism is not based on HSE monitoring runtime failures such as HardFaults or watchdog resets.
HSE itself does not determine whether the newly activated application is stable based on the application runtime behavior. After the AB Swap is performed, the new image becomes active, and it is typically the responsibility of the user bootloader/application to decide whether the update was successful or whether a rollback should be requested.
Secure Boot can also be used as part of the recovery strategy. If authentication of the active image fails, the boot flow can be designed to execute an alternate image or a dedicated recovery image, depending on the configured boot flow and the customer’s software design. Once a valid recovery or alternate image is running, the software can request another AB Swap if needed.
So, in summary, HSE provides the mechanisms for Secure Boot, image authentication, and AB Swap, but the actual rollback policy, including how runtime failures are detected and when the system switches back to the previous image, is implemented by the user bootloader/application.
Regards,
Lukas
