Dual-Bank Flash

Hardware Redundancy

Internal circuitry manages the mapping of the execution address to either bank zero or bank one. While the application executes code from the first region, the dual-bank flash controller allows the second region to be erased and programmed. This separation ensures that a power failure during the write cycle only affects the pending update and leaves the active system intact.

Update Atomicity

Successful transitions depend on a single pointer change that happens at the end of the installation sequence. Once the dual-bank flash has received the new binary and passed a cyclic redundancy check, the bootloader updates its configuration to point to the new start address. The swap occurs during the next reboot, resulting in a nearly instantaneous transition to the new version.

System Recovery

Reliability increases because the previous known good version remains available in the alternate bank. If the new firmware encounters a critical error, the dual-bank flash allows the bootloader to switch the execution pointer back to the old memory region. This safety mechanism prevents the device from entering an unbootable state after a faulty update.