Our irrigation controllers have an STM32F407 doing the valve logic and an ESP32 that only does Wi-Fi and MQTT, the two talk over UART at 921600. The ESP32 is easy to update. The STM32 has to be flashed by someone with an ST-Link in a field, which in summer means a lot of driving.
I want Hermetry’s firmware updates to deliver the STM32 image too. What exactly does the device get from Hermetry when an update is assigned, and what does it have to report back? And on the STM32 side, do I need the dual bank setup or can I get away with a second slot in external flash? 1 MB part, image is about 380 KB.
Following, we have the same split in our HVAC controllers.
We did exactly this on building controllers (STM32 plus an ESP32 modem). Hermetry doesn’t care which chip ends up running the image, it only talks to the device that’s logged in, so the ESP32 is the one that downloads and reports.
When you assign a package, the device gets these shared attributes in one message on v1/attributes/set: fw_title, fw_version, fw_size, fw_checksum, fw_checksum_algorithm (SHA256), fw_url and fw_sig if the package has a detached signature. fw_url is a short-lived HTTPS address, valid for 15 minutes, and the download can resume with an HTTP Range request.
The device reports progress as client attributes: fw_state goes DOWNLOADING, DOWNLOADED, VERIFIED, UPDATING, UPDATED (or FAILED with fw_error), fw_progress 0 to 100 while downloading, and after the reboot current_fw_title and current_fw_version. UPDATED alone isn’t accepted, it wants to see the new running version.
Our flow on the ESP32:
1. fw_* arrives -> check fw_title == "irr-stm32"
2. GET fw_url (Range resume) into ESP32 flash, report fw_progress
3. SHA-256 + Ed25519 check against fw_sig -> fw_state VERIFIED
4. stream image over UART to the STM32 bootloader into bank 2
5. STM32 verifies again, swaps banks, reboots -> fw_state UPDATING
6. STM32 reports its version to ESP32 -> current_fw_versionYou have a 1 MB F407, which is single bank, so for 380 KB I’d use the upper 512 KB as the download slot and a small bootloader that copies it over after checking it. External flash works too, but then the bootloader needs the SPI driver.
On the profile’s Firmware tab turn on firmware updates (off by default), and leave Allow unsigned images off outside the test bench. Updates over LTE are off by default too. Set Hardware models on the package so an ESP32 image never ends up in the STM32 slot.
Very clear, thanks. What happens if the 15 minutes run out halfway through a download on a weak link? Some of our fields have one bar.
The device asks for fw_url again (an attribute request) and gets a fresh one, then resumes from the byte it had with Range. We’ve had downloads take an hour that way without a problem.
Got it working on two bench units and one in the field. I used the upper half of flash plus a 16 KB bootloader. First try failed because I set fw_title on the package to “irr_stm32” and the ESP32 checked for a dash, so it just sat in Queued. Named it properly and it went through to UPDATED with the new current_fw_version.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.