I am currently implementing an Over-the-Air Firmware Update using the processors flash swap system.
Basically the whole process is working fine but I am struggling to get the error handling right.
The swap system follows an internal state machine:
Ready->Update->Update-Erased->Complete (see Figure 29-26 Reference Manual).
I will exclude the Uninitialized state for simplification.
Transition from Ready to Complete is done by:
- Executing swap controls 0x02 (results in state Update)
- Update flash
- Erase IFR swap field (marks firmware writing as complete, results in state Update-Erased)
- Execute swap control 0x04 (results in state Complete)
Let's assume the firmware is written and the SWAP is in state Update-Erased. Now the external update-software detects a broken image and the firmware has to be rewritten.
How can I possibly reset the state to Ready to allow another firmware beeing written without activating the already written firmware before?
The state machine described above unfortunately does not allow for back-transitions.
AN4533 recommends for example "running through the swap procedure once" for fixing corrupt states.
But how can I running through the cycle WITHOUT resetting the processor which is the condition for transition from Complete to Ready?
Any feedback is highly appreciated.