Fail-Safe Firmware Updates: Dual-Bank OTA and Bootloader Strategies with SPI NOR Flash

An OTA update that can brick the device is worse than no update at all. The good news: with SPI NOR Flash, building a genuinely fail-safe update path is a solved problem — provided you design the memory map and the bootloader with power loss as the default assumption, not the exception.

Memory map: dual-bank with golden copy

The foundational decision is whether the bootloader can write the application bank it is running from. It cannot — so you need either:

• Dual-bank (A/B): two full application slots. The bootloader boots whichever bank is marked valid; updates write the inactive bank, verify, then flip a flag. Rollback is trivial — flip the flag back. Cost: 2× application Flash.
• Golden + working: a minimal known-good image plus one working slot. Less Flash, but the golden image limits feature set and complicates versioning.
• External-NOR swap (MCU runs XIP from external NOR): with parts like Puya（普冉半导体） P25Q series or Boya（博雅科技） BY25FQ series holding the application, dual-bank is cheap — NOR density is inexpensive and the MCU's internal Flash stays for the bootloader alone. A 16 Mbit P25Q32 gives comfortable room for two 512 KB banks plus parameters and logs.

The validity flag is a design artifact of its own

Amateur update schemes die on the flag: a single byte in Flash that a power cut at the wrong moment corrupts into ambiguity. Robust schemes:

• Magic-value records with CRC, stored in an append-only parameter sector. The newest valid record wins; torn writes leave the previous record intact.
• Two-phase commit: mark "staging → validated" only after the new image has booted once and self-reported healthy (watchdog-clean, peripherals OK). This is the A/B pattern that lets you survive "boots but broken" images.

Integrity: CRC everything, twice

Verify on write (page-level CRC against the transfer stream) and verify on boot (image-level CRC over the full bank with a header-declared length). The boot-time check is what saves you from bit-rot, a partially-written bank, or a corrupted transfer that somehow passed transport checksums. Store the expected CRC in the image header, not in a separate sector that can desynchronize.

Anti-tear details that bite in the field

• Erase-before-write is the vulnerable window. A bank mid-erase is neither old nor new. If the bootloader may ever run during this window ( watchdog reset during OTA), the flag must still say "old bank valid" — i.e., never invalidate the old bank before the new one is fully written and CRC-verified.
• Watchdog your bootloader. A bootloader that hangs during Flash operations bricks harder than any application bug.
• Wear-level the parameter sector. A flag rewritten on every boot in one sector kills 100K-cycle endurance in months. Append-only records with sector rotation spread the wear; both Puya and Boya spec 100K program/erase cycles, and sector rotation keeps real-world life in decades.

Feature shopping list in the silicon

Modern SPI NOR helps more than raw storage: Boya BY25FQ parts integrate on-chip ECC, catching single-bit reads in high-radiation-noise industrial cabinets; Puya P25Q SN-class parts run at 1.1 V for battery and energy-harvesting designs where the update path must work at marginal supply; both families' standard 4KB sectors make append-only parameter design practical. Quad-SPI (QPI) matters for boot time — a CRC over 512 KB at 80 MHz QSPI takes tens of milliseconds, invisible next to a 3-second power-on.

The checklist

1. Two banks, never write the running one.
2. Append-only, CRC'd parameter records with two-phase (staging→validated) commit.
3. CRC on write, CRC on boot, watchdog through the entire path.
4. Rollback by flag flip, tested by actually cutting power during every phase — in the lab, hundreds of times.

Devices with this discipline ship firmware updates for a decade without a single bricked unit. Devices without it meet their first power cut during update and become a service call.